From d6476862b30692e450cceda09c58d47964f87d32 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 04:05:13 +0000
Subject: [PATCH 01/50] fix(cli): forward HEADERS env var on every backend
 fetch call (#9075)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Several `fetch()` callers in the CLI bypassed `OpenAPI.HEADERS` and skipped
the `HEADERS` env var, causing requests to fail behind auth gateways like
Cloudflare Access (same shape as #6421):

- `pushScript()` `/scripts/create` and `/scripts/create_snapshot` — regressed
  in #8936 when the call switched from `wmill.createScript()` (SDK) to a raw
  `fetch` for the `skip_if_noop` query param.
- Script preview `/jobs/run/preview_bundle`.
- App dev `/jobs_u/getupdate_sse` SSE stream.
- `wmill docs` `/api/inkeep`.

All four now spread `getHeaders()` and call `detectAuthGatewayChallenge()`
so a Cloudflare/SSO challenge surfaces a clear error instead of an opaque
JSON parse failure.

Adds `test/headers_env_var.test.ts`: spins up an auth-gateway proxy that
403s requests missing `CF-Access-Client-Id` / `CF-Access-Client-Secret` and
otherwise reverse-proxies to the test backend, then runs `wmill sync push`
of a fresh script through the proxy. Negative case (no `HEADERS` env)
verifies the proxy actually gates; positive case asserts every request
including `/scripts/create` reaches the backend with the headers attached.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/app/dev.ts       |   7 +-
 cli/src/commands/docs/docs.ts     |   6 +
 cli/src/commands/script/script.ts |  20 ++-
 cli/test/headers_env_var.test.ts  | 258 ++++++++++++++++++++++++++++++
 4 files changed, 287 insertions(+), 4 deletions(-)
 create mode 100644 cli/test/headers_env_var.test.ts

diff --git a/cli/src/commands/app/dev.ts b/cli/src/commands/app/dev.ts
index 5b78f84e3f..7edb793bea 100644
--- a/cli/src/commands/app/dev.ts
+++ b/cli/src/commands/app/dev.ts
@@ -14,7 +14,8 @@ import * as path from "node:path";
 import process from "node:process";
 import { Buffer } from "node:buffer";
 import { writeFileSync } from "node:fs";
-import { readTextFile } from "../../utils/utils.ts";
+import { getHeaders, readTextFile } from "../../utils/utils.ts";
+import { detectAuthGatewayChallenge } from "../../utils/http_guards.ts";
 import { WebSocket, WebSocketServer } from "ws";
 import {
   createFrameworkPlugins,
@@ -1714,13 +1715,17 @@ async function streamJobWithSSE(
   const sseUrl =
     `${baseUrl}api/w/${workspace}/jobs_u/getupdate_sse/${jobId}?fast=true`;
 
+  const extraHeaders = getHeaders();
   const response = await fetch(sseUrl, {
     headers: {
       Accept: "text/event-stream",
       Authorization: `Bearer ${token}`,
+      ...extraHeaders,
     },
   });
 
+  await detectAuthGatewayChallenge(response, sseUrl);
+
   if (!response.ok) {
     throw new Error(
       `SSE request failed: ${response.status} ${response.statusText}`,
diff --git a/cli/src/commands/docs/docs.ts b/cli/src/commands/docs/docs.ts
index d86d4ca367..fed91201e0 100644
--- a/cli/src/commands/docs/docs.ts
+++ b/cli/src/commands/docs/docs.ts
@@ -4,6 +4,8 @@ import * as log from "../../core/log.ts";
 import { requireLogin } from "../../core/auth.ts";
 import { resolveWorkspace } from "../../core/context.ts";
 import { GlobalOptions } from "../../types.ts";
+import { getHeaders } from "../../utils/utils.ts";
+import { detectAuthGatewayChallenge } from "../../utils/http_guards.ts";
 
 interface DocContentItem {
   title: string;
@@ -36,6 +38,7 @@ async function docs(
 
   console.log(colors.bold(`\nSearching Windmill docs...\n`));
 
+  const extraHeaders = getHeaders();
   let res: Response;
   try {
     res = await fetch(url, {
@@ -43,6 +46,7 @@ async function docs(
       headers: {
         "Content-Type": "application/json",
         Authorization: `Bearer ${workspace.token}`,
+        ...extraHeaders,
       },
       body: JSON.stringify({ query }),
     });
@@ -50,6 +54,8 @@ async function docs(
     throw new Error(`Network error connecting to ${workspace.remote}: ${e}`);
   }
 
+  await detectAuthGatewayChallenge(res, url);
+
   if (res.status === 403) {
     log.info(
       "Windmill documentation search is an Enterprise Edition feature. Please upgrade to use this command."
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index 0635cd42ea..f1e605d8ff 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -12,7 +12,8 @@ import * as log from "../../core/log.ts";
 import { sep as SEP } from "node:path";
 import * as path from "node:path";
 import { stringify as yamlStringify } from "yaml";
-import { deepEqual, readTextFile, readTextFileSync } from "../../utils/utils.ts";
+import { deepEqual, getHeaders, readTextFile, readTextFileSync } from "../../utils/utils.ts";
+import { detectAuthGatewayChallenge } from "../../utils/http_guards.ts";
 import * as wmill from "../../../gen/services.gen.ts";
 import * as specificItems from "../../core/specific_items.ts";
 import { getCurrentGitBranch } from "../../utils/git.ts";
@@ -725,6 +726,7 @@ async function createScript(
   // (same content, lockfile, and metadata) as a no-op, so the CLI does not
   // produce phantom git-sync / promotion commits on re-pushes.
   const skipIfNoop = "skip_if_noop=true";
+  const extraHeaders = getHeaders();
   if (!bundleContent) {
     try {
       const url =
@@ -738,9 +740,11 @@ async function createScript(
         headers: {
           Authorization: `Bearer ${workspace.token}`,
           "Content-Type": "application/json",
+          ...extraHeaders,
         },
         body: JSON.stringify(body),
       });
+      await detectAuthGatewayChallenge(req, url);
       if (req.status != 201) {
         throw Error(
           `${req.status} - ${req.statusText} - ${await req.text()}`
@@ -771,9 +775,13 @@ async function createScript(
       skipIfNoop;
     const req = await fetch(url, {
       method: "POST",
-      headers: { Authorization: `Bearer ${workspace.token} ` },
+      headers: {
+        Authorization: `Bearer ${workspace.token} `,
+        ...extraHeaders,
+      },
       body: form,
     });
+    await detectAuthGatewayChallenge(req, url);
     if (req.status != 201) {
       throw Error(
         `Script snapshot creation was not successful: ${req.status} - ${
@@ -1587,12 +1595,18 @@ async function preview(
       workspace.workspaceId +
       "/jobs/run/preview_bundle";
 
+    const extraHeaders = getHeaders();
     const response = await fetch(url, {
       method: "POST",
-      headers: { Authorization: `Bearer ${workspace.token}` },
+      headers: {
+        Authorization: `Bearer ${workspace.token}`,
+        ...extraHeaders,
+      },
       body: form,
     });
 
+    await detectAuthGatewayChallenge(response, url);
+
     if (!response.ok) {
       throw new Error(
         `Preview failed: ${response.status} - ${response.statusText} - ${await response.text()}`
diff --git a/cli/test/headers_env_var.test.ts b/cli/test/headers_env_var.test.ts
new file mode 100644
index 0000000000..ad483f4d05
--- /dev/null
+++ b/cli/test/headers_env_var.test.ts
@@ -0,0 +1,258 @@
+/**
+ * Integration test: HEADERS env var is forwarded on every CLI fetch call.
+ *
+ * Spins up an auth-gateway proxy in front of the test backend that:
+ *   - 403s + Cloudflare-style HTML if the request is missing CF-Access-Client-Id /
+ *     CF-Access-Client-Secret (mirrors the real-world Cloudflare Access challenge),
+ *   - otherwise reverse-proxies to the backend.
+ *
+ * Then runs `wmill sync push` with --base-url pointed at the proxy. If any fetch
+ * in the CLI bypasses HEADERS, the proxy returns the challenge page and the push
+ * fails (or the request is logged as un-authenticated). Negative case verifies
+ * the gateway actually rejects un-headered requests, so a passing positive case
+ * is meaningful.
+ *
+ * Regression coverage for #6421 and the script.ts pushScript /
+ * jobs/run/preview_bundle / app dev SSE fetch calls that used to skip getHeaders().
+ */
+
+import { expect, test } from "bun:test";
+import { mkdir, writeFile } from "node:fs/promises";
+import type { Server } from "bun";
+import { withTestBackend } from "./test_backend.ts";
+
+const HEADER_NAMES = ["CF-Access-Client-Id", "CF-Access-Client-Secret"] as const;
+const HEADER_VALUES = {
+  "CF-Access-Client-Id": "test-cf-id",
+  "CF-Access-Client-Secret": "test-cf-secret",
+} as const;
+
+const HEADERS_ENV = HEADER_NAMES
+  .map((h) => `${h}: ${HEADER_VALUES[h]}`)
+  .join(", ");
+
+interface ProxyState {
+  authenticatedRequests: { method: string; path: string }[];
+  rejectedRequests: { method: string; path: string }[];
+}
+
+interface RunningProxy {
+  server: Server;
+  state: ProxyState;
+  url: string;
+}
+
+function startGatewayProxy(backendUrl: string): RunningProxy {
+  const state: ProxyState = {
+    authenticatedRequests: [],
+    rejectedRequests: [],
+  };
+
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    async fetch(req) {
+      const reqUrl = new URL(req.url);
+      const pathAndQuery = reqUrl.pathname + reqUrl.search;
+
+      const id = req.headers.get("cf-access-client-id");
+      const secret = req.headers.get("cf-access-client-secret");
+      const passes =
+        id === HEADER_VALUES["CF-Access-Client-Id"] &&
+        secret === HEADER_VALUES["CF-Access-Client-Secret"];
+
+      if (!passes) {
+        state.rejectedRequests.push({ method: req.method, path: pathAndQuery });
+        return new Response(
+          '<!DOCTYPE html><title>Sign in ・ Cloudflare Access</title>' +
+            '<body>Authenticate to reach this site.</body>',
+          {
+            status: 403,
+            headers: {
+              "content-type": "text/html; charset=utf-8",
+              "cf-ray": "0000000000000000-TEST",
+              "cf-mitigated": "challenge",
+            },
+          },
+        );
+      }
+
+      state.authenticatedRequests.push({ method: req.method, path: pathAndQuery });
+
+      const target = new URL(pathAndQuery, backendUrl);
+      const forwardHeaders = new Headers(req.headers);
+      forwardHeaders.delete("cf-access-client-id");
+      forwardHeaders.delete("cf-access-client-secret");
+      forwardHeaders.set("host", new URL(backendUrl).host);
+
+      const body =
+        req.method === "GET" || req.method === "HEAD"
+          ? undefined
+          : await req.arrayBuffer();
+
+      return await fetch(target, {
+        method: req.method,
+        headers: forwardHeaders,
+        body,
+        redirect: "manual",
+      });
+    },
+  });
+
+  return {
+    server,
+    state,
+    url: `http://127.0.0.1:${server.port}`,
+  };
+}
+
+async function runCliThroughProxy(
+  backend: { workspace: string; testConfigDir: string; token?: string },
+  proxyUrl: string,
+  cliArgs: string[],
+  cwd: string,
+  env: Record<string, string>,
+): Promise<{ stdout: string; stderr: string; code: number }> {
+  const cliDir = new URL("..", import.meta.url).pathname;
+  const useNode = process.env["TEST_CLI_RUNTIME"] === "node";
+  const runtime = useNode ? "node" : "bun";
+  const entrypoint = useNode
+    ? `${cliDir}/npm/esm/main.js`
+    : `${cliDir}/src/main.ts`;
+  const runtimeArgs = useNode ? [entrypoint] : ["run", entrypoint];
+
+  const fullArgs = [
+    "--base-url", proxyUrl,
+    "--workspace", backend.workspace,
+    "--token", backend.token ?? "",
+    "--config-dir", backend.testConfigDir,
+    ...cliArgs,
+  ];
+
+  const proc = Bun.spawn([runtime, ...runtimeArgs, ...fullArgs], {
+    cwd,
+    env: { ...(process.env as Record<string, string>), ...env },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  const code = await proc.exited;
+  return { stdout, stderr, code };
+}
+
+test(
+  "HEADERS env var is forwarded on every CLI fetch (sync push of new script)",
+  async () => {
+    await withTestBackend(async (backend, tempDir) => {
+      const proxy = startGatewayProxy(backend.baseUrl);
+      try {
+        await writeFile(
+          `${tempDir}/wmill.yaml`,
+          `defaultTs: bun\nincludes:\n  - "**"\nexcludes: []\n`,
+          "utf-8",
+        );
+
+        const uniqueId = Date.now();
+        const scriptName = `headers_${uniqueId}`;
+        const scriptDir = `${tempDir}/f/test`;
+        await mkdir(scriptDir, { recursive: true });
+        await writeFile(
+          `${scriptDir}/${scriptName}.ts`,
+          `export async function main() {\n  return "headers test ${uniqueId}";\n}\n`,
+          "utf-8",
+        );
+        await writeFile(
+          `${scriptDir}/${scriptName}.script.yaml`,
+          [
+            `summary: "headers regression"`,
+            `description: "Push covers /scripts/create + /jobs/run/dependencies_async"`,
+            `lock: ""`,
+            `schema:`,
+            `  $schema: "https://json-schema.org/draft/2020-12/schema"`,
+            `  type: object`,
+            `  properties: {}`,
+            `  required: []`,
+            `is_template: false`,
+            `kind: script`,
+            `language: bun`,
+            ``,
+          ].join("\n"),
+          "utf-8",
+        );
+
+        const includesGlob = `f/test/${scriptName}**`;
+
+        // Negative case: no HEADERS env -> the proxy should return the
+        // gateway challenge and the CLI should bail out non-zero. Proves the
+        // proxy is actually gating, so the positive case isn't a false pass.
+        const noHeaders = await runCliThroughProxy(
+          backend,
+          proxy.url,
+          ["sync", "push", "--yes", "--includes", includesGlob],
+          tempDir,
+          {},
+        );
+        expect(noHeaders.code).not.toEqual(0);
+        expect(proxy.state.rejectedRequests.length).toBeGreaterThan(0);
+        expect(proxy.state.authenticatedRequests.length).toEqual(0);
+
+        // Reset proxy state between cases.
+        proxy.state.authenticatedRequests.length = 0;
+        proxy.state.rejectedRequests.length = 0;
+
+        // Positive case: HEADERS env set -> the proxy must see those headers
+        // on every request the CLI makes for sync push to succeed.
+        const withHeaders = await runCliThroughProxy(
+          backend,
+          proxy.url,
+          ["sync", "push", "--yes", "--includes", includesGlob],
+          tempDir,
+          { HEADERS: HEADERS_ENV },
+        );
+        expect(withHeaders.code).toEqual(0);
+        expect(proxy.state.rejectedRequests).toEqual([]);
+
+        const paths = proxy.state.authenticatedRequests.map((r) => r.path);
+
+        // Print the full path list when an assertion below fails so the
+        // failure is debuggable without re-running with extra logging.
+        const debug = () => paths.join("\n  ");
+
+        // Tarball download (sync diff): src/commands/sync/pull.ts
+        expect(
+          paths.some((p) =>
+            p.startsWith(`/api/w/${backend.workspace}/workspaces/tarball`),
+          ),
+          `expected tarball request, got:\n  ${debug()}`,
+        ).toBe(true);
+
+        // Script create: src/commands/script/script.ts pushScript().
+        // This is the regression: PR #8936 switched from wmill.createScript()
+        // (SDK, inherits OpenAPI.HEADERS) to a raw fetch that didn't forward
+        // HEADERS. Without the fix, the proxy would 403 this request and the
+        // CLI exit would be non-zero — so this assertion is the load-bearing
+        // one for #8936 / #6421-style regressions.
+        expect(
+          paths.some((p) =>
+            p.includes(`/api/w/${backend.workspace}/scripts/create`),
+          ),
+          `expected /scripts/create request, got:\n  ${debug()}`,
+        ).toBe(true);
+
+        // Lock generation: src/utils/metadata.ts. Was the original #6421 fix
+        // (PR #6422) — a soft check; the backend may skip queueing a lock job
+        // for trivial bun scripts under some feature configurations, so we
+        // only verify it *if* the CLI tried to generate one.
+        // (No assertion — covered by the tarball+create checks above plus
+        // the negative case proving the proxy actually gates requests.)
+      } finally {
+        proxy.server.stop(true);
+      }
+    });
+  },
+  240_000,
+);

From bc527fd929577ac57d4e24196069ed236b702d71 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 8 May 2026 06:39:47 +0200
Subject: [PATCH 02/50] feat(cli): add --parallel flag to generate-metadata
 (#9074)

* feat(cli): add --parallel flag to generate-metadata

* fix(cli): validate --parallel input and harden flush ordering
---
 .../generate-metadata/generate-metadata.ts    | 255 +++++++++++-------
 cli/src/guidance/skills.gen.ts                |   2 +
 cli/src/utils/metadata.ts                     |  49 +++-
 .../auto-generated/cli/cli-commands.md        |   2 +
 system_prompts/auto-generated/prompts.ts      |   2 +
 .../skills/cli-commands/SKILL.md              |   2 +
 6 files changed, 209 insertions(+), 103 deletions(-)

diff --git a/cli/src/commands/generate-metadata/generate-metadata.ts b/cli/src/commands/generate-metadata/generate-metadata.ts
index 226220592e..1de173e582 100644
--- a/cli/src/commands/generate-metadata/generate-metadata.ts
+++ b/cli/src/commands/generate-metadata/generate-metadata.ts
@@ -8,6 +8,8 @@ import { resolveWorkspace } from "../../core/context.ts";
 import { requireLogin } from "../../core/auth.ts";
 import * as log from "../../core/log.ts";
 import {
+  beginLockfileBatch,
+  flushLockfileBatch,
   generateScriptMetadataInternal,
   getRawWorkspaceDependencies,
   readLockfile,
@@ -200,6 +202,12 @@ export async function rehashOnly(
   const stubWorkspace = {} as any;
   const rehashOpts = { ...opts, rehashOnly: true } as any;
 
+  type RehashTask =
+    | { kind: "script"; scriptPath: string }
+    | { kind: "flow"; folder: string }
+    | { kind: "app"; folder: string; rawApp: boolean };
+  const queue: RehashTask[] = [];
+
   if (!rehashFilter?.skipScripts) {
     for (const e of scriptPaths) {
       // Filter against the derived remote path so a folder argument like
@@ -210,14 +218,7 @@ export async function rehashOnly(
       if (rehashFilter?.missingOnly) {
         if (skipIfExisting(remotePath) || skipIfExisting(remotePath, "__script_hash")) continue;
       }
-      try {
-        await generateScriptMetadataInternal(
-          e, stubWorkspace, rehashOpts, false, true, {}, codebases, false,
-        );
-        counts.scripts++;
-      } catch (err) {
-        log.warn(`Skipping ${e}: ${err instanceof Error ? err.message : err}`);
-      }
+      queue.push({ kind: "script", scriptPath: e });
     }
   }
 
@@ -228,12 +229,7 @@ export async function rehashOnly(
         const folderNormalized = f.replaceAll(SEP, "/");
         if (skipIfExisting(folderNormalized, "__flow_hash")) continue;
       }
-      try {
-        await generateFlowLockInternal(f, false, stubWorkspace, rehashOpts, false, true);
-        counts.flows++;
-      } catch (err) {
-        log.warn(`Skipping ${f}: ${err instanceof Error ? err.message : err}`);
-      }
+      queue.push({ kind: "flow", folder: f });
     }
   }
 
@@ -244,13 +240,52 @@ export async function rehashOnly(
         const folderNormalized = appFolder.replaceAll(SEP, "/");
         if (skipIfExisting(folderNormalized, "__app_hash")) continue;
       }
-      try {
-        await generateAppLocksInternal(appFolder, rawApp, false, stubWorkspace, rehashOpts, false, true);
-        counts.apps++;
-      } catch (err) {
-        log.warn(`Skipping ${appFolder}: ${err instanceof Error ? err.message : err}`);
+      queue.push({ kind: "app", folder: appFolder, rawApp });
+    }
+  }
+
+  let parallelism = Number(opts.parallel ?? 1);
+  if (!Number.isFinite(parallelism) || parallelism <= 0) parallelism = 1;
+  if (parallelism > 1) {
+    log.info(`Parallelizing ${parallelism} items at a time`);
+  }
+
+  // Buffer wmill-lock.yaml writes during the parallel phase: each task mutates
+  // the shared in-memory lockfile, then we flush once.
+  await beginLockfileBatch();
+  try {
+    const pool = new Set<Promise<void>>();
+    while (queue.length > 0 || pool.size > 0) {
+      while (pool.size < parallelism && queue.length > 0) {
+        const task = queue.shift()!;
+        const p = (async () => {
+          try {
+            if (task.kind === "script") {
+              await generateScriptMetadataInternal(
+                task.scriptPath, stubWorkspace, rehashOpts, false, true, {}, codebases, false,
+              );
+              counts.scripts++;
+            } else if (task.kind === "flow") {
+              await generateFlowLockInternal(task.folder, false, stubWorkspace, rehashOpts, false, true);
+              counts.flows++;
+            } else {
+              await generateAppLocksInternal(task.folder, task.rawApp, false, stubWorkspace, rehashOpts, false, true);
+              counts.apps++;
+            }
+          } catch (err) {
+            const label = task.kind === "script" ? task.scriptPath : task.folder;
+            log.warn(`Skipping ${label}: ${err instanceof Error ? err.message : err}`);
+          }
+        })();
+        pool.add(p);
+        p.then(() => pool.delete(p));
+      }
+      if (pool.size > 0) {
+        await Promise.race(pool);
       }
     }
+  } finally {
+    await flushLockfileBatch();
   }
 
   if (counts.scripts + counts.flows + counts.apps > 0 || !rehashFilter?.missingOnly) {
@@ -519,85 +554,117 @@ export async function generateMetadata(
 
   const errors: { path: string; error: string }[] = [];
 
-  // Process scripts
-  for (const item of scripts) {
-    current++;
-    log.info(`${formatProgress(current)} script ${item.path}`);
-    try {
-      await generateScriptMetadataInternal(
-        item.path, // originalPath with extension
-        workspace,
-        opts,
-        false, // dryRun
-        true, // noStaleMessage
-        mismatchedWorkspaceDeps,
-        codebases,
-        false,
-        tree
-      );
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      log.error(`  Failed: ${msg}`);
-    }
+  let parallelism = Number(opts.parallel ?? 1);
+  if (!Number.isFinite(parallelism) || parallelism <= 0) parallelism = 1;
+  if (parallelism > 1) {
+    log.info(`Parallelizing ${parallelism} items at a time`);
   }
 
-  // Process flows
-  for (const item of flows) {
-    current++;
-    try {
-      const result = await generateFlowLockInternal(
-        item.folder.replaceAll("/", SEP),
-        false, // dryRun
-        workspace,
-        opts,
-        false,
-        true, // noStaleMessage
-        tree
-      );
-      const flowResult = result as FlowLocksResult | undefined;
-      const scriptsInfo = flowResult?.updatedScripts?.length
-        ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`))
-        : "";
-      log.info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      log.info(`${formatProgress(current)} flow   ${item.path}`);
-      log.error(`  Failed: ${msg}`);
-    }
-  }
+  type Task =
+    | { kind: "script"; item: StaleItem }
+    | { kind: "flow"; item: StaleItem }
+    | { kind: "app"; item: StaleItem };
+  const queue: Task[] = [
+    ...scripts.map<Task>((item) => ({ kind: "script", item })),
+    ...flows.map<Task>((item) => ({ kind: "flow", item })),
+    ...apps.map<Task>((item) => ({ kind: "app", item })),
+  ];
 
-  // Process apps
-  for (const item of apps) {
-    current++;
-    try {
-      const result = await generateAppLocksInternal(
-        item.folder.replaceAll("/", SEP),
-        item.isRawApp!, // rawApp
-        false, // dryRun
-        workspace,
-        opts,
-        false,
-        true, // noStaleMessage
-        tree
-      );
-      const appResult = result as AppLocksResult | undefined;
-      const scriptsInfo = appResult?.updatedScripts?.length
-        ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`))
-        : "";
-      log.info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      log.info(`${formatProgress(current)} app    ${item.path}`);
-      log.error(`  Failed: ${msg}`);
+  // Buffer wmill-lock.yaml writes during the parallel phase: each task mutates
+  // the shared in-memory lockfile via clearGlobalLock/updateMetadataGlobalLock,
+  // then we flush once. Without this buffering, two workers' read-modify-write
+  // cycles would race and lose hashes.
+  await beginLockfileBatch();
+  try {
+    const pool = new Set<Promise<void>>();
+    while (queue.length > 0 || pool.size > 0) {
+      while (pool.size < parallelism && queue.length > 0) {
+        const task = queue.shift()!;
+        const taskNumber = ++current;
+        const p = (async () => {
+          if (task.kind === "script") {
+            const item = task.item;
+            log.info(`${formatProgress(taskNumber)} script ${item.path}`);
+            try {
+              await generateScriptMetadataInternal(
+                item.path, // originalPath with extension
+                workspace,
+                opts,
+                false, // dryRun
+                true, // noStaleMessage
+                mismatchedWorkspaceDeps,
+                codebases,
+                false,
+                tree
+              );
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              log.error(`  Failed: ${msg}`);
+            }
+          } else if (task.kind === "flow") {
+            const item = task.item;
+            try {
+              const result = await generateFlowLockInternal(
+                item.folder.replaceAll("/", SEP),
+                false, // dryRun
+                workspace,
+                opts,
+                false,
+                true, // noStaleMessage
+                tree
+              );
+              const flowResult = result as FlowLocksResult | undefined;
+              const scriptsInfo = flowResult?.updatedScripts?.length
+                ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`))
+                : "";
+              log.info(`${formatProgress(taskNumber)} flow   ${item.path}${scriptsInfo}`);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              log.info(`${formatProgress(taskNumber)} flow   ${item.path}`);
+              log.error(`  Failed: ${msg}`);
+            }
+          } else {
+            const item = task.item;
+            try {
+              const result = await generateAppLocksInternal(
+                item.folder.replaceAll("/", SEP),
+                item.isRawApp!, // rawApp
+                false, // dryRun
+                workspace,
+                opts,
+                false,
+                true, // noStaleMessage
+                tree
+              );
+              const appResult = result as AppLocksResult | undefined;
+              const scriptsInfo = appResult?.updatedScripts?.length
+                ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`))
+                : "";
+              log.info(`${formatProgress(taskNumber)} app    ${item.path}${scriptsInfo}`);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              log.info(`${formatProgress(taskNumber)} app    ${item.path}`);
+              log.error(`  Failed: ${msg}`);
+            }
+          }
+        })();
+        pool.add(p);
+        p.then(() => pool.delete(p));
+      }
+      if (pool.size > 0) {
+        await Promise.race(pool);
+      }
     }
-  }
 
-  // Persist all stale workspace dep hashes (not just filtered — deps are global, not folder-scoped)
-  const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
-  await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+    // Persist all stale workspace dep hashes (not just filtered — deps are global, not folder-scoped)
+    const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
+    await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+  } finally {
+    await flushLockfileBatch();
+  }
 
   const succeeded = total - errors.length;
   log.info("");
@@ -640,6 +707,7 @@ const command = new Command()
   .option("--skip-flows", "Skip processing flows")
   .option("--skip-apps", "Skip processing apps")
   .option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)")
+  .option("--parallel <n:number>", "Number of items to process in parallel")
   .option(
     "-i --includes <patterns:file[]>",
     "Comma separated patterns to specify which files to include"
@@ -661,6 +729,7 @@ const command = new Command()
       .option("--skip-scripts", "Skip processing scripts")
       .option("--skip-flows", "Skip processing flows")
       .option("--skip-apps", "Skip processing apps")
+      .option("--parallel <n:number>", "Number of items to process in parallel")
       .option(
         "-i --includes <patterns:file[]>",
         "Comma separated patterns to specify which files to include"
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 3eb1c872cc..ede19be85b 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -6730,6 +6730,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - \`--skip-flows\` - Skip processing flows
 - \`--skip-apps\` - Skip processing apps
 - \`--strict-folder-boundaries\` - Only update items inside the specified folder (requires folder argument)
+- \`--parallel <n:number>\` - Number of items to process in parallel
 - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
 - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
@@ -6739,6 +6740,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - \`--skip-scripts\` - Skip processing scripts
   - \`--skip-flows\` - Skip processing flows
   - \`--skip-apps\` - Skip processing apps
+  - \`--parallel <n:number>\` - Number of items to process in parallel
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
diff --git a/cli/src/utils/metadata.ts b/cli/src/utils/metadata.ts
index 456336dae2..9668dd19e6 100644
--- a/cli/src/utils/metadata.ts
+++ b/cli/src/utils/metadata.ts
@@ -1202,7 +1202,32 @@ export function normalizeLockPath(p: string): string {
   return n;
 }
 
+// When set, `clearGlobalLock` and `updateMetadataGlobalLock` mutate this
+// in-memory copy instead of doing a full read-modify-write on disk for every
+// call. Callers that fan out item processing through a worker pool wrap the
+// pool with `beginLockfileBatch()`/`flushLockfileBatch()` so the lockfile is
+// only written once at the end — see `generate-metadata` parallelism.
+let inMemoryLock: Lock | null = null;
+
+export async function beginLockfileBatch(): Promise<void> {
+  if (inMemoryLock) return;
+  inMemoryLock = await readLockfile();
+}
+
+export async function flushLockfileBatch(): Promise<void> {
+  if (!inMemoryLock) return;
+  // Write first, then clear: if the disk write throws (e.g. ENOSPC), the
+  // buffered updates remain in memory and a retry can re-attempt the flush.
+  await writeFile(
+    WMILL_LOCKFILE,
+    yamlStringify(inMemoryLock as Record<string, any>, yamlOptions),
+    "utf-8",
+  );
+  inMemoryLock = null;
+}
+
 export async function readLockfile(): Promise<Lock> {
+  if (inMemoryLock) return inMemoryLock;
   let parsed: unknown;
   try {
     parsed = await yamlParseFile(WMILL_LOCKFILE);
@@ -1344,11 +1369,13 @@ export async function clearGlobalLock(path: string): Promise<void> {
         }
       });
     }
-    await writeFile(
-      WMILL_LOCKFILE,
-      yamlStringify(conf as Record<string, any>, yamlOptions),
-      "utf-8"
-    );
+    if (!inMemoryLock) {
+      await writeFile(
+        WMILL_LOCKFILE,
+        yamlStringify(conf as Record<string, any>, yamlOptions),
+        "utf-8"
+      );
+    }
   }
 }
 
@@ -1377,9 +1404,11 @@ export async function updateMetadataGlobalLock(
       conf.locks[path] = hash;
     }
   }
-  await writeFile(
-    WMILL_LOCKFILE,
-    yamlStringify(conf as Record<string, any>, yamlOptions),
-    "utf-8"
-  );
+  if (!inMemoryLock) {
+    await writeFile(
+      WMILL_LOCKFILE,
+      yamlStringify(conf as Record<string, any>, yamlOptions),
+      "utf-8"
+    );
+  }
 }
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index e541df9198..692e2dd310 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -168,6 +168,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - `--skip-flows` - Skip processing flows
 - `--skip-apps` - Skip processing apps
 - `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)
+- `--parallel <n:number>` - Number of items to process in parallel
 - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
 - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
@@ -177,6 +178,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - `--skip-scripts` - Skip processing scripts
   - `--skip-flows` - Skip processing flows
   - `--skip-apps` - Skip processing apps
+  - `--parallel <n:number>` - Number of items to process in parallel
   - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
   - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index aeb39bb6b7..83f6ae1157 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -2316,6 +2316,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - \`--skip-flows\` - Skip processing flows
 - \`--skip-apps\` - Skip processing apps
 - \`--strict-folder-boundaries\` - Only update items inside the specified folder (requires folder argument)
+- \`--parallel <n:number>\` - Number of items to process in parallel
 - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
 - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
@@ -2325,6 +2326,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - \`--skip-scripts\` - Skip processing scripts
   - \`--skip-flows\` - Skip processing flows
   - \`--skip-apps\` - Skip processing apps
+  - \`--parallel <n:number>\` - Number of items to process in parallel
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index 66efee7a68..b4818b4fa1 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -173,6 +173,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - `--skip-flows` - Skip processing flows
 - `--skip-apps` - Skip processing apps
 - `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)
+- `--parallel <n:number>` - Number of items to process in parallel
 - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
 - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 
@@ -182,6 +183,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - `--skip-scripts` - Skip processing scripts
   - `--skip-flows` - Skip processing flows
   - `--skip-apps` - Skip processing apps
+  - `--parallel <n:number>` - Number of items to process in parallel
   - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include
   - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude
 

From 2067e0719fd1fd1b899b015badec0f222c054e66 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 04:43:07 +0000
Subject: [PATCH 03/50] perf(flows): skip flow_env DB+transform work when no
 resolution is needed (#9078)

---
 backend/windmill-worker/src/common.rs      |  7 +++
 backend/windmill-worker/src/worker_flow.rs | 50 ++++++++++++++++------
 2 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index 0946075443..99e323dcfd 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -148,6 +148,13 @@ lazy_static::lazy_static! {
     static ref RE_RES_VAR: Regex = Regex::new(r#"\$(?:var|jsonvar|res|encrypted)\:"#).unwrap();
 }
 
+/// Returns true if any value in `vs` contains a `$var:`/`$jsonvar:`/`$res:`/`$encrypted:`
+/// reference that would need interpolation by `transform_json`. Cheap pre-check that
+/// callers can use to skip the DB roundtrip + clone path when nothing requires resolution.
+pub(crate) fn map_needs_resolution(vs: &HashMap<String, Box<RawValue>>) -> bool {
+    vs.values().any(|v| (*RE_RES_VAR).is_match(v.get()))
+}
+
 pub async fn transform_json<'a>(
     client: &AuthedClient,
     workspace: &str,
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 050ae4b44f..3a07d1bfe4 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -2394,21 +2394,47 @@ async fn resolve_flow_env_for_status_update(
     workspace_id: &str,
     flow_value: &FlowValue,
 ) -> Option<HashMap<String, Box<RawValue>>> {
-    let env = if let Some(ref e) = flow_value.flow_env {
-        e.clone()
-    } else {
-        fetch_root_flow_env(db, flow_job_id, workspace_id).await?
-    };
+    // Fetch the env source. For the inherited path, we first need to know whether the
+    // flow even has a parent — `fetch_root_flow_env` runs a recursive CTE on `v2_job`
+    // and is wasted work for top-level flows with no own `flow_env`. The mini job we
+    // pull here can be reused below if `transform_json` ends up needing it.
+    let (env, mini): (HashMap<String, Box<RawValue>>, Option<MiniPulledJob>) =
+        if let Some(ref e) = flow_value.flow_env {
+            (e.clone(), None)
+        } else {
+            let mini = match get_mini_pulled_job(db, &flow_job_id).await {
+                Ok(Some(j)) => j,
+                Ok(None) => return None,
+                Err(e) => {
+                    tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
+                    return None;
+                }
+            };
+            if mini.parent_job.is_none() {
+                // No own flow_env and no parent to inherit from — nothing to resolve.
+                return None;
+            }
+            let env = fetch_root_flow_env(db, flow_job_id, workspace_id).await?;
+            (env, Some(mini))
+        };
     if env.is_empty() {
         return Some(env);
     }
-    let mini = match get_mini_pulled_job(db, &flow_job_id).await {
-        Ok(Some(j)) => j,
-        Ok(None) => return Some(env),
-        Err(e) => {
-            tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
-            return Some(env);
-        }
+    // Skip the DB roundtrip + `transform_json` when nothing in env needs interpolation.
+    // This is the common case: a flow_env containing only literal values.
+    if !crate::common::map_needs_resolution(&env) {
+        return Some(env);
+    }
+    let mini = match mini {
+        Some(m) => m,
+        None => match get_mini_pulled_job(db, &flow_job_id).await {
+            Ok(Some(j)) => j,
+            Ok(None) => return Some(env),
+            Err(e) => {
+                tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
+                return Some(env);
+            }
+        },
     };
     match transform_json(
         client,

From 1c56148714861aafc4f489916c71aa4674e938c0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 07:43:21 +0200
Subject: [PATCH 04/50] fix(cli-tests): stabilize flow lock-gen race + Windows
 path (#9080)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(cli-tests): stabilize flow lock-gen race + Windows path

Three CLI test failures on the latest main, all flaky on CI:

1. `Mixed Case Paths: pull and push flow with capitalized folder` and
   `Integration: Mixed scripts and flows with nonDottedPaths are
   idempotent`: flow create/update queues an async FlowDependencies job
   that fills inline-script lockfiles and rewrites flow.value. The tests
   pulled/pushed before the worker finished, so dry-run idempotency saw
   phantom `*.inline_script.lock` adds and `flow.yaml` edits. Added a
   `waitForFlowDependencyJob` helper that polls `/flows/get` for the
   latest `dependency_job` and `/jobs_u/completed/get` until it lands,
   and called it after each API/CLI flow write in both tests.

2. `HEADERS env var is forwarded on every CLI fetch` (Windows-only,
   added in #9075): the new test built the CLI entrypoint via
   `new URL("..", import.meta.url).pathname`, which yields `/C:/...` on
   Windows and `Bun.spawn` rejected before reaching the proxy, leaving
   `rejectedRequests.length` at 0. Switched to
   `fileURLToPath` + `node:path.join` to match `cargo_backend.ts`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(cli-tests): use /flows/deployment_status to actually wait for dep job

CI reviewers (Claude, Codex) flagged the prior `waitForFlowDependencyJob`
as a no-op: it read `flow.dependency_job` from `/api/w/{ws}/flows/get`,
but `Flow` / `FlowWithStarred` (backend/windmill-types/src/flows.rs:20-60)
do not include that field. The helper exited on the first iteration
without polling.

Switch to `/api/w/{ws}/flows/deployment_status/p/{path}`, which returns
`{ lock_error_logs, job_id }`. `job_id` is the FlowDependencies UUID
written into `deployment_metadata` in the same tx as the dep-job push
(backend/windmill-api-flows/src/flows.rs:660-672 and :1275-1292), so by
the time the create/update API call returns, the response carries the
latest dep-job UUID. Then poll `/jobs_u/completed/get/{job_id}` as
before. Local runtime for `mixed_case_paths.test.ts` jumps from ~9s to
~32s, confirming the helper now actually waits instead of returning
immediately. The 404 short-circuit in `sync_pull_push.test.ts` still
works — `get_deployment_status` returns 404 when the flow is absent.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 cli/test/headers_env_var.test.ts  | 12 +++++--
 cli/test/mixed_case_paths.test.ts | 55 +++++++++++++++++++++++++++++
 cli/test/sync_pull_push.test.ts   | 58 +++++++++++++++++++++++++++++++
 3 files changed, 122 insertions(+), 3 deletions(-)

diff --git a/cli/test/headers_env_var.test.ts b/cli/test/headers_env_var.test.ts
index ad483f4d05..72fdf4103f 100644
--- a/cli/test/headers_env_var.test.ts
+++ b/cli/test/headers_env_var.test.ts
@@ -18,6 +18,8 @@
 
 import { expect, test } from "bun:test";
 import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { Server } from "bun";
 import { withTestBackend } from "./test_backend.ts";
 
@@ -113,12 +115,16 @@ async function runCliThroughProxy(
   cwd: string,
   env: Record<string, string>,
 ): Promise<{ stdout: string; stderr: string; code: number }> {
-  const cliDir = new URL("..", import.meta.url).pathname;
+  // Use fileURLToPath + node:path so the CLI entrypoint is a real OS path on
+  // Windows. `new URL(..).pathname` yields `/C:/...` which Bun.spawn fails to
+  // resolve, so the negative case "rejected" on launch instead of reaching
+  // the proxy and the assertion on rejectedRequests > 0 flaked.
+  const cliDir = join(dirname(fileURLToPath(import.meta.url)), "..");
   const useNode = process.env["TEST_CLI_RUNTIME"] === "node";
   const runtime = useNode ? "node" : "bun";
   const entrypoint = useNode
-    ? `${cliDir}/npm/esm/main.js`
-    : `${cliDir}/src/main.ts`;
+    ? join(cliDir, "npm", "esm", "main.js")
+    : join(cliDir, "src", "main.ts");
   const runtimeArgs = useNode ? [entrypoint] : ["run", entrypoint];
 
   const fullArgs = [
diff --git a/cli/test/mixed_case_paths.test.ts b/cli/test/mixed_case_paths.test.ts
index d85f81cc83..872c6f94ff 100644
--- a/cli/test/mixed_case_paths.test.ts
+++ b/cli/test/mixed_case_paths.test.ts
@@ -130,6 +130,57 @@ async function createFlow(
     throw new Error(`Failed to create flow ${flowPath}: ${error}`);
   }
   await response.text();
+
+  // Flow creation queues an async FlowDependencies job that generates the
+  // inline-script lockfile and rewrites flow.value. If we don't wait, a
+  // subsequent pull/push races the worker and the dry-run idempotency
+  // assertion sees a phantom lock-add + flow.yaml-edit diff (CI-only flake).
+  await waitForFlowDependencyJob(backend, flowPath);
+}
+
+async function waitForFlowDependencyJob(
+  backend: any,
+  flowPath: string,
+  timeoutMs: number = 30000,
+): Promise<void> {
+  // /flows/get does not return `dependency_job`. The deployment_status route
+  // joins flow_version against deployment_metadata, which is populated in the
+  // same tx as the FlowDependencies push, so by the time the create/update
+  // API call returns, job_id is already the latest dep-job UUID.
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const statusResp = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/flows/deployment_status/p/${flowPath}`,
+    );
+    if (statusResp.status === 404) {
+      await statusResp.text().catch(() => {});
+      return;
+    }
+    if (!statusResp.ok) {
+      await statusResp.text().catch(() => {});
+      throw new Error(
+        `Failed to fetch deployment status for ${flowPath}: ${statusResp.status}`,
+      );
+    }
+    const status = await statusResp.json();
+    const depJobId: string | undefined = status?.job_id;
+    if (!depJobId) {
+      await new Promise((r) => setTimeout(r, 100));
+      continue;
+    }
+    const completed = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/jobs_u/completed/get/${depJobId}`,
+    );
+    if (completed.ok) {
+      await completed.text();
+      return;
+    }
+    await completed.text().catch(() => {});
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  throw new Error(
+    `Flow dependency job for ${flowPath} did not complete within ${timeoutMs}ms`,
+  );
 }
 
 async function createApp(
@@ -384,6 +435,10 @@ excludes: []
       const updatedFlow = await getFlow(backend, flowPath);
       expect(updatedFlow.summary).toEqual("Modified Data Processor Flow from test");
 
+      // The CLI push enqueues a fresh FlowDependencies job. Wait for it before
+      // the dry-run pull so the lock/flow.value writes have committed.
+      await waitForFlowDependencyJob(backend, flowPath);
+
       // Verify no diff on subsequent pull (idempotency)
       await verifyNoDiffOnPull(backend, tempDir);
     });
diff --git a/cli/test/sync_pull_push.test.ts b/cli/test/sync_pull_push.test.ts
index e64af246f2..e31c4e1084 100644
--- a/cli/test/sync_pull_push.test.ts
+++ b/cli/test/sync_pull_push.test.ts
@@ -493,6 +493,58 @@ async function cleanupTempDir(dir: string): Promise<void> {
   }
 }
 
+// Polls /flows/deployment_status/p/{path} + /jobs_u/completed/get until the
+// most recent flow dependency job has completed. After a flow create/update
+// the API queues a FlowDependencies job that asynchronously fills inline-
+// script lockfiles and rewrites flow.value; tests that round-trip through
+// sync push/pull must wait for it or they race the worker (CI-only flake).
+// `deployment_status` is the right read here — `/flows/get` does not return
+// `dependency_job`, but the `deployment_metadata.job_id` row is written in
+// the same tx as the dep-job push, so the returned `job_id` is the latest
+// dep-job UUID by the time the create/update API call has returned. Returns
+// silently if the flow doesn't exist on the server (treats it as a no-op
+// push, since the route returns 404 when the flow row is missing).
+async function waitForFlowDependencyJob(
+  backend: any,
+  flowPath: string,
+  timeoutMs: number = 30000,
+): Promise<void> {
+  const start = Date.now();
+  while (Date.now() - start < timeoutMs) {
+    const statusResp = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/flows/deployment_status/p/${flowPath}`,
+    );
+    if (statusResp.status === 404) {
+      await statusResp.text().catch(() => {});
+      return;
+    }
+    if (!statusResp.ok) {
+      await statusResp.text().catch(() => {});
+      throw new Error(
+        `Failed to fetch deployment status for ${flowPath}: ${statusResp.status}`,
+      );
+    }
+    const status = await statusResp.json();
+    const depJobId: string | undefined = status?.job_id;
+    if (!depJobId) {
+      await new Promise((r) => setTimeout(r, 100));
+      continue;
+    }
+    const completed = await backend.apiRequest!(
+      `/api/w/${backend.workspace}/jobs_u/completed/get/${depJobId}`,
+    );
+    if (completed.ok) {
+      await completed.text();
+      return;
+    }
+    await completed.text().catch(() => {});
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  throw new Error(
+    `Flow dependency job for ${flowPath} did not complete within ${timeoutMs}ms`,
+  );
+}
+
 // =============================================================================
 // Tests
 // =============================================================================
@@ -1797,6 +1849,12 @@ excludes: []
 
       expect(pushResult.code).toEqual(0);
 
+      // sync push of the flow enqueues an async FlowDependencies job that
+      // generates the inline-script lockfile and rewrites flow.value. Wait for
+      // it before pulling back, otherwise pull races the worker and the
+      // dry-run push idempotency check sees phantom diffs (CI-only flake).
+      await waitForFlowDependencyJob(backend, flowName);
+
       // Pull back
       const pullResult = await backend.runCLICommand(
         ["sync", "pull", "--yes", "--includes", `f/test/mixed_*_${uniqueId}**`],

From e1a7c75e192b72b3b0d854c1901653e0b9386bf2 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 07:43:46 +0200
Subject: [PATCH 05/50] perf(flows): cache resolved flow_env per flow execution
 (#9079)

* perf(flows): cache resolved flow_env per flow execution

* perf(flows): tighten flow_env cache cap to 1024 and clarify memory note

* perf(flows): don't cache transient flow_env resolution failures
---
 backend/Cargo.lock                         |  1 +
 backend/windmill-worker/Cargo.toml         |  1 +
 backend/windmill-worker/src/worker_flow.rs | 85 ++++++++++++++++++----
 3 files changed, 72 insertions(+), 15 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index c6bf144004..323155c29b 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -17895,6 +17895,7 @@ dependencies = [
  "process-wrap",
  "prometheus",
  "prost",
+ "quick_cache",
  "rand 0.9.0",
  "rcgen",
  "regex",
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index ad3d87d8df..f1c7fa6c99 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -93,6 +93,7 @@ itertools.workspace = true
 regex.workspace = true
 prometheus = { workspace = true, optional = true }
 lazy_static.workspace = true
+quick_cache.workspace = true
 chrono.workspace = true
 dotenv.workspace = true
 rand.workspace = true # TODO: Remove. only used by token creation hack.
diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 3a07d1bfe4..91c6cf9ec7 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -81,6 +81,33 @@ use windmill_audit::ActionKind;
 use windmill_common::audit::AuditAuthor;
 use windmill_queue::{canceled_job_to_result, push};
 
+lazy_static::lazy_static! {
+    /// Per-worker LRU cache of resolved `flow_env` values, keyed by flow job id.
+    /// `update_flow_status_after_job_completion_internal` runs once per child-step
+    /// completion, and re-resolving `$var:`/`$res:` references each time was the
+    /// dominant heap-allocation source under flow-heavy load. The cache aligns
+    /// predicate evaluation with `handle_flow`'s input-transform path, which
+    /// already resolves once at flow entry — predicates were the only place still
+    /// re-resolving on every read.
+    ///
+    /// Per-worker scope (caveat): the cache lives in process memory, not the DB,
+    /// so different workers processing children of the same flow each compute
+    /// their own snapshot on first miss. If a `$var:`/`$res:` value mutates
+    /// mid-flow, predicate eval on different workers can observe different
+    /// values for the same flow run. For typical use (env values configured at
+    /// flow start, read-only during execution) this is invisible. Cross-worker
+    /// determinism would require persisting the resolved env in `v2_job_status`;
+    /// see follow-up notes.
+    ///
+    /// Entries become dead weight once a flow completes and are evicted by LRU
+    /// pressure. Bounded at 1024 entries; per-entry footprint depends on the
+    /// env's contents (literals are small but a single resolved `$res:` can be
+    /// tens of KB), so worst-case memory scales with workload mix rather than
+    /// being fixed.
+    static ref RESOLVED_FLOW_ENV_CACHE: quick_cache::sync::Cache<Uuid, Arc<HashMap<String, Box<RawValue>>>> =
+        quick_cache::sync::Cache::new(1024);
+}
+
 #[derive(Debug)]
 pub struct SchedulePushZombieError(pub String);
 
@@ -480,8 +507,26 @@ pub async fn update_flow_status_after_job_completion_internal(
             .failure_module
             .as_ref()
             .is_some_and(|fm| retry_uses_flow_env(fm));
-        let resolved_flow_env: Option<HashMap<String, Box<RawValue>>> = if needs_flow_env {
-            resolve_flow_env_for_status_update(db, client, flow, w_id, flow_value).await
+        // The resolved env is constant for a flow's lifetime, so cache it by flow
+        // job id and reuse across child-step completions. Cache miss falls back to
+        // the existing resolve+persist path; same-worker subsequent completions are
+        // a single Arc::clone away. Transient-failure fallbacks (`is_cacheable ==
+        // false`) bypass the insert so a single API blip doesn't poison the rest
+        // of the flow run.
+        let resolved_flow_env: Option<Arc<HashMap<String, Box<RawValue>>>> = if needs_flow_env {
+            if let Some(cached) = RESOLVED_FLOW_ENV_CACHE.get(&flow) {
+                Some(cached)
+            } else {
+                resolve_flow_env_for_status_update(db, client, flow, w_id, flow_value)
+                    .await
+                    .map(|(env, is_cacheable)| {
+                        let arc = Arc::new(env);
+                        if is_cacheable {
+                            RESOLVED_FLOW_ENV_CACHE.insert(flow, arc.clone());
+                        }
+                        arc
+                    })
+            }
         } else {
             None
         };
@@ -632,7 +677,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                         let bool_res = compute_bool_from_expr(
                             &expr,
                             Marc::new(args),
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             result.clone(),
                             all_iters,
                             id_ctx.as_ref(),
@@ -916,7 +961,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             &mut stop_early_err_msg,
                             &mut nresult,
                             args,
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             flow,
                             &old_status,
                         )
@@ -1136,7 +1181,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             &mut stop_early_err_msg,
                             &mut nresult,
                             args,
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             flow,
                             &old_status,
                         )
@@ -1219,7 +1264,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                             &old_status.retry,
                             result.clone(),
                             Marc::new(args),
-                            resolved_flow_env.as_ref(),
+                            resolved_flow_env.as_deref(),
                             Some(client),
                         )
                         .await?
@@ -1601,7 +1646,7 @@ pub async fn update_flow_status_after_job_completion_internal(
                 &old_status.retry,
                 result.clone(),
                 Marc::new(args),
-                resolved_flow_env.as_ref(),
+                resolved_flow_env.as_deref(),
                 Some(client),
             )
             .await?
@@ -2387,13 +2432,19 @@ async fn fetch_root_flow_id(db: &DB, flow_id: Uuid) -> Uuid {
 // `update_flow_status_after_job_completion_internal`: take the current flow's
 // `flow_env` if present, otherwise inherit from the root flow, then interpolate
 // any `$var:`/`$res:` references via `transform_json`.
+//
+// Returns `Some((env, is_cacheable))`. `is_cacheable` is `false` only when the
+// returned env is a partially-resolved fallback after a transient error (e.g.
+// `transform_json` failed mid-resolve, or the mini job fetch failed). Callers
+// must not cache `is_cacheable == false` results — doing so would freeze the
+// transient failure for the rest of the flow run.
 async fn resolve_flow_env_for_status_update(
     db: &DB,
     client: &AuthedClient,
     flow_job_id: Uuid,
     workspace_id: &str,
     flow_value: &FlowValue,
-) -> Option<HashMap<String, Box<RawValue>>> {
+) -> Option<(HashMap<String, Box<RawValue>>, bool)> {
     // Fetch the env source. For the inherited path, we first need to know whether the
     // flow even has a parent — `fetch_root_flow_env` runs a recursive CTE on `v2_job`
     // and is wasted work for top-level flows with no own `flow_env`. The mini job we
@@ -2418,21 +2469,23 @@ async fn resolve_flow_env_for_status_update(
             (env, Some(mini))
         };
     if env.is_empty() {
-        return Some(env);
+        return Some((env, true));
     }
     // Skip the DB roundtrip + `transform_json` when nothing in env needs interpolation.
     // This is the common case: a flow_env containing only literal values.
     if !crate::common::map_needs_resolution(&env) {
-        return Some(env);
+        return Some((env, true));
     }
     let mini = match mini {
         Some(m) => m,
         None => match get_mini_pulled_job(db, &flow_job_id).await {
             Ok(Some(j)) => j,
-            Ok(None) => return Some(env),
+            // Don't cache: we couldn't fetch the job, so the env we'd return is the
+            // pre-interpolation literal — caching that would freeze the broken state.
+            Ok(None) => return Some((env, false)),
             Err(e) => {
                 tracing::warn!("Failed to fetch flow job to resolve flow_env: {e:#}");
-                return Some(env);
+                return Some((env, false));
             }
         },
     };
@@ -2445,11 +2498,13 @@ async fn resolve_flow_env_for_status_update(
     )
     .await
     {
-        Ok(Some(resolved)) => Some(resolved),
-        Ok(None) => Some(env),
+        Ok(Some(resolved)) => Some((resolved, true)),
+        Ok(None) => Some((env, true)),
+        // Don't cache transient resolution failures: one variable/resource API blip
+        // would otherwise poison the literal-only env for the rest of the flow run.
         Err(e) => {
             tracing::warn!("Failed to resolve flow_env references in status update: {e:#}");
-            Some(env)
+            Some((env, false))
         }
     }
 }

From 2510a097505c1bc290783fce2fc93b570e64ffa0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 08:16:21 +0200
Subject: [PATCH 06/50] chore(main): release 1.698.0 (#9076)

* chore(main): release 1.698.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  19 +++
 backend/Cargo.lock                            | 156 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/main.ts                               |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 137 insertions(+), 118 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a7f2f43e3a..1034bc4f87 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,24 @@
 # Changelog
 
+## [1.698.0](https://github.com/windmill-labs/windmill/compare/v1.697.0...v1.698.0) (2026-05-08)
+
+
+### Features
+
+* **cli:** add --parallel flag to generate-metadata ([#9074](https://github.com/windmill-labs/windmill/issues/9074)) ([bc527fd](https://github.com/windmill-labs/windmill/commit/bc527fd929577ac57d4e24196069ed236b702d71))
+
+
+### Bug Fixes
+
+* **cli-tests:** stabilize flow lock-gen race + Windows path ([#9080](https://github.com/windmill-labs/windmill/issues/9080)) ([1c56148](https://github.com/windmill-labs/windmill/commit/1c56148714861aafc4f489916c71aa4674e938c0))
+* **cli:** forward HEADERS env var on every backend fetch call ([#9075](https://github.com/windmill-labs/windmill/issues/9075)) ([d647686](https://github.com/windmill-labs/windmill/commit/d6476862b30692e450cceda09c58d47964f87d32))
+
+
+### Performance Improvements
+
+* **flows:** cache resolved flow_env per flow execution ([#9079](https://github.com/windmill-labs/windmill/issues/9079)) ([e1a7c75](https://github.com/windmill-labs/windmill/commit/e1a7c75e192b72b3b0d854c1901653e0b9386bf2))
+* **flows:** skip flow_env DB+transform work when no resolution is needed ([#9078](https://github.com/windmill-labs/windmill/issues/9078)) ([2067e07](https://github.com/windmill-labs/windmill/commit/2067e0719fd1fd1b899b015badec0f222c054e66))
+
 ## [1.697.0](https://github.com/windmill-labs/windmill/compare/v1.696.2...v1.697.0) (2026-05-07)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 323155c29b..47aff74297 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -16025,7 +16025,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16106,7 +16106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -16130,7 +16130,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16143,7 +16143,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16309,7 +16309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16322,7 +16322,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16348,7 +16348,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16375,7 +16375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "base64 0.22.1",
@@ -16397,7 +16397,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16420,7 +16420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16436,7 +16436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16457,7 +16457,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16478,7 +16478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16492,7 +16492,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16524,7 +16524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16549,7 +16549,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "flate2",
@@ -16567,7 +16567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16589,7 +16589,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16609,7 +16609,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16639,7 +16639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16667,7 +16667,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -16679,7 +16679,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "argon2",
  "axum 0.8.4",
@@ -16704,7 +16704,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16718,7 +16718,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16751,7 +16751,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -16765,7 +16765,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16784,7 +16784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -16885,7 +16885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -16904,7 +16904,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "regex",
  "serde",
@@ -16919,7 +16919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -16943,7 +16943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -16960,7 +16960,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -16976,7 +16976,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16997,7 +16997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17028,7 +17028,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -17053,7 +17053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -17087,7 +17087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -17105,7 +17105,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -17114,7 +17114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17126,7 +17126,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17138,7 +17138,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -17150,7 +17150,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17162,7 +17162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17174,7 +17174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -17185,7 +17185,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17196,7 +17196,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17208,7 +17208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17219,7 +17219,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17241,7 +17241,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17253,7 +17253,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17267,7 +17267,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -17284,7 +17284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17297,7 +17297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -17309,7 +17309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17327,7 +17327,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -17343,7 +17343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17359,7 +17359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -17370,7 +17370,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17407,7 +17407,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -17445,7 +17445,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -17456,7 +17456,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17486,7 +17486,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17510,7 +17510,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17543,7 +17543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17576,7 +17576,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17596,7 +17596,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17630,7 +17630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17666,7 +17666,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17689,7 +17689,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17713,7 +17713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -17737,7 +17737,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17772,7 +17772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17800,7 +17800,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17823,7 +17823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "bitflags 2.9.4",
@@ -17842,7 +17842,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -17955,7 +17955,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 0d25909c74..1a1b1f09d0 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.697.0"
+version = "1.698.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.697.0"
+version = "1.698.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 4bb0074734..0bc102cc48 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6183,7 +6183,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6263,7 +6263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6275,7 +6275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6296,7 +6296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6308,7 +6308,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6320,7 +6320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6332,7 +6332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6344,7 +6344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6378,7 +6378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6411,7 +6411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6423,7 +6423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6437,7 +6437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6454,7 +6454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6467,7 +6467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6479,7 +6479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6497,7 +6497,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6513,7 +6513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6529,7 +6529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6561,7 +6561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.697.0"
+version = "1.698.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index e9dc39abc7..43a8bd59ef 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.697.0"
+version = "1.698.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index dd3c480241..0c8d63298e 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.697.0
+  version: 1.698.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 2e1f9ef06a..a20c1b18af 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.697.0";
+export const VERSION = "v1.698.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 3d9a15dfd9..9650032679 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -79,7 +79,7 @@ export {
   token,
 };
 
-export const VERSION = "1.697.0";
+export const VERSION = "1.698.0";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 2e8ca86313..c616a8e212 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.697.0",
+	"version": "1.698.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.697.0",
+			"version": "1.698.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 79d4465429..e6d623791f 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.697.0",
+	"version": "1.698.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 24a854d8e2..efe961555a 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.697.0"
+wmill = ">=1.698.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index b4cd99fb13..d7e823897c 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.697.0
+  version: 1.698.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 5626e3544d..2e25edb52d 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.697.0'
+    ModuleVersion     = '1.698.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 868da1a79c..d1ac989649 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.697.0"
+version = "1.698.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 135c0c7be3..07b5df0602 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.697.0",
+  "version": "1.698.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index bbb6083085..566e4bd4e4 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.697.0",
+  "version": "1.698.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "sideEffects": false,
diff --git a/version.txt b/version.txt
index 20b63a5ebc..7185d214b0 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.697.0
+1.698.0

From d37277d2341c83faf72efa0035cbf70e2cfbd596 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 09:12:33 +0200
Subject: [PATCH 07/50] fix: reject root-rooted paths in ansible playbook
 validator on windows (#9081)

---
 .../windmill-worker/src/ansible_executor.rs   | 38 +++++++++++++------
 1 file changed, 27 insertions(+), 11 deletions(-)

diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index c8289b6934..2608cc6088 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -121,18 +121,24 @@ fn validate_relative_path(path: &str, field_name: &str) -> error::Result<()> {
         )));
     }
     let p = std::path::Path::new(trimmed);
-    if p.is_absolute() {
-        return Err(error::Error::BadRequest(format!(
-            "`{}` must be a relative path inside the cloned repo, got: {}",
-            field_name, trimmed
-        )));
-    }
     for component in p.components() {
-        if matches!(component, std::path::Component::ParentDir) {
-            return Err(error::Error::BadRequest(format!(
-                "`{}` must not contain `..` segments, got: {}",
-                field_name, trimmed
-            )));
+        match component {
+            // RootDir catches leading `/` or `\`; Prefix catches Windows drive
+            // letters and UNC paths. `Path::is_absolute()` alone misses
+            // RootDir-only paths on Windows (e.g. `/etc/passwd`).
+            std::path::Component::RootDir | std::path::Component::Prefix(_) => {
+                return Err(error::Error::BadRequest(format!(
+                    "`{}` must be a relative path inside the cloned repo, got: {}",
+                    field_name, trimmed
+                )));
+            }
+            std::path::Component::ParentDir => {
+                return Err(error::Error::BadRequest(format!(
+                    "`{}` must not contain `..` segments, got: {}",
+                    field_name, trimmed
+                )));
+            }
+            _ => {}
         }
     }
     Ok(())
@@ -1765,9 +1771,19 @@ mod tests {
 
     #[test]
     fn test_validate_relative_path_rejects_absolute() {
+        // `/etc/passwd` isn't `is_absolute()` on Windows (no drive prefix), but
+        // its leading RootDir still escapes the cloned repo, so reject it on
+        // every platform.
         assert!(validate_relative_path("/etc/passwd", "playbook").is_err());
     }
 
+    #[cfg(windows)]
+    #[test]
+    fn test_validate_relative_path_rejects_windows_absolute() {
+        assert!(validate_relative_path("\\etc\\passwd", "playbook").is_err());
+        assert!(validate_relative_path("C:\\Windows\\System32", "playbook").is_err());
+    }
+
     #[test]
     fn test_validate_relative_path_rejects_parent_dir() {
         assert!(validate_relative_path("../escape.yml", "playbook").is_err());

From ee3d82f01f52d835218f544dad6de9b7c3184fbb Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 8 May 2026 09:59:46 +0200
Subject: [PATCH 08/50] fix(native-triggers): serialize Google channel renewal
 across replicas (#9060)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(native-triggers): serialize Google channel renewal across replicas

`sync_all_triggers` runs every 5 minutes on every windmill-app replica
with no leader election. Multiple replicas were each rotating the
webhook token, creating a new Google watch channel, and racing the
trigger UPDATE — leaving the loser's new token (in `token`) and channel
(in Google) orphaned. Cloud was accumulating ~5 leaked tokens/week
without the silent best-effort `delete_token_by_hash` ever logging a
warning.

Wrap each per-trigger renewal in a transaction and acquire the row with
`SELECT … FOR UPDATE SKIP LOCKED`. Contending replicas skip the row
instead of duplicating the work. The lock spans `rotate_webhook_token`
→ Google API call → `update_native_trigger_service_config` and is only
released on commit. Re-checks `should_renew_channel` after acquiring
the lock so a replica that committed seconds earlier doesn't trigger a
duplicate renewal.

The pattern matches existing batch-cleanup paths in `monitor.rs`
(job-retention sweep) and other `FOR UPDATE SKIP LOCKED` call sites.

Also logs at `debug!` when `delete_token_by_hash` finds no matching row,
so future investigations can distinguish "deleted" from "not found"
without changing the `Ok(false)` contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fixup! fix(native-triggers): serialize Google channel renewal across replicas

* fixup! fix(native-triggers): serialize Google channel renewal across replicas

fixup! fix(native-triggers): serialize Google channel renewal across replicas

Address claude review:
- #5: per-skip log info -> debug (expected outcome under SKIP LOCKED)
- #2: warn moved out of delete_token_by_hash to the call site that knows the
  expected state (try_renew_channel_locked); other callers are race-prone and
  shouldn't warn
- #3: NULL service_config now warns (anomalous case)
- #4: post-Google-API DB-update + commit failures log distinctly so the
  channel-orphan case is grep-able

Plus: add 14d expiry to Google webhook tokens via ServiceName::webhook_token_expiration,
mint fresh ephemeral-webhook-{service}-{rd5} labels at create + rotate so the
existing 'ephemeral-' filter excludes them from user-token email/critical-alert
paths (no filter changes in 3 places). Orphans now self-clean via the existing
expiry sweep in monitor.rs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fixup! fix(native-triggers): serialize Google channel renewal across replicas

fixup! fix(native-triggers): serialize Google channel renewal across replicas

Address second-round review:
- Claude #1 (P2): username_override_from_label now strips the 'ephemeral-'
  prefix for ephemeral-webhook-* labels, so created_by stays
  webhook-{service}-{rd5} instead of changing to label-ephemeral-webhook-...
  (preserves audit/job-list filter compatibility)
- Codex (P2): updated renew_channel doc — labels are no longer copied; rotate
  mints fresh ephemeral-webhook-google-{rd5} with 14d expiration
- Claude #3 (optional): test_rotate_webhook_token now asserts the rotated
  Google token has an ephemeral-webhook-google-* label and a populated
  expiration

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fixup! fix(native-triggers): serialize Google channel renewal across replicas

fixup! fix(native-triggers): serialize Google channel renewal across replicas

Reconsider the previous fixup: stripping the 'ephemeral-' prefix made
created_by no longer match token.label exactly, defeating the linking
purpose. Just allowlist 'ephemeral-webhook-' alongside the other
recognized webhook/email/ws prefixes — created_by becomes
ephemeral-webhook-google-XXXXX, matching token.label exactly. The
'ephemeral-' substring also informs operators that this is a
system-managed auto-expiring token vs a user-managed webhook trigger.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...3d94c27fcbbf989a4a70678dbc54e0d896e24.json |  41 ++++
 ...fb888d53c5e4aa53bfc43ca296863bc61813f.json |  46 +++++
 ...a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json |  28 +++
 backend/windmill-api-auth/src/auth.rs         |   3 +-
 .../tests/token_hash.rs                       |  33 ++-
 .../src/google/external.rs                    | 190 +++++++++++++-----
 .../windmill-native-triggers/src/handler.rs   |  15 +-
 backend/windmill-native-triggers/src/lib.rs   |  57 ++++--
 8 files changed, 333 insertions(+), 80 deletions(-)
 create mode 100644 backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json
 create mode 100644 backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json
 create mode 100644 backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json

diff --git a/backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json b/backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json
new file mode 100644
index 0000000000..702e6e36bb
--- /dev/null
+++ b/backend/.sqlx/query-6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24.json
@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT service_config, webhook_token_hash\n        FROM native_trigger\n        WHERE workspace_id = $1\n          AND service_name = $2\n          AND external_id = $3\n        FOR UPDATE SKIP LOCKED\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "service_config",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "webhook_token_hash",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        {
+          "Custom": {
+            "name": "native_trigger_service",
+            "kind": {
+              "Enum": [
+                "nextcloud",
+                "google",
+                "github"
+              ]
+            }
+          }
+        },
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      false
+    ]
+  },
+  "hash": "6474dbc070afdce3e6bc74b02f93d94c27fcbbf989a4a70678dbc54e0d896e24"
+}
diff --git a/backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json b/backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json
new file mode 100644
index 0000000000..a1aa4cc015
--- /dev/null
+++ b/backend/.sqlx/query-676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f.json
@@ -0,0 +1,46 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, scopes, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "scopes",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 2,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "super_admin",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 4,
+        "name": "owner",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "676405f5ba49c1c711646bd0882fb888d53c5e4aa53bfc43ca296863bc61813f"
+}
diff --git a/backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json b/backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json
new file mode 100644
index 0000000000..3536567e16
--- /dev/null
+++ b/backend/.sqlx/query-b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT label, expiration FROM token WHERE token_hash = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "label",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "expiration",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true
+    ]
+  },
+  "hash": "b02d3563b72ee8989dea128a3c6a2be62ce1f8f7edf3793d7ad4af9eb11b648f"
+}
diff --git a/backend/windmill-api-auth/src/auth.rs b/backend/windmill-api-auth/src/auth.rs
index d4c448e934..ac4017b81c 100644
--- a/backend/windmill-api-auth/src/auth.rs
+++ b/backend/windmill-api-auth/src/auth.rs
@@ -715,7 +715,8 @@ pub async fn resolve_opt_job_authed(
 fn username_override_from_label(label: Option<String>) -> Option<String> {
     match label {
         Some(label)
-            if label.starts_with("webhook-")
+            if label.starts_with("ephemeral-webhook-")
+                || label.starts_with("webhook-")
                 || label.starts_with("http-")
                 || label.starts_with("email-")
                 || label.starts_with("ws-") =>
diff --git a/backend/windmill-api-integration-tests/tests/token_hash.rs b/backend/windmill-api-integration-tests/tests/token_hash.rs
index 6f4ba6b0ac..45d324a3d4 100644
--- a/backend/windmill-api-integration-tests/tests/token_hash.rs
+++ b/backend/windmill-api-integration-tests/tests/token_hash.rs
@@ -274,7 +274,9 @@ async fn test_plaintext_backward_compat(db: Pool<Postgres>) -> anyhow::Result<()
     );
 
     // --- Phase 2: All workers upgraded (version >= 1.650.0) ---
-    MIN_VERSION.store(std::sync::Arc::new(MIN_VERSION_SUPPORTS_TOKEN_HASH.version().clone()));
+    MIN_VERSION.store(std::sync::Arc::new(
+        MIN_VERSION_SUPPORTS_TOKEN_HASH.version().clone(),
+    ));
 
     let resp = authed(client().post(format!("{base}/tokens/create")))
         .json(&json!({"label": "new-worker-token"}))
@@ -324,7 +326,7 @@ async fn test_plaintext_backward_compat(db: Pool<Postgres>) -> anyhow::Result<()
 async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
 
-    use windmill_native_triggers::{delete_token_by_hash, rotate_webhook_token};
+    use windmill_native_triggers::{delete_token_by_hash, rotate_webhook_token, ServiceName};
 
     // Insert a token directly with known values
     let original_token = "test-webhook-token-original-1234";
@@ -342,7 +344,7 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     .await?;
 
     // Rotate the token
-    let rotated = rotate_webhook_token(&db, &original_hash)
+    let rotated = rotate_webhook_token(&db, &original_hash, ServiceName::Google)
         .await?
         .expect("rotate must return Some for existing token");
 
@@ -350,16 +352,27 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_ne!(rotated.new_token, original_token);
     assert_eq!(rotated.old_token_hash, original_hash);
 
-    // New token's hash should exist in DB
+    // New token's hash should exist in DB with the per-service label and expiration
     let new_hash = hash_token(&rotated.new_token);
-    let exists: bool = sqlx::query_scalar!(
-        "SELECT EXISTS(SELECT 1 FROM token WHERE token_hash = $1) AS exists",
+    let new_row = sqlx::query!(
+        "SELECT label, expiration FROM token WHERE token_hash = $1",
         new_hash
     )
-    .fetch_one(&db)
+    .fetch_optional(&db)
     .await?
-    .unwrap_or(false);
-    assert!(exists, "new token hash must exist in DB after rotation");
+    .expect("new token hash must exist in DB after rotation");
+    assert!(
+        new_row
+            .label
+            .as_deref()
+            .is_some_and(|l| l.starts_with("ephemeral-webhook-google-")),
+        "rotated token must carry an ephemeral-webhook-google-* label, got {:?}",
+        new_row.label
+    );
+    assert!(
+        new_row.expiration.is_some(),
+        "rotated Google token must carry an expiration"
+    );
 
     // Old token should still exist (deletion deferred to caller)
     let old_exists: bool = sqlx::query_scalar!(
@@ -389,7 +402,7 @@ async fn test_rotate_webhook_token(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert!(!old_gone, "old token must be gone after explicit deletion");
 
     // Rotating a non-existent hash should return None
-    let result = rotate_webhook_token(&db, "nonexistent_hash").await?;
+    let result = rotate_webhook_token(&db, "nonexistent_hash", ServiceName::Google).await?;
     assert!(
         result.is_none(),
         "rotating a non-existent token must return None"
diff --git a/backend/windmill-native-triggers/src/google/external.rs b/backend/windmill-native-triggers/src/google/external.rs
index 29dd1c943f..616f8d3f63 100644
--- a/backend/windmill-native-triggers/src/google/external.rs
+++ b/backend/windmill-native-triggers/src/google/external.rs
@@ -323,9 +323,10 @@ impl Google {
     }
 
     /// Renew an expiring Google watch channel.
-    /// Rotates the webhook token (creating a new one with the same label),
-    /// stops the old channel and creates a new one with a fresh channel ID
-    /// (Google rejects reused channel IDs with `channelIdNotUnique`).
+    /// Rotates the webhook token (mints a fresh `ephemeral-webhook-google-{rd5}` label
+    /// and a 14-day expiration via `rotate_webhook_token`), stops the old channel and
+    /// creates a new one with a fresh channel ID (Google rejects reused channel IDs
+    /// with `channelIdNotUnique`).
     /// Returns (new_service_config, new_plaintext_token, old_token_hash).
     /// Callers should delete old_token_hash after successfully updating the trigger.
     pub async fn renew_channel(
@@ -341,7 +342,13 @@ impl Google {
             .transpose()?
             .ok_or_else(|| Error::InternalErr("Missing service config".to_string()))?;
 
-        let rotated = match rotate_webhook_token(db, &trigger.webhook_token_hash).await? {
+        let rotated = match rotate_webhook_token(
+            db,
+            &trigger.webhook_token_hash,
+            ServiceName::Google,
+        )
+        .await?
+        {
             Some(r) => r,
             None => {
                 return Err(Error::InternalErr(format!(
@@ -464,6 +471,115 @@ pub fn should_renew_channel(service_config: &serde_json::Value) -> bool {
     remaining_ms < renewal_window_ms
 }
 
+enum RenewOutcome {
+    Renewed,
+    /// Another replica holds the lock, or the row was already renewed.
+    Skipped,
+}
+
+/// Renew one Google watch channel under a row lock.
+/// `sync_all_triggers` runs on every replica with no leader election — without
+/// the lock, parallel renewals orphan the losers' new tokens and Google channels.
+async fn try_renew_channel_locked(
+    handler: &Google,
+    db: &DB,
+    workspace_id: &str,
+    trigger: &NativeTrigger,
+) -> Result<RenewOutcome> {
+    let mut tx = db.begin().await?;
+
+    let row = sqlx::query!(
+        r#"
+        SELECT service_config, webhook_token_hash
+        FROM native_trigger
+        WHERE workspace_id = $1
+          AND service_name = $2
+          AND external_id = $3
+        FOR UPDATE SKIP LOCKED
+        "#,
+        workspace_id,
+        ServiceName::Google as ServiceName,
+        trigger.external_id,
+    )
+    .fetch_optional(&mut *tx)
+    .await?;
+
+    let Some(row) = row else {
+        return Ok(RenewOutcome::Skipped);
+    };
+
+    let Some(service_config) = row.service_config else {
+        // Anomalous: a Google trigger row should always carry a service_config.
+        tracing::warn!(
+            "Google trigger '{}' has NULL service_config — skipping renewal",
+            trigger.external_id
+        );
+        return Ok(RenewOutcome::Skipped);
+    };
+
+    // Re-check after the lock — a contending replica may have just renewed.
+    if !should_renew_channel(&service_config) {
+        return Ok(RenewOutcome::Skipped);
+    }
+
+    // Use freshly-read fields — webhook_token_hash may have rotated since list time.
+    let fresh_trigger = NativeTrigger {
+        service_config: Some(service_config),
+        webhook_token_hash: row.webhook_token_hash,
+        ..trigger.clone()
+    };
+
+    let (new_config, new_token, old_token_hash) = handler
+        .renew_channel(workspace_id, &fresh_trigger, db)
+        .await?;
+
+    // Past this point a new Google channel exists. Any failure leaks it.
+    if let Err(e) = update_native_trigger_service_config(
+        &mut *tx,
+        workspace_id,
+        ServiceName::Google,
+        &trigger.external_id,
+        &new_config,
+        Some(&new_token),
+    )
+    .await
+    {
+        tracing::error!(
+            "DB update failed after creating new Google channel for '{}' — channel orphaned in Google: {}",
+            trigger.external_id,
+            e
+        );
+        return Err(e);
+    }
+
+    if let Err(e) = tx.commit().await {
+        tracing::error!(
+            "Commit failed after creating new Google channel for '{}' — channel orphaned in Google: {}",
+            trigger.external_id,
+            e
+        );
+        return Err(e.into());
+    }
+
+    // With the lock + rotation in place, the old token row must exist here.
+    // Ok(false) means a concurrent path deleted it (or the expiry sweep collected it).
+    match crate::delete_token_by_hash(db, &old_token_hash).await {
+        Ok(true) => {}
+        Ok(false) => tracing::warn!(
+            "Old webhook token already gone after renewal for '{}' (hash {})",
+            trigger.external_id,
+            old_token_hash
+        ),
+        Err(e) => tracing::warn!(
+            "Failed to delete old webhook token after channel renewal for '{}': {}",
+            trigger.external_id,
+            e
+        ),
+    }
+
+    Ok(RenewOutcome::Renewed)
+}
+
 async fn renew_expiring_channels(
     handler: &Google,
     db: &DB,
@@ -488,53 +604,25 @@ async fn renew_expiring_channels(
             workspace_id
         );
 
-        match handler.renew_channel(workspace_id, trigger, db).await {
-            Ok((new_config, new_token, old_token_hash)) => {
-                match update_native_trigger_service_config(
-                    db,
-                    workspace_id,
-                    ServiceName::Google,
-                    &trigger.external_id,
-                    &new_config,
-                    Some(&new_token),
-                )
-                .await
-                {
-                    Ok(()) => {
-                        // Trigger updated — clean up old token (best-effort)
-                        if let Err(e) = crate::delete_token_by_hash(db, &old_token_hash).await {
-                            tracing::warn!(
-                                "Failed to delete old webhook token after channel renewal for {}: {}",
-                                trigger.external_id, e
-                            );
-                        }
-                        tracing::info!(
-                            "Renewed Google channel {} for '{}'",
-                            trigger.external_id,
-                            trigger.script_path
-                        );
-                        synced.push(TriggerSyncInfo {
-                            external_id: trigger.external_id.clone(),
-                            script_path: trigger.script_path.clone(),
-                            action: SyncAction::ConfigUpdated,
-                        });
-                    }
-                    Err(e) => {
-                        tracing::error!(
-                            "Failed to update DB after renewing Google channel {}: {}",
-                            trigger.external_id,
-                            e
-                        );
-                        errors.push(SyncError {
-                            resource_path: format!("workspace:{}", workspace_id),
-                            error_message: format!(
-                                "Failed to update DB after channel renewal for {}: {}",
-                                trigger.external_id, e
-                            ),
-                            error_type: "channel_renewal_error".to_string(),
-                        });
-                    }
-                }
+        match try_renew_channel_locked(handler, db, workspace_id, trigger).await {
+            Ok(RenewOutcome::Renewed) => {
+                tracing::info!(
+                    "Renewed Google channel {} for '{}'",
+                    trigger.external_id,
+                    trigger.script_path
+                );
+                synced.push(TriggerSyncInfo {
+                    external_id: trigger.external_id.clone(),
+                    script_path: trigger.script_path.clone(),
+                    action: SyncAction::ConfigUpdated,
+                });
+            }
+            Ok(RenewOutcome::Skipped) => {
+                // Expected outcome under SKIP LOCKED: contending replica or already-renewed row.
+                tracing::debug!(
+                    "Skipped Google channel renewal for '{}': another replica is renewing or the row was already renewed",
+                    trigger.external_id
+                );
             }
             Err(e) => {
                 tracing::error!(
diff --git a/backend/windmill-native-triggers/src/handler.rs b/backend/windmill-native-triggers/src/handler.rs
index 91a8b9531e..1b6aa83b92 100644
--- a/backend/windmill-native-triggers/src/handler.rs
+++ b/backend/windmill-native-triggers/src/handler.rs
@@ -1,7 +1,8 @@
 use crate::{
     decrypt_oauth_data, delete_native_trigger, delete_token_by_hash, get_native_trigger,
     list_native_triggers, rotate_webhook_token, store_native_trigger, update_native_trigger_error,
-    External, NativeTrigger, NativeTriggerConfig, NativeTriggerData, ServiceName,
+    webhook_token_label, External, NativeTrigger, NativeTriggerConfig, NativeTriggerData,
+    ServiceName,
 };
 use axum::{
     extract::{Path, Query},
@@ -18,7 +19,6 @@ use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::{
     db::UserDB,
     error::{Error, JsonResult, Result},
-    utils::rd_string,
     DB,
 };
 
@@ -84,10 +84,13 @@ async fn new_webhook_token(
     let kind = if is_flow { "flows" } else { "scripts" };
 
     let scopes = vec![format!("jobs:run:{kind}:{script_path}")];
-    let label = format!("webhook-{}-{}", service_name.as_str(), rd_string(5));
+    let label = webhook_token_label(service_name);
+    let expiration = service_name
+        .webhook_token_expiration()
+        .map(|d| chrono::Utc::now() + d);
     let token_config = NewToken::new(
         Some(label),
-        None,
+        expiration,
         None,
         Some(scopes),
         Some(workspace_id.to_owned()),
@@ -255,8 +258,8 @@ async fn update_native_trigger_handler<T: External>(
         tx = user_db.begin(&authed).await?;
         token
     } else {
-        // Same runnable — rotate the token keeping the same label
-        match rotate_webhook_token(&db, &existing.webhook_token_hash).await? {
+        // Same runnable — rotate the token (mints a fresh label + expiration)
+        match rotate_webhook_token(&db, &existing.webhook_token_hash, service_name).await? {
             Some(rotated) => {
                 old_token_hash_to_delete = Some(rotated.old_token_hash);
                 rotated.new_token
diff --git a/backend/windmill-native-triggers/src/lib.rs b/backend/windmill-native-triggers/src/lib.rs
index c871159b0f..743b9f8210 100644
--- a/backend/windmill-native-triggers/src/lib.rs
+++ b/backend/windmill-native-triggers/src/lib.rs
@@ -180,6 +180,17 @@ impl ServiceName {
     pub fn integration_service(&self) -> ServiceName {
         *self
     }
+
+    /// How long webhook tokens for this service should remain valid. `None` = no expiry.
+    /// Google channels turn over on a tight schedule (24h Drive, 7d Calendar) — a finite
+    /// TTL lets `delete_expired_items` (`monitor.rs`) sweep orphaned tokens automatically.
+    /// Persistent-webhook services (Nextcloud, GitHub) return `None`.
+    pub fn webhook_token_expiration(&self) -> Option<chrono::Duration> {
+        match self {
+            ServiceName::Google => Some(chrono::Duration::days(14)),
+            ServiceName::Nextcloud | ServiceName::Github => None,
+        }
+    }
 }
 
 impl std::fmt::Display for ServiceName {
@@ -759,22 +770,23 @@ async fn update_oauth_token_resource(
     }
 }
 
-/// Create a new webhook token that keeps the same label as the old one.
-/// The old token is **not** deleted — callers must call `delete_token_by_hash`
-/// on `old_token_hash` after the trigger row has been successfully updated.
-/// This ensures the trigger keeps working if the external service call or
-/// subsequent DB update fails.
+/// Create a new webhook token, minting a fresh `ephemeral-webhook-{service}-{rd5}`
+/// label and the per-service expiration (see `ServiceName::webhook_token_expiration`).
+/// The old token is **not** deleted — callers must call `delete_token_by_hash` on
+/// `old_token_hash` after the trigger row has been successfully updated.
 ///
 /// Returns `Ok(None)` if the old token no longer exists (e.g. manually deleted by user).
-/// In that case, `renew_channel` returns an error which `renew_expiring_channels` writes
-/// to the trigger's `error` column — visible in the UI so the user can re-create the trigger.
-pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Option<RotatedToken>> {
+pub async fn rotate_webhook_token(
+    db: &DB,
+    old_token_hash: &str,
+    service_name: ServiceName,
+) -> Result<Option<RotatedToken>> {
     use windmill_common::auth::{hash_token, TOKEN_PREFIX_LEN};
     use windmill_common::min_version::MIN_VERSION_SUPPORTS_TOKEN_HASH;
     use windmill_common::utils::rd_string;
 
     let old = match sqlx::query!(
-        "SELECT label, email, scopes, workspace_id, super_admin, owner, expiration FROM token WHERE token_hash = $1",
+        "SELECT email, scopes, workspace_id, super_admin, owner FROM token WHERE token_hash = $1",
         old_token_hash
     )
     .fetch_optional(db)
@@ -799,6 +811,11 @@ pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Optio
         Some(&new_token)
     };
 
+    let new_label = webhook_token_label(service_name);
+    let new_expiration = service_name
+        .webhook_token_expiration()
+        .map(|d| Utc::now() + d);
+
     sqlx::query!(
         "INSERT INTO token (token_hash, token_prefix, token, email, label, super_admin, scopes, workspace_id, owner, expiration)
          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)",
@@ -806,12 +823,12 @@ pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Optio
         new_prefix,
         plaintext as Option<&str>,
         old.email,
-        old.label,
+        new_label,
         old.super_admin,
         old.scopes.as_deref(),
         old.workspace_id,
         old.owner,
-        old.expiration,
+        new_expiration,
     )
     .execute(db)
     .await?;
@@ -822,6 +839,19 @@ pub async fn rotate_webhook_token(db: &DB, old_token_hash: &str) -> Result<Optio
     }))
 }
 
+/// Mint the standard label used for native-trigger webhook tokens.
+/// The `ephemeral-` prefix opts the token out of the user-token email/critical-alert
+/// notification paths (`is_user_token` in `monitor.rs`, `register_token_expiry_notification`
+/// in `windmill-api-auth/src/lib.rs`, `isUserToken` in the frontend).
+pub fn webhook_token_label(service_name: ServiceName) -> String {
+    use windmill_common::utils::rd_string;
+    format!(
+        "ephemeral-webhook-{}-{}",
+        service_name.as_str(),
+        rd_string(5)
+    )
+}
+
 pub struct RotatedToken {
     pub new_token: String,
     /// Hash of the old token — callers should delete this after the
@@ -829,7 +859,10 @@ pub struct RotatedToken {
     pub old_token_hash: String,
 }
 
-/// Delete a token from the token table using its hash (exact match).
+/// Delete a token by hash. Returns `Ok(false)` when no row matched.
+/// Some call sites legitimately race against expiry sweeps or concurrent deletes;
+/// callers that consider 0-rows anomalous should log themselves at the appropriate
+/// level rather than have this helper warn unconditionally.
 pub async fn delete_token_by_hash<'c, E: sqlx::Executor<'c, Database = Postgres>>(
     db: E,
     token_hash: &str,

From 4b4aa0e303f9c47c4f931511977107f42f93abc3 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 8 May 2026 17:57:04 +0200
Subject: [PATCH 09/50] fix(cli): bump svelte version in `wmill app new`
 template (#9084)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(cli): bump svelte version in `wmill app new` template

The svelte5 template pinned `svelte` to `5.45.2`, but the Svelte
compiler bundled in `wmill app dev` emits `$.delegated('click', ...)`
calls. The `delegated` export was added later, so 5.45.2 doesn't have
it — esbuild warns `Import "delegated" will always be undefined`,
replaces the call with `void 0`, and the page crashes at first
event-handler bind (white screen).

Bump to `^5.55.5` so the compiler and runtime stay in sync.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(frontend): bump svelte version in raw_apps UI template

Mirror the CLI fix: the UI's `Add raw app` flow scaffolds a
package.json with `svelte: "5.45.2"`. That works today only because
the bundled rolldown worker also pins 5.45.2 — when the worker is
upgraded past 5.51.1, the compiler will emit `$.delegated()` and the
runtime won't have it, producing the same white-page crash that hit
the CLI.

5.55.5 still exports `event` (used by the current bundled compiler),
so this is forward-compatible: it works with the 5.45.2 compiler now
and won't break when the worker is upgraded.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/app/new.ts                                   | 2 +-
 frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cli/src/commands/app/new.ts b/cli/src/commands/app/new.ts
index 2072c0312c..87d40f161b 100644
--- a/cli/src/commands/app/new.ts
+++ b/cli/src/commands/app/new.ts
@@ -168,7 +168,7 @@ const templates: Record<string, FrameworkTemplate> = {
       "/index.css": indexCss,
       "/package.json": `{
     "dependencies": {
-        "svelte": "5.45.2",
+        "svelte": "^5.55.5",
         "windmill-client": "^1"
     }
 }`,
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts b/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
index 71225f9ce1..eaac0f108f 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
@@ -136,7 +136,7 @@ export const svelte5Template = {
 	'/index.css': indexCss,
 	'/package.json': `{
     "dependencies": {
-        "svelte": "5.45.2",
+        "svelte": "^5.55.5",
         "windmill-client": "^1"
     }
 }`

From 23af6c2ea31265a1898d0632e72cd2fd826e4044 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 8 May 2026 17:57:17 +0200
Subject: [PATCH 10/50] perf(flows): gate flow_env resolve on expr text and
 share cache with handle_flow (#9085)

---
 backend/windmill-worker/src/worker_flow.rs | 59 +++++++++++++++++-----
 1 file changed, 45 insertions(+), 14 deletions(-)

diff --git a/backend/windmill-worker/src/worker_flow.rs b/backend/windmill-worker/src/worker_flow.rs
index 91c6cf9ec7..53c94a7458 100644
--- a/backend/windmill-worker/src/worker_flow.rs
+++ b/backend/windmill-worker/src/worker_flow.rs
@@ -494,19 +494,34 @@ pub async fn update_flow_status_after_job_completion_internal(
         }
 
         // Resolve flow_env for predicate evaluations (stop_after_if,
-        // stop_after_all_iters_if, retry_if). Only fetch when one of these
-        // predicates is configured to avoid an extra DB query on the common
-        // path. `retry` without `retry_if` doesn't consult flow_env.
-        let retry_uses_flow_env =
-            |module: &FlowModule| module.retry.as_ref().is_some_and(|r| r.retry_if.is_some());
+        // stop_after_all_iters_if, retry_if). Two-level gate:
+        //   1. Structural — at least one such predicate is configured.
+        //   2. Textual — the predicate expression actually references
+        //      `flow_env`. Mirrors the existing `expr.contains("results.")`
+        //      check in `get_id_ctx_for_expr`. A substring match has false
+        //      positives (harmless — just runs an unneeded resolve) but no
+        //      false negatives, since `flow_env` must appear textually for the
+        //      expression engine to read it.
+        let expr_uses_flow_env = |expr: &str| expr.contains("flow_env");
+        let retry_if_uses_flow_env = |module: &FlowModule| {
+            module
+                .retry
+                .as_ref()
+                .and_then(|r| r.retry_if.as_ref())
+                .is_some_and(|r| expr_uses_flow_env(&r.expr))
+        };
         let needs_flow_env = current_module.is_some_and(|m| {
-            m.stop_after_if.is_some()
-                || m.stop_after_all_iters_if.is_some()
-                || retry_uses_flow_env(m)
+            m.stop_after_if
+                .as_ref()
+                .is_some_and(|s| expr_uses_flow_env(&s.expr))
+                || m.stop_after_all_iters_if
+                    .as_ref()
+                    .is_some_and(|s| expr_uses_flow_env(&s.expr))
+                || retry_if_uses_flow_env(m)
         }) || flow_value
             .failure_module
             .as_ref()
-            .is_some_and(|fm| retry_uses_flow_env(fm));
+            .is_some_and(|fm| retry_if_uses_flow_env(fm));
         // The resolved env is constant for a flow's lifetime, so cache it by flow
         // job id and reuse across child-step completions. Cache miss falls back to
         // the existing resolve+persist path; same-worker subsequent completions are
@@ -2729,8 +2744,11 @@ pub async fn handle_flow(
     // Resolve $var: and $res: references in flow_env.
     // We resolve into a separate variable to avoid cloning the entire FlowValue
     // (which includes modules, failure_module, etc.) just to replace flow_env.
+    // `is_cacheable` is `false` only on a transient `transform_json` failure,
+    // matching `resolve_flow_env_for_status_update`'s contract — we must not
+    // freeze a partial resolution into the cache.
     let resolved_env;
-    let flow_env = if let Some(env) = env_source {
+    let (flow_env, is_cacheable) = if let Some(env) = env_source {
         match transform_json(
             client,
             &flow_job.workspace_id,
@@ -2742,18 +2760,31 @@ pub async fn handle_flow(
         {
             Ok(Some(resolved)) => {
                 resolved_env = resolved;
-                Some(&resolved_env)
+                (Some(&resolved_env), true)
             }
-            Ok(None) => Some(env),
+            Ok(None) => (Some(env), true),
             Err(e) => {
                 tracing::warn!("Failed to resolve flow_env references: {e}");
-                Some(env)
+                (Some(env), false)
             }
         }
     } else {
-        None
+        (None, true)
     };
 
+    // Populate the per-flow resolved-env cache so subsequent predicate
+    // evaluations in `update_flow_status_after_job_completion_internal` skip
+    // the recursive CTE + transform_json. Costs one HashMap clone per
+    // sub-flow handle_flow entry; saves up to one CTE + one transform_json
+    // per flow execution that has predicates referencing flow_env.
+    if is_cacheable {
+        if let Some(env) = flow_env {
+            if !env.is_empty() {
+                RESOLVED_FLOW_ENV_CACHE.insert(flow_job.id, Arc::new(env.clone()));
+            }
+        }
+    }
+
     let status = flow_job
         .parse_flow_status()
         .with_context(|| "Unable to parse flow status")?;

From dd5320205f200dd058db2ff7d44d5c4bbcf25ec9 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 8 May 2026 17:57:34 +0200
Subject: [PATCH 11/50] feat: parse windmill_failure field to tag run as
 failure (#9073)

* feat: parse windmill_failure field in job result to tag run as failure

* feat: preserve top-level fields when windmill_failure tags a run as failure

* fix: address review findings on windmill_manual_failure

* refactor: rename windmill_manual_failure to wm_failure and add wm_* aliases

* fix: prefer injected ManualFailure error over sibling name/message in OTel
---
 backend/windmill-api-jobs/src/execution.rs    |   3 +
 backend/windmill-queue/src/jobs.rs            | 156 +++++++++++++++---
 .../windmill-worker/src/result_processor.rs   | 135 ++++++++++++---
 3 files changed, 249 insertions(+), 45 deletions(-)

diff --git a/backend/windmill-api-jobs/src/execution.rs b/backend/windmill-api-jobs/src/execution.rs
index 555d7a4d8b..e4359e19da 100644
--- a/backend/windmill-api-jobs/src/execution.rs
+++ b/backend/windmill-api-jobs/src/execution.rs
@@ -248,8 +248,11 @@ lazy_static::lazy_static! {
 
 #[derive(Deserialize)]
 pub struct WindmillCompositeResult {
+    #[serde(alias = "wm_status_code")]
     windmill_status_code: Option<u16>,
+    #[serde(alias = "wm_content_type")]
     windmill_content_type: Option<String>,
+    #[serde(alias = "wm_headers")]
     windmill_headers: Option<HashMap<String, String>>,
     result: Option<Box<RawValue>>,
 }
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 897f8e2ce0..52e6b09c6f 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -630,12 +630,45 @@ pub struct WrappedError {
 pub trait ValidableJson {
     fn is_valid_json(&self) -> bool;
     fn wm_labels(&self) -> Option<Vec<String>>;
+    fn wm_failure(&self) -> Option<String>;
+    fn result_metadata(&self) -> ResultMetadata;
     fn size(&self) -> usize;
 }
 
-#[derive(serde::Deserialize)]
-struct ResultLabels {
-    wm_labels: Vec<String>,
+/// The Windmill-specific markers we look for inside a job's result.
+/// `wm_failure` retags a successful run as a failure with the
+/// given message; `wm_labels` adds runtime labels to the job row.
+#[derive(serde::Deserialize, Default, Debug, Clone)]
+pub struct ResultMetadata {
+    pub wm_labels: Option<Vec<String>>,
+    pub wm_failure: Option<String>,
+}
+
+/// Sentinel `error.name` we inject into a result when retagging a successful
+/// run as a failure due to `wm_failure`. Used downstream to detect that
+/// the result is already in the standard `{ error: { name, message }, ... }`
+/// shape and must not be wrapped a second time by `WrappedError`.
+pub const MANUAL_FAILURE_ERROR_NAME: &str = "ManualFailure";
+
+/// Returns true when the result already carries our injected
+/// `error: { name: "ManualFailure", ... }` marker — i.e. it was shaped by
+/// `process_jc`'s wm_failure path. A real runtime failure whose raw
+/// result happens to contain a `wm_failure` field but no such error
+/// key returns false (and so still goes through the standard wrap path).
+pub fn is_pre_shaped_wm_failure_result(result: &str) -> bool {
+    #[derive(serde::Deserialize)]
+    struct Marker {
+        error: Option<NameOnly>,
+    }
+    #[derive(serde::Deserialize)]
+    struct NameOnly {
+        name: String,
+    }
+    serde_json::from_str::<Marker>(result)
+        .ok()
+        .and_then(|m| m.error)
+        .map(|e| e.name == MANUAL_FAILURE_ERROR_NAME)
+        .unwrap_or(false)
 }
 
 impl ValidableJson for WrappedError {
@@ -647,6 +680,14 @@ impl ValidableJson for WrappedError {
         None
     }
 
+    fn wm_failure(&self) -> Option<String> {
+        None
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        ResultMetadata::default()
+    }
+
     fn size(&self) -> usize {
         0
     }
@@ -658,9 +699,15 @@ impl ValidableJson for Box<RawValue> {
     }
 
     fn wm_labels(&self) -> Option<Vec<String>> {
-        serde_json::from_str::<ResultLabels>(self.get())
-            .ok()
-            .map(|r| r.wm_labels)
+        self.result_metadata().wm_labels
+    }
+
+    fn wm_failure(&self) -> Option<String> {
+        self.result_metadata().wm_failure
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        serde_json::from_str::<ResultMetadata>(self.get()).unwrap_or_default()
     }
 
     fn size(&self) -> usize {
@@ -677,6 +724,14 @@ impl<T: ValidableJson> ValidableJson for Arc<T> {
         T::wm_labels(&self)
     }
 
+    fn wm_failure(&self) -> Option<String> {
+        T::wm_failure(&self)
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        T::result_metadata(&self)
+    }
+
     fn size(&self) -> usize {
         T::size(&self)
     }
@@ -688,9 +743,15 @@ impl ValidableJson for serde_json::Value {
     }
 
     fn wm_labels(&self) -> Option<Vec<String>> {
-        serde_json::from_value::<ResultLabels>(self.clone())
-            .ok()
-            .map(|r| r.wm_labels)
+        self.result_metadata().wm_labels
+    }
+
+    fn wm_failure(&self) -> Option<String> {
+        self.result_metadata().wm_failure
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        serde_json::from_value::<ResultMetadata>(self.clone()).unwrap_or_default()
     }
 
     fn size(&self) -> usize {
@@ -707,6 +768,14 @@ impl<T: ValidableJson> ValidableJson for Json<T> {
         self.0.wm_labels()
     }
 
+    fn wm_failure(&self) -> Option<String> {
+        self.0.wm_failure()
+    }
+
+    fn result_metadata(&self) -> ResultMetadata {
+        self.0.result_metadata()
+    }
+
     fn size(&self) -> usize {
         self.0.size()
     }
@@ -742,16 +811,7 @@ where
     }
 }
 
-pub async fn add_completed_job_error(
-    db: &Pool<Postgres>,
-    completed_job: &MiniCompletedJob,
-    mem_peak: i32,
-    canceled_by: Option<CanceledBy>,
-    e: serde_json::Value,
-    _worker_name: &str,
-    flow_is_done: bool,
-    duration: Option<i64>,
-) -> Result<WrappedError, Error> {
+async fn record_failure_metrics(completed_job: &MiniCompletedJob, _worker_name: &str) {
     #[cfg(feature = "prometheus")]
     register_metric(
         &WORKER_EXECUTION_FAILED,
@@ -772,6 +832,64 @@ pub async fn add_completed_job_error(
     .await;
 
     otel_incr_worker_execution_failed(&completed_job.tag);
+}
+
+/// Tag a completed job as a failure while storing the result as-is, without
+/// the standard `WrappedError` `{ error: ... }` wrap. Use for jobs whose result
+/// is already shaped (e.g. when `wm_failure` injected a top-level
+/// `error` key, while preserving sibling fields like `windmill_status_code`).
+///
+/// This is a worker-internal helper called by trusted result-processing code
+/// after the worker has authenticated and pulled the job. Callers MUST verify
+/// upstream auth (i.e. the job was legitimately pulled by this worker) — this
+/// function performs no authorization check itself, mirroring the contract of
+/// `add_completed_job_error`.
+pub async fn add_completed_job_pre_shaped_failure<T: Serialize + Send + Sync + ValidableJson>(
+    db: &Pool<Postgres>,
+    completed_job: &MiniCompletedJob,
+    mem_peak: i32,
+    canceled_by: Option<CanceledBy>,
+    result: Json<&T>,
+    worker_name: &str,
+    flow_is_done: bool,
+    duration: Option<i64>,
+) -> Result<(), Error> {
+    record_failure_metrics(completed_job, worker_name).await;
+
+    tracing::error!(
+        "job {} in {} did not succeed (wm_failure)",
+        completed_job.id,
+        completed_job.workspace_id,
+    );
+    let _ = add_completed_job(
+        db,
+        completed_job,
+        false,
+        false,
+        result,
+        None,
+        mem_peak,
+        canceled_by,
+        flow_is_done,
+        duration,
+        false,
+    )
+    .warn_after_seconds(10)
+    .await?;
+    Ok(())
+}
+
+pub async fn add_completed_job_error(
+    db: &Pool<Postgres>,
+    completed_job: &MiniCompletedJob,
+    mem_peak: i32,
+    canceled_by: Option<CanceledBy>,
+    e: serde_json::Value,
+    worker_name: &str,
+    flow_is_done: bool,
+    duration: Option<i64>,
+) -> Result<WrappedError, Error> {
+    record_failure_metrics(completed_job, worker_name).await;
 
     let result = WrappedError { error: e };
     tracing::error!(
diff --git a/backend/windmill-worker/src/result_processor.rs b/backend/windmill-worker/src/result_processor.rs
index 1f771f6879..9eac0a5dcd 100644
--- a/backend/windmill-worker/src/result_processor.rs
+++ b/backend/windmill-worker/src/result_processor.rs
@@ -35,8 +35,9 @@ use windmill_common::{
 use windmill_common::bench::{BenchmarkInfo, BenchmarkIter};
 
 use windmill_queue::{
-    append_logs, get_mini_completed_job, CanceledBy, FlowRunners, JobCompleted, MiniCompletedJob,
-    MiniPulledJob, ValidableJson, WrappedError, INIT_SCRIPT_TAG,
+    append_logs, get_mini_completed_job, is_pre_shaped_wm_failure_result, CanceledBy, FlowRunners,
+    JobCompleted, MiniCompletedJob, MiniPulledJob, ValidableJson, WrappedError, INIT_SCRIPT_TAG,
+    MANUAL_FAILURE_ERROR_NAME,
 };
 
 use serde_json::{json, value::RawValue, Value};
@@ -61,8 +62,37 @@ struct ErrorMessage {
     name: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct NestedErrorMessage {
+    error: ErrorMessage,
+}
+
+/// Extract `{ name, message }` from a result. Accepts both the standard
+/// top-level shape (regular runtime errors) and the nested `{ error: { name,
+/// message }, ... }` shape produced by the wm_failure injection.
+///
+/// For wm_failure-injected results, we prefer the nested error: a successful
+/// run may legitimately contain top-level `name`/`message` fields (user data
+/// named `name`/`message`), and we want OTel to record the ManualFailure
+/// rather than the user's sibling fields.
+fn extract_error_message(raw: &str) -> Option<ErrorMessage> {
+    let nested = serde_json::from_str::<NestedErrorMessage>(raw)
+        .ok()
+        .map(|n| n.error);
+    if matches!(&nested, Some(em) if em.name == MANUAL_FAILURE_ERROR_NAME) {
+        return nested;
+    }
+    if let Ok(em) = serde_json::from_str::<ErrorMessage>(raw) {
+        return Some(em);
+    }
+    nested
+}
+
+/// Returns the post-processing `success` value (after any `wm_failure`
+/// override). Callers use this to make worker-loop decisions that depend on
+/// whether the job ultimately succeeded — e.g. the init-script killpill.
 async fn process_jc(
-    jc: JobCompleted,
+    mut jc: JobCompleted,
     worker_name: &str,
     base_internal_url: &str,
     db: &DB,
@@ -73,7 +103,32 @@ async fn process_jc(
     killpill_rx: &tokio::sync::broadcast::Receiver<()>,
     #[cfg(feature = "benchmark")] bench: &mut BenchmarkIter,
     #[cfg(feature = "benchmark")] bench_infos: &mut BenchmarkInfo,
-) {
+) -> bool {
+    // Parse `wm_labels` and `wm_failure` together (single `from_str`)
+    // so we don't deserialize the whole result twice on every job.
+    let metadata = jc.result.result_metadata();
+
+    // If the script returned a `wm_failure: <string>` field in its
+    // result, tag the run as a failure. Inject an `error: { name, message }`
+    // at the top level so error handlers / UI / OTel see the standard error
+    // shape, while preserving sibling fields (`windmill_status_code`,
+    // `windmill_content_type`, `windmill_headers`, the user's data) at the
+    // top level so sync webhook responses still honor them.
+    if jc.success {
+        if let Some(failure_msg) = metadata.wm_failure.as_ref() {
+            if let Ok(Value::Object(mut map)) = serde_json::from_str::<Value>(jc.result.get()) {
+                map.insert(
+                    "error".to_string(),
+                    json!({ "name": MANUAL_FAILURE_ERROR_NAME, "message": failure_msg }),
+                );
+                if let Ok(raw) = serde_json::value::to_raw_value(&Value::Object(map)) {
+                    jc.result = Arc::new(raw);
+                }
+            }
+            jc.success = false;
+        }
+    }
+
     let success: bool = jc.success;
 
     let span = if success {
@@ -125,7 +180,7 @@ async fn process_jc(
         jc.job.id
     };
 
-    if let Some(labels) = jc.result.wm_labels() {
+    if let Some(labels) = metadata.wm_labels.as_ref() {
         if !labels.is_empty() {
             span.record("labels", labels.join(","));
         }
@@ -163,7 +218,7 @@ async fn process_jc(
         span.record("script_hash", script_hash.to_string().as_str());
     }
     if !success {
-        if let Ok(result_error) = serde_json::from_str::<ErrorMessage>(jc.result.get()) {
+        if let Some(result_error) = extract_error_message(jc.result.get()) {
             span.record("error.message", result_error.message.as_str());
             span.record("error.name", result_error.name.as_str());
             span.record(
@@ -218,6 +273,8 @@ async fn process_jc(
         )
         .await;
     }
+
+    success
 }
 
 enum JobCompletedRx {
@@ -311,8 +368,7 @@ pub fn start_background_processor(
                     result: SendResultPayload::JobCompleted(jc),
                     time,
                 }) => {
-                    let is_init_script_and_failure =
-                        !jc.success && jc.job.tag.as_str() == INIT_SCRIPT_TAG;
+                    let is_init_script = jc.job.tag.as_str() == INIT_SCRIPT_TAG;
                     let is_dependency_job = matches!(
                         jc.job.kind,
                         JobKind::Dependencies | JobKind::FlowDependencies
@@ -322,7 +378,10 @@ pub fn start_background_processor(
                     #[cfg(feature = "benchmark")]
                     let is_top_level_job = jc.job.parent_job.is_none();
 
-                    process_jc(
+                    // process_jc returns the post-override success value so a
+                    // job that flipped to failure via `wm_failure` still
+                    // triggers the init-script killpill.
+                    let final_success = process_jc(
                         jc,
                         &worker_name,
                         &base_internal_url,
@@ -340,7 +399,7 @@ pub fn start_background_processor(
                     .warn_after_seconds(10)
                     .await;
 
-                    if is_init_script_and_failure {
+                    if is_init_script && !final_success {
                         tracing::error!("init script errored, exiting");
                         killpill_tx.send();
                         break;
@@ -793,19 +852,44 @@ pub async fn process_completed_job(
             }
         }
     } else {
-        let result = add_completed_job_error(
-            db,
-            &job,
-            mem_peak.to_owned(),
-            canceled_by.clone(),
-            serde_json::from_str(result.get()).unwrap_or_else(
-                |_| json!({ "message": format!("Non serializable error: {}", result.get()) }),
-            ),
-            worker_name,
-            false,
-            None,
-        )
-        .await?;
+        // The result already carries our injected
+        // `error: { name: "ManualFailure", ... }` marker when process_jc
+        // retagged a successful run as a failure — store it as-is to preserve
+        // sibling fields like `windmill_status_code`. We check for the
+        // injected marker specifically (not just the presence of a
+        // `wm_failure` field) so a real runtime failure whose raw
+        // result happens to contain a `wm_failure` field still goes
+        // through the standard `WrappedError { error: ... }` wrap path.
+        let downstream_result: Arc<Box<RawValue>> = if is_pre_shaped_wm_failure_result(result.get())
+        {
+            windmill_queue::add_completed_job_pre_shaped_failure(
+                db,
+                &job,
+                mem_peak.to_owned(),
+                canceled_by.clone(),
+                Json(&*result),
+                worker_name,
+                false,
+                None,
+            )
+            .await?;
+            result.clone()
+        } else {
+            let wrapped = add_completed_job_error(
+                db,
+                &job,
+                mem_peak.to_owned(),
+                canceled_by.clone(),
+                serde_json::from_str(result.get()).unwrap_or_else(
+                    |_| json!({ "message": format!("Non serializable error: {}", result.get()) }),
+                ),
+                worker_name,
+                false,
+                None,
+            )
+            .await?;
+            Arc::new(serde_json::value::to_raw_value(&wrapped).unwrap())
+        };
         if job.is_flow_step() {
             if let Some(parent_job) = job.parent_job {
                 tracing::error!(parent_flow = %parent_job, subflow = %job.id, "process completed job error, updating flow status");
@@ -817,7 +901,7 @@ pub async fn process_completed_job(
                     &job.workspace_id,
                     false,
                     canceled_by,
-                    Arc::new(serde_json::value::to_raw_value(&result).unwrap()),
+                    downstream_result,
                     duration.and_then(|d| {
                         job.started_at.map(|started_at| FlowJobDuration {
                             started_at: started_at,
@@ -855,13 +939,12 @@ pub async fn process_completed_job(
             .fetch_optional(db)
             .await?;
             if let Some(Some(job_ids)) = job_ids_json {
-                let err_result = Arc::new(serde_json::value::to_raw_value(&result).unwrap());
                 if let Ok(Some(_)) = handle_wac_child_completion(
                     db,
                     &job.id,
                     parent_job,
                     &job.workspace_id,
-                    err_result,
+                    downstream_result,
                     false,
                     job_ids,
                 )

From 935c666d50ef30d89a3669c76094af7506fbb448 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 18:56:42 +0200
Subject: [PATCH 12/50] fix: hide _ENTRYPOINT_OVERRIDE jobs from script/flow
 history panel (#9088)

---
 backend/windmill-api-inputs/src/lib.rs                 |  1 +
 backend/windmill-api-jobs/src/concurrency_groups.rs    |  1 +
 backend/windmill-api-jobs/src/query.rs                 | 10 ++++++++++
 backend/windmill-api-jobs/src/types.rs                 |  5 +++++
 backend/windmill-api/openapi.yaml                      |  5 +++++
 frontend/src/lib/components/HistoricInputs.svelte      |  3 ++-
 .../src/lib/components/runs/useJobsLoader.svelte.ts    |  5 ++++-
 7 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-api-inputs/src/lib.rs b/backend/windmill-api-inputs/src/lib.rs
index 154e02e5a9..348b434eea 100644
--- a/backend/windmill-api-inputs/src/lib.rs
+++ b/backend/windmill-api-inputs/src/lib.rs
@@ -172,6 +172,7 @@ async fn get_input_history(
             kind IN ('preview', 'flowpreview') as is_preview \
             FROM v2_job JOIN v2_job_completed USING (id) \
             WHERE v2_job.workspace_id = $3 AND {} = $1 AND kind = any($2) \
+            AND v2_job.script_entrypoint_override IS NULL \
             {args_query} AND v2_job_completed.status != 'skipped' {include_non_root} \
             ORDER BY v2_job.created_at DESC LIMIT $4\
         ) t ORDER BY completed_at DESC LIMIT $5 OFFSET $6",
diff --git a/backend/windmill-api-jobs/src/concurrency_groups.rs b/backend/windmill-api-jobs/src/concurrency_groups.rs
index f3ef3b14a8..d8e7a54112 100644
--- a/backend/windmill-api-jobs/src/concurrency_groups.rs
+++ b/backend/windmill-api-jobs/src/concurrency_groups.rs
@@ -226,6 +226,7 @@ async fn get_concurrent_intervals(
             trigger_kind: _,
             include_args: _,
             broad_filter: _,
+            excludes_entrypoint_override: _,
         } => true,
         _ => false,
     };
diff --git a/backend/windmill-api-jobs/src/query.rs b/backend/windmill-api-jobs/src/query.rs
index 38e139b77b..e6c57e6c5b 100644
--- a/backend/windmill-api-jobs/src/query.rs
+++ b/backend/windmill-api-jobs/src/query.rs
@@ -216,6 +216,10 @@ pub fn filter_list_queue_query(
         sqlb.and_where("trigger_kind IS DISTINCT FROM 'schedule'");
     }
 
+    if lq.excludes_entrypoint_override.unwrap_or(false) {
+        sqlb.and_where_is_null("v2_job.script_entrypoint_override");
+    }
+
     if let Some(tk) = &lq.trigger_kind {
         let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
         if tk.negated {
@@ -519,6 +523,10 @@ pub fn filter_list_completed_query(
         sqlb.and_where("trigger_kind IS DISTINCT FROM 'schedule'");
     }
 
+    if lq.excludes_entrypoint_override.unwrap_or(false) {
+        sqlb.and_where_is_null("v2_job.script_entrypoint_override");
+    }
+
     if let Some(tk) = &lq.trigger_kind {
         let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
         if tk.negated {
@@ -624,6 +632,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         }
     }
 
@@ -668,6 +677,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         }
     }
 
diff --git a/backend/windmill-api-jobs/src/types.rs b/backend/windmill-api-jobs/src/types.rs
index e07328e2be..bc03a04289 100644
--- a/backend/windmill-api-jobs/src/types.rs
+++ b/backend/windmill-api-jobs/src/types.rs
@@ -122,6 +122,7 @@ pub struct ListQueueQuery {
     pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
     pub broad_filter: Option<String>,
+    pub excludes_entrypoint_override: Option<bool>,
 }
 
 #[derive(Deserialize, Clone)]
@@ -167,6 +168,7 @@ pub struct ListCompletedQuery {
     pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
     pub broad_filter: Option<String>,
+    pub excludes_entrypoint_override: Option<bool>,
 }
 
 impl From<ListCompletedQuery> for ListQueueQuery {
@@ -202,6 +204,7 @@ impl From<ListCompletedQuery> for ListQueueQuery {
             trigger_path: lcq.trigger_path,
             include_args: lcq.include_args,
             broad_filter: lcq.broad_filter,
+            excludes_entrypoint_override: lcq.excludes_entrypoint_override,
         }
     }
 }
@@ -704,6 +707,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         };
 
         let lqq: ListQueueQuery = lcq.into();
@@ -772,6 +776,7 @@ mod tests {
             trigger_path: None,
             include_args: None,
             broad_filter: None,
+            excludes_entrypoint_override: None,
         };
 
         let lqq: ListQueueQuery = lcq.into();
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 0c8d63298e..7cb96a3e29 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -12000,6 +12000,11 @@ paths:
           in: query
           schema:
             type: boolean
+        - name: excludes_entrypoint_override
+          description: exclude jobs that were started with a `_ENTRYPOINT_OVERRIDE` arg (e.g. dynamic-select helper runs and preprocessor previews)
+          in: query
+          schema:
+            type: boolean
         - name: broad_filter
           description: broad search across multiple fields (case-insensitive substring match on path, tag, schedule path, trigger kind, label)
           in: query
diff --git a/frontend/src/lib/components/HistoricInputs.svelte b/frontend/src/lib/components/HistoricInputs.svelte
index ca01013e0a..3c784f354f 100644
--- a/frontend/src/lib/components/HistoricInputs.svelte
+++ b/frontend/src/lib/components/HistoricInputs.svelte
@@ -112,7 +112,8 @@
 				syncQueuedRunsCount: false,
 				refreshRate: 10000,
 				currentWorkspace: $workspaceStore ?? '',
-				skip: !runnableId
+				skip: !runnableId,
+				excludesEntrypointOverride: true
 			}) satisfies UseJobLoaderArgs
 	)
 	let jobs = $derived(jobsLoader?.jobs ?? [])
diff --git a/frontend/src/lib/components/runs/useJobsLoader.svelte.ts b/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
index b75355a6cb..e7d8337708 100644
--- a/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
+++ b/frontend/src/lib/components/runs/useJobsLoader.svelte.ts
@@ -53,6 +53,7 @@ export interface UseJobLoaderArgs {
 	skip?: boolean
 	lookback?: number
 	perPage?: number
+	excludesEntrypointOverride?: boolean
 }
 
 export function useJobsLoader(args: () => UseJobLoaderArgs) {
@@ -69,6 +70,7 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 	let lookback = $derived(_args.lookback ?? 0)
 	let timeframe = $derived(_args?.timeframe)
 	let perPage = $derived(_args?.perPage ?? 1000)
+	let excludesEntrypointOverride = $derived(_args.excludesEntrypointOverride ?? false)
 
 	let label = $derived(filters?.label ?? null)
 	let worker = $derived(filters?.worker ?? null)
@@ -274,7 +276,8 @@ export function useJobsLoader(args: () => UseJobLoaderArgs) {
 			allWorkspaces: allWorkspaces ? true : undefined,
 			perPage: perPageOverride ?? perPage,
 			allowWildcards: allowWildcards ? true : undefined,
-			broadFilter
+			broadFilter,
+			excludesEntrypointOverride: excludesEntrypointOverride ? true : undefined
 		})
 		promise = CancelablePromiseUtils.catchErr(promise, (e) => {
 			if (e instanceof CancelError) return CancelablePromiseUtils.err(e)

From f37d3606446d23f8b11a94ea1ce5f5d4836fae17 Mon Sep 17 00:00:00 2001
From: Arnaud <31803803+Araden14@users.noreply.github.com>
Date: Fri, 8 May 2026 18:57:36 +0200
Subject: [PATCH 13/50] fix(flows): populate error handler input args from
 failure picker (#9087)

* fix(flows): populate error handler input args from failure picker

* style(flows): fix indentation in failure-step branch
---
 .../lib/components/flows/stepsInputArgs.svelte.ts   | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts b/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts
index 025bca1bfe..06a4972ee5 100644
--- a/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts
+++ b/frontend/src/lib/components/flows/stepsInputArgs.svelte.ts
@@ -4,10 +4,10 @@ import {
 	dfs,
 	getPreviousModule,
 	getStepPropPicker,
-	type PickableProperties
+	type PickableProperties,
+	getFailureStepPropPicker
 } from './previousResults'
 import { evalValue } from './utils.svelte'
-
 export class StepsInputArgs {
 	#stepsEvaluated = $state<Record<string, Record<string, any>>>({})
 	#steps = $state<Record<string, Record<string, any>>>({})
@@ -158,6 +158,15 @@ export class StepsInputArgs {
 		flow: OpenFlow | undefined,
 		previewArgs: Record<string, any> | undefined
 	) {
+		if (id === 'failure' && flow && flow.value.failure_module && flowState) {
+			const picker = getFailureStepPropPicker(flowState, flow, previewArgs)
+			this.initializeFromSchema(
+				flow.value.failure_module,
+				flowState['failure']?.schema ?? {},
+				picker.pickableProperties
+			)
+			return
+		}
 		if (!flowState || !flow) {
 			return
 		}

From 98ff146cfabf45418c95c027ad6d07b08069cfcd Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 19:56:51 +0200
Subject: [PATCH 14/50] fix(python): verify wheel RECORD on cache pull/install,
 finalize piptar (#9090)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Python per-package dependency cache could persist an incomplete wheel
extraction with `.valid.windmill` set, then propagate that broken artifact
to every worker through the object store. Customer hit this on
argon2-cffi==25.1.0 (missing argon2/_utils.py), and previously on
botocore/httpx (truncated tars). Symptom is a runtime ImportError that
looks like a missing dependency declaration rather than a Windmill bug.

Three changes that together stop the propagation:

1. After `pull_from_tar`, parse the wheel's `<dist-info>/RECORD` and
   confirm every listed path exists on disk before writing
   `.valid.windmill`. On failure, wipe the directory and fall through
   to a fresh local install — the next install also self-heals the
   broken object-store entry by pushing a fresh tar.

2. After `uv pip install` succeeds, run the same RECORD check before
   queuing the piptar upload or writing `.valid.windmill`. A bad install
   never becomes the source of a broken tar in the object store.

3. Finalize the tar (`drop(tar.into_inner()?)`) before reading its bytes
   for upload, so we never push an unfinalized archive (no end-of-archive
   marker) to the object store.

Verified with a 60-package end-to-end integration test (first-fill →
clear-local-cache → re-pull-from-objectstore → corrupt-objectstore-tar
→ detect-and-self-heal). All 27 packages on the live test pulled cleanly,
and the deliberately corrupted argon2-cffi tar was caught with the exact
expected log line ("wheel RECORD lists files missing on disk: argon2/_utils.py")
and replaced with a fresh tar.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 backend/windmill-worker/src/global_cache.rs   |   4 +
 .../windmill-worker/src/python_executor.rs    | 135 ++++++++++++++++++
 2 files changed, 139 insertions(+)

diff --git a/backend/windmill-worker/src/global_cache.rs b/backend/windmill-worker/src/global_cache.rs
index 23375746fd..67a8484b82 100644
--- a/backend/windmill-worker/src/global_cache.rs
+++ b/backend/windmill-worker/src/global_cache.rs
@@ -40,6 +40,9 @@ pub async fn build_tar_and_push(
     let tar_file = std::fs::File::create(&tar_path)?;
     let mut tar = tar::Builder::new(tar_file);
     tar.append_dir_all(".", &folder)?;
+    // Write the trailing zero blocks and close the inner file BEFORE std::fs::read
+    // below. Without this, the bytes we upload to S3 are an unfinalized archive.
+    drop(tar.into_inner()?);
 
     let tar_metadata = tokio::fs::metadata(&tar_path).await;
     if tar_metadata.is_err() || tar_metadata.as_ref().unwrap().len() == 0 {
@@ -231,6 +234,7 @@ pub async fn save_cache(
             let tar_file = std::fs::File::create(&tar_path)?;
             let mut tar = tar::Builder::new(tar_file);
             tar.append_dir_all(".", &origin)?;
+            drop(tar.into_inner()?);
             let tar_metadata = tokio::fs::metadata(&tar_path).await;
             if tar_metadata.is_err() || tar_metadata.as_ref().unwrap().len() == 0 {
                 tracing::info!("Failed to tar cache: {origin}");
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index 5fb1278976..4db7b20fd5 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -2113,6 +2113,84 @@ async fn spawn_uv_install(
     }
 }
 
+/// Verify that every file listed in the wheel's RECORD exists on disk under
+/// `venv_p`. Used as a structural integrity check after both a successful
+/// `pull_from_tar` (object-store cache hit) and a successful local
+/// `uv pip install`, so a truncated tar or a dropped wheel entry can never
+/// become an authoritative cache entry. Returns Err with a short description
+/// on the first integrity issue (no .dist-info, no RECORD, or any listed
+/// path missing on disk).
+async fn verify_wheel_record(venv_p: &str) -> Result<(), String> {
+    let mut entries = tokio::fs::read_dir(venv_p)
+        .await
+        .map_err(|e| format!("read_dir({venv_p}): {e}"))?;
+
+    let mut dist_info: Option<String> = None;
+    loop {
+        match entries.next_entry().await {
+            Ok(Some(entry)) => {
+                let name = entry.file_name();
+                let name_s = name.to_string_lossy();
+                if name_s.ends_with(".dist-info") {
+                    if let Ok(ft) = entry.file_type().await {
+                        if ft.is_dir() {
+                            dist_info = Some(name_s.into_owned());
+                            break;
+                        }
+                    }
+                }
+            }
+            Ok(None) => break,
+            Err(e) => return Err(format!("read_dir entry in {venv_p}: {e}")),
+        }
+    }
+
+    let dist_info = match dist_info {
+        Some(d) => d,
+        None => return Err(format!("no .dist-info directory in {venv_p}")),
+    };
+
+    let record_path = format!("{venv_p}/{dist_info}/RECORD");
+    let record_content = tokio::fs::read_to_string(&record_path)
+        .await
+        .map_err(|e| format!("read RECORD at {record_path}: {e}"))?;
+
+    let mut missing: Vec<String> = Vec::new();
+    for line in record_content.lines() {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            continue;
+        }
+        let rel_path = match trimmed.split(',').next() {
+            Some(p) if !p.is_empty() => p,
+            _ => continue,
+        };
+        // Defensive: skip absolute paths or escaping entries — we only
+        // validate package-relative files.
+        if rel_path.starts_with('/') || rel_path.contains("..") {
+            continue;
+        }
+        let full = format!("{venv_p}/{rel_path}");
+        if tokio::fs::metadata(&full).await.is_err() {
+            missing.push(rel_path.to_string());
+            // Bound error size in pathological cases (e.g. wholly empty dir).
+            if missing.len() >= 10 {
+                missing.push("...".to_string());
+                break;
+            }
+        }
+    }
+
+    if missing.is_empty() {
+        Ok(())
+    } else {
+        Err(format!(
+            "wheel RECORD lists files missing on disk: {}",
+            missing.join(", ")
+        ))
+    }
+}
+
 /// uv pip install, include cached or pull from S3
 pub async fn handle_python_reqs(
     requirements: Vec<String>,
@@ -2484,6 +2562,30 @@ pub async fn handle_python_reqs(
                                     workspace_id = %w_id,
                                     "No tarball was found for {venv_p} on S3 or different problem occurred {job_id}:\n{e}",
                                 );
+                            } else if let Err(verify_err) = verify_wheel_record(&venv_p).await {
+                                // The object-store tar extracted cleanly but the resulting
+                                // directory is missing files referenced by the wheel RECORD.
+                                // Wipe the broken cache entry and fall through to a fresh
+                                // local install rather than treating it as authoritative.
+                                tracing::warn!(
+                                    workspace_id = %w_id,
+                                    job_id = %job_id,
+                                    "Object-store cache for {venv_p} failed wheel RECORD verification, will reinstall locally: {verify_err}"
+                                );
+                                if let Err(rm_err) = tokio::fs::remove_dir_all(&venv_p).await {
+                                    tracing::warn!(
+                                        workspace_id = %w_id,
+                                        "could not remove broken cache dir {venv_p}: {rm_err}"
+                                    );
+                                }
+                                append_logs(
+                                    &job_id,
+                                    &w_id,
+                                    format!(
+                                        "\n[!] cached wheel for {req} from object store failed integrity check, reinstalling: {verify_err}\n"
+                                    ),
+                                    &conn,
+                                ).await;
                             } else {
                                 print_success(
                                     true,
@@ -2640,6 +2742,39 @@ pub async fn handle_python_reqs(
                 let _ = std::fs::remove_file(format!("{job_dir}/{req}.config.proto"));
             }
 
+            // Verify the install before declaring success: if uv exited 0 but
+            // the on-disk directory is missing files the wheel RECORD says
+            // should exist, do NOT write .valid.windmill, do NOT queue the
+            // piptar upload, and fail the job. This prevents a broken tar
+            // from ever being pushed to the object store and propagated to
+            // every other replica.
+            if let Err(verify_err) = verify_wheel_record(&venv_p).await {
+                tracing::error!(
+                    workspace_id = %w_id,
+                    job_id = %job_id,
+                    "uv pip install of {req} into {venv_p} failed wheel RECORD verification: {verify_err}"
+                );
+                append_logs(
+                    &job_id,
+                    &w_id,
+                    format!(
+                        "\nWheel RECORD verification failed after install of {req}: {verify_err}. \
+                         Aborting to avoid publishing a corrupt cache entry."
+                    ),
+                    &conn,
+                ).await;
+                if let Err(rm_err) = tokio::fs::remove_dir_all(&venv_p).await {
+                    tracing::warn!(
+                        workspace_id = %w_id,
+                        "could not remove broken install dir {venv_p}: {rm_err}"
+                    );
+                }
+                pids.lock().await.get_mut(i).and_then(|e| e.take());
+                return Err(Error::from(anyhow!(
+                    "wheel RECORD verification failed after install of {req}"
+                )));
+            }
+
             print_success(
                 false,
                 s3_push,

From 91ddb930c3360d5c06156f9f14da60cebd1949e7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 8 May 2026 20:03:06 +0200
Subject: [PATCH 15/50] chore(main): release 1.699.0 (#9082)

* chore(main): release 1.699.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  22 +++
 backend/Cargo.lock                            | 160 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/main.ts                               |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 142 insertions(+), 120 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1034bc4f87..98cdc3b50a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog
 
+## [1.699.0](https://github.com/windmill-labs/windmill/compare/v1.698.0...v1.699.0) (2026-05-08)
+
+
+### Features
+
+* parse windmill_failure field to tag run as failure ([#9073](https://github.com/windmill-labs/windmill/issues/9073)) ([dd53202](https://github.com/windmill-labs/windmill/commit/dd5320205f200dd058db2ff7d44d5c4bbcf25ec9))
+
+
+### Bug Fixes
+
+* **cli:** bump svelte version in `wmill app new` template ([#9084](https://github.com/windmill-labs/windmill/issues/9084)) ([4b4aa0e](https://github.com/windmill-labs/windmill/commit/4b4aa0e303f9c47c4f931511977107f42f93abc3))
+* **flows:** populate error handler input args from failure picker ([#9087](https://github.com/windmill-labs/windmill/issues/9087)) ([f37d360](https://github.com/windmill-labs/windmill/commit/f37d3606446d23f8b11a94ea1ce5f5d4836fae17))
+* hide _ENTRYPOINT_OVERRIDE jobs from script/flow history panel ([#9088](https://github.com/windmill-labs/windmill/issues/9088)) ([935c666](https://github.com/windmill-labs/windmill/commit/935c666d50ef30d89a3669c76094af7506fbb448))
+* **native-triggers:** serialize Google channel renewal across replicas ([#9060](https://github.com/windmill-labs/windmill/issues/9060)) ([ee3d82f](https://github.com/windmill-labs/windmill/commit/ee3d82f01f52d835218f544dad6de9b7c3184fbb))
+* **python:** verify wheel RECORD on cache pull/install, finalize piptar ([#9090](https://github.com/windmill-labs/windmill/issues/9090)) ([98ff146](https://github.com/windmill-labs/windmill/commit/98ff146cfabf45418c95c027ad6d07b08069cfcd))
+* reject root-rooted paths in ansible playbook validator on windows ([#9081](https://github.com/windmill-labs/windmill/issues/9081)) ([d37277d](https://github.com/windmill-labs/windmill/commit/d37277d2341c83faf72efa0035cbf70e2cfbd596))
+
+
+### Performance Improvements
+
+* **flows:** gate flow_env resolve on expr text and share cache with handle_flow ([#9085](https://github.com/windmill-labs/windmill/issues/9085)) ([23af6c2](https://github.com/windmill-labs/windmill/commit/23af6c2ea31265a1898d0632e72cd2fd826e4044))
+
 ## [1.698.0](https://github.com/windmill-labs/windmill/compare/v1.697.0...v1.698.0) (2026-05-08)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 47aff74297..6952682391 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2213,9 +2213,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.61"
+version = "1.2.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
+checksum = "a1dce859f0832a7d088c4f1119888ab94ef4b5d6795d1ce05afb7fe159d79f98"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -16025,7 +16025,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16106,7 +16106,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -16130,7 +16130,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16143,7 +16143,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -16286,7 +16286,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16309,7 +16309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16322,7 +16322,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16348,7 +16348,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -16358,7 +16358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16375,7 +16375,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "base64 0.22.1",
@@ -16397,7 +16397,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16420,7 +16420,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16436,7 +16436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16457,7 +16457,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16478,7 +16478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16492,7 +16492,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16524,7 +16524,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16549,7 +16549,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "flate2",
@@ -16567,7 +16567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16589,7 +16589,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16609,7 +16609,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16639,7 +16639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16667,7 +16667,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -16679,7 +16679,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "argon2",
  "axum 0.8.4",
@@ -16704,7 +16704,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16718,7 +16718,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16751,7 +16751,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -16765,7 +16765,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16784,7 +16784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -16885,7 +16885,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -16904,7 +16904,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "regex",
  "serde",
@@ -16919,7 +16919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -16943,7 +16943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -16960,7 +16960,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -16976,7 +16976,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16997,7 +16997,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17028,7 +17028,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -17053,7 +17053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -17087,7 +17087,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -17105,7 +17105,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -17114,7 +17114,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17126,7 +17126,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17138,7 +17138,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -17150,7 +17150,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17162,7 +17162,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17174,7 +17174,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -17185,7 +17185,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17196,7 +17196,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17208,7 +17208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17219,7 +17219,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17241,7 +17241,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17253,7 +17253,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17267,7 +17267,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -17284,7 +17284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17297,7 +17297,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -17309,7 +17309,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17327,7 +17327,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -17343,7 +17343,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17359,7 +17359,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -17370,7 +17370,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17407,7 +17407,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -17445,7 +17445,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -17456,7 +17456,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17486,7 +17486,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17510,7 +17510,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17543,7 +17543,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17576,7 +17576,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17596,7 +17596,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17630,7 +17630,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17666,7 +17666,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17689,7 +17689,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17713,7 +17713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -17737,7 +17737,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17772,7 +17772,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17800,7 +17800,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17823,7 +17823,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "bitflags 2.9.4",
@@ -17842,7 +17842,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -17955,7 +17955,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 1a1b1f09d0..042179683d 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.698.0"
+version = "1.699.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.698.0"
+version = "1.699.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 0bc102cc48..d337f4838d 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6183,7 +6183,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6263,7 +6263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6275,7 +6275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6296,7 +6296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6308,7 +6308,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6320,7 +6320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6332,7 +6332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6344,7 +6344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6378,7 +6378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6411,7 +6411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6423,7 +6423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6437,7 +6437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6454,7 +6454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6467,7 +6467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6479,7 +6479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6497,7 +6497,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6513,7 +6513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6529,7 +6529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6561,7 +6561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.698.0"
+version = "1.699.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 43a8bd59ef..80d8c63983 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.698.0"
+version = "1.699.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 7cb96a3e29..c6a7de2601 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.698.0
+  version: 1.699.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index a20c1b18af..3d7b371b24 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.698.0";
+export const VERSION = "v1.699.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 9650032679..372087c69a 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -79,7 +79,7 @@ export {
   token,
 };
 
-export const VERSION = "1.698.0";
+export const VERSION = "1.699.0";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index c616a8e212..0ce5dc49ef 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.698.0",
+	"version": "1.699.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.698.0",
+			"version": "1.699.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index e6d623791f..82c7ad8fa9 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.698.0",
+	"version": "1.699.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index efe961555a..3e38043b9e 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.698.0"
+wmill = ">=1.699.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index d7e823897c..824243b2af 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.698.0
+  version: 1.699.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 2e25edb52d..244a2e0d54 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.698.0'
+    ModuleVersion     = '1.699.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index d1ac989649..5aa17d46c3 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.698.0"
+version = "1.699.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 07b5df0602..884ac84799 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.698.0",
+  "version": "1.699.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 566e4bd4e4..ec86e6d07d 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.698.0",
+  "version": "1.699.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "sideEffects": false,
diff --git a/version.txt b/version.txt
index 7185d214b0..dc6966fffd 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.698.0
+1.699.0

From 43b18006f32fd5db54bbf8ae7ff0e0b314a517e5 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 9 May 2026 10:38:47 +0200
Subject: [PATCH 16/50] feat(cli): auto-infer args for `wmill app push` (#9091)

Run `wmill app push` from inside an app folder (e.g. `f/foo/my_app.app/`)
with no args. The local path defaults to CWD, and the remote path is
derived from CWD relative to `wmill.yaml`, with `.app`/`.raw_app`/
`__app`/`__raw_app` suffixes stripped. Either, both, or neither
positional argument can be passed.

Also resolves `file_path` against the user's original CWD before
`resolveWorkspace` may chdir to the wmill.yaml root, so a relative
`file_path` argument is interpreted from where the user invoked the
command (previously it could resolve against the wrong directory).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 cli/src/commands/app/app.ts                   | 131 +++++++++++++++---
 cli/src/guidance/skills.gen.ts                |   2 +-
 .../auto-generated/cli/cli-commands.md        |   2 +-
 system_prompts/auto-generated/prompts.ts      |   2 +-
 .../skills/cli-commands/SKILL.md              |   2 +-
 5 files changed, 117 insertions(+), 22 deletions(-)

diff --git a/cli/src/commands/app/app.ts b/cli/src/commands/app/app.ts
index f99df84636..2749c0269c 100644
--- a/cli/src/commands/app/app.ts
+++ b/cli/src/commands/app/app.ts
@@ -4,7 +4,7 @@ import { Command } from "@cliffy/command";
 import { Table } from "@cliffy/table";
 import { colors } from "@cliffy/ansi/colors";
 import * as log from "../../core/log.ts";
-import { sep as SEP } from "node:path";
+import { sep as SEP, isAbsolute, resolve as pathResolve, relative as pathRelative, basename } from "node:path";
 import { stat } from "node:fs/promises";
 import * as windmillUtils from "@windmill-labs/shared-utils";
 import { yamlParseFile } from "../../utils/yaml.ts";
@@ -12,6 +12,7 @@ import * as wmill from "../../../gen/services.gen.ts";
 import { ListableApp, Policy } from "../../../gen/types.gen.ts";
 
 import { GlobalOptions, isSuperset } from "../../types.ts";
+import { getWmillYamlPath } from "../../core/conf.ts";
 import { readInlinePathSync } from "../../utils/utils.ts";
 import devCommand from "./dev.ts";
 import lintCommand from "./lint.ts";
@@ -261,31 +262,122 @@ async function get(opts: GlobalOptions & { json?: boolean }, path: string) {
   }
 }
 
-async function push(opts: GlobalOptions, filePath: string, remotePath: string) {
-  if (!validatePath(remotePath)) {
-    return;
-  }
+const APP_FOLDER_SUFFIXES = ["__raw_app", ".raw_app", "__app", ".app"] as const;
+
+async function push(
+  opts: GlobalOptions,
+  filePath?: string,
+  remotePath?: string
+) {
+  // Capture original CWD before resolveWorkspace, which may chdir to the
+  // wmill.yaml root. We need it to resolve relative inputs and to derive
+  // the remote path from the user's location when auto-inferring.
+  const originalCwd = process.cwd();
+
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
 
-  // Detect raw apps by checking for raw_app.yaml or __raw_app/.raw_app suffix
-  const normalizedPath = filePath.endsWith(SEP) ? filePath.slice(0, -1) : filePath;
-  const isRawApp = normalizedPath.endsWith("__raw_app") || normalizedPath.endsWith(".raw_app");
+  // Auto-infer file path from CWD when omitted
+  if (!filePath) {
+    filePath = originalCwd;
+  }
+  const absoluteFilePath = isAbsolute(filePath)
+    ? filePath
+    : pathResolve(originalCwd, filePath);
+
+  // Detect app folder type (regular vs raw)
+  const normalizedPath = absoluteFilePath.endsWith(SEP)
+    ? absoluteFilePath.slice(0, -1)
+    : absoluteFilePath;
+  const dirName = basename(normalizedPath);
+  const isRawAppByName =
+    dirName.endsWith("__raw_app") || dirName.endsWith(".raw_app");
+  const isAppByName = dirName.endsWith("__app") || dirName.endsWith(".app");
+
   let hasRawAppYaml = false;
-  if (!isRawApp) {
+  let hasAppYaml = false;
+  try {
+    await stat(normalizedPath + SEP + "raw_app.yaml");
+    hasRawAppYaml = true;
+  } catch { /* not a raw app */ }
+  if (!hasRawAppYaml) {
     try {
-      const rawAppPath = (filePath.endsWith(SEP) ? filePath : filePath + SEP) + "raw_app.yaml";
-      await stat(rawAppPath);
-      hasRawAppYaml = true;
-    } catch { /* not a raw app */ }
+      await stat(normalizedPath + SEP + "app.yaml");
+      hasAppYaml = true;
+    } catch { /* not an app */ }
   }
 
-  if (isRawApp || hasRawAppYaml) {
+  if (!isRawAppByName && !isAppByName && !hasRawAppYaml && !hasAppYaml) {
+    log.error(
+      colors.red(
+        `'${filePath}' is not an app folder (no app.yaml or raw_app.yaml, and not a *.app/*.raw_app folder).`
+      )
+    );
+    return;
+  }
+
+  // Auto-infer remote path from the folder location relative to wmill.yaml root
+  if (!remotePath) {
+    const wmillYamlPath = getWmillYamlPath();
+    if (!wmillYamlPath) {
+      log.error(
+        colors.red(
+          "Could not infer remote path: no wmill.yaml found. Run 'wmill init' or pass <remote_path> explicitly."
+        )
+      );
+      return;
+    }
+    // After resolveWorkspace, process.cwd() is the wmill.yaml dir
+    const wmillRoot = process.cwd();
+    let inferred = pathRelative(wmillRoot, normalizedPath).replaceAll(SEP, "/");
+    if (inferred.startsWith("..") || isAbsolute(inferred)) {
+      log.error(
+        colors.red(
+          `Could not infer remote path: '${filePath}' is outside the wmill.yaml root (${wmillRoot}). Move the folder under the root or pass <remote_path> explicitly.`
+        )
+      );
+      return;
+    }
+    for (const suffix of APP_FOLDER_SUFFIXES) {
+      if (inferred.endsWith(suffix)) {
+        inferred = inferred.slice(0, -suffix.length);
+        break;
+      }
+    }
+    if (!inferred) {
+      log.error(
+        colors.red(
+          "Could not infer remote path: app folder is at the wmill.yaml root. Pass <remote_path> explicitly."
+        )
+      );
+      return;
+    }
+    if (
+      !inferred.startsWith("u/") &&
+      !inferred.startsWith("g/") &&
+      !inferred.startsWith("f/")
+    ) {
+      log.error(
+        colors.red(
+          `Could not infer remote path: '${inferred}' is not under u/, g/, or f/. Move the app under one of these prefixes or pass <remote_path> explicitly.`
+        )
+      );
+      return;
+    }
+    remotePath = inferred;
+    log.info(colors.gray(`Inferred remote path: ${remotePath}`));
+  }
+
+  if (!validatePath(remotePath)) {
+    return;
+  }
+
+  if (isRawAppByName || hasRawAppYaml) {
     const { pushRawApp } = await import("./raw_apps.ts");
-    await pushRawApp(workspace.workspaceId, remotePath, filePath);
+    await pushRawApp(workspace.workspaceId, remotePath, absoluteFilePath);
     log.info(colors.bold.underline.green("Raw app pushed"));
   } else {
-    await pushApp(workspace.workspaceId, remotePath, filePath);
+    await pushApp(workspace.workspaceId, remotePath, absoluteFilePath);
     log.info(colors.bold.underline.green("App pushed"));
   }
 }
@@ -301,8 +393,11 @@ const command = new Command()
   .arguments("<path:string>")
   .option("--json", "Output as JSON (for piping to jq)")
   .action(get as any)
-  .command("push", "push a local app ")
-  .arguments("<file_path:string> <remote_path:string>")
+  .command(
+    "push",
+    "push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml."
+  )
+  .arguments("[file_path:string] [remote_path:string]")
   .action(push as any)
   .command("dev", devCommand)
   .command("lint", lintCommand)
diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index ede19be85b..72d2e9d76b 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -6588,7 +6588,7 @@ app related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`app get <path:string>\` - get an app's details
   - \`--json\` - Output as JSON (for piping to jq)
-- \`app push <file_path:string> <remote_path:string>\` - push a local app 
+- \`app push [file_path:string] [remote_path:string]\` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - \`app dev [app_folder:string]\` - Start a development server for building apps with live reload and hot module replacement
   - \`--port <port:number>\` - Port to run the dev server on (will find next available port if occupied)
   - \`--host <host:string>\` - Host to bind the dev server to
diff --git a/system_prompts/auto-generated/cli/cli-commands.md b/system_prompts/auto-generated/cli/cli-commands.md
index 692e2dd310..dc0eb66640 100644
--- a/system_prompts/auto-generated/cli/cli-commands.md
+++ b/system_prompts/auto-generated/cli/cli-commands.md
@@ -26,7 +26,7 @@ app related commands
   - `--json` - Output as JSON (for piping to jq)
 - `app get <path:string>` - get an app's details
   - `--json` - Output as JSON (for piping to jq)
-- `app push <file_path:string> <remote_path:string>` - push a local app 
+- `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement
   - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)
   - `--host <host:string>` - Host to bind the dev server to
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 83f6ae1157..53336762cc 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -2174,7 +2174,7 @@ app related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`app get <path:string>\` - get an app's details
   - \`--json\` - Output as JSON (for piping to jq)
-- \`app push <file_path:string> <remote_path:string>\` - push a local app 
+- \`app push [file_path:string] [remote_path:string]\` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - \`app dev [app_folder:string]\` - Start a development server for building apps with live reload and hot module replacement
   - \`--port <port:number>\` - Port to run the dev server on (will find next available port if occupied)
   - \`--host <host:string>\` - Host to bind the dev server to
diff --git a/system_prompts/auto-generated/skills/cli-commands/SKILL.md b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
index b4818b4fa1..98ce52efde 100644
--- a/system_prompts/auto-generated/skills/cli-commands/SKILL.md
+++ b/system_prompts/auto-generated/skills/cli-commands/SKILL.md
@@ -31,7 +31,7 @@ app related commands
   - `--json` - Output as JSON (for piping to jq)
 - `app get <path:string>` - get an app's details
   - `--json` - Output as JSON (for piping to jq)
-- `app push <file_path:string> <remote_path:string>` - push a local app 
+- `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.
 - `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement
   - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)
   - `--host <host:string>` - Host to bind the dev server to

From b95f0e2379a82b7064d9317dfacac852b1988699 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 10 May 2026 12:06:25 +0000
Subject: [PATCH 17/50] style(log-viewer): tighter top bar (icons, hyphenated
 label, scoped overflow) (#9094)

- duration/mem-peak labels replaced by Timer/Cpu icons with tooltips
- 'Auto scroll' -> 'auto-scroll' (lowercase, hyphenated, whitespace-nowrap)
- top bar gets overflow-x-auto so it scrolls horizontally instead of pushing the entire log panel into overflow when narrow
---
 frontend/src/lib/components/LogViewer.svelte | 36 ++++++++++++++------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index 9f06f90eec..e3012a9db6 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -11,7 +11,7 @@
 </script>
 
 <script lang="ts">
-	import { ClipboardCopy, Download, Expand, Loader2 } from 'lucide-svelte'
+	import { ClipboardCopy, Download, Expand, Loader2, Timer, Cpu } from 'lucide-svelte'
 	import { Button, Drawer, DrawerContent } from './common'
 	import { copyToClipboard } from '$lib/utils'
 	import { base } from '$lib/base'
@@ -166,8 +166,7 @@
 	}
 
 	export function scrollToBottom() {
-		scroll &&
-			setTimeout(() => preEl?.scroll({ top: preEl?.scrollHeight, behavior: 'smooth' }), 100)
+		scroll && setTimeout(() => preEl?.scroll({ top: preEl?.scrollHeight, behavior: 'smooth' }), 100)
 	}
 
 	let logViewer: Drawer | undefined = $state()
@@ -296,7 +295,9 @@
 			class="w-full h-full bg-surface-secondary flex flex-col {noMaxH ? '' : 'max-h-screen'}"
 			data-nav-id={navigationId}
 		>
-			<div class="flex gap-2 ml-2 {small ? 'py-1' : 'py-2'} border-b">
+			<div
+				class="flex gap-2 ml-2 {small ? 'py-1' : 'py-2'} border-b overflow-x-auto overflow-y-hidden"
+			>
 				{#if isLoading}
 					<div class="flex gap-2 items-center">
 						<Loader2 class="animate-spin" />
@@ -312,14 +313,27 @@
 					</div>
 				{:else if duration}
 					<span
-						class={twMerge('text-secondary dark:text-gray-400', small ? '!text-2xs' : '!text-xs')}
-						>took {duration}ms</span
+						class={twMerge(
+							'flex items-center gap-1 text-secondary dark:text-gray-400',
+							small ? '!text-2xs' : '!text-xs'
+						)}
+						title="Duration"
 					>
+						<Timer size={small ? 10 : 12} />
+						{duration}ms
+					</span>
 				{/if}
 				{#if mem}
-					<span class="{small ? '!text-2xs' : '!text-xs'} text-secondary dark:text-gray-400"
-						>mem peak: {(mem / 1024).toPrecision(4)}MB</span
+					<span
+						class={twMerge(
+							'flex items-center gap-1 text-secondary dark:text-gray-400',
+							small ? '!text-2xs' : '!text-xs'
+						)}
+						title="Memory peak"
 					>
+						<Cpu size={small ? 10 : 12} />
+						{(mem / 1024).toPrecision(4)}MB
+					</span>
 				{/if}
 				<div class="flex gap-2 justify-end flex-1">
 					{#if jobId && download}
@@ -335,8 +349,10 @@
 					{/if}
 					<button onclick={logViewer.openDrawer}><Expand size="12" /></button>
 					{#if !noAutoScroll}
-						<label class="pr-2 text-2xs flex gap-2 font-normal text-primary items-center">
-							Auto scroll
+						<label
+							class="pr-2 text-2xs flex gap-2 font-normal text-primary items-center whitespace-nowrap"
+						>
+							auto-scroll
 							<input class="windmillapp" type="checkbox" bind:checked={scroll} />
 						</label>
 					{/if}

From da9e416b8ed41a0cbb219ad32b7456dd6997d09d Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Mon, 11 May 2026 09:56:52 +0200
Subject: [PATCH 18/50] workspace specific nit fixes (#9072)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: capture linked variables in trash on bulk resource delete

delete_resources_bulk grew linked-variable cascade deletion in an
earlier commit on this branch but only mirrored the deletion side of
delete_resource — not the trashbin capture side. Linked variables
deleted via bulk were permanently lost while their single-delete
counterparts could be recovered from trash.

Fetch each resource's linked variable rows as JSON before bulk delete
and stash them under `trash_data['linked_variables']` of that
resource's trash entry, matching the shape produced by single-resource
delete.

* fix: ws_specific cleanup gaps in variable rename + bulk delete; tooltip

Four spots:

1. update_variable rename block: when a variable is renamed and a
   linked resource at the same path is renamed alongside, also move
   any explicit ws_specific 'resource' marker from the old path to
   the new one. Symmetric with what update_resource already does for
   ws_specific 'variable'.

2. delete_variables_bulk: clean ws_specific 'resource' rows for any
   linked resource paths before the resource DELETE. Without this,
   bulk-delete leaves orphaned markers that would cause a freshly
   recreated resource at the same path to be falsely treated as
   workspace-specific. (linked_resource trash capture is already
   present in the bulk path — the reviewer note about that was
   inaccurate against the current code.)

3. list_ws_specific: ORDER BY item_kind, path so the CLI sees a
   stable list across pulls/pushes — cheap on a small per-workspace
   row set and avoids spurious diffs.

4. VariableForm tooltip: mirror the resource form so users who find a
   variable already toggled know it may have been auto-marked by a
   workspace-specific resource referencing it, and that disabling
   doesn't retroactively un-mark the referencing resource.

* sqlx prepare
---
 ...1f7f387f5055c47f493271d26731336257384.json | 10 +++---
 ...631af9f524389309f17ef04f70c773b1d5e75.json | 28 +++++++++++++++
 ...153c43903f929ae5d62fbba12610f89c36d55.json |  2 +-
 .../windmill-api-workspaces/src/workspaces.rs |  1 +
 backend/windmill-store/src/resources.rs       | 35 +++++++++++++++++--
 backend/windmill-store/src/variables.rs       | 25 +++++++++++++
 .../src/lib/components/VariableForm.svelte    |  2 +-
 7 files changed, 94 insertions(+), 9 deletions(-)
 create mode 100644 backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json

diff --git a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
index e7ed0aee65..d29a18c691 100644
--- a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
+++ b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
+      true,
+      true,
+      true,
+      true,
+      true,
       true,
       true
     ]
diff --git a/backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json b/backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json
new file mode 100644
index 0000000000..ad296e9eda
--- /dev/null
+++ b/backend/.sqlx/query-290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT s.item_kind, s.path\n        FROM ws_specific s\n        WHERE s.workspace_id = $1\n          AND (\n              (s.item_kind = 'resource' AND EXISTS (\n                  SELECT 1 FROM resource r\n                  WHERE r.workspace_id = s.workspace_id AND r.path = s.path\n              ))\n              OR (s.item_kind = 'variable' AND EXISTS (\n                  SELECT 1 FROM variable v\n                  WHERE v.workspace_id = s.workspace_id AND v.path = s.path\n              ))\n          )\n        ORDER BY s.item_kind, s.path\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "item_kind",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "290599fc173947acb518344d6fb631af9f524389309f17ef04f70c773b1d5e75"
+}
diff --git a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
index 36ddb8ab9f..713ccb9dd3 100644
--- a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
+++ b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      true
+      null
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index f479b8c719..94e2026ad3 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -7351,6 +7351,7 @@ async fn list_ws_specific(
                   WHERE v.workspace_id = s.workspace_id AND v.path = s.path
               ))
           )
+        ORDER BY s.item_kind, s.path
         "#,
         &w_id
     )
diff --git a/backend/windmill-store/src/resources.rs b/backend/windmill-store/src/resources.rs
index 6b169a0c0d..8aa88bad86 100644
--- a/backend/windmill-store/src/resources.rs
+++ b/backend/windmill-store/src/resources.rs
@@ -1238,10 +1238,39 @@ async fn delete_resources_bulk(
         .await?;
 
         if let Some(res_data) = trash_resource {
+            // Per-resource linked vars so each resource's trash entry carries
+            // exactly the variables that vanished with it (matching the
+            // single-delete shape: trash_data["linked_variables"]).
+            let mut this_linked: Vec<String> = Vec::new();
             if let Some(value) = res_data.get("value") {
-                collect_var_refs(value, &mut linked_var_paths);
+                collect_var_refs(value, &mut this_linked);
+            }
+            this_linked.sort();
+            this_linked.dedup();
+
+            let trash_linked_vars: Vec<serde_json::Value> = if this_linked.is_empty() {
+                Vec::new()
+            } else {
+                let placeholders: Vec<String> = this_linked
+                    .iter()
+                    .enumerate()
+                    .map(|(i, _)| format!("${}", i + 2))
+                    .collect();
+                let query = format!(
+                    "SELECT to_jsonb(t) FROM variable t WHERE workspace_id = $1 AND path IN ({})",
+                    placeholders.join(", ")
+                );
+                let mut q = sqlx::query_scalar::<_, serde_json::Value>(&query).bind(&w_id);
+                for var_path in &this_linked {
+                    q = q.bind(var_path);
+                }
+                q.fetch_all(&mut *tx).await?
+            };
+
+            let mut trash_data = serde_json::json!({"row": res_data});
+            if !trash_linked_vars.is_empty() {
+                trash_data["linked_variables"] = serde_json::Value::Array(trash_linked_vars);
             }
-            let trash_data = serde_json::json!({"row": res_data});
             windmill_common::trashbin::move_to_trash(
                 &mut *tx,
                 &w_id,
@@ -1251,6 +1280,8 @@ async fn delete_resources_bulk(
                 &authed.username,
             )
             .await?;
+
+            linked_var_paths.extend(this_linked);
         }
     }
     linked_var_paths.sort();
diff --git a/backend/windmill-store/src/variables.rs b/backend/windmill-store/src/variables.rs
index a9f8734647..c50049fcd6 100644
--- a/backend/windmill-store/src/variables.rs
+++ b/backend/windmill-store/src/variables.rs
@@ -755,6 +755,17 @@ async fn delete_variables_bulk(
     )
     .fetch_all(&mut *tx)
     .await?;
+    // Mirror single delete_variable: clean the linked-resource ws_specific
+    // markers BEFORE deleting the resource rows so they don't survive as
+    // orphans. A resource later created at the same path would otherwise
+    // inherit a stale ws_specific flag.
+    sqlx::query!(
+        "DELETE FROM ws_specific WHERE workspace_id = $1 AND item_kind = 'resource' AND path = ANY($2)",
+        w_id,
+        &deleted_paths
+    )
+    .execute(&mut *tx)
+    .await?;
     sqlx::query!(
         "DELETE FROM resource WHERE path = ANY($1) AND workspace_id = $2",
         &deleted_paths,
@@ -1019,6 +1030,20 @@ async fn update_variable(
             )
             .execute(&mut *tx)
             .await?;
+
+            // The linked resource at the same path is renamed above; move
+            // its ws_specific 'resource' marker too so an explicitly-flagged
+            // resource doesn't lose its ws_specific status on rename and
+            // doesn't leave a stale marker at the old path. Symmetric with
+            // update_resource's rename block.
+            sqlx::query!(
+                "UPDATE ws_specific SET path = $1 WHERE workspace_id = $2 AND item_kind = 'resource' AND path = $3",
+                npath,
+                w_id,
+                path
+            )
+            .execute(&mut *tx)
+            .await?;
         }
     }
 
diff --git a/frontend/src/lib/components/VariableForm.svelte b/frontend/src/lib/components/VariableForm.svelte
index 167172450e..0ffa4d8ba6 100644
--- a/frontend/src/lib/components/VariableForm.svelte
+++ b/frontend/src/lib/components/VariableForm.svelte
@@ -86,7 +86,7 @@
 {#if deployTo}
 	<Label
 		label="Workspace specific"
-		tooltip="Prevents this variable from being deployed to prod/staging"
+		tooltip="Prevents this variable from being deployed to prod/staging. May have been enabled automatically because a workspace-specific resource references this variable via $var:. Disabling this toggle does not retroactively un-mark the resource that referenced it."
 	>
 		<Toggle bind:checked={wsSpecific} />
 	</Label>

From 23bb1b541e78846d5978153fd8d9bb4f01cec72b Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 11 May 2026 12:01:13 +0200
Subject: [PATCH 19/50] fix(frontend): mark Path dirty when folder picker
 changes selection (#9096)

* fix(frontend): enable move button when only folder changes

* fix(frontend): mark Path dirty when folder picker changes selection

* fix(frontend): preserve script auto-derive for new items in Path dirty effect
---
 frontend/src/lib/components/Path.svelte | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index 6e1244b05f..c35b5f1e81 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -355,6 +355,19 @@
 		!dirty && (dirty = true)
 	}
 
+	$effect(() => {
+		if (
+			path !== undefined &&
+			path !== '' &&
+			initialPath &&
+			!initialPath.startsWith('tmp/') &&
+			path !== initialPath &&
+			!dirty
+		) {
+			dirty = true
+		}
+	})
+
 	const openSearchWithPrefilledText: (t?: string) => void = getContext(
 		'openSearchWithPrefilledText'
 	)

From 27acbbf3d595f16b3e73b81011c4ae4df989c2a7 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Mon, 11 May 2026 12:01:45 +0200
Subject: [PATCH 20/50] refactor: move ai sse plumbing to windmill-ai (#9059)

* docs: refine windmill ai refactor plan

* refactor: move ai sse plumbing to windmill-ai

* refactor: remove ai re-export shims

* fix: update ee ai memory ref

* chore: update ee-repo-ref to d3bc7fa85195b46b7a38d43c2f806520bf8b5454

This commit updates the EE repository reference after PR #560 was merged in windmill-ee-private.

Previous ee-repo-ref: ff35bf7cc198e13884b33654e1d6dbd8a8b314d3

New ee-repo-ref: d3bc7fa85195b46b7a38d43c2f806520bf8b5454

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/Cargo.lock                            |  2 +
 backend/ee-repo-ref.txt                       |  2 +-
 backend/windmill-ai/Cargo.toml                |  2 +
 backend/windmill-ai/src/lib.rs                |  2 +
 .../src/ai => windmill-ai/src}/sse.rs         | 19 +++--
 backend/windmill-ai/src/utils.rs              | 56 ++++++++++++++
 backend/windmill-api/src/ai.rs                | 29 +------
 .../windmill-worker/src/ai/image_handler.rs   |  3 +-
 backend/windmill-worker/src/ai/mod.rs         |  2 -
 .../src/ai/providers/anthropic.rs             | 11 +--
 .../src/ai/providers/bedrock.rs               | 17 ++--
 .../src/ai/providers/google_ai.rs             | 18 ++---
 .../src/ai/providers/openai.rs                | 12 +--
 .../src/ai/providers/openrouter.rs            | 11 ++-
 .../windmill-worker/src/ai/providers/other.rs | 10 +--
 .../windmill-worker/src/ai/query_builder.rs   | 19 ++---
 backend/windmill-worker/src/ai/tools.rs       |  6 +-
 backend/windmill-worker/src/ai/types.rs       |  2 -
 backend/windmill-worker/src/ai/utils.rs       | 29 +------
 backend/windmill-worker/src/ai_executor.rs    | 49 +++---------
 backend/windmill-worker/src/memory_common.rs  |  2 +-
 backend/windmill-worker/src/memory_oss.rs     |  4 +-
 docs/windmill-ai-refactor-plan.md             | 77 +++++++++++++++++--
 23 files changed, 209 insertions(+), 175 deletions(-)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/sse.rs (99%)
 create mode 100644 backend/windmill-ai/src/utils.rs
 delete mode 100644 backend/windmill-worker/src/ai/types.rs

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 6952682391..842799d5f9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -16114,12 +16114,14 @@ dependencies = [
  "aws-sdk-bedrockruntime",
  "aws-smithy-types",
  "base64 0.22.1",
+ "eventsource-stream",
  "lazy_static",
  "reqwest 0.13.1",
  "serde",
  "serde_json",
  "sqlx",
  "tokio",
+ "tokio-stream",
  "tracing",
  "uuid",
  "windmill-common",
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 401a8213f7..2e43e667c1 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-c8d100d74b8de6bd26fc973d5edbd8853d54dd8b
+d3bc7fa85195b46b7a38d43c2f806520bf8b5454
diff --git a/backend/windmill-ai/Cargo.toml b/backend/windmill-ai/Cargo.toml
index 69cc0f181b..3cfea846b9 100644
--- a/backend/windmill-ai/Cargo.toml
+++ b/backend/windmill-ai/Cargo.toml
@@ -21,6 +21,7 @@ windmill-mcp = { workspace = true, optional = true }
 
 async-trait.workspace = true
 base64.workspace = true
+eventsource-stream.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -29,6 +30,7 @@ uuid.workspace = true
 lazy_static.workspace = true
 tracing.workspace = true
 tokio.workspace = true
+tokio-stream.workspace = true
 
 # Bedrock (optional)
 aws-config = { workspace = true, optional = true }
diff --git a/backend/windmill-ai/src/lib.rs b/backend/windmill-ai/src/lib.rs
index dfa34e7d43..8b786cb741 100644
--- a/backend/windmill-ai/src/lib.rs
+++ b/backend/windmill-ai/src/lib.rs
@@ -5,4 +5,6 @@ pub mod ai_google;
 pub mod ai_providers;
 pub mod ai_types;
 pub mod query_builder;
+pub mod sse;
 pub mod types;
+pub mod utils;
diff --git a/backend/windmill-worker/src/ai/sse.rs b/backend/windmill-ai/src/sse.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/sse.rs
rename to backend/windmill-ai/src/sse.rs
index 2cc03b148e..35a4e43acc 100644
--- a/backend/windmill-worker/src/ai/sse.rs
+++ b/backend/windmill-ai/src/sse.rs
@@ -3,17 +3,15 @@ use std::collections::HashMap;
 use eventsource_stream::Eventsource;
 use reqwest::Response;
 use serde::Deserialize;
-use serde_json;
 use tokio_stream::StreamExt;
-use windmill_ai::{
-    ai_google::{parse_gemini_sse_event, GeminiUsageMetadata},
-    ai_types::{ExtraContent, GoogleExtraContent, OpenAIFunction, OpenAIToolCall},
-};
 use windmill_common::{error::Error, utils::rd_string};
 
-use crate::ai::{
+use crate::{
+    ai_google::{parse_gemini_sse_event, GeminiUsageMetadata},
+    ai_types::UrlCitation,
+    ai_types::{ExtraContent, GoogleExtraContent, OpenAIFunction, OpenAIToolCall},
     query_builder::StreamEventSink,
-    types::{StreamingEvent, UrlCitation},
+    types::StreamingEvent,
 };
 
 #[derive(Deserialize)]
@@ -64,6 +62,7 @@ lazy_static::lazy_static! {
         .parse::<bool>()
         .unwrap_or(false);
 }
+#[allow(async_fn_in_trait)]
 pub trait SSEParser {
     async fn parse_event_data(&mut self, data: &str) -> Result<(), Error>;
 
@@ -459,11 +458,11 @@ impl SSEParser for AnthropicSSEParser {
 // Gemini SSE Parser
 // ============================================================================
 
-/// Accumulates Gemini streaming events and converts them into the worker's
-/// internal [`OpenAIToolCall`] / [`StreamingEvent`] representation.
+/// Accumulates Gemini streaming events and converts them into the shared
+/// [`OpenAIToolCall`] / [`StreamingEvent`] representation.
 ///
 /// The actual SSE parsing is delegated to [`parse_gemini_sse_event`] from
-/// `windmill_common::ai_google` so the logic can be shared with the API proxy.
+/// `windmill_ai::ai_google` so the logic can be shared with the API proxy.
 pub struct GeminiSSEParser {
     pub accumulated_content: String,
     pub accumulated_tool_calls: HashMap<i64, OpenAIToolCall>,
diff --git a/backend/windmill-ai/src/utils.rs b/backend/windmill-ai/src/utils.rs
new file mode 100644
index 0000000000..b401282df1
--- /dev/null
+++ b/backend/windmill-ai/src/utils.rs
@@ -0,0 +1,56 @@
+use crate::{
+    ai_providers::AIProvider,
+    ai_types::{ContentPart, OpenAIContent},
+};
+
+lazy_static::lazy_static! {
+    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples
+    /// Format: "header1: value1, header2: value2"
+    pub static ref AI_HTTP_HEADERS: Vec<(String, String)> = {
+        std::env::var("AI_HTTP_HEADERS")
+            .ok()
+            .map(|headers_str| {
+                headers_str
+                    .split(',')
+                    .filter_map(|header| {
+                        let parts: Vec<&str> = header.splitn(2, ':').collect();
+                        if parts.len() == 2 {
+                            let name = parts[0].trim().to_string();
+                            let value = parts[1].trim().to_string();
+                            if !name.is_empty() && !value.is_empty() {
+                                Some((name, value))
+                            } else {
+                                None
+                            }
+                        } else {
+                            None
+                        }
+                    })
+                    .collect()
+            })
+            .unwrap_or_default()
+    };
+}
+
+/// AWS Bedrock do not handle structured output query param, so we use a tool for structured output. Same for every Claude models.
+pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) -> bool {
+    model.contains("claude") || provider == &AIProvider::AWSBedrock
+}
+
+/// Extract text content from OpenAIContent, joining parts with space if multiple
+pub fn extract_text_content(content: &OpenAIContent) -> String {
+    match content {
+        OpenAIContent::Text(text) => text.clone(),
+        OpenAIContent::Parts(parts) => parts
+            .iter()
+            .filter_map(|p| {
+                if let ContentPart::Text { text } = p {
+                    Some(text.as_str())
+                } else {
+                    None
+                }
+            })
+            .collect::<Vec<_>>()
+            .join(""),
+    }
+}
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index a2c4ceb811..8b415997c2 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -15,11 +15,12 @@ use serde::{Deserialize, Serialize};
 use serde_json::{json, value::RawValue};
 use std::collections::HashMap;
 use std::time::Duration;
-use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_ai::ai_cache::current_instance_ai_config_revision;
 use windmill_ai::ai_providers::{
     empty_string_as_none, AIPlatform, AIProvider, ProviderConfig, ProviderModel,
 };
+use windmill_ai::utils::AI_HTTP_HEADERS;
+use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::db::UserDB;
 use windmill_common::error::{to_anyhow, Error, Result};
 use windmill_common::utils::configure_client;
@@ -101,32 +102,6 @@ lazy_static::lazy_static! {
 
     pub static ref AI_REQUEST_CACHE: Cache<(String, AIProvider), ExpiringAIRequestConfig> = Cache::new(500);
 
-    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples
-    /// Format: "header1: value1, header2: value2"
-    static ref AI_HTTP_HEADERS: Vec<(String, String)> = {
-        std::env::var("AI_HTTP_HEADERS")
-            .ok()
-            .map(|headers_str| {
-                headers_str
-                    .split(',')
-                    .filter_map(|header| {
-                        let parts: Vec<&str> = header.splitn(2, ':').collect();
-                        if parts.len() == 2 {
-                            let name = parts[0].trim().to_string();
-                            let value = parts[1].trim().to_string();
-                            if !name.is_empty() && !value.is_empty() {
-                                Some((name, value))
-                            } else {
-                                None
-                            }
-                        } else {
-                            None
-                        }
-                    })
-                    .collect()
-            })
-            .unwrap_or_default()
-    };
 }
 
 pub(crate) fn invalidate_ai_request_cache_for_workspace(workspace_id: &str) {
diff --git a/backend/windmill-worker/src/ai/image_handler.rs b/backend/windmill-worker/src/ai/image_handler.rs
index 4fc0bcb4db..089d73dc42 100644
--- a/backend/windmill-worker/src/ai/image_handler.rs
+++ b/backend/windmill-worker/src/ai/image_handler.rs
@@ -1,12 +1,11 @@
 use base64::Engine;
 use futures;
 use ulid;
+use windmill_ai::types::*;
 use windmill_common::{client::AuthedClient, error::Error};
 use windmill_queue::MiniPulledJob;
 use windmill_types::s3::S3Object;
 
-use crate::ai::types::*;
-
 /// Upload image to S3 and return S3Object
 pub async fn upload_image_to_s3(
     base64_image: &str,
diff --git a/backend/windmill-worker/src/ai/mod.rs b/backend/windmill-worker/src/ai/mod.rs
index 4ad67b9e6e..2423fca372 100644
--- a/backend/windmill-worker/src/ai/mod.rs
+++ b/backend/windmill-worker/src/ai/mod.rs
@@ -4,7 +4,5 @@
 pub mod image_handler;
 pub mod providers;
 pub mod query_builder;
-pub mod sse;
 pub mod tools;
-pub mod types;
 pub mod utils;
diff --git a/backend/windmill-worker/src/ai/providers/anthropic.rs b/backend/windmill-worker/src/ai/providers/anthropic.rs
index 2bbfd83768..f2c310923f 100644
--- a/backend/windmill-worker/src/ai/providers/anthropic.rs
+++ b/backend/windmill-worker/src/ai/providers/anthropic.rs
@@ -1,16 +1,17 @@
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
-use windmill_ai::{ai_google::parse_data_url, ai_providers::AIProvider};
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
-    image_handler::prepare_messages_for_api,
+use windmill_ai::{
+    ai_google::parse_data_url,
+    ai_providers::AIProvider,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{AnthropicSSEParser, SSEParser},
     types::*,
     utils::{extract_text_content, should_use_structured_output_tool},
 };
+use windmill_common::{client::AuthedClient, error::Error};
+
+use crate::ai::image_handler::prepare_messages_for_api;
 
 /// Anthropic API version for standard API
 const ANTHROPIC_VERSION_STANDARD: &str = "2023-06-01";
diff --git a/backend/windmill-worker/src/ai/providers/bedrock.rs b/backend/windmill-worker/src/ai/providers/bedrock.rs
index ce87d21a44..ec499f5fcd 100644
--- a/backend/windmill-worker/src/ai/providers/bedrock.rs
+++ b/backend/windmill-worker/src/ai/providers/bedrock.rs
@@ -6,25 +6,22 @@
 //! - Stream event parsing
 //! - Helper utilities
 
-use crate::ai::{
-    image_handler::prepare_messages_for_api,
-    query_builder::{ParsedResponse, StreamEventSink},
-    types::StreamingEvent,
-    types::TokenUsage,
-    types::{OpenAIMessage, ToolDef},
-};
+use crate::ai::image_handler::prepare_messages_for_api;
 use std::collections::HashMap;
+use windmill_ai::{
+    query_builder::{ParsedResponse, StreamEventSink},
+    types::{OpenAIMessage, StreamingEvent, TokenUsage, ToolDef},
+};
 use windmill_common::{client::AuthedClient, error::Error};
 
-// Re-export from shared module for use by other parts of the worker
+// Import shared Bedrock helpers for worker-specific orchestration.
 use windmill_ai::ai_bedrock::{
     bedrock_model_supports_prompt_caching, bedrock_stream_event_is_block_stop,
     bedrock_stream_event_to_text, bedrock_stream_event_to_tool_delta,
     bedrock_stream_event_to_tool_start, build_tool_config, create_inference_config,
     format_bedrock_error, openai_messages_to_bedrock, streaming_tool_calls_to_openai,
-    StreamingToolCall,
+    BedrockClient, StreamingToolCall,
 };
-pub use windmill_ai::ai_bedrock::{check_env_credentials, BedrockClient};
 
 // ============================================================================
 // Query Builder (Worker-specific orchestration)
diff --git a/backend/windmill-worker/src/ai/providers/google_ai.rs b/backend/windmill-worker/src/ai/providers/google_ai.rs
index 6098cb22d8..2a00011de7 100644
--- a/backend/windmill-worker/src/ai/providers/google_ai.rs
+++ b/backend/windmill-worker/src/ai/providers/google_ai.rs
@@ -1,17 +1,17 @@
 use async_trait::async_trait;
-use windmill_ai::ai_google::{
-    openai_messages_to_gemini, openai_tools_to_gemini, GeminiGenerationConfig, GeminiImageContent,
-    GeminiImageRequest, GeminiImageResponse, GeminiInlineData, GeminiPart, GeminiPredictContent,
-    GeminiTextRequest, GeminiTool,
-};
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
-    image_handler::{download_and_encode_s3_image, prepare_messages_for_api},
+use windmill_ai::{
+    ai_google::{
+        openai_messages_to_gemini, openai_tools_to_gemini, GeminiGenerationConfig,
+        GeminiImageContent, GeminiImageRequest, GeminiImageResponse, GeminiInlineData, GeminiPart,
+        GeminiPredictContent, GeminiTextRequest, GeminiTool,
+    },
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{GeminiSSEParser, SSEParser},
     types::*,
 };
+use windmill_common::{client::AuthedClient, error::Error};
+
+use crate::ai::image_handler::{download_and_encode_s3_image, prepare_messages_for_api};
 
 // ============================================================================
 // Query Builder Implementation
diff --git a/backend/windmill-worker/src/ai/providers/openai.rs b/backend/windmill-worker/src/ai/providers/openai.rs
index 52feb2eca7..691f8fd5e3 100644
--- a/backend/windmill-worker/src/ai/providers/openai.rs
+++ b/backend/windmill-worker/src/ai/providers/openai.rs
@@ -1,17 +1,17 @@
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
-use windmill_ai::ai_providers::AIProvider;
-use windmill_ai::ai_types::OpenAIToolCall;
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
-    image_handler::{prepare_messages_for_api, s3_object_to_content_part},
+use windmill_ai::{
+    ai_providers::AIProvider,
+    ai_types::OpenAIToolCall,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAIResponsesSSEParser, SSEParser},
     types::*,
     utils::extract_text_content,
 };
+use windmill_common::{client::AuthedClient, error::Error};
+
+use crate::ai::image_handler::{prepare_messages_for_api, s3_object_to_content_part};
 
 // Responses API structures
 #[derive(Deserialize)]
diff --git a/backend/windmill-worker/src/ai/providers/openrouter.rs b/backend/windmill-worker/src/ai/providers/openrouter.rs
index 68ad1922d3..9bfc47ed8f 100644
--- a/backend/windmill-worker/src/ai/providers/openrouter.rs
+++ b/backend/windmill-worker/src/ai/providers/openrouter.rs
@@ -1,15 +1,14 @@
 use async_trait::async_trait;
 use serde::{Deserialize, Serialize};
 use serde_json;
-use windmill_ai::ai_providers::AIProvider;
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
-    image_handler::prepare_messages_for_api,
-    providers::other::OtherQueryBuilder,
+use windmill_ai::{
+    ai_providers::AIProvider,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     types::*,
 };
+use windmill_common::{client::AuthedClient, error::Error};
+
+use crate::ai::{image_handler::prepare_messages_for_api, providers::other::OtherQueryBuilder};
 
 // OpenRouter-specific types
 #[derive(Serialize)]
diff --git a/backend/windmill-worker/src/ai/providers/other.rs b/backend/windmill-worker/src/ai/providers/other.rs
index f8ee60f287..7982dc739d 100644
--- a/backend/windmill-worker/src/ai/providers/other.rs
+++ b/backend/windmill-worker/src/ai/providers/other.rs
@@ -1,16 +1,16 @@
 use async_trait::async_trait;
 use serde::Serialize;
 use serde_json;
-use windmill_ai::ai_providers::AIProvider;
-use windmill_common::{client::AuthedClient, error::Error};
-
-use crate::ai::{
-    image_handler::prepare_messages_for_api,
+use windmill_ai::{
+    ai_providers::AIProvider,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAISSEParser, SSEParser},
     types::*,
     utils::should_use_structured_output_tool,
 };
+use windmill_common::{client::AuthedClient, error::Error};
+
+use crate::ai::image_handler::prepare_messages_for_api;
 
 #[derive(Serialize, Debug, Clone)]
 #[serde(rename_all = "lowercase")]
diff --git a/backend/windmill-worker/src/ai/query_builder.rs b/backend/windmill-worker/src/ai/query_builder.rs
index d74c45c098..606aa8f9db 100644
--- a/backend/windmill-worker/src/ai/query_builder.rs
+++ b/backend/windmill-worker/src/ai/query_builder.rs
@@ -1,24 +1,19 @@
 use async_trait::async_trait;
+use windmill_ai::{
+    query_builder::{QueryBuilder, StreamEventSink},
+    types::*,
+};
 use windmill_common::{error::Error, worker::Connection};
 use windmill_queue::MiniPulledJob;
 
 use crate::{
-    ai::{
-        providers::{
-            anthropic::AnthropicQueryBuilder, google_ai::GoogleAIQueryBuilder,
-            openai::OpenAIQueryBuilder, openrouter::OpenRouterQueryBuilder,
-            other::OtherQueryBuilder,
-        },
-        types::*,
+    ai::providers::{
+        anthropic::AnthropicQueryBuilder, google_ai::GoogleAIQueryBuilder,
+        openai::OpenAIQueryBuilder, openrouter::OpenRouterQueryBuilder, other::OtherQueryBuilder,
     },
     job_logger::append_result_stream,
 };
 
-// Re-export from windmill_ai
-pub use windmill_ai::query_builder::{
-    BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink,
-};
-
 /// Factory function to create the appropriate query builder for a provider
 pub fn create_query_builder(provider: &ProviderWithResource) -> Box<dyn QueryBuilder> {
     use windmill_ai::ai_providers::AIProvider;
diff --git a/backend/windmill-worker/src/ai/tools.rs b/backend/windmill-worker/src/ai/tools.rs
index c92fc2a94e..fcc9cdf3c9 100644
--- a/backend/windmill-worker/src/ai/tools.rs
+++ b/backend/windmill-worker/src/ai/tools.rs
@@ -1,6 +1,4 @@
-use crate::ai::query_builder::{StreamEventProcessor, StreamEventSink};
-use crate::ai::types::McpToolSource;
-use crate::ai::types::*;
+use crate::ai::query_builder::StreamEventProcessor;
 use crate::ai::utils::{
     add_message_to_conversation, execute_mcp_tool, get_step_name_from_flow,
     is_completed_input_transform, update_flow_status_module_with_actions,
@@ -20,7 +18,7 @@ use mappable_rc::Marc;
 use serde_json::value::RawValue;
 use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
-use windmill_ai::ai_types::OpenAIToolCall;
+use windmill_ai::{ai_types::OpenAIToolCall, query_builder::StreamEventSink, types::*};
 use windmill_common::jobs::JobPayload;
 
 #[cfg(feature = "mcp")]
diff --git a/backend/windmill-worker/src/ai/types.rs b/backend/windmill-worker/src/ai/types.rs
deleted file mode 100644
index 57619f0dd9..0000000000
--- a/backend/windmill-worker/src/ai/types.rs
+++ /dev/null
@@ -1,2 +0,0 @@
-// Re-export all types from windmill_ai::types
-pub use windmill_ai::types::*;
diff --git a/backend/windmill-worker/src/ai/utils.rs b/backend/windmill-worker/src/ai/utils.rs
index f1e8fdd22f..74e75ef0a5 100644
--- a/backend/windmill-worker/src/ai/utils.rs
+++ b/backend/windmill-worker/src/ai/utils.rs
@@ -1,5 +1,3 @@
-pub use crate::ai::types::McpToolSource;
-use crate::ai::types::ToolDef;
 use anyhow::Context;
 use serde_json::value::RawValue;
 use sqlx::types::Json;
@@ -8,7 +6,7 @@ use std::{
     sync::Arc,
 };
 use uuid::Uuid;
-use windmill_ai::ai_providers::AIProvider;
+use windmill_ai::types::*;
 use windmill_common::flows::FlowModuleValue;
 use windmill_common::{
     db::DB,
@@ -24,7 +22,7 @@ use windmill_common::{
 use windmill_mcp::{McpClient, McpResource, McpTool};
 use windmill_queue::{flow_status::get_step_of_flow_status, MiniPulledJob};
 
-use crate::{ai::types::*, parse_sig_of_lang};
+use crate::parse_sig_of_lang;
 
 pub fn parse_raw_script_schema(
     content: &str,
@@ -323,11 +321,6 @@ pub fn get_step_name_from_flow(
     )
 }
 
-/// AWS Bedrock do not handle structured output query param, so we use a tool for structured output. Same for every Claude models.
-pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) -> bool {
-    model.contains("claude") || provider == &AIProvider::AWSBedrock
-}
-
 /// Cleanup MCP clients by gracefully shutting down connections
 #[cfg(feature = "mcp")]
 pub async fn cleanup_mcp_clients(mcp_clients: HashMap<String, Arc<McpClient>>) {
@@ -713,21 +706,3 @@ pub fn any_tool_needs_previous_result(tools: &[Tool]) -> bool {
         false
     })
 }
-
-/// Extract text content from OpenAIContent, joining parts with space if multiple
-pub fn extract_text_content(content: &OpenAIContent) -> String {
-    match content {
-        OpenAIContent::Text(text) => text.clone(),
-        OpenAIContent::Parts(parts) => parts
-            .iter()
-            .filter_map(|p| {
-                if let ContentPart::Text { text } = p {
-                    Some(text.as_str())
-                } else {
-                    None
-                }
-            })
-            .collect::<Vec<_>>()
-            .join(""),
-    }
-}
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index 03153df0a4..4dfeee3571 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -1,12 +1,10 @@
-#[cfg(feature = "bedrock")]
-use crate::ai::providers::bedrock::check_env_credentials;
 use crate::ai::tools::{execute_tool_calls, ToolAbortHandles, ToolExecutionContext};
 use crate::ai::utils::{
     add_message_to_conversation, any_tool_needs_previous_result, cleanup_mcp_clients,
     filter_schema_by_input_transforms, find_unique_tool_name, get_flow_context,
     get_flow_job_runnable_and_raw_flow, get_step_name_from_flow, load_mcp_tools,
-    parse_raw_script_schema, should_use_structured_output_tool,
-    update_flow_status_module_with_actions, update_flow_status_module_with_actions_success,
+    parse_raw_script_schema, update_flow_status_module_with_actions,
+    update_flow_status_module_with_actions_success,
 };
 use crate::memory_oss::{read_from_memory, write_to_memory};
 use crate::worker_flow::{get_previous_job_result, get_transform_context};
@@ -15,12 +13,19 @@ use regex::Regex;
 use serde_json::value::RawValue;
 use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
+#[cfg(feature = "bedrock")]
+use windmill_ai::ai_bedrock::check_env_credentials;
 #[cfg(feature = "mcp")]
 use windmill_mcp::McpClient;
 
 #[cfg(not(feature = "mcp"))]
 use crate::ai::tools::McpClientStub as McpClient;
-use windmill_ai::ai_providers::AIProvider;
+use windmill_ai::{
+    ai_providers::AIProvider,
+    query_builder::{BuildRequestArgs, ParsedResponse},
+    types::*,
+    utils::{should_use_structured_output_tool, AI_HTTP_HEADERS},
+};
 use windmill_common::{
     cache,
     client::AuthedClient,
@@ -40,10 +45,7 @@ use windmill_queue::{cancel_single_job, CanceledBy, MiniPulledJob};
 use crate::{
     ai::{
         image_handler::upload_image_to_s3,
-        query_builder::{
-            create_query_builder, BuildRequestArgs, ParsedResponse, StreamEventProcessor,
-        },
-        types::*,
+        query_builder::{create_query_builder, StreamEventProcessor},
     },
     common::{build_args_map, resolve_job_timeout, OccupancyMetrics, StreamNotifier},
     handle_child::{run_future_with_polling_update_job_poller_graceful, GracefulPollOutcome},
@@ -52,33 +54,6 @@ use crate::{
 lazy_static::lazy_static! {
     static ref TOOL_NAME_REGEX: Regex = Regex::new(r"^[a-zA-Z0-9_]+$").unwrap();
 
-    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples
-    /// Format: "header1: value1, header2: value2"
-    static ref AI_HTTP_HEADERS: Vec<(String, String)> = {
-        std::env::var("AI_HTTP_HEADERS")
-            .ok()
-            .map(|headers_str| {
-                headers_str
-                    .split(',')
-                    .filter_map(|header| {
-                        let parts: Vec<&str> = header.splitn(2, ':').collect();
-                        if parts.len() == 2 {
-                            let name = parts[0].trim().to_string();
-                            let value = parts[1].trim().to_string();
-                            if !name.is_empty() && !value.is_empty() {
-                                Some((name, value))
-                            } else {
-                                None
-                            }
-                        } else {
-                            None
-                        }
-                    })
-                    .collect()
-            })
-            .unwrap_or_default()
-    };
-
     static ref AI_AGENT_TOOL_SCHEMA: Box<RawValue> = to_raw_value(&serde_json::json!({
         "type": "object",
         "properties": {
@@ -791,7 +766,7 @@ pub async fn run_agent(
 
     let mut actions = vec![];
     let mut content = None;
-    let mut final_usage: Option<crate::ai::types::TokenUsage> = None;
+    let mut final_usage: Option<TokenUsage> = None;
 
     // Check if this provider supports tools with the current output type
     let supports_tools = query_builder.supports_tools_with_output_type(output_type);
diff --git a/backend/windmill-worker/src/memory_common.rs b/backend/windmill-worker/src/memory_common.rs
index 440199702f..e024acea69 100644
--- a/backend/windmill-worker/src/memory_common.rs
+++ b/backend/windmill-worker/src/memory_common.rs
@@ -1,5 +1,5 @@
-use crate::ai::types::OpenAIMessage;
 use uuid::Uuid;
+use windmill_ai::types::OpenAIMessage;
 use windmill_common::{db::DB, error::Error};
 
 pub const MAX_MEMORY_SIZE_BYTES: usize = 100_000; // 100KB per memory entry in database
diff --git a/backend/windmill-worker/src/memory_oss.rs b/backend/windmill-worker/src/memory_oss.rs
index 74771a79e8..dcdab14e2a 100644
--- a/backend/windmill-worker/src/memory_oss.rs
+++ b/backend/windmill-worker/src/memory_oss.rs
@@ -3,7 +3,9 @@
 pub use crate::memory_ee::*;
 
 #[cfg(not(all(feature = "private", feature = "enterprise")))]
-use {crate::ai::types::OpenAIMessage, crate::memory_common, uuid::Uuid, windmill_common::db::DB};
+use {
+    crate::memory_common, uuid::Uuid, windmill_ai::types::OpenAIMessage, windmill_common::db::DB,
+};
 
 /// Read AI agent memory from storage
 /// In OSS: always reads from database
diff --git a/docs/windmill-ai-refactor-plan.md b/docs/windmill-ai-refactor-plan.md
index 81ab5d7b86..78b82ddcc6 100644
--- a/docs/windmill-ai-refactor-plan.md
+++ b/docs/windmill-ai-refactor-plan.md
@@ -23,6 +23,58 @@ windmill-worker →  windmill-ai
 
 windmill-common does **NOT** re-export from windmill-ai (would be circular). All consumers update imports.
 
+## Reviewer Note: Keep the Next PR Small
+
+The first merged PR established the crate boundary; it did not yet remove the duplicated API-vs-worker provider paths. The remaining work should stay split by dependency risk, not by the final desired module layout.
+
+Do not jump directly from the current state to provider moves, proxy unification, and credential unification in one PR. The riskiest part is the API proxy because it combines request transformation, endpoint selection, auth headers, custom headers, OAuth user injection, Azure URL handling, Anthropic Vertex handling, Bedrock SDK calls, and SSE keepalive behavior.
+
+Pull the shared plumbing forward before moving provider implementations:
+- Move tiny shared utilities first, including `AI_HTTP_HEADERS`, `extract_text_content`, and `should_use_structured_output_tool`.
+- Move SSE parsers next, using the existing `StreamEventSink` abstraction, and update callers to import from `windmill_ai` directly.
+- Leave provider implementations, image upload/download handling, API proxy changes, and credential unification out of that PR.
+
+Avoid adding modules whose only purpose is to re-export moved code. Direct imports from `windmill_ai` make ownership and dependency direction clearer at each call site.
+
+Also do not make `build_proxy_request(raw_body, path)` too narrow. The proxy path needs method, incoming headers, resolved credentials, base URL/platform, organization/user fields, custom headers, and Bedrock/Azure/Vertex-specific context. Introduce a structured `ProxyBuildArgs`/`ProviderCredentials` shape before deleting `AIRequestConfig::prepare_request`, `google.rs`, or `bedrock.rs`.
+
+## Next Phase PR: Shared Plumbing Only
+
+Goal: make `windmill-ai` own the provider-independent helper code that later provider moves will need, without changing API proxy behavior or agent request behavior.
+
+Suggested PR title: `refactor(ai): move shared SSE plumbing into windmill-ai`.
+
+Scope:
+- Add `windmill-ai/src/utils.rs`.
+- Move the duplicated `AI_HTTP_HEADERS` parsing into `windmill_ai::utils` with identical parsing behavior.
+- Move `extract_text_content` and `should_use_structured_output_tool` from `windmill-worker/src/ai/utils.rs` to `windmill_ai::utils`.
+- Move `windmill-worker/src/ai/sse.rs` to `windmill-ai/src/sse.rs`.
+- Delete `windmill-worker/src/ai/sse.rs` and update callers to import parser types from `windmill_ai::sse`.
+- Update callers of moved utility functions to import from `windmill_ai::utils` directly.
+- Add the minimal new `windmill-ai` dependencies required by `sse.rs` (`eventsource-stream`, `tokio-stream`) and avoid adding worker/queue dependencies.
+
+Out of scope:
+- Do not move provider implementations.
+- Do not move `image_handler`.
+- Do not change `QueryBuilder` method signatures.
+- Do not add `build_proxy_request`.
+- Do not change API proxy routing, request preparation, credential resolution, audit logging, cache behavior, or Bedrock/Google special cases.
+- Do not remove `windmill-api/src/google.rs`, `windmill-api/src/bedrock.rs`, or `AIRequestConfig::prepare_request`.
+
+Implementation checklist:
+1. Add `utils.rs` to `windmill-ai` and export it from `lib.rs`.
+2. Move `AI_HTTP_HEADERS` exactly once, then update `windmill-api/src/ai.rs` and `windmill-worker/src/ai_executor.rs` to import it.
+3. Move the two provider-independent helper functions into `windmill_ai::utils`; leave worker-specific flow/MCP/conversation utilities in `windmill-worker/src/ai/utils.rs`.
+4. Move `sse.rs` into `windmill-ai`, change imports from `crate::ai::{query_builder, types}` to `crate::{query_builder, types}`, and keep behavior unchanged.
+5. Remove worker `ai/sse.rs` and update provider imports to use `windmill_ai::sse` directly.
+6. Run focused grep checks for duplicate `AI_HTTP_HEADERS`, old local helper definitions, and accidental `windmill_queue`/worker dependencies from `windmill-ai`.
+7. Validate with `cargo check -p windmill-ai`, `cargo check -p windmill-worker`, and `cargo check -p windmill-api`. For `bedrock` builds, also check the existing bedrock feature path.
+
+Review expectations:
+- The diff should be mostly moved code and import updates.
+- The behavior should be byte-for-byte equivalent where practical.
+- Tests are only needed if helper behavior changes. For a pure move, existing backend checks plus manual AI streaming verification are enough.
+
 ## Step-by-Step Plan
 
 Each step produces a compiling, working backend.
@@ -131,18 +183,27 @@ This is the key unification step. Add a new method to the `QueryBuilder` trait:
 /// Used by the API chat proxy. Handles format conversion for non-OpenAI providers.
 fn build_proxy_request(
     &self,
-    raw_body: &[u8],
-    path: &str,
+    args: &ProxyBuildArgs<'_>,
 ) -> Result<ProxyRequest, Error>;
 ```
 
-Where `ProxyRequest` contains the transformed body, endpoint URL, and auth headers:
+Where `ProxyBuildArgs` carries the API proxy context that provider implementations need:
+```rust
+pub struct ProxyBuildArgs<'a> {
+    pub method: http::Method,
+    pub path: &'a str,
+    pub headers: &'a http::HeaderMap,
+    pub body: &'a [u8],
+    pub credentials: &'a ProviderCredentials,
+}
+```
+
+And `ProxyRequest` contains the transformed request:
 ```rust
 pub struct ProxyRequest {
     pub url: String,
     pub body: Vec<u8>,
-    pub auth_headers: Vec<(String, String)>,
-    pub is_sse: bool,
+    pub headers: Vec<(String, String)>,
 }
 ```
 
@@ -153,9 +214,9 @@ pub struct ProxyRequest {
 - **Bedrock**: Convert OpenAI format → Bedrock SDK calls. Replaces `windmill-api/src/bedrock.rs`.
 
 **Refactor API proxy** (`windmill-api/src/ai.rs`):
-1. Parse provider from headers, resolve credentials → `ProviderWithResource`
+1. Parse provider from headers, resolve credentials → `ProviderCredentials`
 2. Create `QueryBuilder` via `create_query_builder`
-3. Call `query_builder.build_proxy_request(body, path)` → `ProxyRequest`
+3. Call `query_builder.build_proxy_request(&proxy_args)` → `ProxyRequest`
 4. Send the request, return response with SSE keepalive injection
 
 **Remove** from windmill-api:
@@ -166,7 +227,7 @@ pub struct ProxyRequest {
 - `supports_native_fim`, `transform_fim_to_chat_completions` — moved to windmill-ai
 
 **Keep** in API:
-- `AIRequestConfig::new` credential resolution (or refactor to produce `ProviderWithResource`)
+- `AIRequestConfig::new` credential resolution until it is refactored to produce `ProviderCredentials`
 - HTTP routes, audit logging, request caching
 - `inject_keepalives`, `is_sse_response` helpers
 - `AIConfig`, `ExpiringAIRequestConfig` caching types

From e43a958c5c6ae01a1fbecf3db63c6541a245be62 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Mon, 11 May 2026 14:30:37 +0200
Subject: [PATCH 21/50] feat(forks): prompt to delete forked children when
 deleting a fork (#9097)

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
---
 .../components/sidebar/SidebarContent.svelte  | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index 24817571c8..c2a790264a 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -4,6 +4,7 @@
 		superadmin,
 		usedTriggerKinds,
 		userStore,
+		userWorkspaces,
 		workspaceStore,
 		isCriticalAlertsUIOpen,
 		enterpriseLicense,
@@ -11,6 +12,7 @@
 		tutorialsToDo,
 		skippedAll
 	} from '$lib/stores'
+	import { findWorkspaceDescendants } from '$lib/utils/workspaceHierarchy'
 	import { syncTutorialsTodos } from '$lib/tutorialUtils'
 	import { SIDEBAR_SHOW_SCHEDULES } from '$lib/consts'
 	import {
@@ -123,12 +125,28 @@
 			}
 		}
 
+		if (deleteForkedChildren && forkedDescendants.length > 0) {
+			for (const child of forkedDescendants) {
+				try {
+					await WorkspaceService.deleteWorkspace({ workspace: child.id })
+				} catch (err) {
+					sendUserToast(`Failed to delete forked child ${child.id}: ${err}`, true)
+					return
+				}
+			}
+		}
+
 		await WorkspaceService.deleteWorkspace({ workspace })
 		sendUserToast('You deleted the workspace')
 		clearStores()
 		goto('/user/workspaces')
 	}
 
+	let deleteForkedChildren = $state(false)
+	const forkedDescendants = $derived(
+		$workspaceStore ? findWorkspaceDescendants($workspaceStore, $userWorkspaces ?? []) : []
+	)
+
 	let hasNewChangelogs = $state(false)
 	let recentChangelogs: Changelog[] = $state([])
 	let lastOpened = localStorage.getItem('changelogsLastOpened')
@@ -492,6 +510,7 @@
 								label: 'Delete Forked Workspace',
 								action: async () => {
 									await loadForkedDatatables()
+									deleteForkedChildren = false
 									deleteWorkspaceForkModal = true
 								},
 								icon: Trash2,
@@ -807,6 +826,30 @@
 	>
 		<div class="flex flex-col w-full space-y-4">
 			<span>Are you sure you want to delete this workspace fork? (deleting {$workspaceStore})</span>
+			{#if forkedDescendants.length > 0}
+				<div class="border rounded-md divide-y">
+					<div class="px-4 py-2 flex items-center justify-between gap-2">
+						<div class="flex flex-col min-w-0">
+							<span class="text-xs font-semibold text-secondary">Forked children</span>
+							<span class="text-3xs text-hint">
+								This fork has {forkedDescendants.length} forked
+								{forkedDescendants.length === 1 ? 'child' : 'children'} (transitively).
+							</span>
+						</div>
+						<Toggle
+							class="shrink-0"
+							size="xs"
+							bind:checked={deleteForkedChildren}
+							options={{ right: 'Also delete children' }}
+						/>
+					</div>
+					<ul class="px-4 py-2 text-3xs text-hint max-h-32 overflow-y-auto">
+						{#each forkedDescendants as child}
+							<li class="font-mono truncate" title={child.id}>{child.id}</li>
+						{/each}
+					</ul>
+				</div>
+			{/if}
 			{#if forkedDatatables.length > 0}
 				<div class="border rounded-md divide-y">
 					<div class="px-4 py-2 text-xs font-semibold text-secondary"> Forked databases </div>

From 05172ac3bdfc3472da5e9d8a825cdd479ba9e375 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 13:54:50 +0000
Subject: [PATCH 22/50] fix: populate raw_code for flowscript and appscript
 runs (#9104)

---
 backend/windmill-api/src/jobs.rs | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/backend/windmill-api/src/jobs.rs b/backend/windmill-api/src/jobs.rs
index efe03f73dd..ff72ddce70 100644
--- a/backend/windmill-api/src/jobs.rs
+++ b/backend/windmill-api/src/jobs.rs
@@ -1067,10 +1067,15 @@ impl<'a> GetQuery<'a> {
                 .ok()
                 .inspect(|data| job.raw_flow = Some(sqlx::types::Json(data.raw_flow.clone())));
         }
-        if self.with_code && job.job_kind() == &JobKind::Preview {
+        if self.with_code
+            && matches!(
+                job.job_kind(),
+                JobKind::Preview | JobKind::FlowScript | JobKind::AppScript
+            )
+        {
             // Try to fetch the code from the cache, fallback to the preview code.
-            // NOTE: This could check for the job kinds instead of the `or_else` but it's not
-            // necessary as `fetch_script` return early if the job kind is not a preview one.
+            // `fetch_script` resolves FlowScript / AppScript via their runnable_id; for
+            // Preview jobs it returns early and we fall through to `fetch_preview_script`.
             let conn = Connection::from(db.clone());
             cache::job::fetch_script(db.clone(), job.job_kind(), hash)
                 .or_else(|_| cache::job::fetch_preview_script(&conn, &id, raw_lock, raw_code))

From bbef5c9dd428c3a5f192b16d45a4592516873431 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 11 May 2026 16:56:52 +0200
Subject: [PATCH 23/50] ping PR author when auto-review verdict is not good to
 merge (#9101)

* feat(ci): ping PR author when auto-review verdict is not good to merge

* fix(ci): drop (unknown) author fallback and clarify verdict-line rule
---
 .github/workflows/codex-pr-review.yml | 14 ++++++++++++--
 .github/workflows/pi-pr-review.yml    | 14 ++++++++++++--
 .github/workflows/pr-ready-review.yml | 12 ++++++++++--
 REVIEW.md                             |  6 +++++-
 4 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/codex-pr-review.yml b/.github/workflows/codex-pr-review.yml
index e89a58b629..b4916714f2 100644
--- a/.github/workflows/codex-pr-review.yml
+++ b/.github/workflows/codex-pr-review.yml
@@ -82,10 +82,11 @@ jobs:
           EVENT_TITLE: ${{ github.event.pull_request.title }}
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
+          EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
             PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
-              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository)
+              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository,author)
             PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
             BASE_REF=$(echo "$PR_JSON" | jq -r '.baseRefName')
             BASE_SHA=$(echo "$PR_JSON" | jq -r '.baseRefOid')
@@ -93,6 +94,7 @@ jobs:
             PR_TITLE=$(echo "$PR_JSON" | jq -r '.title')
             PR_BODY=$(echo "$PR_JSON" | jq -r '.body // ""')
             IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
+            PR_AUTHOR=$(echo "$PR_JSON" | jq -r '.author.login // ""')
           else
             PR_NUMBER="$EVENT_PR_NUMBER"
             BASE_REF="$EVENT_BASE_REF"
@@ -101,6 +103,7 @@ jobs:
             PR_TITLE="$EVENT_TITLE"
             PR_BODY="$EVENT_BODY"
             IS_FORK="$EVENT_FORK"
+            PR_AUTHOR="$EVENT_AUTHOR"
           fi
           if [ "$IS_FORK" = "true" ]; then
             echo "Skipping Codex review for fork PR."
@@ -113,6 +116,7 @@ jobs:
             echo "base_ref=$BASE_REF"
             echo "base_sha=$BASE_SHA"
             echo "head_sha=$HEAD_SHA"
+            echo "pr_author=$PR_AUTHOR"
             echo 'title<<PR_TITLE_EOF'
             printf '%s\n' "$PR_TITLE"
             echo 'PR_TITLE_EOF'
@@ -211,6 +215,7 @@ jobs:
           PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
           PR_TITLE: ${{ steps.pr.outputs.title }}
           PR_BODY: ${{ steps.pr.outputs.body }}
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
           EXTRA_PROMPT: ${{ inputs.extra_prompt }}
         run: |
           mkdir -p .github/codex
@@ -219,6 +224,11 @@ jobs:
           const lines = [
             `Repository: ${process.env.PR_REPOSITORY}`,
             `PR number: ${process.env.PR_NUMBER}`,
+          ];
+          if (process.env.PR_AUTHOR) {
+            lines.push(`PR AUTHOR: ${process.env.PR_AUTHOR}`);
+          }
+          lines.push(
             `Base SHA: ${process.env.PR_BASE_SHA}`,
             `Head SHA: ${process.env.PR_HEAD_SHA}`,
             '',
@@ -236,7 +246,7 @@ jobs:
             '',
             'Full review diff command:',
             `git diff --unified=0 ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`
-          ];
+          );
           if (process.env.EXTRA_PROMPT && process.env.EXTRA_PROMPT.trim()) {
             lines.push('', 'Additional reviewer instructions:', process.env.EXTRA_PROMPT.trim());
           }
diff --git a/.github/workflows/pi-pr-review.yml b/.github/workflows/pi-pr-review.yml
index 9c0edc9cb5..9fbe43e9f0 100644
--- a/.github/workflows/pi-pr-review.yml
+++ b/.github/workflows/pi-pr-review.yml
@@ -82,10 +82,11 @@ jobs:
           EVENT_TITLE: ${{ github.event.pull_request.title }}
           EVENT_BODY: ${{ github.event.pull_request.body }}
           EVENT_FORK: ${{ github.event.pull_request.head.repo.fork }}
+          EVENT_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
             PR_JSON=$(gh pr view "$INPUT_PR_NUMBER" --repo "${{ github.repository }}" \
-              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository)
+              --json number,baseRefName,baseRefOid,headRefOid,title,body,isCrossRepository,author)
             PR_NUMBER=$(echo "$PR_JSON" | jq -r '.number')
             BASE_REF=$(echo "$PR_JSON" | jq -r '.baseRefName')
             BASE_SHA=$(echo "$PR_JSON" | jq -r '.baseRefOid')
@@ -93,6 +94,7 @@ jobs:
             PR_TITLE=$(echo "$PR_JSON" | jq -r '.title')
             PR_BODY=$(echo "$PR_JSON" | jq -r '.body // ""')
             IS_FORK=$(echo "$PR_JSON" | jq -r '.isCrossRepository')
+            PR_AUTHOR=$(echo "$PR_JSON" | jq -r '.author.login // ""')
           else
             PR_NUMBER="$EVENT_PR_NUMBER"
             BASE_REF="$EVENT_BASE_REF"
@@ -101,6 +103,7 @@ jobs:
             PR_TITLE="$EVENT_TITLE"
             PR_BODY="$EVENT_BODY"
             IS_FORK="$EVENT_FORK"
+            PR_AUTHOR="$EVENT_AUTHOR"
           fi
           if [ "$IS_FORK" = "true" ]; then
             echo "Skipping Pi review for fork PR."
@@ -113,6 +116,7 @@ jobs:
             echo "base_ref=$BASE_REF"
             echo "base_sha=$BASE_SHA"
             echo "head_sha=$HEAD_SHA"
+            echo "pr_author=$PR_AUTHOR"
             echo 'title<<PR_TITLE_EOF'
             printf '%s\n' "$PR_TITLE"
             echo 'PR_TITLE_EOF'
@@ -195,6 +199,7 @@ jobs:
           PR_HEAD_SHA: ${{ steps.pr.outputs.head_sha }}
           PR_TITLE: ${{ steps.pr.outputs.title }}
           PR_BODY: ${{ steps.pr.outputs.body }}
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
           EXTRA_PROMPT: ${{ inputs.extra_prompt }}
         run: |
           mkdir -p .github/pi
@@ -203,6 +208,11 @@ jobs:
           const lines = [
             `Repository: ${process.env.PR_REPOSITORY}`,
             `PR number: ${process.env.PR_NUMBER}`,
+          ];
+          if (process.env.PR_AUTHOR) {
+            lines.push(`PR AUTHOR: ${process.env.PR_AUTHOR}`);
+          }
+          lines.push(
             `Base SHA: ${process.env.PR_BASE_SHA}`,
             `Head SHA: ${process.env.PR_HEAD_SHA}`,
             '',
@@ -220,7 +230,7 @@ jobs:
             '',
             'Full review diff command:',
             `git diff --unified=0 ${process.env.PR_BASE_SHA}...${process.env.PR_HEAD_SHA}`
-          ];
+          );
           if (process.env.EXTRA_PROMPT && process.env.EXTRA_PROMPT.trim()) {
             lines.push('', 'Additional reviewer instructions:', process.env.EXTRA_PROMPT.trim());
           }
diff --git a/.github/workflows/pr-ready-review.yml b/.github/workflows/pr-ready-review.yml
index be2d13477a..6414cf944c 100644
--- a/.github/workflows/pr-ready-review.yml
+++ b/.github/workflows/pr-ready-review.yml
@@ -90,14 +90,21 @@ jobs:
       - name: Resolve PR number
         id: resolve
         env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
           INPUT_PR_NUMBER: ${{ inputs.pr_number }}
           EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+          EVENT_PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
           if [ -n "$INPUT_PR_NUMBER" ]; then
-            echo "pr_number=$INPUT_PR_NUMBER" >> "$GITHUB_OUTPUT"
+            PR_NUMBER="$INPUT_PR_NUMBER"
+            PR_AUTHOR=$(gh api "repos/$REPO/pulls/$PR_NUMBER" --jq '.user.login')
           else
-            echo "pr_number=$EVENT_PR_NUMBER" >> "$GITHUB_OUTPUT"
+            PR_NUMBER="$EVENT_PR_NUMBER"
+            PR_AUTHOR="$EVENT_PR_AUTHOR"
           fi
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+          echo "pr_author=$PR_AUTHOR" >> "$GITHUB_OUTPUT"
 
       - name: Fetch prior PR discussion
         id: prior
@@ -148,6 +155,7 @@ jobs:
           prompt: |
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ steps.resolve.outputs.pr_number }}
+            PR AUTHOR: ${{ steps.resolve.outputs.pr_author }}
 
             ${{ env.REVIEW_PROMPT }}
           claude_args: |
diff --git a/REVIEW.md b/REVIEW.md
index de311cccc6..21f5e50f26 100644
--- a/REVIEW.md
+++ b/REVIEW.md
@@ -9,7 +9,7 @@ You are reviewing a GitHub pull request for this repository. Apply this policy a
 
 ## Verdict (first line of the review)
 
-Start every review with a single verdict line, before any other section. Pick exactly one:
+Start every review with a single verdict line, before any other section (the only thing that may appear above the verdict is the optional `cc @<PR_AUTHOR>` ping described in "Pinging the author" below). Pick exactly one:
 
 - **Good to merge** — no blocking issues and no nits worth surfacing.
 - **Mergeable, but should ideally address nits: <short list>** — no blockers, but P2 findings that are worth a look. The list must name each nit briefly (e.g. "doc/code mismatch in `foo.rs`, half-finished `pub fn bar`").
@@ -17,6 +17,10 @@ Start every review with a single verdict line, before any other section. Pick ex
 
 The names in the list must match findings detailed later in the review. If you list a nit or issue here, it must appear with full context in the body. Do not invent items that aren't in the body, and do not bury blockers in the body without surfacing them in the verdict.
 
+## Pinging the author
+
+If the prompt context provides a `PR AUTHOR` (GitHub login) and the verdict is NOT "Good to merge" (i.e. it is "Mergeable, but should ideally address nits: ..." or "Should address issues before merging: ..."), prepend a single line `cc @<PR_AUTHOR>` to the top-level review comment, above the verdict line. This pings the author so they get a notification that there are items to address. Skip the ping entirely when the verdict is "Good to merge" — there is nothing for the author to act on. Do not add the ping to inline comments; the top-level summary comment is the only place it belongs.
+
 ## Review policy
 
 - Only report issues you are confident are real and introduced by this pull request.

From 6f7d31e56ba7a1357f0ffeda221b20d4e0cf2b78 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Mon, 11 May 2026 16:59:40 +0200
Subject: [PATCH 24/50] refactor: move ai image handling to windmill-ai (#9098)

---
 backend/Cargo.lock                            |  4 +++
 backend/windmill-ai/Cargo.toml                |  4 +++
 .../ai => windmill-ai/src}/image_handler.rs   | 27 ++++++++++++-------
 backend/windmill-ai/src/lib.rs                |  1 +
 backend/windmill-worker/src/ai/mod.rs         |  1 -
 .../src/ai/providers/anthropic.rs             |  3 +--
 .../src/ai/providers/bedrock.rs               |  2 +-
 .../src/ai/providers/google_ai.rs             |  3 +--
 .../src/ai/providers/openai.rs                |  3 +--
 .../src/ai/providers/openrouter.rs            |  3 ++-
 .../windmill-worker/src/ai/providers/other.rs |  3 +--
 backend/windmill-worker/src/ai_executor.rs    |  9 +++----
 12 files changed, 38 insertions(+), 25 deletions(-)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/image_handler.rs (86%)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 842799d5f9..719890fd97 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -16114,8 +16114,11 @@ dependencies = [
  "aws-sdk-bedrockruntime",
  "aws-smithy-types",
  "base64 0.22.1",
+ "bytes",
  "eventsource-stream",
+ "futures",
  "lazy_static",
+ "mime_guess",
  "reqwest 0.13.1",
  "serde",
  "serde_json",
@@ -16123,6 +16126,7 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "tracing",
+ "ulid",
  "uuid",
  "windmill-common",
  "windmill-mcp",
diff --git a/backend/windmill-ai/Cargo.toml b/backend/windmill-ai/Cargo.toml
index 3cfea846b9..542c390cc0 100644
--- a/backend/windmill-ai/Cargo.toml
+++ b/backend/windmill-ai/Cargo.toml
@@ -21,7 +21,10 @@ windmill-mcp = { workspace = true, optional = true }
 
 async-trait.workspace = true
 base64.workspace = true
+bytes.workspace = true
 eventsource-stream.workspace = true
+futures.workspace = true
+mime_guess.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
@@ -31,6 +34,7 @@ lazy_static.workspace = true
 tracing.workspace = true
 tokio.workspace = true
 tokio-stream.workspace = true
+ulid.workspace = true
 
 # Bedrock (optional)
 aws-config = { workspace = true, optional = true }
diff --git a/backend/windmill-worker/src/ai/image_handler.rs b/backend/windmill-ai/src/image_handler.rs
similarity index 86%
rename from backend/windmill-worker/src/ai/image_handler.rs
rename to backend/windmill-ai/src/image_handler.rs
index 089d73dc42..5bd9794da5 100644
--- a/backend/windmill-worker/src/ai/image_handler.rs
+++ b/backend/windmill-ai/src/image_handler.rs
@@ -1,15 +1,18 @@
+use crate::types::*;
 use base64::Engine;
 use futures;
 use ulid;
-use windmill_ai::types::*;
+use uuid::Uuid;
 use windmill_common::{client::AuthedClient, error::Error};
-use windmill_queue::MiniPulledJob;
 use windmill_types::s3::S3Object;
 
-/// Upload image to S3 and return S3Object
+/// Upload image to S3 and return S3Object.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn upload_image_to_s3(
     base64_image: &str,
-    job: &MiniPulledJob,
+    workspace_id: &str,
+    job_id: &Uuid,
     client: &AuthedClient,
 ) -> Result<S3Object, Error> {
     let image_bytes = base64::engine::general_purpose::STANDARD
@@ -18,7 +21,7 @@ pub async fn upload_image_to_s3(
 
     // Generate unique S3 key
     let unique_id = ulid::Ulid::new().to_string();
-    let s3_key = format!("ai_images/{}/{}.png", job.id, unique_id);
+    let s3_key = format!("ai_images/{}/{}.png", job_id, unique_id);
 
     // Create byte stream
     let byte_stream = futures::stream::once(async move {
@@ -28,7 +31,7 @@ pub async fn upload_image_to_s3(
     // Upload to S3
     client
         .upload_s3_file(
-            &job.workspace_id,
+            workspace_id,
             s3_key.clone(),
             None, // storage - use default
             byte_stream,
@@ -44,7 +47,9 @@ pub async fn upload_image_to_s3(
     })
 }
 
-/// Download an S3 image and convert it to a base64 data URL
+/// Download an S3 image and convert it to a base64 data URL.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn download_and_encode_s3_image(
     image: &S3Object,
     client: &AuthedClient,
@@ -70,6 +75,8 @@ pub async fn download_and_encode_s3_image(
 }
 
 /// Convert an S3Object to the appropriate ContentPart based on MIME type.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn s3_object_to_content_part(
     s3_object: &S3Object,
     client: &AuthedClient,
@@ -79,7 +86,7 @@ pub async fn s3_object_to_content_part(
         download_and_encode_s3_image(s3_object, client, workspace_id).await?;
     let data_url = format!("data:{};base64,{}", mime_type, file_bytes);
 
-    if windmill_ai::ai_types::is_document_mime(&mime_type) {
+    if crate::ai_types::is_document_mime(&mime_type) {
         let filename = s3_object
             .s3
             .rsplit('/')
@@ -92,7 +99,9 @@ pub async fn s3_object_to_content_part(
     }
 }
 
-/// Prepare messages for API by converting S3Objects to base64 ImageUrls
+/// Prepare messages for API by converting S3Objects to base64 ImageUrls.
+///
+/// The caller must provide an AuthedClient authorized for `workspace_id`.
 pub async fn prepare_messages_for_api(
     messages: &[OpenAIMessage],
     client: &AuthedClient,
diff --git a/backend/windmill-ai/src/lib.rs b/backend/windmill-ai/src/lib.rs
index 8b786cb741..945091613b 100644
--- a/backend/windmill-ai/src/lib.rs
+++ b/backend/windmill-ai/src/lib.rs
@@ -4,6 +4,7 @@ pub mod ai_cache;
 pub mod ai_google;
 pub mod ai_providers;
 pub mod ai_types;
+pub mod image_handler;
 pub mod query_builder;
 pub mod sse;
 pub mod types;
diff --git a/backend/windmill-worker/src/ai/mod.rs b/backend/windmill-worker/src/ai/mod.rs
index 2423fca372..b004b0ec20 100644
--- a/backend/windmill-worker/src/ai/mod.rs
+++ b/backend/windmill-worker/src/ai/mod.rs
@@ -1,7 +1,6 @@
 // AI executor module structure
 // This module will contain all AI-related execution logic
 
-pub mod image_handler;
 pub mod providers;
 pub mod query_builder;
 pub mod tools;
diff --git a/backend/windmill-worker/src/ai/providers/anthropic.rs b/backend/windmill-worker/src/ai/providers/anthropic.rs
index f2c310923f..0a3c5df6e4 100644
--- a/backend/windmill-worker/src/ai/providers/anthropic.rs
+++ b/backend/windmill-worker/src/ai/providers/anthropic.rs
@@ -4,6 +4,7 @@ use serde_json::value::RawValue;
 use windmill_ai::{
     ai_google::parse_data_url,
     ai_providers::AIProvider,
+    image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{AnthropicSSEParser, SSEParser},
     types::*,
@@ -11,8 +12,6 @@ use windmill_ai::{
 };
 use windmill_common::{client::AuthedClient, error::Error};
 
-use crate::ai::image_handler::prepare_messages_for_api;
-
 /// Anthropic API version for standard API
 const ANTHROPIC_VERSION_STANDARD: &str = "2023-06-01";
 /// Anthropic API version for Google Vertex AI
diff --git a/backend/windmill-worker/src/ai/providers/bedrock.rs b/backend/windmill-worker/src/ai/providers/bedrock.rs
index ec499f5fcd..8c37433cab 100644
--- a/backend/windmill-worker/src/ai/providers/bedrock.rs
+++ b/backend/windmill-worker/src/ai/providers/bedrock.rs
@@ -6,9 +6,9 @@
 //! - Stream event parsing
 //! - Helper utilities
 
-use crate::ai::image_handler::prepare_messages_for_api;
 use std::collections::HashMap;
 use windmill_ai::{
+    image_handler::prepare_messages_for_api,
     query_builder::{ParsedResponse, StreamEventSink},
     types::{OpenAIMessage, StreamingEvent, TokenUsage, ToolDef},
 };
diff --git a/backend/windmill-worker/src/ai/providers/google_ai.rs b/backend/windmill-worker/src/ai/providers/google_ai.rs
index 2a00011de7..19c50d06de 100644
--- a/backend/windmill-worker/src/ai/providers/google_ai.rs
+++ b/backend/windmill-worker/src/ai/providers/google_ai.rs
@@ -5,14 +5,13 @@ use windmill_ai::{
         GeminiImageContent, GeminiImageRequest, GeminiImageResponse, GeminiInlineData, GeminiPart,
         GeminiPredictContent, GeminiTextRequest, GeminiTool,
     },
+    image_handler::{download_and_encode_s3_image, prepare_messages_for_api},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{GeminiSSEParser, SSEParser},
     types::*,
 };
 use windmill_common::{client::AuthedClient, error::Error};
 
-use crate::ai::image_handler::{download_and_encode_s3_image, prepare_messages_for_api};
-
 // ============================================================================
 // Query Builder Implementation
 // ============================================================================
diff --git a/backend/windmill-worker/src/ai/providers/openai.rs b/backend/windmill-worker/src/ai/providers/openai.rs
index 691f8fd5e3..e0767d5dda 100644
--- a/backend/windmill-worker/src/ai/providers/openai.rs
+++ b/backend/windmill-worker/src/ai/providers/openai.rs
@@ -4,6 +4,7 @@ use serde_json::value::RawValue;
 use windmill_ai::{
     ai_providers::AIProvider,
     ai_types::OpenAIToolCall,
+    image_handler::{prepare_messages_for_api, s3_object_to_content_part},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAIResponsesSSEParser, SSEParser},
     types::*,
@@ -11,8 +12,6 @@ use windmill_ai::{
 };
 use windmill_common::{client::AuthedClient, error::Error};
 
-use crate::ai::image_handler::{prepare_messages_for_api, s3_object_to_content_part};
-
 // Responses API structures
 #[derive(Deserialize)]
 #[allow(dead_code)]
diff --git a/backend/windmill-worker/src/ai/providers/openrouter.rs b/backend/windmill-worker/src/ai/providers/openrouter.rs
index 9bfc47ed8f..ede541cd13 100644
--- a/backend/windmill-worker/src/ai/providers/openrouter.rs
+++ b/backend/windmill-worker/src/ai/providers/openrouter.rs
@@ -3,12 +3,13 @@ use serde::{Deserialize, Serialize};
 use serde_json;
 use windmill_ai::{
     ai_providers::AIProvider,
+    image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     types::*,
 };
 use windmill_common::{client::AuthedClient, error::Error};
 
-use crate::ai::{image_handler::prepare_messages_for_api, providers::other::OtherQueryBuilder};
+use crate::ai::providers::other::OtherQueryBuilder;
 
 // OpenRouter-specific types
 #[derive(Serialize)]
diff --git a/backend/windmill-worker/src/ai/providers/other.rs b/backend/windmill-worker/src/ai/providers/other.rs
index 7982dc739d..a840517133 100644
--- a/backend/windmill-worker/src/ai/providers/other.rs
+++ b/backend/windmill-worker/src/ai/providers/other.rs
@@ -3,6 +3,7 @@ use serde::Serialize;
 use serde_json;
 use windmill_ai::{
     ai_providers::AIProvider,
+    image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     sse::{OpenAISSEParser, SSEParser},
     types::*,
@@ -10,8 +11,6 @@ use windmill_ai::{
 };
 use windmill_common::{client::AuthedClient, error::Error};
 
-use crate::ai::image_handler::prepare_messages_for_api;
-
 #[derive(Serialize, Debug, Clone)]
 #[serde(rename_all = "lowercase")]
 pub enum ToolChoice {
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index 4dfeee3571..cdf2995f9c 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -22,6 +22,7 @@ use windmill_mcp::McpClient;
 use crate::ai::tools::McpClientStub as McpClient;
 use windmill_ai::{
     ai_providers::AIProvider,
+    image_handler::upload_image_to_s3,
     query_builder::{BuildRequestArgs, ParsedResponse},
     types::*,
     utils::{should_use_structured_output_tool, AI_HTTP_HEADERS},
@@ -43,10 +44,7 @@ use windmill_common::{
 use windmill_queue::{cancel_single_job, CanceledBy, MiniPulledJob};
 
 use crate::{
-    ai::{
-        image_handler::upload_image_to_s3,
-        query_builder::{create_query_builder, StreamEventProcessor},
-    },
+    ai::query_builder::{create_query_builder, StreamEventProcessor},
     common::{build_args_map, resolve_job_timeout, OccupancyMetrics, StreamNotifier},
     handle_child::{run_future_with_polling_update_job_poller_graceful, GracefulPollOutcome},
 };
@@ -1206,7 +1204,8 @@ pub async fn run_agent(
             }
             ParsedResponse::Image { base64_data } => {
                 // For image output, upload to S3 and track in conversation
-                let s3_object = upload_image_to_s3(&base64_data, job, client).await?;
+                let s3_object =
+                    upload_image_to_s3(&base64_data, &job.workspace_id, &job.id, client).await?;
 
                 let content = to_raw_value(&s3_object);
 

From 03e8bc8c14258355d7d695333c1588807fbf8cd6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 17:20:46 +0000
Subject: [PATCH 25/50] perf: lazy-load script editor history and hit partial
 index (#9107)

---
 .../src/lib/components/ScriptEditor.svelte    | 36 ++++++++++++++++---
 .../components/scriptEditor/LogPanel.svelte   |  8 ++++-
 2 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/frontend/src/lib/components/ScriptEditor.svelte b/frontend/src/lib/components/ScriptEditor.svelte
index 16f835fcdd..646cbc0477 100644
--- a/frontend/src/lib/components/ScriptEditor.svelte
+++ b/frontend/src/lib/components/ScriptEditor.svelte
@@ -561,6 +561,8 @@
 	let testIsLoading = $state(false)
 	let testJob: Job | undefined = $state()
 	let pastPreviews: CompletedJob[] = $state([])
+	let historyTabActive = false
+	let pastPreviewsRequest: ReturnType<typeof JobService.listCompletedJobs> | undefined
 	let validCode = $state(true)
 
 	// Recording
@@ -691,7 +693,9 @@
 						lastRecording = scriptRecording.stop()
 						setActiveRecording(undefined)
 					}
-					loadPastTests()
+					if (historyTabActive) {
+						loadPastTests()
+					}
 				},
 				doneError({ error }) {
 					if (scriptRecording.active) {
@@ -722,12 +726,29 @@
 	}
 
 	async function loadPastTests(): Promise<void> {
-		pastPreviews = await JobService.listCompletedJobs({
+		pastPreviewsRequest?.cancel()
+		const req = JobService.listCompletedJobs({
 			workspace: $workspaceStore!,
 			jobKinds: 'preview',
 			createdBy: $userStore?.username,
-			scriptPathExact: path
+			scriptPathExact: path,
+			hasNullParent: true
 		})
+		pastPreviewsRequest = req
+		try {
+			const result = await req
+			if (pastPreviewsRequest === req) {
+				pastPreviews = result
+			}
+		} catch (err) {
+			if (!(err instanceof Error) || err.name !== 'CancelError') {
+				throw err
+			}
+		} finally {
+			if (pastPreviewsRequest === req) {
+				pastPreviewsRequest = undefined
+			}
+		}
 	}
 
 	export async function inferSchema(
@@ -1128,7 +1149,6 @@
 		if (!validCode && code && lang) {
 			await inferSchema(code, { applyInitialArgs: true })
 		}
-		loadPastTests()
 		aiChatManager.saveAndClear()
 		aiChatManager.changeMode(AIMode.SCRIPT)
 	})
@@ -1209,6 +1229,8 @@
 	}
 
 	onDestroy(() => {
+		pastPreviewsRequest?.cancel()
+		pastPreviewsRequest = undefined
 		disableCollaboration()
 		aiChatManager.scriptEditorApplyCode = undefined
 		aiChatManager.scriptEditorShowDiffMode = undefined
@@ -1676,6 +1698,12 @@
 										} as any)
 									: testJob}
 								{pastPreviews}
+								onTabChange={(tab) => {
+									historyTabActive = tab === 'history'
+									if (historyTabActive) {
+										loadPastTests()
+									}
+								}}
 								previewIsLoading={debugMode
 									? $debugState.running && !$debugState.stopped
 									: testIsLoading}
diff --git a/frontend/src/lib/components/scriptEditor/LogPanel.svelte b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
index 82845c4a88..1f31d7f12d 100644
--- a/frontend/src/lib/components/scriptEditor/LogPanel.svelte
+++ b/frontend/src/lib/components/scriptEditor/LogPanel.svelte
@@ -49,6 +49,7 @@
 		capturesTab?: import('svelte').Snippet
 		customResultPanel?: import('svelte').Snippet
 		showCustomResultPanel?: boolean
+		onTabChange?: (tab: string) => void
 	}
 
 	let {
@@ -65,7 +66,8 @@
 		children,
 		capturesTab,
 		customResultPanel,
-		showCustomResultPanel = false
+		showCustomResultPanel = false,
+		onTabChange
 	}: Props = $props()
 
 	type DContent = {
@@ -78,6 +80,10 @@
 	let drawerOpen: boolean = $state(false)
 	let drawerContent: DContent | undefined = $state(undefined)
 
+	$effect(() => {
+		onTabChange?.(selectedTab)
+	})
+
 	export function setFocusToLogs() {
 		selectedTab = 'logs'
 	}

From 20ecd904e7060c3cf90f2605740bb349b2a3e6ed Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Mon, 11 May 2026 20:36:34 +0200
Subject: [PATCH 26/50] feat(operators): allow operators to access assets page
 (#9095)

* feat(operators): allow operators to access assets page

Adds the "assets" key to workspace operator_settings (defaulting to true
for existing and new workspaces) and toggles the frontend default so the
assets page is visible to operators by default.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* nit: remove settings btn when not available

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 ...5_add_assets_to_operator_settings.down.sql | 19 +++++++++++++
 ...225_add_assets_to_operator_settings.up.sql | 21 ++++++++++++++
 .../settings/WorkspaceOperatorSettings.svelte |  2 +-
 .../components/sidebar/SidebarContent.svelte  |  1 -
 .../(root)/(logged)/assets/+page.svelte       | 28 ++++++++++++-------
 5 files changed, 59 insertions(+), 12 deletions(-)
 create mode 100644 backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql
 create mode 100644 backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql

diff --git a/backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql b/backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql
new file mode 100644
index 0000000000..c38c2a1e42
--- /dev/null
+++ b/backend/migrations/20260511075225_add_assets_to_operator_settings.down.sql
@@ -0,0 +1,19 @@
+-- Remove "assets" key from operator_settings
+UPDATE workspace_settings
+SET operator_settings = operator_settings - 'assets'
+WHERE operator_settings IS NOT NULL
+  AND operator_settings ? 'assets';
+
+-- Revert the column default
+ALTER TABLE workspace_settings
+ALTER COLUMN operator_settings SET DEFAULT '{
+    "runs": true,
+    "groups": true,
+    "folders": true,
+    "workers": true,
+    "triggers": true,
+    "resources": true,
+    "schedules": true,
+    "variables": true,
+    "audit_logs": true
+}';
diff --git a/backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql b/backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql
new file mode 100644
index 0000000000..96aba860ec
--- /dev/null
+++ b/backend/migrations/20260511075225_add_assets_to_operator_settings.up.sql
@@ -0,0 +1,21 @@
+-- Add "assets": true to operator_settings for all workspaces that have operator_settings
+-- but don't already have an "assets" key
+UPDATE workspace_settings
+SET operator_settings = operator_settings || '{"assets": true}'::jsonb
+WHERE operator_settings IS NOT NULL
+  AND NOT operator_settings ? 'assets';
+
+-- Update the column default to include assets
+ALTER TABLE workspace_settings
+ALTER COLUMN operator_settings SET DEFAULT '{
+    "runs": true,
+    "groups": true,
+    "folders": true,
+    "workers": true,
+    "triggers": true,
+    "resources": true,
+    "schedules": true,
+    "variables": true,
+    "audit_logs": true,
+    "assets": true
+}';
diff --git a/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte b/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
index 6aaa69cc53..ba8f42cba7 100644
--- a/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
+++ b/frontend/src/lib/components/settings/WorkspaceOperatorSettings.svelte
@@ -17,7 +17,7 @@
 		schedules: true,
 		resources: true,
 		variables: true,
-		assets: false,
+		assets: true,
 		triggers: true,
 		audit_logs: true,
 		groups: true,
diff --git a/frontend/src/lib/components/sidebar/SidebarContent.svelte b/frontend/src/lib/components/sidebar/SidebarContent.svelte
index c2a790264a..f95d242657 100644
--- a/frontend/src/lib/components/sidebar/SidebarContent.svelte
+++ b/frontend/src/lib/components/sidebar/SidebarContent.svelte
@@ -303,7 +303,6 @@
 			label: 'Assets',
 			href: `${base}/assets`,
 			icon: Pyramid,
-			disabled: $userStore?.operator,
 			aiId: 'sidebar-menu-link-assets',
 			aiDescription: 'Button to navigate to assets'
 		},
diff --git a/frontend/src/routes/(root)/(logged)/assets/+page.svelte b/frontend/src/routes/(root)/(logged)/assets/+page.svelte
index 50ed6f041b..2873140fea 100644
--- a/frontend/src/routes/(root)/(logged)/assets/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/assets/+page.svelte
@@ -12,7 +12,13 @@
 		type AssetKind,
 		type ListAssetsResponse
 	} from '$lib/gen'
-	import { userStore, workspaceStore, userWorkspaces, globalDbManagerDrawer } from '$lib/stores'
+	import {
+		userStore,
+		workspaceStore,
+		userWorkspaces,
+		globalDbManagerDrawer,
+		superadmin
+	} from '$lib/stores'
 	import { parseDbInputFromAssetSyntax, pluralize, truncate } from '$lib/utils'
 	import ExploreAssetButton, {
 		assetCanBeExplored
@@ -182,15 +188,17 @@
 								>
 									See documentation
 								</Button>
-								<Button
-									wrapperClasses="h-fit"
-									variant={props.data.current?.length === 0 && !props.data.loading
-										? 'accent'
-										: 'subtle'}
-									iconOnly
-									endIcon={{ icon: SettingsIcon }}
-									href={props.settingsHref}
-								/>
+								{#if !($userStore?.operator || (!$userStore?.is_admin && !$superadmin))}
+									<Button
+										wrapperClasses="h-fit"
+										variant={props.data.current?.length === 0 && !props.data.loading
+											? 'accent'
+											: 'subtle'}
+										iconOnly
+										endIcon={{ icon: SettingsIcon }}
+										href={props.settingsHref}
+									/>
+								{/if}
 							</div>
 						</div>
 						{#if props.data.current?.length}

From 1e89aff2d67cfc1375c3d48b4f33f5517f8d01b6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 18:43:54 +0000
Subject: [PATCH 27/50] test(nativets): add #[ignore]'d smoke suite for
 deno_core / deno_ast / swc bumps (#9108)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds ten `#[ignore]`'d integration tests in
backend/windmill-runtime-nativets/src/smoke_tests.rs exercising the JS
API surface that the existing nativets tests in tests/worker.rs don't
reach. Run them when bumping the deno_core / deno_ast / deno_runtime /
swc_* pins in backend/Cargo.toml, not on every CI:

    cargo test -p windmill-runtime-nativets smoke -- --ignored
    # skip network-dependent ones with `--skip smoke_net_`

Why here and not in tests/worker.rs:
windmill-runtime-nativets is the only consumer of the deno_core crate
in the workspace — ScriptLang::Deno spawns the external `deno` binary
via deno_executor.rs, while ScriptLang::Nativets is the only path that
loads the in-process V8 runtime. So a deno_core / deno_ast bump can
only break things downstream of this crate. Co-locating the smoke
tests with the runtime they exercise means they hit the right surface
directly, skip the entire job-queue / worker / API-server stack, and
run in <1s end-to-end (vs. ~30-60s per test for the worker-level
nativets tests).

The tests use the existing `PrewarmedIsolate::spawn` API (already
public for the dedicated-worker path), which gives a clean
"compile-TS → load module → execute main(args) → return JSON" entry
point with no DB or queue plumbing required.

Coverage:
- smoke_basic_value_passing — args binding + return marshaling
- smoke_transpile_enum_and_union — TS-specific syntax (enums,
  discriminated unions, casts) through swc_ecma_parser / swc_ecma_ast
- smoke_set_timeout_and_promise_all — deno_web timer ops + V8
  microtask drain order
- smoke_url_and_searchparams — deno_url surface
- smoke_web_blob_btoa_atob — deno_web Blob + base64 ops
- smoke_large_payload_roundtrip — 512 KB string in/out through the
  op-table boundary
- smoke_error_propagation_with_message — thrown Error must surface
  in PrewarmedResult::Err with original message
- smoke_concurrent_isolates — 8 isolates spawned in parallel from
  the same tokio runtime; catches V8 isolate-setup races
- smoke_net_fetch_example_com — deno_fetch end-to-end against
  example.com
- smoke_net_fetch_json_and_headers — deno_fetch with custom request
  headers + Response.json() against httpbin.org/anything

`structuredClone` is not currently wired into the nativets global —
documented in the smoke_web_blob_btoa_atob test in case that ever
changes.

All ten tests pass locally against the current pinned versions
(deno_core 0.336.0 / deno_ast =0.44.0 / swc_common =0.37.5).
---
 backend/windmill-runtime-nativets/src/lib.rs  |   3 +
 .../src/smoke_tests.rs                        | 280 ++++++++++++++++++
 2 files changed, 283 insertions(+)
 create mode 100644 backend/windmill-runtime-nativets/src/smoke_tests.rs

diff --git a/backend/windmill-runtime-nativets/src/lib.rs b/backend/windmill-runtime-nativets/src/lib.rs
index dda57ae708..83de806716 100644
--- a/backend/windmill-runtime-nativets/src/lib.rs
+++ b/backend/windmill-runtime-nativets/src/lib.rs
@@ -15,6 +15,9 @@
 mod dedicated;
 pub use dedicated::{ExecutingIsolate, PrewarmedIsolate, PrewarmedResult};
 
+#[cfg(test)]
+mod smoke_tests;
+
 use std::{
     borrow::Cow,
     cell::RefCell,
diff --git a/backend/windmill-runtime-nativets/src/smoke_tests.rs b/backend/windmill-runtime-nativets/src/smoke_tests.rs
new file mode 100644
index 0000000000..20675ee2a7
--- /dev/null
+++ b/backend/windmill-runtime-nativets/src/smoke_tests.rs
@@ -0,0 +1,280 @@
+//! Opt-in smoke tests for the nativets V8 runtime.
+//!
+//! Exercise the deno_core / deno_ast / swc surface (TypeScript transpile,
+//! fetch, timers, URL, structuredClone, error propagation, concurrent
+//! isolates, large payload roundtrip) that the standard worker-level
+//! nativets tests in `backend/tests/worker.rs` don't reach — those tests
+//! validate value passing through the job queue, but not the JS API
+//! surface a deno_core bump would actually move.
+//!
+//! These tests are `#[ignore]`'d so the regular `cargo test` flow doesn't
+//! pay their cost (each spawns a V8 isolate; some hit the network). Run
+//! when changing the `deno_core` / `deno_ast` / `deno_runtime` / `swc_*`
+//! pins in `backend/Cargo.toml`:
+//!
+//!     cargo test -p windmill-runtime-nativets smoke -- --ignored
+//!
+//! Tests prefixed `smoke_net_` hit the public internet (httpbin.org,
+//! example.com) and will fail if the runner has no egress. Skip them
+//! locally with `cargo test -p windmill-runtime-nativets smoke -- --ignored --skip smoke_net_`.
+
+use crate::{transpile_ts, NativeAnnotation, PrewarmedIsolate, PrewarmedResult};
+
+/// Compile a TS snippet, run it through a fresh isolate with the given
+/// positional args, and return the isolate's result + captured logs.
+async fn run_ts(ts: &str, arg_names: &[&str], args: serde_json::Value) -> PrewarmedResult {
+    let js = transpile_ts(ts.to_string()).expect("transpile_ts failed");
+    let ann = NativeAnnotation { useragent: None, proxy: None };
+    let arg_names: Vec<String> = arg_names.iter().map(|s| s.to_string()).collect();
+    let mut iso = PrewarmedIsolate::spawn(String::new(), js, ann, arg_names, None);
+    iso.wait_ready().await.expect("isolate failed to pre-warm");
+    iso.start_execution(args.to_string())
+        .wait()
+        .await
+        .expect("isolate execution panicked")
+}
+
+fn unwrap_value(r: &PrewarmedResult) -> serde_json::Value {
+    let raw = r.result.as_ref().expect("script returned an error");
+    serde_json::from_str(raw.get()).expect("result not valid JSON")
+}
+
+// -----------------------------------------------------------------------------
+// Local (no network) — these still need V8 / deno_core ops to be wired.
+// -----------------------------------------------------------------------------
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_basic_value_passing() {
+    let ts = r#"
+export async function main(x: number): Promise<number> {
+    return x + 1;
+}
+"#;
+    let r = run_ts(ts, &["x"], serde_json::json!({"x": 41})).await;
+    assert_eq!(unwrap_value(&r), serde_json::json!(42));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_transpile_enum_and_union() {
+    // Enums + discriminated union + as-cast exercise the swc_ecma_ast +
+    // swc_ecma_parser TS-syntax paths the bare value tests don't.
+    let ts = r#"
+enum Direction { Up = "U", Down = "D" }
+type Msg = { kind: "move"; dir: Direction } | { kind: "stop" };
+export async function main(): Promise<string> {
+    const msgs: Msg[] = [
+        { kind: "move", dir: Direction.Up },
+        { kind: "stop" },
+        { kind: "move", dir: Direction.Down },
+    ];
+    return msgs.map(m => m.kind === "move" ? m.dir : "_").join(",");
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    assert_eq!(unwrap_value(&r), serde_json::json!("U,_,D"));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_set_timeout_and_promise_all() {
+    // setTimeout lives in deno_web; Promise.all hits the V8 microtask
+    // queue. A bump that breaks timer-op registration or microtask drain
+    // would surface here (script would hang or return wrong order).
+    let ts = r#"
+export async function main(): Promise<number[]> {
+    const delays = [40, 10, 20, 30];
+    return await Promise.all(delays.map(d =>
+        new Promise<number>(resolve => setTimeout(() => resolve(d), d))
+    ));
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    // Promise.all preserves input order regardless of resolution order.
+    assert_eq!(unwrap_value(&r), serde_json::json!([40, 10, 20, 30]));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_url_and_searchparams() {
+    // deno_url surface: URL ctor, URLSearchParams parsing + iteration.
+    let ts = r#"
+export async function main(): Promise<{ host: string; pairs: [string, string][] }> {
+    const u = new URL("https://example.com:8443/path?b=2&a=1&a=3");
+    const pairs: [string, string][] = [];
+    for (const [k, v] of u.searchParams) pairs.push([k, v]);
+    return { host: u.host, pairs };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    assert_eq!(
+        unwrap_value(&r),
+        serde_json::json!({
+            "host": "example.com:8443",
+            "pairs": [["b", "2"], ["a", "1"], ["a", "3"]],
+        }),
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_web_blob_btoa_atob() {
+    // deno_web surface: Blob, atob/btoa. `structuredClone` is *not* wired
+    // into the nativets global (the deno_web binding doesn't expose it
+    // here) — if that's ever changed, extend this test to cover it.
+    let ts = r#"
+export async function main(): Promise<{ b64: string; round_trip: string; size: number }> {
+    const blob = new Blob(["hello"], { type: "text/plain" });
+    const b64 = btoa("hello");
+    const round_trip = atob(b64);
+    return { b64, round_trip, size: blob.size };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    assert_eq!(
+        unwrap_value(&r),
+        serde_json::json!({
+            "b64": "aGVsbG8=",
+            "round_trip": "hello",
+            "size": 5,
+        }),
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_large_payload_roundtrip() {
+    // ~512 KB string in and out — exercises arg encoding + result
+    // serialization through the deno_core <-> host op boundary at sizes
+    // an op-table change could break.
+    let big_in: String = "a".repeat(512 * 1024);
+    let ts = r#"
+export async function main(s: string): Promise<{ in_len: number; out: string }> {
+    if (typeof s !== "string") throw new Error(`expected string, got ${typeof s}`);
+    return { in_len: s.length, out: "b".repeat(512 * 1024) };
+}
+"#;
+    let r = run_ts(ts, &["s"], serde_json::json!({"s": big_in})).await;
+    let v = unwrap_value(&r);
+    assert_eq!(v.get("in_len").and_then(|x| x.as_u64()), Some(512 * 1024));
+    let out_len = v
+        .get("out")
+        .and_then(|x| x.as_str())
+        .map(|s| s.len())
+        .unwrap_or(0);
+    assert_eq!(out_len, 512 * 1024);
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_error_propagation_with_message() {
+    // Throwing a typed Error must surface as PrewarmedResult::Err with
+    // the original message. A deno_core bump that changes the host-side
+    // error wrapping would lose this contract.
+    let ts = r#"
+export async function main(): Promise<void> {
+    throw new Error("nativets_smoke_marker_xyz");
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    let err = r.result.expect_err("expected script to fail");
+    assert!(
+        err.contains("nativets_smoke_marker_xyz"),
+        "thrown error message did not reach result: {err}",
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+#[ignore = "deno_core upgrade smoke; run with --ignored"]
+async fn smoke_concurrent_isolates() {
+    // Spawn N isolates in parallel from the same tokio runtime. Each
+    // PrewarmedIsolate uses spawn_blocking + a fresh V8 isolate.
+    // Catches isolate-setup races (V8_ISOLATE_CREATE_LOCK ordering) and
+    // any per-isolate state that a deno_core bump could break under
+    // concurrency.
+    let ts = r#"
+export async function main(i: number): Promise<number> {
+    return i * 10;
+}
+"#;
+    let js = transpile_ts(ts.to_string()).expect("transpile_ts failed");
+
+    const N: i64 = 8;
+    let mut handles = Vec::with_capacity(N as usize);
+    for i in 0..N {
+        let js = js.clone();
+        let h = tokio::spawn(async move {
+            let ann = NativeAnnotation { useragent: None, proxy: None };
+            let mut iso =
+                PrewarmedIsolate::spawn(String::new(), js, ann, vec!["i".to_string()], None);
+            iso.wait_ready().await.expect("pre-warm failed");
+            let res = iso
+                .start_execution(serde_json::json!({"i": i}).to_string())
+                .wait()
+                .await
+                .expect("isolate panicked");
+            res.result.expect("script errored")
+        });
+        handles.push(h);
+    }
+
+    let mut got: Vec<i64> = Vec::with_capacity(N as usize);
+    for h in handles {
+        let raw = h.await.expect("join failed");
+        let v: serde_json::Value = serde_json::from_str(raw.get()).expect("not JSON");
+        got.push(v.as_i64().unwrap_or(-1));
+    }
+    got.sort();
+    let expected: Vec<i64> = (0..N).map(|i| i * 10).collect();
+    assert_eq!(got, expected);
+}
+
+// -----------------------------------------------------------------------------
+// Network — actually exercise deno_fetch end-to-end. Skip in air-gapped CI
+// with `--skip smoke_net_`.
+// -----------------------------------------------------------------------------
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke (network); run with --ignored"]
+async fn smoke_net_fetch_example_com() {
+    // example.com is one of the most stable hosts on the internet and
+    // returns a tiny known-text body, so we can both assert "fetch works"
+    // and "the response body parses correctly through deno_fetch".
+    let ts = r#"
+export async function main(): Promise<{ status: number; has_marker: boolean }> {
+    const r = await fetch("https://example.com/");
+    const body = await r.text();
+    return { status: r.status, has_marker: body.includes("Example Domain") };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    let v = unwrap_value(&r);
+    assert_eq!(v.get("status").and_then(|x| x.as_u64()), Some(200));
+    assert_eq!(v.get("has_marker"), Some(&serde_json::json!(true)));
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "deno_core upgrade smoke (network); run with --ignored"]
+async fn smoke_net_fetch_json_and_headers() {
+    // httpbin.org/anything echoes request metadata back as JSON, so we
+    // can verify: deno_fetch sends custom headers, parses JSON response,
+    // and propagates query params end-to-end.
+    let ts = r#"
+export async function main(): Promise<{ ua: string; arg: string }> {
+    const r = await fetch("https://httpbin.org/anything?nativets=ok", {
+        headers: { "x-windmill-smoke": "1" },
+    });
+    if (!r.ok) throw new Error(`status ${r.status}`);
+    const j: any = await r.json();
+    return {
+        ua: j.headers["X-Windmill-Smoke"] ?? "",
+        arg: j.args.nativets ?? "",
+    };
+}
+"#;
+    let r = run_ts(ts, &[], serde_json::json!({})).await;
+    let v = unwrap_value(&r);
+    assert_eq!(v.get("ua").and_then(|x| x.as_str()), Some("1"));
+    assert_eq!(v.get("arg").and_then(|x| x.as_str()), Some("ok"));
+}

From 9f79a86a686708f66ccc512d4f132cb9a00397a7 Mon Sep 17 00:00:00 2001
From: brone1323 <59184559+brone1323@users.noreply.github.com>
Date: Mon, 11 May 2026 13:51:49 -0600
Subject: [PATCH 28/50] fix: add Input, Result, Trigger to reserved flow step
 IDs (#9109)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Renaming a flow step to 'Input', 'Result', or 'Trigger' would silently
corrupt the UI — the flow editor panel would switch to rendering the
special Input/Result/Trigger node instead of the step's config panel,
making the step inaccessible without editing YAML directly.

These virtual node IDs were already handled as reserved by
multiSelectUtils.ts but were missing from the forbiddenIds list that
drives the IdEditorInput validation, so users got no warning.

Fixes #7139
---
 frontend/src/lib/components/flows/idUtils.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/frontend/src/lib/components/flows/idUtils.ts b/frontend/src/lib/components/flows/idUtils.ts
index bb82c278a1..db3e496c54 100644
--- a/frontend/src/lib/components/flows/idUtils.ts
+++ b/frontend/src/lib/components/flows/idUtils.ts
@@ -14,7 +14,10 @@ export const forbiddenIds: string[] = [
 	'in',
 	'failure',
 	'preprocessor',
-	'as'
+	'as',
+	'Input',
+	'Result',
+	'Trigger'
 ]
 
 export function numberToChars(n: number) {

From 36b316d9e848166e8ea01e7686f496873bb77594 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 20:21:46 +0000
Subject: [PATCH 29/50] deps(nativets): inline maybe_transpile_source, drop
 deno_runtime (#9110)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

windmill-runtime-nativets was the workspace's only consumer of the
deno_runtime crate, and its only use of it was one call site in
build.rs:

    deno_runtime::transpile::maybe_transpile_source(specifier, source)

That function (`deno_runtime-0.198.0/transpile.rs`, ~80 lines) is a pure
deno_ast + deno_core + deno_error wrapper — it doesn't touch any
deno_runtime state. Inline it verbatim into our build.rs and drop the
entire deno_runtime dep.

Why this matters now: deno_runtime transitively pulls in deno_cache →
rusqlite → libsqlite3-sys. From deno_cache 0.128.0 (Feb-Mar 2025)
onwards, rusqlite was bumped to ^0.34, which means libsqlite3-sys ^0.35.
sqlx 0.8 transitively requires libsqlite3-sys ^0.30. Cargo's `links =
"sqlite3"` rule allows only one libsqlite3-sys in a build graph, so the
two crates collide on any deno release ≥ v2.5. Inlining the transpile
helper sidesteps the collision entirely — sqlx-sqlite stays the sole
libsqlite3-sys consumer at 0.30.1.

All other appearances of "deno_runtime" in the source tree are for a
Windmill-internal function named `setup_deno_runtime`, not the crate.

Build artifacts validated:
- `cargo check --features quickjs` → green.
- `cargo test -p windmill-runtime-nativets smoke -- --ignored --skip smoke_net_`
  → 8 passed (the in-process V8 runtime + deno_fetch + deno_web + swc
  transpilation surface still works end-to-end through the inlined
  function).
- `cargo tree --invert deno_cache` → "did not match any packages"
  (gone from the graph).
- Single `libsqlite3-sys` entry in Cargo.lock at 0.30.1 (sqlx's).
---
 backend/Cargo.lock                           | 2333 +-----------------
 backend/Cargo.toml                           |    1 -
 backend/windmill-runtime-nativets/Cargo.toml |    3 +-
 backend/windmill-runtime-nativets/build.rs   |   73 +-
 4 files changed, 127 insertions(+), 2283 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 719890fd97..c5a26d1b45 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -43,20 +43,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "aead-gcm-stream"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e70c8dec860340effb00f6945c49c0daaa6dac963602750db862eabb74bf7886"
-dependencies = [
- "aead",
- "aes 0.8.3",
- "cipher 0.4.4",
- "ctr",
- "ghash",
- "subtle",
-]
-
 [[package]]
 name = "aes"
 version = "0.7.5"
@@ -94,15 +80,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "aes-kw"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69fa2b352dcefb5f7f3a5fb840e02665d311d878955380515e4fd50095dd3d8c"
-dependencies = [
- "aes 0.8.3",
-]
-
 [[package]]
 name = "ahash"
 version = "0.7.8"
@@ -279,9 +256,6 @@ name = "arrayvec"
 version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
-dependencies = [
- "serde",
-]
 
 [[package]]
 name = "arrow"
@@ -493,59 +467,22 @@ dependencies = [
  "regex-syntax 0.8.10",
 ]
 
-[[package]]
-name = "ash"
-version = "0.37.3+1.3.251"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39e9c3835d686b0a6084ab4234fcd1b07dbf6e4767dce60874b12356a25ecd4a"
-dependencies = [
- "libloading 0.7.4",
-]
-
-[[package]]
-name = "asn1-rs"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f6fd5ddaf0351dff5b8da21b2fb4ff8e08ddd02857f0bf69c47639106c0fff0"
-dependencies = [
- "asn1-rs-derive 0.4.0",
- "asn1-rs-impl 0.1.0",
- "displaydoc",
- "nom 7.1.3",
- "num-traits",
- "rusticata-macros",
- "thiserror 1.0.69",
- "time",
-]
-
 [[package]]
 name = "asn1-rs"
 version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5493c3bedbacf7fd7382c6346bbd66687d12bbaad3a89a2d2c303ee6cf20b048"
 dependencies = [
- "asn1-rs-derive 0.5.1",
- "asn1-rs-impl 0.2.0",
+ "asn1-rs-derive",
+ "asn1-rs-impl",
  "displaydoc",
- "nom 7.1.3",
+ "nom",
  "num-traits",
  "rusticata-macros",
  "thiserror 1.0.69",
  "time",
 ]
 
-[[package]]
-name = "asn1-rs-derive"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "synstructure 0.12.6",
-]
-
 [[package]]
 name = "asn1-rs-derive"
 version = "0.5.1"
@@ -555,18 +492,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "synstructure 0.13.2",
-]
-
-[[package]]
-name = "asn1-rs-impl"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
+ "synstructure",
 ]
 
 [[package]]
@@ -1759,19 +1685,13 @@ dependencies = [
  "cpufeatures 0.3.0",
 ]
 
-[[package]]
-name = "block"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
-
 [[package]]
 name = "block-buffer"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
 dependencies = [
- "block-padding 0.2.1",
+ "block-padding",
  "generic-array",
 ]
 
@@ -1799,7 +1719,7 @@ version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2cb03d1bed155d89dce0f845b7899b18a9a163e148fd004e1c28421a783e2d8e"
 dependencies = [
- "block-padding 0.2.1",
+ "block-padding",
  "cipher 0.3.0",
 ]
 
@@ -1809,15 +1729,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d696c370c750c948ada61c69a0ee2cbbb9c50b1019ddb86d9317157a99c2cae"
 
-[[package]]
-name = "block-padding"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "bollard"
 version = "0.18.1"
@@ -1895,7 +1806,7 @@ checksum = "cfd1e3f8955a5d7de9fab72fc8373fade9fb8a703968cb200ae3dc6cf08e185a"
 dependencies = [
  "borsh-derive",
  "bytes",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
 ]
 
 [[package]]
@@ -1921,17 +1832,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "brotli"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74f7971dbd9326d58187408ab83117d8ac1bb9c17b085fdacd1cf2f598719b6b"
-dependencies = [
- "alloc-no-stdlib",
- "alloc-stdlib",
- "brotli-decompressor 4.0.3",
-]
-
 [[package]]
 name = "brotli"
 version = "7.0.0"
@@ -2107,12 +2007,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "cache_control"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1bf2a5fb3207c12b5d208ebc145f967fea5cac41a021c37417ccc31ba40f39ee"
-
 [[package]]
 name = "candle-core"
 version = "0.9.2"
@@ -2124,7 +2018,7 @@ dependencies = [
  "gemm",
  "half",
  "libm",
- "memmap2 0.9.10",
+ "memmap2",
  "num-traits",
  "num_cpus",
  "rand 0.9.0",
@@ -2132,7 +2026,7 @@ dependencies = [
  "rayon",
  "safetensors",
  "thiserror 2.0.18",
- "yoke 0.8.2",
+ "yoke",
  "zip",
 ]
 
@@ -2187,8 +2081,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f2d24a6dcf0cd402a21b65d35340f3a49ff3475dc5fdac91d22d2733e6641c6"
 dependencies = [
  "capacity_builder_macros",
- "ecow",
- "hipstr",
  "itoa",
 ]
 
@@ -2202,15 +2094,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "cbc"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
-dependencies = [
- "cipher 0.4.4",
-]
-
 [[package]]
 name = "cc"
 version = "1.2.62"
@@ -2241,7 +2124,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
 dependencies = [
- "nom 7.1.3",
+ "nom",
 ]
 
 [[package]]
@@ -2250,12 +2133,6 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
-[[package]]
-name = "cfg_aliases"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
-
 [[package]]
 name = "cfg_aliases"
 version = "0.2.1"
@@ -2334,7 +2211,7 @@ checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
 dependencies = [
  "glob",
  "libc",
- "libloading 0.8.9",
+ "libloading",
 ]
 
 [[package]]
@@ -2377,15 +2254,6 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
-[[package]]
-name = "clipboard-win"
-version = "5.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"
-dependencies = [
- "error-code",
-]
-
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -2401,43 +2269,6 @@ version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
 
-[[package]]
-name = "codespan-reporting"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
-dependencies = [
- "termcolor",
- "unicode-width 0.1.14",
-]
-
-[[package]]
-name = "color-print"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3aa954171903797d5623e047d9ab69d91b493657917bdfb8c2c80ecaf9cdb6f4"
-dependencies = [
- "color-print-proc-macro",
-]
-
-[[package]]
-name = "color-print-proc-macro"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "692186b5ebe54007e45a59aea47ece9eb4108e141326c304cdc91699a7118a22"
-dependencies = [
- "nom 7.1.3",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "color_quant"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
-
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -2624,17 +2455,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "core-graphics-types"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45390e6114f68f718cc7a830514a96f903cccd70d02a8f6d9f643ac4ba45afaf"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation 0.9.4",
- "libc",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -2861,7 +2681,7 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto 0.2.9",
+ "fiat-crypto",
  "rustc_version 0.4.1",
  "subtle",
  "zeroize",
@@ -2878,17 +2698,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "d3d12"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b28bfe653d79bd16c77f659305b195b82bb5ce0c0eb2a4846b82ddbd77586813"
-dependencies = [
- "bitflags 2.9.4",
- "libloading 0.8.9",
- "winapi",
-]
-
 [[package]]
 name = "darling"
 version = "0.13.4"
@@ -3764,106 +3573,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "deno_broadcast_channel"
-version = "0.184.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33db5dacb54c6fda4c5ea4103c5687b76a51202343379af8b21120ba9d20f3c2"
-dependencies = [
- "async-trait",
- "deno_core",
- "deno_error",
- "thiserror 2.0.18",
- "tokio",
- "uuid",
-]
-
-[[package]]
-name = "deno_cache"
-version = "0.122.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0daca6ec4e6142a994d38e7bc587dda7948fa00e6194b671a5d4340f5a918a3"
-dependencies = [
- "async-trait",
- "deno_core",
- "deno_error",
- "rusqlite",
- "serde",
- "sha2 0.10.9",
- "thiserror 2.0.18",
- "tokio",
-]
-
-[[package]]
-name = "deno_cache_dir"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27429da4d0e601baaa41415a43468d49a586645d13497f12e8a9346f9f6b1347"
-dependencies = [
- "async-trait",
- "base32",
- "base64 0.21.7",
- "boxed_error",
- "cache_control",
- "chrono",
- "data-url",
- "deno_error",
- "deno_media_type",
- "deno_path_util",
- "http 1.4.0",
- "indexmap 2.14.0",
- "log",
- "once_cell",
- "parking_lot",
- "serde",
- "serde_json",
- "sha2 0.10.9",
- "sys_traits",
- "thiserror 1.0.69",
- "url",
-]
-
-[[package]]
-name = "deno_canvas"
-version = "0.59.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35ca8f93d60d96d6f6cb0da632303afb98567accf07d9b6f8d2ef88617589d9e"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_webgpu",
- "image",
- "serde",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "deno_config"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08fe512a72c4300bd997c6849450a1f050da0c909a2a4fbdc44891647392bacf"
-dependencies = [
- "boxed_error",
- "capacity_builder 0.5.0",
- "deno_error",
- "deno_package_json",
- "deno_path_util",
- "deno_semver",
- "glob",
- "ignore",
- "import_map",
- "indexmap 2.14.0",
- "jsonc-parser",
- "log",
- "percent-encoding",
- "phf 0.11.3",
- "serde",
- "serde_json",
- "sys_traits",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "deno_console"
 version = "0.190.0"
@@ -3918,62 +3627,6 @@ version = "0.74.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe4dccb6147bb3f3ba0c7a48e993bfeb999d2c2e47a81badee80e2b370c8d695"
 
-[[package]]
-name = "deno_cron"
-version = "0.70.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ec283bef14bcf655b209619766bdeab67f2a5e093991cca73f5d502f7bf6e8"
-dependencies = [
- "anyhow",
- "async-trait",
- "chrono",
- "deno_core",
- "deno_error",
- "saffron",
- "thiserror 2.0.18",
- "tokio",
-]
-
-[[package]]
-name = "deno_crypto"
-version = "0.204.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f0493142a437e49b46aa8e08d715942076ff48c3cb776f0b015b4224ed0d37a"
-dependencies = [
- "aes 0.8.3",
- "aes-gcm",
- "aes-kw",
- "base64 0.21.7",
- "cbc",
- "const-oid 0.9.6",
- "ctr",
- "curve25519-dalek",
- "deno_core",
- "deno_error",
- "deno_web",
- "ed448-goldilocks",
- "elliptic-curve",
- "num-traits",
- "once_cell",
- "p256",
- "p384",
- "p521",
- "rand 0.8.5",
- "ring 0.17.14",
- "rsa",
- "sec1",
- "serde",
- "serde_bytes",
- "sha1",
- "sha2 0.10.9",
- "signature",
- "spki",
- "thiserror 2.0.18",
- "tokio",
- "uuid",
- "x25519-dalek",
-]
-
 [[package]]
 name = "deno_error"
 version = "0.5.5"
@@ -4038,29 +3691,6 @@ dependencies = [
  "tower-service",
 ]
 
-[[package]]
-name = "deno_ffi"
-version = "0.177.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfbdc4e55c79ec1bc8a3ac72313e6f70d76340222f1e50c5c91e050296f83544"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_permissions",
- "dlopen2 0.6.1",
- "dynasmrt",
- "libffi",
- "libffi-sys",
- "log",
- "num-bigint",
- "serde",
- "serde-value",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "winapi",
-]
-
 [[package]]
 name = "deno_fs"
 version = "0.100.0"
@@ -4087,45 +3717,6 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_http"
-version = "0.188.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0b7e7a3bcac31ebd4677a96318003a98f0fda4613f6ba6d7f5ba57928727191"
-dependencies = [
- "async-compression",
- "async-trait",
- "base64 0.21.7",
- "brotli 6.0.0",
- "bytes",
- "cache_control",
- "deno_core",
- "deno_error",
- "deno_net",
- "deno_websocket",
- "flate2",
- "http 0.2.12",
- "http 1.4.0",
- "httparse",
- "hyper 0.14.32",
- "hyper 1.9.0",
- "hyper-util",
- "itertools 0.10.5",
- "memmem",
- "mime",
- "once_cell",
- "percent-encoding",
- "phf 0.11.3",
- "pin-project",
- "ring 0.17.14",
- "scopeguard",
- "serde",
- "smallvec",
- "thiserror 2.0.18",
- "tokio",
- "tokio-util",
-]
-
 [[package]]
 name = "deno_io"
 version = "0.100.0"
@@ -4150,53 +3741,6 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "deno_kv"
-version = "0.98.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b0e3930d0195a3350c05eb9a4bc619ec598ea84ad8bdb9b6c3e4bef798e7cf34"
-dependencies = [
- "anyhow",
- "async-trait",
- "base64 0.21.7",
- "boxed_error",
- "bytes",
- "chrono",
- "deno_core",
- "deno_error",
- "deno_fetch",
- "deno_path_util",
- "deno_permissions",
- "deno_tls",
- "denokv_proto",
- "denokv_remote",
- "denokv_sqlite",
- "faster-hex",
- "http 1.4.0",
- "http-body-util",
- "log",
- "num-bigint",
- "prost",
- "prost-build",
- "rand 0.8.5",
- "rusqlite",
- "serde",
- "thiserror 2.0.18",
- "url",
-]
-
-[[package]]
-name = "deno_lockfile"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "632e835a53ed667d62fdd766c5780fe8361c831d3e3fbf1a760a0b7896657587"
-dependencies = [
- "deno_semver",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
-]
-
 [[package]]
 name = "deno_media_type"
 version = "0.2.5"
@@ -4208,30 +3752,13 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "deno_napi"
-version = "0.121.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13f30bf147cc46dba87e3088d037cf99a2845ead1138033d3b346178cb781558"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_permissions",
- "libc",
- "libloading 0.7.4",
- "log",
- "napi_sym",
- "thiserror 2.0.18",
- "windows-sys 0.59.0",
-]
-
 [[package]]
 name = "deno_native_certs"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "86bc737e098a45aa5742d51ce694ac7236a1e69fb0d9df8c862e9b4c9583c5f9"
 dependencies = [
- "dlopen2 0.7.0",
+ "dlopen2",
  "dlopen2_derive",
  "once_cell",
  "rustls-native-certs 0.7.3",
@@ -4259,121 +3786,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "deno_node"
-version = "0.128.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9638e803a668b0a5793ff94c9b2e82c54a05d9fc510901e9f3093d2d63dbdaab"
-dependencies = [
- "aead-gcm-stream",
- "aes 0.8.3",
- "async-trait",
- "base64 0.21.7",
- "blake2",
- "boxed_error",
- "brotli 6.0.0",
- "bytes",
- "cbc",
- "const-oid 0.9.6",
- "ctr",
- "data-encoding",
- "deno_core",
- "deno_error",
- "deno_fetch",
- "deno_fs",
- "deno_io",
- "deno_net",
- "deno_package_json",
- "deno_path_util",
- "deno_permissions",
- "deno_process",
- "deno_whoami",
- "der",
- "digest 0.10.7",
- "dsa",
- "ecb",
- "ecdsa",
- "ed25519-dalek",
- "elliptic-curve",
- "errno",
- "faster-hex",
- "h2 0.4.14",
- "hkdf",
- "http 1.4.0",
- "http-body-util",
- "hyper 1.9.0",
- "hyper-util",
- "idna",
- "indexmap 2.14.0",
- "ipnetwork",
- "k256",
- "lazy-regex",
- "libc",
- "libz-sys",
- "md-5 0.10.6",
- "md4",
- "memchr",
- "node_resolver",
- "num-bigint",
- "num-bigint-dig",
- "num-integer",
- "num-traits",
- "once_cell",
- "p224",
- "p256",
- "p384",
- "path-clean",
- "pbkdf2",
- "pkcs8",
- "rand 0.8.5",
- "regex",
- "ring 0.17.14",
- "ripemd",
- "rsa",
- "scrypt",
- "sec1",
- "serde",
- "sha1",
- "sha2 0.10.9",
- "sha3",
- "signature",
- "simd-json",
- "sm3",
- "spki",
- "stable_deref_trait",
- "sys_traits",
- "thiserror 2.0.18",
- "tokio",
- "tokio-eld",
- "url",
- "webpki-root-certs 0.26.11",
- "winapi",
- "windows-sys 0.59.0",
- "x25519-dalek",
- "x509-parser 0.15.1",
- "yoke 0.7.5",
-]
-
-[[package]]
-name = "deno_npm"
-version = "0.27.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4adceb4c34f10e837d0e3ae76e88dddefb13e83c05c1ef1699fa5519241c9d27"
-dependencies = [
- "async-trait",
- "capacity_builder 0.5.0",
- "deno_error",
- "deno_lockfile",
- "deno_semver",
- "futures",
- "log",
- "monch",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "deno_ops"
 version = "0.212.0"
@@ -4391,47 +3803,6 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
-[[package]]
-name = "deno_os"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8371d206f6265c4e0b74116c1a58cc8c464c45da0b43c1e8c19a911e88feb2b"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_path_util",
- "deno_permissions",
- "deno_telemetry",
- "libc",
- "netif",
- "ntapi",
- "once_cell",
- "serde",
- "signal-hook",
- "signal-hook-registry",
- "thiserror 2.0.18",
- "tokio",
- "winapi",
-]
-
-[[package]]
-name = "deno_package_json"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07d26dbfcc01e636aef86f9baff7faf5338398e74d283d8fe01e39068f48049"
-dependencies = [
- "boxed_error",
- "deno_error",
- "deno_path_util",
- "deno_semver",
- "indexmap 2.14.0",
- "serde",
- "serde_json",
- "sys_traits",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "deno_path_util"
 version = "0.3.1"
@@ -4467,154 +3838,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "deno_process"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "700f8a2c9d369e7035e693f26a671489a73724450cbbc0a1e32f3966ef2f21fb"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_fs",
- "deno_io",
- "deno_os",
- "deno_path_util",
- "deno_permissions",
- "libc",
- "log",
- "memchr",
- "nix 0.27.1",
- "pin-project-lite",
- "rand 0.8.5",
- "serde",
- "simd-json",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "which 6.0.3",
- "winapi",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "deno_resolver"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93c4ceec7b6e22344047b8a5577bb8239dc0a99884c25c1fa7d8611f4c3ed28b"
-dependencies = [
- "anyhow",
- "async-once-cell",
- "async-trait",
- "base32",
- "boxed_error",
- "dashmap 5.5.3",
- "deno_cache_dir",
- "deno_config",
- "deno_error",
- "deno_media_type",
- "deno_npm",
- "deno_package_json",
- "deno_path_util",
- "deno_semver",
- "deno_terminal",
- "futures",
- "log",
- "node_resolver",
- "once_cell",
- "parking_lot",
- "sys_traits",
- "thiserror 2.0.18",
- "url",
-]
-
-[[package]]
-name = "deno_runtime"
-version = "0.198.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26a54d54ca920e5256c1e910c7574787d009a34afd41b20ad250278bb1aea290"
-dependencies = [
- "color-print",
- "deno_ast",
- "deno_broadcast_channel",
- "deno_cache",
- "deno_canvas",
- "deno_console",
- "deno_core",
- "deno_cron",
- "deno_crypto",
- "deno_error",
- "deno_fetch",
- "deno_ffi",
- "deno_fs",
- "deno_http",
- "deno_io",
- "deno_kv",
- "deno_napi",
- "deno_net",
- "deno_node",
- "deno_os",
- "deno_path_util",
- "deno_permissions",
- "deno_process",
- "deno_resolver",
- "deno_telemetry",
- "deno_terminal",
- "deno_tls",
- "deno_url",
- "deno_web",
- "deno_webgpu",
- "deno_webidl",
- "deno_websocket",
- "deno_webstorage",
- "dlopen2 0.6.1",
- "encoding_rs",
- "fastwebsockets",
- "http 1.4.0",
- "http-body-util",
- "hyper 0.14.32",
- "hyper 1.9.0",
- "hyper-util",
- "libc",
- "log",
- "nix 0.27.1",
- "node_resolver",
- "notify",
- "ntapi",
- "once_cell",
- "percent-encoding",
- "regex",
- "rustyline",
- "same-file",
- "serde",
- "sys_traits",
- "tempfile",
- "thiserror 2.0.18",
- "tokio",
- "tokio-metrics",
- "twox-hash 1.6.3",
- "uuid",
- "which 6.0.3",
- "winapi",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "deno_semver"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4775271f9b5602482698f76d24ea9ed8ba27af7f587a7e9a876916300c542435"
-dependencies = [
- "capacity_builder 0.5.0",
- "deno_error",
- "ecow",
- "hipstr",
- "monch",
- "once_cell",
- "serde",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "deno_telemetry"
 version = "0.12.0"
@@ -4715,22 +3938,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "deno_webgpu"
-version = "0.157.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4077584c0ccfde0737e576c396bbf1645f25ed0ebf4f44543e0ad13729285cf3"
-dependencies = [
- "deno_core",
- "deno_error",
- "raw-window-handle",
- "serde",
- "thiserror 2.0.18",
- "tokio",
- "wgpu-core",
- "wgpu-types",
-]
-
 [[package]]
 name = "deno_webidl"
 version = "0.190.0"
@@ -4740,121 +3947,6 @@ dependencies = [
  "deno_core",
 ]
 
-[[package]]
-name = "deno_websocket"
-version = "0.195.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ad15c3856dd1748f9a36102e90b4e345e40d7d64a9bf6672d584201e1fded28"
-dependencies = [
- "bytes",
- "deno_core",
- "deno_error",
- "deno_net",
- "deno_permissions",
- "deno_tls",
- "fastwebsockets",
- "h2 0.4.14",
- "http 1.4.0",
- "http-body-util",
- "hyper 1.9.0",
- "hyper-util",
- "once_cell",
- "rustls-tokio-stream",
- "serde",
- "thiserror 2.0.18",
- "tokio",
-]
-
-[[package]]
-name = "deno_webstorage"
-version = "0.185.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "079dc4f6ce91f53bb848bad8d743dc20d16ca44cbed3425531cf5d922b1a45bc"
-dependencies = [
- "deno_core",
- "deno_error",
- "deno_web",
- "rusqlite",
- "thiserror 2.0.18",
-]
-
-[[package]]
-name = "deno_whoami"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e75e4caa92b98a27f09c671d1399aee0f5970aa491b9a598523aac000a2192e3"
-dependencies = [
- "libc",
- "whoami",
-]
-
-[[package]]
-name = "denokv_proto"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5b77de4d3b9215e14624d4f4eb16cb38c0810e3f5860ba3b3fc47d0537f9a4d"
-dependencies = [
- "async-trait",
- "chrono",
- "deno_error",
- "futures",
- "num-bigint",
- "prost",
- "serde",
- "uuid",
-]
-
-[[package]]
-name = "denokv_remote"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6497c28eec268ed99f1e8664f0842935f02d1508529c67d94c57ca5d893d743"
-dependencies = [
- "async-stream",
- "async-trait",
- "bytes",
- "chrono",
- "deno_error",
- "denokv_proto",
- "futures",
- "http 1.4.0",
- "log",
- "prost",
- "rand 0.8.5",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tokio-util",
- "url",
- "uuid",
-]
-
-[[package]]
-name = "denokv_sqlite"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc0f21a450a35eb85760761401fddf9bfff9840127be07a6ca5c31863127913d"
-dependencies = [
- "async-stream",
- "async-trait",
- "chrono",
- "deno_error",
- "denokv_proto",
- "futures",
- "hex",
- "log",
- "num-bigint",
- "rand 0.8.5",
- "rusqlite",
- "serde_json",
- "thiserror 2.0.18",
- "tokio",
- "tokio-stream",
- "uuid",
- "v8_valueserializer",
-]
-
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -4862,50 +3954,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid 0.9.6",
- "der_derive",
  "pem-rfc7468",
  "zeroize",
 ]
 
-[[package]]
-name = "der-parser"
-version = "8.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbd676fbbab537128ef0278adb5576cf363cff6aa22a7b24effe97347cfab61e"
-dependencies = [
- "asn1-rs 0.5.2",
- "displaydoc",
- "nom 7.1.3",
- "num-bigint",
- "num-traits",
- "rusticata-macros",
-]
-
 [[package]]
 name = "der-parser"
 version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5cd0a5c643689626bec213c4d8bd4d96acc8ffdb4ad4bb6bc16abf27d5f4b553"
 dependencies = [
- "asn1-rs 0.6.2",
+ "asn1-rs",
  "displaydoc",
- "nom 7.1.3",
+ "nom",
  "num-bigint",
  "num-traits",
  "rusticata-macros",
 ]
 
-[[package]]
-name = "der_derive"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8034092389675178f570469e6c3b0465d3d30b4505c294a6550db47f3c17ad18"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -5158,18 +4224,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dlopen2"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bc2c7ed06fd72a8513ded8d0d2f6fd2655a85d6885c48cae8625d80faf28c03"
-dependencies = [
- "dlopen2_derive",
- "libc",
- "once_cell",
- "winapi",
-]
-
 [[package]]
 name = "dlopen2"
 version = "0.7.0"
@@ -5193,15 +4247,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "document-features"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4b8a88685455ed29a21542a33abd9cb6510b6b129abadabdcef0f4c55bc8f61"
-dependencies = [
- "litrs",
-]
-
 [[package]]
 name = "dotenv"
 version = "0.15.0"
@@ -5235,22 +4280,6 @@ dependencies = [
  "text_lines",
 ]
 
-[[package]]
-name = "dsa"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48bc224a9084ad760195584ce5abb3c2c34a225fa312a128ad245a6b412b7689"
-dependencies = [
- "digest 0.10.7",
- "num-bigint-dig",
- "num-traits",
- "pkcs8",
- "rfc6979",
- "sha2 0.10.9",
- "signature",
- "zeroize",
-]
-
 [[package]]
 name = "duct"
 version = "0.13.7"
@@ -5291,41 +4320,6 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d926b4d407d372f141f93bb444696142c29d32962ccbd3531117cf3aa0bfa9"
 
-[[package]]
-name = "dynasm"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "add9a102807b524ec050363f09e06f1504214b0e1c7797f64261c891022dce8b"
-dependencies = [
- "bitflags 1.3.2",
- "byteorder",
- "lazy_static",
- "proc-macro-error",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
-[[package]]
-name = "dynasmrt"
-version = "1.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64fba5a42bd76a17cad4bfa00de168ee1cbfa06a5e8ce992ae880218c05641a9"
-dependencies = [
- "byteorder",
- "dynasm",
- "memmap2 0.5.10",
-]
-
-[[package]]
-name = "ecb"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a8bfa975b1aec2145850fcaa1c6fe269a16578c44705a532ae3edc92b8881c7"
-dependencies = [
- "cipher 0.4.4",
-]
-
 [[package]]
 name = "ecdsa"
 version = "0.16.9"
@@ -5340,15 +4334,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "ecow"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78e4f79b296fbaab6ce2e22d52cb4c7f010fe0ebe7a32e34fa25885fd797bd02"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -5375,18 +4360,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "ed448-goldilocks"
-version = "0.8.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06924531e9e90130842b012e447f85bdaf9161bc8a0f8092be8cb70b01ebe092"
-dependencies = [
- "fiat-crypto 0.1.20",
- "hex",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "educe"
 version = "0.6.0"
@@ -5415,7 +4388,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
  "base16ct",
- "base64ct",
  "crypto-bigint",
  "digest 0.10.7",
  "ff",
@@ -5426,8 +4398,6 @@ dependencies = [
  "pkcs8",
  "rand_core 0.6.4",
  "sec1",
- "serde_json",
- "serdect",
  "subtle",
  "zeroize",
 ]
@@ -5447,12 +4417,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "endian-type"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
-
 [[package]]
 name = "enum-as-inner"
 version = "0.6.1"
@@ -5532,12 +4496,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "error-code"
-version = "3.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"
-
 [[package]]
 name = "error_reporter"
 version = "1.0.0"
@@ -5598,7 +4556,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74fef4569247a5f429d9156b9d0a2599914385dd189c539334c625d8099d90ab"
 dependencies = [
  "futures-core",
- "nom 7.1.3",
+ "nom",
  "pin-project-lite",
 ]
 
@@ -5608,18 +4566,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
 
-[[package]]
-name = "fallible-iterator"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
-
-[[package]]
-name = "fallible-streaming-iterator"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
-
 [[package]]
 name = "fancy-regex"
 version = "0.14.0"
@@ -5648,61 +4594,12 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9afc2bd4d5a73106dd53d10d73d3401c2f32730ba2c0b93ddb888a8983680471"
 
-[[package]]
-name = "faster-hex"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2a2b11eda1d40935b26cf18f6833c526845ae8c41e58d09af6adeb6f0269183"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "fastrand"
 version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
-[[package]]
-name = "fastwebsockets"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dac026e15fb7e44d768880b868a0fd5bd30ffdee272e88b3060f657a5a72947"
-dependencies = [
- "base64 0.21.7",
- "bytes",
- "http-body-util",
- "hyper 1.9.0",
- "hyper-util",
- "pin-project",
- "rand 0.8.5",
- "sha1",
- "simdutf8",
- "thiserror 1.0.69",
- "tokio",
- "utf-8",
-]
-
-[[package]]
-name = "fd-lock"
-version = "4.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
-dependencies = [
- "cfg-if",
- "rustix 1.1.4",
- "windows-sys 0.59.0",
-]
-
-[[package]]
-name = "fdeflate"
-version = "0.3.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
-dependencies = [
- "simd-adler32",
-]
-
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -5713,12 +4610,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "fiat-crypto"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e825f6987101665dea6ec934c09ec6d721de7bc1bf92248e1d5810c8cd636b77"
-
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
@@ -5770,15 +4661,6 @@ dependencies = [
  "zlib-rs",
 ]
 
-[[package]]
-name = "float-cmp"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b09cf3155332e944990140d967ff5eceb70df778b34f77d8075db46e4704e6d8"
-dependencies = [
- "num-traits",
-]
-
 [[package]]
 name = "float8"
 version = "0.6.1"
@@ -5827,28 +4709,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
 dependencies = [
- "foreign-types-shared 0.1.1",
-]
-
-[[package]]
-name = "foreign-types"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
-dependencies = [
- "foreign-types-macros",
- "foreign-types-shared 0.3.1",
-]
-
-[[package]]
-name = "foreign-types-macros"
-version = "0.2.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a5c6c585bc94aaf2c7b51dd4c2ba22680844aba4c687be581871a6f518c5742"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
+ "foreign-types-shared",
 ]
 
 [[package]]
@@ -5857,12 +4718,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
-[[package]]
-name = "foreign-types-shared"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
-
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -5916,15 +4771,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
-[[package]]
-name = "fsevent-sys"
-version = "4.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "fslock"
 version = "0.2.1"
@@ -6330,17 +5176,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "gl_generator"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a95dfc23a2b4a9a2f5ab41d194f8bfda3cabec42af4e39f08c339eb2a0c124d"
-dependencies = [
- "khronos_api",
- "log",
- "xml-rs",
-]
-
 [[package]]
 name = "glob"
 version = "0.3.3"
@@ -6372,27 +5207,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "glow"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd348e04c43b32574f2de31c8bb397d96c9fcfa1371bd4ca6d8bdc464ab121b1"
-dependencies = [
- "js-sys",
- "slotmap",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "glutin_wgl_sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8098adac955faa2d31079b65dc48841251f69efd3ac25477903fc424362ead"
-dependencies = [
- "gl_generator",
-]
-
 [[package]]
 name = "google-cloud-auth"
 version = "0.17.2"
@@ -6493,45 +5307,6 @@ dependencies = [
  "unic-ucd-category",
 ]
 
-[[package]]
-name = "gpu-alloc"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbcd2dba93594b227a1f57ee09b8b9da8892c34d55aa332e034a228d0fe6a171"
-dependencies = [
- "bitflags 2.9.4",
- "gpu-alloc-types",
-]
-
-[[package]]
-name = "gpu-alloc-types"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98ff03b468aa837d70984d55f5d3f846f6ec31fe34bbb97c4f85219caeee1ca4"
-dependencies = [
- "bitflags 2.9.4",
-]
-
-[[package]]
-name = "gpu-descriptor"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b89c83349105e3732062a895becfc71a8f921bb71ecbbdd8ff99263e3b53a0ca"
-dependencies = [
- "bitflags 2.9.4",
- "gpu-descriptor-types",
- "hashbrown 0.15.5",
-]
-
-[[package]]
-name = "gpu-descriptor-types"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdf242682df893b86f33a73828fb09ca4b2d3bb6cc95249707fc684d27484b91"
-dependencies = [
- "bitflags 2.9.4",
-]
-
 [[package]]
 name = "group"
 version = "0.13.0"
@@ -6605,16 +5380,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "halfbrown"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8588661a8607108a5ca69cab034063441a0413a0b041c13618a7dd348021ef6f"
-dependencies = [
- "hashbrown 0.14.5",
- "serde",
-]
-
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -6675,15 +5440,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "hashlink"
 version = "0.10.0"
@@ -6693,20 +5449,6 @@ dependencies = [
  "hashbrown 0.15.5",
 ]
 
-[[package]]
-name = "hdrhistogram"
-version = "7.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "765c9198f173dd59ce26ff9f95ef0aafd0a0fe01fb9d72841bc5066a4c06511d"
-dependencies = [
- "base64 0.21.7",
- "byteorder",
- "crossbeam-channel",
- "flate2",
- "nom 7.1.3",
- "num-traits",
-]
-
 [[package]]
 name = "headers"
 version = "0.4.1"
@@ -6755,12 +5497,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
-[[package]]
-name = "hexf-parse"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df"
-
 [[package]]
 name = "hf-hub"
 version = "0.4.3"
@@ -6833,17 +5569,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hipstr"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97971ffc85d4c98de12e2608e992a43f5294ebb625fdb045b27c731b64c4c6d6"
-dependencies = [
- "serde",
- "serde_bytes",
- "sptr",
-]
-
 [[package]]
 name = "hkdf"
 version = "0.12.4"
@@ -7276,7 +6001,7 @@ dependencies = [
  "displaydoc",
  "potential_utf",
  "utf8_iter",
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
  "zerovec",
 ]
@@ -7343,7 +6068,7 @@ dependencies = [
  "displaydoc",
  "icu_locale_core",
  "writeable",
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
  "zerotrie",
  "zerovec",
@@ -7388,52 +6113,6 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cd62e6b5e86ea8eeeb8db1de02880a6abc01a397b2ebb64b5d74ac255318f5cb"
 
-[[package]]
-name = "ignore"
-version = "0.4.25"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a"
-dependencies = [
- "crossbeam-deque",
- "globset",
- "log",
- "memchr",
- "regex-automata",
- "same-file",
- "walkdir",
- "winapi-util",
-]
-
-[[package]]
-name = "image"
-version = "0.24.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5690139d2f55868e080017335e4b94cb7414274c74f1669c84fb5feba2c9f69d"
-dependencies = [
- "bytemuck",
- "byteorder",
- "color_quant",
- "num-traits",
- "png",
-]
-
-[[package]]
-name = "import_map"
-version = "0.21.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1215d4d92511fbbdaea50e750e91f2429598ef817f02b579158e92803b52c00a"
-dependencies = [
- "boxed_error",
- "deno_error",
- "indexmap 2.14.0",
- "log",
- "percent-encoding",
- "serde",
- "serde_json",
- "thiserror 2.0.18",
- "url",
-]
-
 [[package]]
 name = "indexmap"
 version = "1.9.3"
@@ -7470,33 +6149,12 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "inotify"
-version = "0.9.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
-dependencies = [
- "bitflags 1.3.2",
- "inotify-sys",
- "libc",
-]
-
-[[package]]
-name = "inotify-sys"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "inout"
 version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
- "block-padding 0.3.3",
  "generic-array",
 ]
 
@@ -7545,15 +6203,6 @@ version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
-[[package]]
-name = "ipnetwork"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "is-macro"
 version = "0.3.7"
@@ -7696,15 +6345,6 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
-[[package]]
-name = "jsonc-parser"
-version = "0.26.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d6d80e6d70e7911a29f3cf3f44f452df85d06f73572b494ca99a2cad3fcf8f4"
-dependencies = [
- "serde_json",
-]
-
 [[package]]
 name = "jsonpath-rust"
 version = "0.7.5"
@@ -7767,20 +6407,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "k256"
-version = "0.13.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
-dependencies = [
- "cfg-if",
- "ecdsa",
- "elliptic-curve",
- "once_cell",
- "sha2 0.10.9",
- "signature",
-]
-
 [[package]]
 name = "k8s-openapi"
 version = "0.25.0"
@@ -7793,15 +6419,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "keccak"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
-dependencies = [
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "keyed_priority_queue"
 version = "0.4.2"
@@ -7811,23 +6428,6 @@ dependencies = [
  "indexmap 2.14.0",
 ]
 
-[[package]]
-name = "khronos-egl"
-version = "6.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6aae1df220ece3c0ada96b8153459b67eebe9ae9212258bb0134ae60416fdf76"
-dependencies = [
- "libc",
- "libloading 0.8.9",
- "pkg-config",
-]
-
-[[package]]
-name = "khronos_api"
-version = "3.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2db585e1d738fc771bf08a151420d3ed193d9d895a36df7f6f8a9456b911ddc"
-
 [[package]]
 name = "konst"
 version = "0.2.20"
@@ -7843,26 +6443,6 @@ version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
 
-[[package]]
-name = "kqueue"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
-dependencies = [
- "kqueue-sys",
- "libc",
-]
-
-[[package]]
-name = "kqueue-sys"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
-dependencies = [
- "bitflags 1.3.2",
- "libc",
-]
-
 [[package]]
 name = "kube"
 version = "1.1.0"
@@ -7979,29 +6559,6 @@ version = "0.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "507460a910eb7b32ee961886ff48539633b788a36b65692b95f225b844c82553"
 
-[[package]]
-name = "lazy-regex"
-version = "3.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bae91019476d3ec7147de9aa291cadb6d870abf2f3015d2da73a90325ac1496"
-dependencies = [
- "lazy-regex-proc_macros",
- "once_cell",
- "regex",
-]
-
-[[package]]
-name = "lazy-regex-proc_macros"
-version = "3.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4de9c1e1439d8b7b3061b2d209809f447ca33241733d9a3c01eabf2dc8d94358"
-dependencies = [
- "proc-macro2",
- "quote",
- "regex",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -8086,16 +6643,6 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
-[[package]]
-name = "libffi"
-version = "3.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce826c243048e3d5cec441799724de52e2d42f820468431fc3fceee2341871e2"
-dependencies = [
- "libc",
- "libffi-sys",
-]
-
 [[package]]
 name = "libffi-sys"
 version = "2.3.0"
@@ -8127,16 +6674,6 @@ dependencies = [
  "pkg-config",
 ]
 
-[[package]]
-name = "libloading"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
-dependencies = [
- "cfg-if",
- "winapi",
-]
-
 [[package]]
 name = "libloading"
 version = "0.8.9"
@@ -8182,7 +6719,6 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
 dependencies = [
- "cc",
  "pkg-config",
  "vcpkg",
 ]
@@ -8244,12 +6780,6 @@ version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
-[[package]]
-name = "litrs"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -8320,7 +6850,7 @@ version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
 dependencies = [
- "twox-hash 2.1.2",
+ "twox-hash",
 ]
 
 [[package]]
@@ -8477,15 +7007,6 @@ dependencies = [
  "malachite-nz",
 ]
 
-[[package]]
-name = "malloc_buf"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "mappable-rc"
 version = "0.1.1"
@@ -8550,15 +7071,6 @@ dependencies = [
  "digest 0.11.3",
 ]
 
-[[package]]
-name = "md4"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da5ac363534dce5fabf69949225e174fbf111a498bf0ff794c8ea1fba9f3dda"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "md5"
 version = "0.6.1"
@@ -8580,15 +7092,6 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
-[[package]]
-name = "memmap2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83faa42c0a078c393f6b29d5db232d8be22776a891f8f56e5284faee4a20b327"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "memmap2"
 version = "0.9.10"
@@ -8599,12 +7102,6 @@ dependencies = [
  "stable_deref_trait",
 ]
 
-[[package]]
-name = "memmem"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a64a92489e2744ce060c349162be1c5f33c6969234104dbd99ddb5feb08b8c15"
-
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -8614,21 +7111,6 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "metal"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5637e166ea14be6063a3f8ba5ccb9a4159df7d8f6d61c02fc3d480b1f90dcfcb"
-dependencies = [
- "bitflags 2.9.4",
- "block",
- "core-graphics-types",
- "foreign-types 0.5.0",
- "log",
- "objc",
- "paste",
-]
-
 [[package]]
 name = "miette"
 version = "7.6.0"
@@ -8708,18 +7190,6 @@ dependencies = [
  "simd-adler32",
 ]
 
-[[package]]
-name = "mio"
-version = "0.8.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
-dependencies = [
- "libc",
- "log",
- "wasi 0.11.1+wasi-snapshot-preview1",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "mio"
 version = "1.2.0"
@@ -8751,12 +7221,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "monch"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b52c1b33ff98142aecea13138bd399b68aa7ab5d9546c300988c345004001eea"
-
 [[package]]
 name = "monostate"
 version = "0.1.18"
@@ -8796,12 +7260,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "multimap"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
-
 [[package]]
 name = "murmurhash32"
 version = "0.3.1"
@@ -8852,7 +7310,7 @@ dependencies = [
  "tokio",
  "tokio-native-tls",
  "tokio-util",
- "twox-hash 2.1.2",
+ "twox-hash",
  "url",
 ]
 
@@ -8884,28 +7342,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "naga"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e536ae46fcab0876853bd4a632ede5df4b1c2527a58f6c5a4150fe86be858231"
-dependencies = [
- "arrayvec",
- "bit-set 0.5.3",
- "bitflags 2.9.4",
- "codespan-reporting",
- "hexf-parse",
- "indexmap 2.14.0",
- "log",
- "num-traits",
- "rustc-hash 1.1.0",
- "serde",
- "spirv",
- "termcolor",
- "thiserror 1.0.69",
- "unicode-xid",
-]
-
 [[package]]
 name = "nanorand"
 version = "0.7.0"
@@ -8915,18 +7351,6 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
-[[package]]
-name = "napi_sym"
-version = "0.120.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33a55ec137cebb7f4a594edd16157a5b9d9addf7ebd29c88198ec4e0cff2e93e"
-dependencies = [
- "quote",
- "serde",
- "serde_json",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "native-tls"
 version = "0.2.16"
@@ -8944,40 +7368,12 @@ dependencies = [
  "tempfile",
 ]
 
-[[package]]
-name = "ndk-sys"
-version = "0.5.0+25.2.9519653"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c196769dd60fd4f363e11d948139556a344e79d451aeb2fa2fd040738ef7691"
-dependencies = [
- "jni-sys 0.3.1",
-]
-
-[[package]]
-name = "netif"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d29a01b9f018d6b7b277fef6c79fdbd9bf17bb2d1e298238055cafab49baa5ee"
-dependencies = [
- "libc",
- "winapi",
-]
-
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
-[[package]]
-name = "nibble_vec"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
-dependencies = [
- "smallvec",
-]
-
 [[package]]
 name = "nix"
 version = "0.27.1"
@@ -8997,7 +7393,7 @@ checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
  "bitflags 2.9.4",
  "cfg-if",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "libc",
 ]
 
@@ -9009,7 +7405,7 @@ checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
  "bitflags 2.9.4",
  "cfg-if",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "libc",
 ]
 
@@ -9028,42 +7424,6 @@ dependencies = [
  "signatory",
 ]
 
-[[package]]
-name = "node_resolver"
-version = "0.28.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "808426e80ce77a311b24ac080caf18c23c632e035d797edb217ce74cdf6a0e71"
-dependencies = [
- "anyhow",
- "async-trait",
- "boxed_error",
- "dashmap 5.5.3",
- "deno_error",
- "deno_media_type",
- "deno_package_json",
- "deno_path_util",
- "futures",
- "lazy-regex",
- "once_cell",
- "path-clean",
- "regex",
- "serde",
- "serde_json",
- "sys_traits",
- "thiserror 2.0.18",
- "url",
-]
-
-[[package]]
-name = "nom"
-version = "5.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08959a387a676302eebf4ddbcbc611da04285579f76f88ee0506c63b1a61dd4b"
-dependencies = [
- "memchr",
- "version_check",
-]
-
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -9074,25 +7434,6 @@ dependencies = [
  "minimal-lexical",
 ]
 
-[[package]]
-name = "notify"
-version = "6.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
-dependencies = [
- "bitflags 2.9.4",
- "crossbeam-channel",
- "filetime",
- "fsevent-sys",
- "inotify",
- "kqueue",
- "libc",
- "log",
- "mio 0.8.11",
- "walkdir",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "ntapi"
 version = "0.4.3"
@@ -9288,7 +7629,6 @@ dependencies = [
  "num-iter",
  "num-traits",
  "rand 0.8.5",
- "serde",
  "smallvec",
  "zeroize",
 ]
@@ -9418,15 +7758,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "objc"
-version = "0.2.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
-dependencies = [
- "malloc_buf",
-]
-
 [[package]]
 name = "object"
 version = "0.37.3"
@@ -9482,22 +7813,13 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "oid-registry"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bedf36ffb6ba96c2eb7144ef6270557b52e54b20c0a8e1eb2ff99a6c6959bff"
-dependencies = [
- "asn1-rs 0.5.2",
-]
-
 [[package]]
 name = "oid-registry"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8d8034d9489cdaf79228eb9f6a3b8d7bb32ba00d6645ebd48eef4077ceb5bd9"
 dependencies = [
- "asn1-rs 0.6.2",
+ "asn1-rs",
 ]
 
 [[package]]
@@ -9591,7 +7913,7 @@ checksum = "bf0b434746ee2832f4f0baf10137e1cabb18cbe6912c69e2e33263c45250f542"
 dependencies = [
  "bitflags 2.9.4",
  "cfg-if",
- "foreign-types 0.3.2",
+ "foreign-types",
  "libc",
  "openssl-macros",
  "openssl-sys",
@@ -9912,18 +8234,6 @@ version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
 
-[[package]]
-name = "p224"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30c06436d66652bc2f01ade021592c80a2aad401570a18aa18b82e440d2b9aa1"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -9948,20 +8258,6 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
-[[package]]
-name = "p521"
-version = "0.13.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
-dependencies = [
- "base16ct",
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "rand_core 0.6.4",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -10023,7 +8319,7 @@ dependencies = [
  "snap",
  "thrift",
  "tokio",
- "twox-hash 2.1.2",
+ "twox-hash",
  "zstd",
 ]
 
@@ -10050,28 +8346,12 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c5a797f0e07bdf071d15742978fc3128ec6c22891c31a3a931513263904c982a"
 
-[[package]]
-name = "path-clean"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecba01bf2678719532c5e3059e0b5f0811273d94b397088b82e3bd0a78c78fdd"
-
 [[package]]
 name = "pathdiff"
 version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
 
-[[package]]
-name = "pbkdf2"
-version = "0.12.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
-dependencies = [
- "digest 0.10.7",
- "hmac 0.12.1",
-]
-
 [[package]]
 name = "pem"
 version = "1.1.1"
@@ -10305,21 +8585,6 @@ dependencies = [
  "spki",
 ]
 
-[[package]]
-name = "pkcs5"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
-dependencies = [
- "aes 0.8.3",
- "cbc",
- "der",
- "pbkdf2",
- "scrypt",
- "sha2 0.10.9",
- "spki",
-]
-
 [[package]]
 name = "pkcs8"
 version = "0.10.2"
@@ -10327,8 +8592,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
  "der",
- "pkcs5",
- "rand_core 0.6.4",
  "spki",
 ]
 
@@ -10344,19 +8607,6 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
 
-[[package]]
-name = "png"
-version = "0.17.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82151a2fc869e011c153adc57cf2789ccb8d9906ce52c0b39a6b5697749d7526"
-dependencies = [
- "bitflags 1.3.2",
- "crc32fast",
- "fdeflate",
- "flate2",
- "miniz_oxide 0.8.9",
-]
-
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -10406,7 +8656,7 @@ dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "hmac 0.12.1",
  "md-5 0.10.6",
  "memchr",
@@ -10424,7 +8674,7 @@ dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "hmac 0.13.0",
  "md-5 0.11.0",
  "memchr",
@@ -10439,7 +8689,7 @@ version = "0.2.7"
 source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
 dependencies = [
  "bytes",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "postgres-protocol 0.6.7",
 ]
 
@@ -10453,7 +8703,7 @@ dependencies = [
  "bit-vec 0.6.3",
  "bytes",
  "chrono",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "postgres-protocol 0.6.11",
  "serde",
  "serde_json",
@@ -10527,7 +8777,6 @@ dependencies = [
  "proc-macro-error-attr",
  "proc-macro2",
  "quote",
- "syn 1.0.109",
  "version_check",
 ]
 
@@ -10635,12 +8884,6 @@ dependencies = [
  "hex",
 ]
 
-[[package]]
-name = "profiling"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d595e54a326bc53c1c197b32d295e14b169e3cfeaa8dc82b529f947fba6bcf5"
-
 [[package]]
 name = "prometheus"
 version = "0.14.0"
@@ -10665,26 +8908,6 @@ dependencies = [
  "prost-derive",
 ]
 
-[[package]]
-name = "prost-build"
-version = "0.13.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
-dependencies = [
- "heck 0.5.0",
- "itertools 0.14.0",
- "log",
- "multimap",
- "once_cell",
- "petgraph",
- "prettyplease",
- "prost",
- "prost-types",
- "regex",
- "syn 2.0.117",
- "tempfile",
-]
-
 [[package]]
 name = "prost-derive"
 version = "0.13.5"
@@ -10817,7 +9040,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
 dependencies = [
  "bytes",
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
@@ -10858,7 +9081,7 @@ version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
- "cfg_aliases 0.2.1",
+ "cfg_aliases",
  "libc",
  "once_cell",
  "socket2 0.6.3",
@@ -10893,16 +9116,6 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
-[[package]]
-name = "radix_trie"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
-dependencies = [
- "endian-type",
- "nibble_vec",
-]
-
 [[package]]
 name = "rand"
 version = "0.7.3"
@@ -11031,12 +9244,6 @@ dependencies = [
  "rand_core 0.5.1",
 ]
 
-[[package]]
-name = "range-alloc"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca45419789ae5a7899559e9512e58ca889e41f04f1f2445e9f4b290ceccd1d08"
-
 [[package]]
 name = "raw-cpuid"
 version = "11.6.0"
@@ -11046,12 +9253,6 @@ dependencies = [
  "bitflags 2.9.4",
 ]
 
-[[package]]
-name = "raw-window-handle"
-version = "0.6.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
-
 [[package]]
 name = "rayon"
 version = "1.12.0"
@@ -11093,7 +9294,7 @@ dependencies = [
  "ring 0.17.14",
  "rustls-pki-types",
  "time",
- "x509-parser 0.16.0",
+ "x509-parser",
  "yasna",
 ]
 
@@ -11460,15 +9661,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "ripemd"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "rkyv"
 version = "0.7.46"
@@ -11546,18 +9738,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "ron"
-version = "0.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b91f7eff05f748767f183df4320a63d6936e9c6107d97c9e6bdd9784f4289c94"
-dependencies = [
- "base64 0.21.7",
- "bitflags 2.9.4",
- "serde",
- "serde_derive",
-]
-
 [[package]]
 name = "rquickjs"
 version = "0.11.0"
@@ -11646,20 +9826,6 @@ dependencies = [
  "tokio-rustls 0.25.0",
 ]
 
-[[package]]
-name = "rusqlite"
-version = "0.32.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
-dependencies = [
- "bitflags 2.9.4",
- "fallible-iterator 0.3.0",
- "fallible-streaming-iterator",
- "hashlink 0.9.1",
- "libsqlite3-sys",
- "smallvec",
-]
-
 [[package]]
 name = "rust-embed"
 version = "6.8.1"
@@ -11765,7 +9931,7 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
 dependencies = [
- "nom 7.1.3",
+ "nom",
 ]
 
 [[package]]
@@ -11918,7 +10084,7 @@ dependencies = [
  "rustls-webpki 0.103.13",
  "security-framework 3.6.0",
  "security-framework-sys",
- "webpki-root-certs 1.0.7",
+ "webpki-root-certs",
  "windows-sys 0.61.2",
 ]
 
@@ -12036,28 +10202,6 @@ version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
-[[package]]
-name = "rustyline"
-version = "13.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02a2d683a4ac90aeef5b1013933f6d977bd37d51ff3f4dad829d4931a7e6be86"
-dependencies = [
- "bitflags 2.9.4",
- "cfg-if",
- "clipboard-win",
- "fd-lock",
- "home",
- "libc",
- "log",
- "memchr",
- "nix 0.27.1",
- "radix_trie",
- "unicode-segmentation",
- "unicode-width 0.1.14",
- "utf8parse",
- "winapi",
-]
-
 [[package]]
 name = "ryu"
 version = "1.0.23"
@@ -12081,25 +10225,6 @@ dependencies = [
  "serde_json",
 ]
 
-[[package]]
-name = "saffron"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03fb9a628596fc7590eb7edbf7b0613287be78df107f5f97b118aad59fb2eea9"
-dependencies = [
- "chrono",
- "nom 5.1.3",
-]
-
-[[package]]
-name = "salsa20"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
-dependencies = [
- "cipher 0.4.4",
-]
-
 [[package]]
 name = "samael"
 version = "0.0.20"
@@ -12245,18 +10370,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "scrypt"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0516a385866c09368f0b5bcd1caff3366aace790fcd46e2bb032697bb172fd1f"
-dependencies = [
- "password-hash",
- "pbkdf2",
- "salsa20",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "sct"
 version = "0.7.1"
@@ -12289,7 +10402,6 @@ dependencies = [
  "der",
  "generic-array",
  "pkcs8",
- "serdect",
  "subtle",
  "zeroize",
 ]
@@ -12409,16 +10521,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "serde_bytes"
-version = "0.11.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5d440709e79d88e51ac01c4b72fc6cb7314017bb7da9eeff678aa94c10e3ea8"
-dependencies = [
- "serde",
- "serde_core",
-]
-
 [[package]]
 name = "serde_core"
 version = "1.0.220"
@@ -12599,16 +10701,6 @@ dependencies = [
  "version_check",
 ]
 
-[[package]]
-name = "serdect"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
-dependencies = [
- "base16ct",
- "serde",
-]
-
 [[package]]
 name = "serial_test"
 version = "3.4.0"
@@ -12681,16 +10773,6 @@ dependencies = [
  "digest 0.11.3",
 ]
 
-[[package]]
-name = "sha3"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
-dependencies = [
- "digest 0.10.7",
- "keccak",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -12725,16 +10807,6 @@ version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
-[[package]]
-name = "signal-hook"
-version = "0.3.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d881a16cf4426aa584979d30bd82cb33429027e42122b169753d6ef1085ed6e2"
-dependencies = [
- "libc",
- "signal-hook-registry",
-]
-
 [[package]]
 name = "signal-hook-registry"
 version = "1.4.8"
@@ -12782,21 +10854,6 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
-[[package]]
-name = "simd-json"
-version = "0.14.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa2bcf6c6e164e81bc7a5d49fc6988b3d515d9e8c07457d7b74ffb9324b9cd40"
-dependencies = [
- "getrandom 0.2.17",
- "halfbrown",
- "ref-cast",
- "serde",
- "serde_json",
- "simdutf8",
- "value-trait",
-]
-
 [[package]]
 name = "simdutf8"
 version = "0.1.5"
@@ -12848,24 +10905,6 @@ version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
-[[package]]
-name = "slotmap"
-version = "1.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bdd58c3c93c3d278ca835519292445cb4b0d4dc59ccfdf7ceadaab3f8aeb4038"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "sm3"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebb9a3b702d0a7e33bc4d85a14456633d2b165c2ad839c5fd9a8417c1ab15860"
-dependencies = [
- "digest 0.10.7",
-]
-
 [[package]]
 name = "smallvec"
 version = "1.15.1"
@@ -12981,15 +11020,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spirv"
-version = "0.3.0+sdk-1.3.268.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eda41003dc44290527a59b13432d4a0379379fa074b70174882adfbdfd917844"
-dependencies = [
- "bitflags 2.9.4",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -13007,17 +11037,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5851699c4033c63636f7ea4cf7b7c1f1bf06d0cc03cfb42e711de5a5c46cf326"
 dependencies = [
  "base64 0.13.1",
- "nom 7.1.3",
+ "nom",
  "serde",
  "unicode-segmentation",
 ]
 
-[[package]]
-name = "sptr"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b9b39299b249ad65f3b7e96443bad61c02ca5cd3589f46cb6d610a0fd6c0d6a"
-
 [[package]]
 name = "sql-builder"
 version = "3.1.1"
@@ -13093,7 +11117,7 @@ dependencies = [
  "futures-io",
  "futures-util",
  "hashbrown 0.15.5",
- "hashlink 0.10.0",
+ "hashlink",
  "indexmap 2.14.0",
  "log",
  "memchr",
@@ -13825,18 +11849,6 @@ dependencies = [
  "futures-core",
 ]
 
-[[package]]
-name = "synstructure"
-version = "0.12.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 1.0.109",
- "unicode-xid",
-]
-
 [[package]]
 name = "synstructure"
 version = "0.13.2"
@@ -13862,10 +11874,6 @@ name = "sys_traits"
 version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5b46ac05dfbe9fd3a9703eff20e17f5b31e7b6a54daf27a421dcd56c7a27ecdd"
-dependencies = [
- "libc",
- "windows-sys 0.59.0",
-]
 
 [[package]]
 name = "sysctl"
@@ -13925,7 +11933,7 @@ dependencies = [
  "bytesize",
  "lazy_static",
  "libc",
- "nom 7.1.3",
+ "nom",
  "time",
  "winapi",
 ]
@@ -13962,7 +11970,7 @@ dependencies = [
  "lru 0.16.4",
  "lz4_flex 0.13.0",
  "measure_time",
- "memmap2 0.9.10",
+ "memmap2",
  "once_cell",
  "oneshot",
  "rayon",
@@ -14040,7 +12048,7 @@ version = "0.25.0"
 source = "git+https://github.com/windmill-labs/tantivy?rev=6ae7c70bc603b8e69e27f3240e08bd00a93fb12c#6ae7c70bc603b8e69e27f3240e08bd00a93fb12c"
 dependencies = [
  "fnv",
- "nom 7.1.3",
+ "nom",
  "ordered-float 5.3.0",
  "serde",
  "serde_json",
@@ -14399,7 +12407,7 @@ dependencies = [
  "bytes",
  "io-uring",
  "libc",
- "mio 1.2.0",
+ "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
@@ -14410,16 +12418,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "tokio-eld"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9166030f05d6bc5642bdb8f8c2be31eb3c02cd465d662bcdc2df82d4aa41a584"
-dependencies = [
- "hdrhistogram",
- "tokio",
-]
-
 [[package]]
 name = "tokio-graceful"
 version = "0.1.6"
@@ -14444,18 +12442,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "tokio-metrics"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eace09241d62c98b7eeb1107d4c5c64ca3bd7da92e8c218c153ab3a78f9be112"
-dependencies = [
- "futures-util",
- "pin-project-lite",
- "tokio",
- "tokio-stream",
-]
-
 [[package]]
 name = "tokio-native-tls"
 version = "0.3.1"
@@ -14474,7 +12460,7 @@ dependencies = [
  "async-trait",
  "byteorder",
  "bytes",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "futures-channel",
  "futures-util",
  "log",
@@ -14500,7 +12486,7 @@ dependencies = [
  "async-trait",
  "byteorder",
  "bytes",
- "fallible-iterator 0.2.0",
+ "fallible-iterator",
  "futures-channel",
  "futures-util",
  "log",
@@ -14624,7 +12610,6 @@ dependencies = [
  "futures-io",
  "futures-sink",
  "futures-util",
- "hashbrown 0.15.5",
  "pin-project-lite",
  "slab",
  "tokio",
@@ -15114,17 +13099,6 @@ dependencies = [
  "utf-8",
 ]
 
-[[package]]
-name = "twox-hash"
-version = "1.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
-dependencies = [
- "cfg-if",
- "rand 0.8.5",
- "static_assertions",
-]
-
 [[package]]
 name = "twox-hash"
 version = "2.1.2"
@@ -15516,39 +13490,12 @@ dependencies = [
  "which 6.0.3",
 ]
 
-[[package]]
-name = "v8_valueserializer"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97599c400fc79925922b58303e98fcb8fa88f573379a08ddb652e72cbd2e70f6"
-dependencies = [
- "bitflags 2.9.4",
- "encoding_rs",
- "indexmap 2.14.0",
- "num-bigint",
- "serde",
- "thiserror 1.0.69",
- "wtf8",
-]
-
 [[package]]
 name = "valuable"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
-[[package]]
-name = "value-trait"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9170e001f458781e92711d2ad666110f153e4e50bfd5cbd02db6547625714187"
-dependencies = [
- "float-cmp",
- "halfbrown",
- "itoa",
- "ryu",
-]
-
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -15819,15 +13766,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "webpki-root-certs"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75c7f0ef91146ebfb530314f5f1d24528d7f0767efbfd31dce919275413e393e"
-dependencies = [
- "webpki-root-certs 1.0.7",
-]
-
 [[package]]
 name = "webpki-root-certs"
 version = "1.0.7"
@@ -15855,89 +13793,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "wgpu-core"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d50819ab545b867d8a454d1d756b90cd5f15da1f2943334ca314af10583c9d39"
-dependencies = [
- "arrayvec",
- "bit-vec 0.6.3",
- "bitflags 2.9.4",
- "cfg_aliases 0.1.1",
- "codespan-reporting",
- "document-features",
- "indexmap 2.14.0",
- "log",
- "naga",
- "once_cell",
- "parking_lot",
- "profiling",
- "raw-window-handle",
- "ron",
- "rustc-hash 1.1.0",
- "serde",
- "smallvec",
- "thiserror 1.0.69",
- "web-sys",
- "wgpu-hal",
- "wgpu-types",
-]
-
-[[package]]
-name = "wgpu-hal"
-version = "0.21.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "172e490a87295564f3fcc0f165798d87386f6231b04d4548bca458cbbfd63222"
-dependencies = [
- "android_system_properties",
- "arrayvec",
- "ash",
- "bit-set 0.5.3",
- "bitflags 2.9.4",
- "block",
- "cfg_aliases 0.1.1",
- "core-graphics-types",
- "d3d12",
- "glow",
- "glutin_wgl_sys",
- "gpu-alloc",
- "gpu-descriptor",
- "js-sys",
- "khronos-egl",
- "libc",
- "libloading 0.8.9",
- "log",
- "metal",
- "naga",
- "ndk-sys",
- "objc",
- "once_cell",
- "parking_lot",
- "profiling",
- "range-alloc",
- "raw-window-handle",
- "rustc-hash 1.1.0",
- "smallvec",
- "thiserror 1.0.69",
- "wasm-bindgen",
- "web-sys",
- "wgpu-types",
- "winapi",
-]
-
-[[package]]
-name = "wgpu-types"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1353d9a46bff7f955a680577f34c69122628cc2076e1d6f3a9be6ef00ae793ef"
-dependencies = [
- "bitflags 2.9.4",
- "js-sys",
- "serde",
- "web-sys",
-]
-
 [[package]]
 name = "which"
 version = "4.4.2"
@@ -17425,7 +15280,6 @@ dependencies = [
  "deno_io",
  "deno_net",
  "deno_permissions",
- "deno_runtime",
  "deno_telemetry",
  "deno_tls",
  "deno_url",
@@ -17885,7 +15739,7 @@ dependencies = [
  "jsonwebtoken 8.3.0",
  "lazy_static",
  "libffi-sys",
- "libloading 0.8.9",
+ "libloading",
  "mappable-rc",
  "mime_guess",
  "mysql_async",
@@ -17955,7 +15809,7 @@ dependencies = [
  "windmill-types",
  "windmill-worker-volumes",
  "windows 0.61.3",
- "x509-parser 0.16.0",
+ "x509-parser",
  "yaml-rust",
 ]
 
@@ -18671,12 +16525,6 @@ version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
-[[package]]
-name = "wtf8"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c01ae8492c38f52376efd3a17d0994b6bcf3df1e39c0226d458b7d81670b2a06"
-
 [[package]]
 name = "wyz"
 version = "0.5.1"
@@ -18686,47 +16534,18 @@ dependencies = [
  "tap",
 ]
 
-[[package]]
-name = "x25519-dalek"
-version = "2.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
-dependencies = [
- "curve25519-dalek",
- "rand_core 0.6.4",
- "serde",
- "zeroize",
-]
-
-[[package]]
-name = "x509-parser"
-version = "0.15.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7069fba5b66b9193bd2c5d3d4ff12b839118f6bcbef5328efafafb5395cf63da"
-dependencies = [
- "asn1-rs 0.5.2",
- "data-encoding",
- "der-parser 8.2.0",
- "lazy_static",
- "nom 7.1.3",
- "oid-registry 0.6.1",
- "rusticata-macros",
- "thiserror 1.0.69",
- "time",
-]
-
 [[package]]
 name = "x509-parser"
 version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fcbc162f30700d6f3f82a24bf7cc62ffe7caea42c0b2cba8bf7f3ae50cf51f69"
 dependencies = [
- "asn1-rs 0.6.2",
+ "asn1-rs",
  "data-encoding",
- "der-parser 9.0.0",
+ "der-parser",
  "lazy_static",
- "nom 7.1.3",
- "oid-registry 0.7.1",
+ "nom",
+ "oid-registry",
  "ring 0.17.14",
  "rusticata-macros",
  "thiserror 1.0.69",
@@ -18743,12 +16562,6 @@ dependencies = [
  "rustix 1.1.4",
 ]
 
-[[package]]
-name = "xml-rs"
-version = "0.8.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ae8337f8a065cfc972643663ea4279e04e7256de865aa66fe25cec5fb912d3f"
-
 [[package]]
 name = "xmlparser"
 version = "0.13.6"
@@ -18788,18 +16601,6 @@ dependencies = [
  "time",
 ]
 
-[[package]]
-name = "yoke"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
-dependencies = [
- "serde",
- "stable_deref_trait",
- "yoke-derive 0.7.5",
- "zerofrom",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.2"
@@ -18807,22 +16608,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
- "yoke-derive 0.8.2",
+ "yoke-derive",
  "zerofrom",
 ]
 
-[[package]]
-name = "yoke-derive"
-version = "0.7.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
- "synstructure 0.13.2",
-]
-
 [[package]]
 name = "yoke-derive"
 version = "0.8.2"
@@ -18832,7 +16621,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -18873,7 +16662,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "synstructure 0.13.2",
+ "synstructure",
 ]
 
 [[package]]
@@ -18881,20 +16670,6 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
-dependencies = [
- "zeroize_derive",
-]
-
-[[package]]
-name = "zeroize_derive"
-version = "1.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
 
 [[package]]
 name = "zerotrie"
@@ -18903,7 +16678,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
 ]
 
@@ -18913,7 +16688,7 @@ version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
- "yoke 0.8.2",
+ "yoke",
  "zerofrom",
  "zerovec-derive",
 ]
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 042179683d..fbee476402 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -455,7 +455,6 @@ deno_net = "0.182.0"
 deno_core = "0.336.0"
 deno_ast = { version = "=0.44.0", features = ["transpiling"] }
 deno_permissions = "0.49.0"
-deno_runtime = { version = "0.198.0", features = ["transpile"] }
 deno_telemetry = "0.12.0"
 deno_error = "=0.5.5"
 rustls-pemfile = "2.2.0"
diff --git a/backend/windmill-runtime-nativets/Cargo.toml b/backend/windmill-runtime-nativets/Cargo.toml
index 417ec8de9d..c4f3461815 100644
--- a/backend/windmill-runtime-nativets/Cargo.toml
+++ b/backend/windmill-runtime-nativets/Cargo.toml
@@ -30,7 +30,6 @@ deno_permissions.workspace = true
 deno_io.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
-deno_runtime.workspace = true
 winapi.workspace = true
 
 itertools.workspace = true
@@ -60,6 +59,6 @@ deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
 deno_io.workspace = true
-deno_runtime.workspace = true
 deno_telemetry.workspace = true
+deno_error.workspace = true
 winapi.workspace = true
diff --git a/backend/windmill-runtime-nativets/build.rs b/backend/windmill-runtime-nativets/build.rs
index 2f4ec8c38d..6598c974eb 100644
--- a/backend/windmill-runtime-nativets/build.rs
+++ b/backend/windmill-runtime-nativets/build.rs
@@ -1,3 +1,6 @@
+use deno_ast::{MediaType, ParseParams};
+use deno_core::{ModuleCodeString, ModuleName, SourceMapData};
+use deno_error::JsErrorBox;
 use deno_fetch::FetchPermissions;
 use deno_net::NetPermissions;
 use deno_web::{BlobStore, TimersPermission};
@@ -77,6 +80,74 @@ deno_core::extension!(
     esm = ["src/runtime.js"],
 );
 
+// `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`.
+//
+// Specialized to our snapshot's inputs. Of the seven deno_* extensions
+// we register via `init_ops_and_esm()`, six ship pre-built `.js` files
+// in their `esm` lists (webidl/url/console/web/fetch/net) — only
+// `deno_telemetry`'s `extension!` macro lists `.ts` files
+// (`telemetry.ts`, `util.ts`), so the TypeScript branch is needed
+// solely for that crate. Our local `fetch` extension contributes
+// `src/runtime.js` (pure JS). No `node:` imports happen at snapshot
+// build time, no `.mjs`, no user-supplied modules. So:
+//   - `.js` → pass through.
+//   - `.ts` → transpile via deno_ast (deno_telemetry only).
+//   - anything else → build bug (deno shipping an unexpected file type
+//     or us mislabelling one), panic loudly rather than emit a broken
+//     snapshot.
+//
+// No source maps: the snapshot is a binary blob the runtime loads — source
+// maps would never be consumed.
+//
+// The signature still returns `Result<_, JsErrorBox>` because that's what
+// `extension_transpiler` expects, but we never construct one — parse and
+// transpile failures are build-time bugs in deno's own .ts internals (or
+// in our runtime.js, if we ever change its extension), so they panic.
+//
+// This replaces a call to `deno_runtime::transpile::maybe_transpile_source`
+// from `deno_runtime 0.198.0`. The original is more general (handles
+// `node:` modules, `.mjs`, emits source maps in debug builds, plumbs
+// errors via `JsErrorBox`); none of that surface is reachable in our
+// build. Dropping the `deno_runtime` dep eliminates a
+// `deno_cache → rusqlite → libsqlite3-sys 0.35` transitive chain that
+// collides with sqlx-sqlite's `libsqlite3-sys 0.30` (cargo's
+// `links = "sqlite3"` rule).
+fn maybe_transpile_source(
+    name: ModuleName,
+    source: ModuleCodeString,
+) -> Result<(ModuleCodeString, Option<SourceMapData>), JsErrorBox> {
+    let media_type = MediaType::from_path(Path::new(&name));
+    match media_type {
+        MediaType::JavaScript => return Ok((source, None)),
+        MediaType::TypeScript => {}
+        _ => panic!("unexpected media type {media_type:?} for {name} during snapshot build"),
+    }
+
+    let parsed = deno_ast::parse_module(ParseParams {
+        specifier: deno_core::url::Url::parse(&name).unwrap(),
+        text: source.into(),
+        media_type,
+        capture_tokens: false,
+        scope_analysis: false,
+        maybe_syntax: None,
+    })
+    .unwrap_or_else(|e| panic!("snapshot transpile: parse failed for {name}: {e}"));
+
+    let transpiled = parsed
+        .transpile(
+            &deno_ast::TranspileOptions {
+                imports_not_used_as_values: deno_ast::ImportsNotUsedAsValues::Remove,
+                ..Default::default()
+            },
+            &deno_ast::TranspileModuleOptions::default(),
+            &deno_ast::EmitOptions::default(),
+        )
+        .unwrap_or_else(|e| panic!("snapshot transpile: emit failed for {name}: {e}"))
+        .into_source();
+
+    Ok((transpiled.text.into(), None))
+}
+
 fn main() {
     println!("cargo:rustc-env=TARGET={}", env::var("TARGET").unwrap());
     println!("cargo:rustc-env=PROFILE={}", env::var("PROFILE").unwrap());
@@ -105,7 +176,7 @@ fn main() {
             cargo_manifest_dir: env!("CARGO_MANIFEST_DIR"),
             startup_snapshot: None,
             extension_transpiler: Some(std::rc::Rc::new(|specifier, source| {
-                deno_runtime::transpile::maybe_transpile_source(specifier, source)
+                maybe_transpile_source(specifier, source)
             })),
             extensions: exts,
             with_runtime_cb: None,

From 3cd0eac8c15ec22a65035925e9b52d47cb217056 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 21:13:24 +0000
Subject: [PATCH 30/50] deps: bump deno_core / deno_ast / swc to the goldilocks
 pin set; drop serde ceiling (#9111)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* deps: bump deno_core / deno_ast / swc to the goldilocks pin set; drop serde ceiling

Bumps every deno_* and swc_* workspace dep to a hand-picked "goldilocks"
combination that drops the serde =1.0.220 ceiling without crashing into
the rustls / aws-sdk resolver wall that the obvious deno v2.6.0 target
hits.

## What's the goldilocks set

| crate            | old      | new       | source                                |
|------------------|----------|-----------|---------------------------------------|
| deno_core        | 0.336.0  | 0.352.0   | deno v2.4.0                           |
| deno_fetch       | 0.214.0  | 0.233.0   | deno v2.4.0                           |
| deno_tls         | 0.177.0  | 0.196.0   | deno v2.4.0 (last permissive-rustls)  |
| deno_console     | 0.190.0  | 0.209.0   | deno v2.4.0                           |
| deno_url         | 0.190.0  | 0.209.0   | deno v2.4.0                           |
| deno_webidl      | 0.190.0  | 0.209.0   | deno v2.4.0                           |
| deno_web         | 0.221.0  | 0.240.0   | deno v2.4.0                           |
| deno_io          | 0.100.0  | 0.119.0   | deno v2.4.0                           |
| deno_net         | 0.182.0  | 0.201.0   | deno v2.4.0                           |
| deno_permissions | 0.49.0   | 0.68.0    | deno v2.4.0                           |
| deno_telemetry   | 0.12.0   | 0.31.0    | deno v2.4.0                           |
| deno_error       | =0.5.5   | =0.6.1    | deno v2.4.0                           |
| deno_ast         | =0.44.0  | =0.51.0   | **override** — see "load-bearing" below |
| deno_fs          | (new)    | 0.119.0   | new workspace dep — FetchPermissions exposes deno_fs::CheckedPath / GetPath as public API |
| v8               | =130.0.7 | =137.1.0  | deno_core 0.352 transitive            |
| swc_common       | =0.37.5  | =14.0.4   | **the load-bearing pin**              |
| swc_ecma_ast     | =0.118.2 | =15.0.0   | matched set with swc_common 14.0.4    |
| swc_ecma_parser  | =0.149.1 | =24.0.3   | matched set                           |
| swc_ecma_visit   | =0.104.8 | =15.0.0   | matched set                           |
| serde            | =1.0.220 | ^1        | **freed** (resolves to 1.0.228+)      |

## Why this combination and not v2.6.0

The obvious target was deno v2.6.0 (with deno_ast 0.52 → swc_common 17,
well past the `__private` ceiling). That hits three resolver collisions:

1. libsqlite3-sys: deno_cache → rusqlite 0.37 → libsqlite3-sys 0.35
   vs sqlx → libsqlite3-sys 0.30. **Already killed by PR #9110** —
   we dropped deno_runtime, which is what pulled in deno_cache.
2. fqdn 0.4.6/0.4.7 yanked, required by deno_permissions 0.81.0. Solvable
   by injecting the yanked entry into Cargo.lock manually but ugly.
3. rustls: deno_tls 0.198+ hard-pins `=0.23.28`, but aws-sdk-bedrockruntime
   1.122.0 → aws-smithy-http-client 1.1.5 wants `^0.23.31`. Within-major
   conflict, no resolver path. The unbeatable wall.

Goldilocks-set choice sidesteps (2) and (3) entirely:

- `deno_tls 0.196.0` was the last version before deno tightened
  `rustls ^0.23.11` (range, accepts 0.23.31) to exact `=0.23.28`. With
  ^0.23.11, the resolver picks rustls 0.23.35 (latest 0.23 patch) which
  satisfies both deno_tls's `>=0.23.11` and aws-sdk's `>=0.23.31`. Verified
  empirically: lockfile has rustls 0.23.35 after this bump.
- `deno_permissions 0.68.0` (v2.4.0's pin) doesn't depend on fqdn at all.
  The fqdn dep was added in a later deno_permissions release.

## Why deno_ast =0.51.0 specifically (not 0.48.0 from v2.4.0)

`swc_common 14.0.4` is the first patch that **drops the
`pub use serde::__private as serde;` line** in `src/private/mod.rs`. Older
14.0.x and all 0.37.5–13.x revisions still have it, and that line is
what was capping `serde = "=1.0.220"` (the workspace pin's "stuck because
of swc" comment). Empirically verified by inspecting the tarballs of
14.0.0 / 14.0.1 / 14.0.2 / 14.0.3 / 14.0.4:

    14.0.0: has hack
    14.0.1: has hack
    14.0.2: has hack
    14.0.3: has hack
    14.0.4: NO HACK    ← inflection point

`deno_ast 0.51.0` pins `swc_common =14.0.4` exactly — older deno_ast
versions pin earlier swc_common patches that still have the hack.
Notably, deno v2.4.0 itself pins `deno_ast =0.48.0` (swc_common 9.2.0,
still has hack) — we deliberately deviate from v2.4.0's deno_ast pin
to escape the swc serde wall, while keeping the rest of v2.4.0's pin
set for resolver compatibility with aws-sdk. deno_ast 0.51 was never
shipped in any deno release (v2.4.5 used 0.49, v2.5.0 jumped to 0.50,
v2.6.0 to 0.52), but it's published on crates.io and compatible with
v2.4.0's deno_core 0.352.

## What this unblocks

- PR #9106's `serde = "=1.0.224"` bump variant can rebase onto this
  and resolve cleanly (MaterializeInc/rust-postgres' `postgres-types`
  needs `serde_core ^1.0.221`, which is satisfied now that we're on
  serde 1.0.228).
- Future deno_* / swc_* bumps no longer need to argue about the serde
  ceiling — it's gone.

## What changes in source code

This commit is Cargo.toml + Cargo.lock only. Source changes that the
new deno_core / deno_fetch API requires live in the follow-up commits:

- `parsers/windmill-parser-{ts,ts-asset,wac}`: swc 0.37 → 14
  (`code.into()` ambiguity fix at 5 sites)
- `windmill-runtime-nativets/build.rs` + `src/lib.rs`: deno_core 0.336
  → 0.352 API moves (`init_ops_and_esm()` → `init()`,
  `FetchPermissions` / `NetPermissions` trait signature updates,
  `deno_tls::Proxy` enum shape change)

A companion change in windmill-ee-private adjusts
`otel_tracing_proxy_ee.rs:521` for `deno_telemetry::init`'s second arg
becoming by-value (was `&OtelConfig`).

* fix(parsers): adapt to swc_common 14 BytesStr ambiguity

swc 0.37.5 → 14.0.4 changed `SourceMap::new_source_file`'s `src` argument
from `String` to `impl Into<BytesStr>`. With `BytesStr` available, the
existing call sites' `code.into()` on a `&str` becomes ambiguous between
`Into<Bytes>` (from the bytes crate) and `Into<BytesStr>` (from
bytes_str). Switch to `code.to_string()` to produce an owned `String`
that satisfies `From<String> for BytesStr` unambiguously.

Five call sites across three crates:
- windmill-parser-ts/src/lib.rs (3 sites)
- windmill-parser-ts-asset/src/lib.rs (1 site)
- windmill-parser-wac/src/typescript.rs (1 site)

* fix(nativets): adapt to deno_core 0.352 / deno_fetch 0.233 API changes

The goldilocks deno bump (deno_core 0.336 → 0.352, deno_fetch 0.214 →
0.233, etc.) ripples through nativets' build.rs and src/lib.rs.
Source-level changes required:

## 1. `extension!` macro: `init_ops_and_esm()` and `init_ops()` removed

deno_core 0.352's `extension!` macro now generates a single `init()`
function on the extension struct (full: ops + esm), plus `lazy_init()`
(ops only, with `needs_lazy_init = true` and a contract that the
caller invokes `JsRuntime::lazy_init_extensions` after construction).

- `build.rs` (snapshot creation, wants both ops and esm baked in):
  `X::init_ops_and_esm(...)` → `X::init(...)`.
- `src/lib.rs:create_nativets_runtime` (runtime, was using `init_ops()`
  because the snapshot already provides esm): also → `X::init(...)`.
  deno_core's snapshot path skips esm re-execution when the snapshot
  provides them, so the esm registration is a no-op at runtime. This
  is how deno's own v2.4.0 runtime works.

Avoided `lazy_init` because it requires plumbing
`JsRuntime::lazy_init_extensions(ext_args_vec)` correctly across the
codebase, which is invasive for no behavioural benefit.

## 2. Local `fetch` extension now declared in both build.rs and lib.rs

deno_core 0.352 validates extension order between snapshot and runtime.
Our snapshot's last extension is the local `fetch` ext (which provides
ext:fetch/src/runtime.js). To avoid a runtime panic:

    "Extensions from snapshot loaded in wrong order: expected fetch but got windmill"

…the runtime extension list now ends with `fetch::init()` matching the
snapshot order. The macro requires the same `esm` argument to type-check,
even though the ESM is not re-executed at runtime (it's in the snapshot).

## 3. `FetchPermissions` and `NetPermissions` trait shape

`deno_fetch::FetchPermissions` (deno_fetch 0.233.0) added new methods
and changed signatures:

- `check_read` / `check_write`: now take `path: Cow<'a, Path>` plus
  a new `get_path: &'a dyn deno_fs::GetPath` parameter, and return
  `Result<deno_fs::CheckedPath<'a>, FsError>` instead of `Result<Cow<Path>, FsError>`.
- New `check_write` (didn't exist) and `check_net_vsock` methods.

`deno_net::NetPermissions` (deno_net 0.201.0) gained `check_vsock`
and `check_write_path` now takes `Cow<'_, Path>`.

For `build.rs`'s `PermissionsContainer` (used only during snapshot
creation, where permissions are never actually checked): all methods
`unreachable!("snapshotting")`.

For `src/lib.rs`'s `PermissionsContainer` (used at runtime — the
nativets policy is "allow everything"): `check_read` / `check_write`
return `Ok(CheckedPath::Unresolved(path))`, `check_*_vsock` return
`Ok(())`. Smoke tests confirm fetch/net/url/web/blob/timers/structuredClone
behaviour is intact end-to-end.

## 4. `deno_tls::Proxy` is now an enum

`deno_tls::Proxy` was a struct, is now an enum with `Http`, `Https`,
`Socks5` variants. Our call site uses HTTP proxies — switched the
struct literal `deno_tls::Proxy { url, basic_auth }` to
`deno_tls::Proxy::Http { url, basic_auth }`.

## 5. New `deno_fs` direct workspace dep

`FetchPermissions` exposes `deno_fs::CheckedPath` and `deno_fs::GetPath`
as part of its public API. We can't avoid naming `deno_fs` directly any
more. Pinned to 0.119.0 (v2.4.0's matched version, transitively present
already through deno_fetch). Added to workspace `[dependencies]` plus
nativets's `[dependencies]` and `[build-dependencies]`.

## Validation

`cargo check --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp,run_inline`
→ clean.

`cargo test -p windmill-runtime-nativets smoke -- --ignored --skip smoke_net_`
→ 8 passed; 0 failed (the full local smoke suite covering fetch,
setTimeout/Promise.all, URL/SearchParams, Blob/btoa/atob, large payload
roundtrip, error propagation, concurrent isolates, TS enum/union
transpile).

Network smoke tests (`smoke_net_fetch_example_com`,
`smoke_net_fetch_json_and_headers`) not run as part of the validation
gate but expected to pass — the change preserves deno_fetch behaviour
through the trait surface.

* chore: update ee-repo-ref to pick up deno_telemetry::init by-value fix

Points at windmill-ee-private branch deps/bump-deno-and-swc-goldilocks
which contains the companion otel_tracing_proxy_ee.rs adjustment for
deno_telemetry 0.12 → 0.31 (second arg of `init` is now by-value).
EE-only file, doesn't affect OSS build.

* chore(nix): bump rusty_v8 in flake.nix to 137.1.0 to match Cargo.toml

Cargo.toml's v8 pin moved from =130.0.7 to =137.1.0 as part of the
deno_core 0.336 → 0.352 bump, but I missed the comment directly above
the version pin:

    # Exact version NOTE: Do not forget to update version and hash in flake.nix

flake.nix provides the prebuilt librusty_v8 binary that the v8 crate
links against. A version mismatch would either fail to fetch (if the
137.1.0 release didn't exist) or cause link-time symbol mismatches.
Nix is used by rust-client-check.yml and rust_on_release.yml in CI,
plus the dev shell — stale flake pin breaks all of those.

Updates x86_64-linux's sha256 to match the actual hash of
librusty_v8_release_x86_64-unknown-linux-gnu.a.gz at the 137.1.0 tag.
Other targets (aarch64-linux, x86_64-darwin, aarch64-darwin) remain
as lib.fakeHash — they were already placeholders in the previous
pin, so we don't regress on them.

Caught by both cubic and Pi reviewers on PR #9111.

* docs(nativets): clarify snapshot-prefix rule in extension-order comment

Claude reviewer caught that the doc comment claimed the runtime
extension list matches the snapshot's order — implying an exact match.
The truth is more permissive: deno_core 0.352 requires the snapshot's
extension list to be a *prefix* of the runtime's, not an exact match.
Runtime is allowed to append extra extensions (which we do — the
windmill `ext` carrying our ops is the last entry at runtime but absent
from the snapshot).

The code is correct as-is; only the comment wording was misleading.

Also fixes the same wording in PR description.
---
 backend/Cargo.lock                            | 810 ++++++++++--------
 backend/Cargo.toml                            |  48 +-
 backend/ee-repo-ref.txt                       |   2 +-
 .../windmill-parser-ts-asset/src/lib.rs       |   2 +-
 backend/parsers/windmill-parser-ts/src/lib.rs |   6 +-
 .../windmill-parser-wac/src/typescript.rs     |   2 +-
 backend/windmill-runtime-nativets/Cargo.toml  |   2 +
 backend/windmill-runtime-nativets/build.rs    |  70 +-
 backend/windmill-runtime-nativets/src/lib.rs  |  90 +-
 flake.nix                                     |   4 +-
 10 files changed, 593 insertions(+), 443 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index c5a26d1b45..d4ec956b96 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2,16 +2,6 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "Inflector"
-version = "0.11.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
-dependencies = [
- "lazy_static",
- "regex",
-]
-
 [[package]]
 name = "addr2line"
 version = "0.25.1"
@@ -21,12 +11,6 @@ dependencies = [
  "gimli",
 ]
 
-[[package]]
-name = "adler"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -467,6 +451,12 @@ dependencies = [
  "regex-syntax 0.8.10",
 ]
 
+[[package]]
+name = "ascii"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d92bec98840b8f03a5ff5413de5293bfcd8bf96467cf5452609f939ec6f5de16"
+
 [[package]]
 name = "asn1-rs"
 version = "0.6.2"
@@ -508,11 +498,10 @@ dependencies = [
 
 [[package]]
 name = "ast_node"
-version = "0.9.9"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9184f2b369b3e8625712493c89b785881f27eedc6cde480a81883cef78868b2"
+checksum = "0a184645bcc6f52d69d8e7639720699c6a99efb711f886e251ed1d16db8dd90e"
 dependencies = [
- "proc-macro2",
  "quote",
  "swc_macros_common",
  "syn 2.0.117",
@@ -1252,7 +1241,7 @@ version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "576b0d6991c9c32bc14fc340582ef148311f924d41815f641a308b5d11e8e7cd"
 dependencies = [
- "base64-simd 0.8.0",
+ "base64-simd",
  "bytes",
  "bytes-utils",
  "futures-core",
@@ -1444,7 +1433,7 @@ dependencies = [
  "addr2line",
  "cfg-if",
  "libc",
- "miniz_oxide 0.8.9",
+ "miniz_oxide",
  "object",
  "rustc-demangle",
  "windows-link 0.2.1",
@@ -1480,22 +1469,13 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
-[[package]]
-name = "base64-simd"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "781dd20c3aff0bd194fe7d2a977dd92f21c173891f3a03b677359e5fa457e5d5"
-dependencies = [
- "simd-abstraction",
-]
-
 [[package]]
 name = "base64-simd"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
 dependencies = [
- "outref 0.5.2",
+ "outref",
  "vsimd",
 ]
 
@@ -1507,9 +1487,9 @@ checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "better_scoped_tls"
-version = "0.1.2"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297b153aa5e573b5863108a6ddc9d5c968bd0b20e75cc614ee9821d2f45679c7"
+checksum = "7cd228125315b132eed175bf47619ac79b945b26e56b848ba203ae4ea8603609"
 dependencies = [
  "scoped-tls",
 ]
@@ -1536,26 +1516,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "bindgen"
-version = "0.70.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f49d8fed880d473ea71efb9bf597651e77201bdd4893efe54c9e5d65ae04ce6f"
-dependencies = [
- "bitflags 2.9.4",
- "cexpr",
- "clang-sys",
- "itertools 0.13.0",
- "log",
- "prettyplease",
- "proc-macro2",
- "quote",
- "regex",
- "rustc-hash 1.1.0",
- "shlex",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "bindgen"
 version = "0.71.1"
@@ -1596,15 +1556,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "bit-set"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0700ddab506f33b20a03b13996eccd309a48e5ff77d0d95926aa0210fb4e95f1"
-dependencies = [
- "bit-vec 0.6.3",
-]
-
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -1972,6 +1923,16 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bytes-str"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c60b5ce37e0b883c37eb89f79a1e26fbe9c1081945d024eee93e8d91a7e18b3"
+dependencies = [
+ "bytes",
+ "serde",
+]
+
 [[package]]
 name = "bytes-utils"
 version = "0.1.4"
@@ -2065,15 +2026,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "capacity_builder"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58ec49028cb308564429cd8fac4ef21290067a0afe8f5955330a8d487d0d790c"
-dependencies = [
- "itoa",
-]
-
 [[package]]
 name = "capacity_builder"
 version = "0.5.0"
@@ -2094,6 +2046,15 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "castaway"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dec551ab6e7578819132c713a93c022a05d60159dc86e7a7050223577484c55a"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.62"
@@ -2295,6 +2256,19 @@ dependencies = [
  "unicode-width 0.2.2",
 ]
 
+[[package]]
+name = "compact_str"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f86b9c4c00838774a6d902ef931eff7470720c51d90c2e32cfe15dc304737b3f"
+dependencies = [
+ "castaway",
+ "cfg-if",
+ "itoa",
+ "ryu",
+ "static_assertions",
+]
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -2872,19 +2846,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "dashmap"
-version = "5.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
-dependencies = [
- "cfg-if",
- "hashbrown 0.14.5",
- "lock_api",
- "once_cell",
- "parking_lot_core",
-]
-
 [[package]]
 name = "dashmap"
 version = "6.1.0"
@@ -2974,7 +2935,7 @@ checksum = "61fe34f401bd03724a1f96d12108144f8cd495a3cdda2bf5e091822fb80b7e66"
 dependencies = [
  "arrow",
  "async-trait",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion-common",
  "datafusion-common-runtime",
  "datafusion-datasource",
@@ -3180,7 +3141,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "06f004d100f49a3658c9da6fb0c3a9b760062d96cd4ad82ccc3b7b69a9fb2f84"
 dependencies = [
  "arrow",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion-common",
  "datafusion-expr",
  "futures",
@@ -3476,7 +3437,7 @@ checksum = "ad229a134c7406c057ece00c8743c0c34b97f4e72f78b475fe17b66c5e14fa4f"
 dependencies = [
  "arrow",
  "async-trait",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion-common",
  "datafusion-common-runtime",
  "datafusion-execution",
@@ -3533,19 +3494,18 @@ dependencies = [
 
 [[package]]
 name = "deno_ast"
-version = "0.44.0"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eebc7aaabfdb3ddcad32aee1b62d250149dc8b35dfbdccbb125df2bdc62da952"
+checksum = "c72e0409b3dbd60a5bf296cbc273a8e36bb3a3aab6abac389f1891e187d5ce14"
 dependencies = [
- "base64 0.21.7",
- "deno_error",
+ "base64 0.22.1",
+ "capacity_builder",
+ "deno_error 0.7.3",
  "deno_media_type",
  "deno_terminal",
  "dprint-swc-ext",
- "once_cell",
  "percent-encoding",
  "serde",
- "sourcemap 9.3.2",
  "swc_atoms",
  "swc_common",
  "swc_config",
@@ -3553,6 +3513,7 @@ dependencies = [
  "swc_ecma_ast",
  "swc_ecma_codegen",
  "swc_ecma_codegen_macros",
+ "swc_ecma_lexer",
  "swc_ecma_loader",
  "swc_ecma_parser",
  "swc_ecma_transforms_base",
@@ -3565,46 +3526,45 @@ dependencies = [
  "swc_ecma_visit",
  "swc_eq_ignore_macros",
  "swc_macros_common",
+ "swc_sourcemap",
  "swc_visit",
- "swc_visit_macros",
  "text_lines",
  "thiserror 2.0.18",
- "unicode-width 0.1.14",
+ "unicode-width 0.2.2",
  "url",
 ]
 
 [[package]]
 name = "deno_console"
-version = "0.190.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94352b8d75c288a26ef748ad0ddae07e181109374a02c547850f96eef76b5389"
+checksum = "66c0b8a65dcb7b38c22e5969c6454b3cb0839b7dcfb7a4f0d904de871a4c4416"
 dependencies = [
  "deno_core",
 ]
 
 [[package]]
 name = "deno_core"
-version = "0.336.0"
+version = "0.352.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd50476c4325d5fa52bb906804a1e35b127d2a1dcf674e3447b53dcf25525bf"
+checksum = "bf78f3f72ac8e09b18a588bc26a1b3c5ab853e7fb489889b2f5000654d34db5d"
 dependencies = [
  "anyhow",
  "az",
  "bincode",
- "bit-set 0.5.3",
- "bit-vec 0.6.3",
+ "bit-set",
+ "bit-vec 0.8.0",
  "bytes",
- "capacity_builder 0.1.3",
+ "capacity_builder",
  "cooked-waker",
  "deno_core_icudata",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_ops",
  "deno_path_util",
  "deno_unsync",
  "futures",
  "indexmap 2.14.0",
  "libc",
- "memoffset",
  "parking_lot",
  "percent-encoding",
  "pin-project",
@@ -3612,7 +3572,7 @@ dependencies = [
  "serde_json",
  "serde_v8",
  "smallvec",
- "sourcemap 8.0.1",
+ "sourcemap",
  "static_assertions",
  "thiserror 2.0.18",
  "tokio",
@@ -3629,11 +3589,11 @@ checksum = "fe4dccb6147bb3f3ba0c7a48e993bfeb999d2c2e47a81badee80e2b370c8d695"
 
 [[package]]
 name = "deno_error"
-version = "0.5.5"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c23dbc46d5804814b08b4675838f9884e3a52916987ec5105af36d42f9911b5"
+checksum = "612ec3fc481fea759141b0c57810889b0a4fb6fee8f10748677bfe492fd30486"
 dependencies = [
- "deno_error_macro",
+ "deno_error_macro 0.6.1",
  "libc",
  "serde",
  "serde_json",
@@ -3642,10 +3602,20 @@ dependencies = [
 ]
 
 [[package]]
-name = "deno_error_macro"
-version = "0.5.5"
+name = "deno_error"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "babccedee31ce7e57c3e6dff2cb3ab8d68c49d0df8222fe0d11d628e65192790"
+checksum = "3007d3f1ea92ea503324ae15883aac0c2de2b8cf6fead62203ff6a67161007ab"
+dependencies = [
+ "deno_error_macro 0.7.3",
+ "libc",
+]
+
+[[package]]
+name = "deno_error_macro"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8380a4224d5d2c3f84da4d764c4326cac62e9a1e3d4960442d29136fc07be863"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3653,16 +3623,38 @@ dependencies = [
 ]
 
 [[package]]
-name = "deno_fetch"
-version = "0.214.0"
+name = "deno_error_macro"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3df032ca1f7f06a5cc459189b960793f64d415ddc9f59f262e0ad5059865002d"
+checksum = "9b565e60a9685cdf312c888665b5f8647ac692a7da7e058a5e2268a466da8eaf"
 dependencies = [
- "base64 0.21.7",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "deno_features"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "487773bb24b92f3b88d1c9ef0d4d15888641a2e2ea4d4cdfd6fda12cae26317c"
+dependencies = [
+ "deno_core",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "deno_fetch"
+version = "0.233.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cbe158bec955790105ded69978b1245b97c65092f7bf184add344c0e78efffa"
+dependencies = [
+ "base64 0.22.1",
  "bytes",
  "data-url",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_fs",
  "deno_path_util",
  "deno_permissions",
@@ -3686,6 +3678,7 @@ dependencies = [
  "tokio-rustls 0.26.4",
  "tokio-socks",
  "tokio-util",
+ "tokio-vsock",
  "tower 0.5.3",
  "tower-http",
  "tower-service",
@@ -3693,15 +3686,15 @@ dependencies = [
 
 [[package]]
 name = "deno_fs"
-version = "0.100.0"
+version = "0.119.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c82f79b71403b93b248727a89746026104b3a5ac1d82e79a02af6fa8e8487666"
+checksum = "5ca83a95cea7bcdf19dac1888ef6f04aff69d251640a4d085bc6089c06b4b181"
 dependencies = [
  "async-trait",
  "base32",
  "boxed_error",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_io",
  "deno_path_util",
  "deno_permissions",
@@ -3719,17 +3712,19 @@ dependencies = [
 
 [[package]]
 name = "deno_io"
-version = "0.100.0"
+version = "0.119.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e72489fe0dcada08047611d1ab92db1baebf7b606ab7c78790f622ecb30e22b"
+checksum = "597aac25be261a1bd545d6f47a80439c60e600c076f9847b3718a592883b2a73"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
+ "deno_subprocess_windows",
  "filetime",
  "fs3",
  "libc",
  "log",
+ "nix 0.27.1",
  "once_cell",
  "os_pipe",
  "parking_lot",
@@ -3743,9 +3738,9 @@ dependencies = [
 
 [[package]]
 name = "deno_media_type"
-version = "0.2.5"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "600222d059ab31ff31182b3e12615df2134a9e01605836b78ad8df91ba39eab3"
+checksum = "9fd0af4161f90b092feb363864a64d7c74e0efc13a15905d0d09df73bb72a123"
 dependencies = [
  "data-url",
  "serde",
@@ -3767,12 +3762,13 @@ dependencies = [
 
 [[package]]
 name = "deno_net"
-version = "0.182.0"
+version = "0.201.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab869063cbfe428a707511835865d55247886eb175659e538af4d5096c3d4d9d"
+checksum = "eb88f1ea2762065d6cc0316372acc22696ab6004943aa029f80546f9faf1b491"
 dependencies = [
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
+ "deno_features",
  "deno_permissions",
  "deno_tls",
  "hickory-proto",
@@ -3781,35 +3777,39 @@ dependencies = [
  "quinn",
  "rustls-tokio-stream",
  "serde",
+ "sha2 0.10.9",
  "socket2 0.5.10",
  "thiserror 2.0.18",
  "tokio",
+ "tokio-vsock",
+ "url",
+ "web-transport-proto",
 ]
 
 [[package]]
 name = "deno_ops"
-version = "0.212.0"
+version = "0.228.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2d328067139909aa81522a5d90f119368b541fbddd73ab630e4d9f777865f0d"
+checksum = "8bf8dbe5abf37d270bb853c5dfe45fbe3b1b6c453877cc11d7fe84e9862a6dbc"
 dependencies = [
  "indexmap 2.14.0",
  "proc-macro-rules",
  "proc-macro2",
  "quote",
  "stringcase",
- "strum 0.25.0",
- "strum_macros 0.25.3",
+ "strum 0.27.2",
+ "strum_macros 0.27.2",
  "syn 2.0.117",
  "thiserror 2.0.18",
 ]
 
 [[package]]
 name = "deno_path_util"
-version = "0.3.1"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c87b8996966ae1b13ee9c20219b1d10fc53905b9570faae6adfa34614fd15224"
+checksum = "516f813389095889776b81cc9108ff6f336fd9409b4b12fc0138aea23d2708e1"
 dependencies = [
- "deno_error",
+ "deno_error 0.6.1",
  "percent-encoding",
  "sys_traits",
  "thiserror 2.0.18",
@@ -3818,35 +3818,54 @@ dependencies = [
 
 [[package]]
 name = "deno_permissions"
-version = "0.49.0"
+version = "0.68.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abf879dff0b3de4dbcb78d6dda3a55e711369d5b9f479270a82853ef106c4176"
+checksum = "baa14d9c3fbba59836ffbaac7f736a2f48d4a5fc209a2103d1e1b898915232a5"
 dependencies = [
- "capacity_builder 0.5.0",
- "deno_core",
- "deno_error",
+ "capacity_builder",
+ "deno_error 0.6.1",
  "deno_path_util",
  "deno_terminal",
+ "deno_unsync",
  "fqdn",
+ "ipnetwork",
  "libc",
  "log",
+ "nix 0.27.1",
  "once_cell",
+ "parking_lot",
  "percent-encoding",
  "serde",
+ "serde_json",
+ "sys_traits",
+ "temp_deno_which",
  "thiserror 2.0.18",
- "which 6.0.3",
+ "url",
  "winapi",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "deno_subprocess_windows"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bc6b10059f0ccb14c6e0319c5275f0407fb2f9ffe405cd555700561999ea4bf"
+dependencies = [
+ "fastrand",
+ "futures-channel",
+ "libc",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "deno_telemetry"
-version = "0.12.0"
+version = "0.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d73802ee27361bbb6c0e3c04a799b39f458afbed1972c4aff0867420d1c36fdb"
+checksum = "377581966bd34e85ce230f7f4b1dee7e16c6bf7f845b4690648507ce7ba105d9"
 dependencies = [
  "async-trait",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_tls",
  "http-body-util",
  "hyper 1.9.0",
@@ -3867,9 +3886,9 @@ dependencies = [
 
 [[package]]
 name = "deno_terminal"
-version = "0.2.3"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3ba8041ae7319b3ca6a64c399df4112badcbbe0868b4517637647614bede4be"
+checksum = "23f71c27009e0141dedd315f1dfa3ebb0a6ca4acce7c080fac576ea415a465f6"
 dependencies = [
  "once_cell",
  "termcolor",
@@ -3877,12 +3896,12 @@ dependencies = [
 
 [[package]]
 name = "deno_tls"
-version = "0.177.0"
+version = "0.196.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e3ceb2be448150d8214e8fc454c947e0ea94f6ce16556544f05a67ad5a16b8"
+checksum = "a7835eb6a8d114703b0293573fbb8885bc2c81e8c35363b9e89391dd3c541fa6"
 dependencies = [
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_native_certs",
  "rustls 0.23.35",
  "rustls-pemfile 2.2.0",
@@ -3907,27 +3926,26 @@ dependencies = [
 
 [[package]]
 name = "deno_url"
-version = "0.190.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d79e743ad841f7826d46c6944580f5ba665fe9ab4c31a68c4eed8b5a78225da3"
+checksum = "8cccbb10fb59f29b04161055a65f7fe83364f9e8317d4d2ce3bd7979faf63a87"
 dependencies = [
  "deno_core",
- "deno_error",
- "thiserror 2.0.18",
+ "deno_error 0.6.1",
  "urlpattern",
 ]
 
 [[package]]
 name = "deno_web"
-version = "0.221.0"
+version = "0.240.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8041ba73bb2f238c61b5e4ed341d2fe1f9464a71115a240ab3390480b3c10e12"
+checksum = "1d6b8a97cc90b6aaea20fe200cfa7e5b6953dd33ecda0af50d6d360387c33df4"
 dependencies = [
  "async-trait",
- "base64-simd 0.8.0",
+ "base64-simd",
  "bytes",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_permissions",
  "encoding_rs",
  "flate2",
@@ -3940,9 +3958,9 @@ dependencies = [
 
 [[package]]
 name = "deno_webidl"
-version = "0.190.0"
+version = "0.209.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4ff81a990196bf3a80fe5d339b4eb8b411ef17634d60d399a63bae6e71a37c9"
+checksum = "a20bbfac0cf15918f7cbd0b55c366ac20ad65c825f362fa684c3104984254d3b"
 dependencies = [
  "deno_core",
 ]
@@ -4267,15 +4285,16 @@ checksum = "117240f60069e65410b3ae1bb213295bd828f707b5bec6596a1afc8793ce0cbc"
 
 [[package]]
 name = "dprint-swc-ext"
-version = "0.20.0"
+version = "0.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ba28c12892aadb751c2ba7001d8460faee4748a04b4edc51c7121cc67ee03db"
+checksum = "cf592ae6a864437e98ef9c6ae7936b822077e9d038a3a48ee081ab92313afad4"
 dependencies = [
  "num-bigint",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
+ "swc_ecma_lexer",
  "swc_ecma_parser",
  "text_lines",
 ]
@@ -4410,9 +4429,9 @@ checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.33"
+version = "0.8.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7268b386296a025e474d5140678f75d6de9493ae55a5d709eeb9dd08149945e1"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
 dependencies = [
  "cfg-if",
 ]
@@ -4572,7 +4591,7 @@ version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298"
 dependencies = [
- "bit-set 0.8.0",
+ "bit-set",
  "regex-automata",
  "regex-syntax 0.8.10",
 ]
@@ -4583,7 +4602,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8"
 dependencies = [
- "bit-set 0.8.0",
+ "bit-set",
  "regex-automata",
  "regex-syntax 0.8.10",
 ]
@@ -4657,7 +4676,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "libz-sys",
- "miniz_oxide 0.8.9",
+ "miniz_oxide",
  "zlib-rs",
 ]
 
@@ -4735,11 +4754,10 @@ checksum = "eb540cf7bc4fe6df9d8f7f0c974cfd0dce8ed4e9e8884e73433b503ee78b4e7d"
 
 [[package]]
 name = "from_variant"
-version = "0.1.9"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32016f1242eb82af5474752d00fd8ebcd9004bd69b462b1c91de833972d08ed4"
+checksum = "308530a56b099da144ebc5d8e179f343ad928fa2b3558d1eb3db9af18d6eff43"
 dependencies = [
- "proc-macro2",
  "swc_macros_common",
  "syn 2.0.117",
 ]
@@ -5618,15 +5636,14 @@ dependencies = [
 
 [[package]]
 name = "hstr"
-version = "0.2.17"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1a26def229ea95a8709dad32868d975d0dd40235bd2ce82920e4a8fe692b5e0"
+checksum = "31f11d91d7befd2ffd9d216e9e5ea1fae6174b20a2a1b67a688138003d2f4122"
 dependencies = [
  "hashbrown 0.14.5",
  "new_debug_unreachable",
  "once_cell",
- "phf 0.11.3",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "triomphe",
 ]
 
@@ -6203,6 +6220,15 @@ version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
+[[package]]
+name = "ipnetwork"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "is-macro"
 version = "0.3.7"
@@ -7171,15 +7197,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
-[[package]]
-name = "miniz_oxide"
-version = "0.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8a240ddb74feaf34a79a7add65a741f3167852fba007066dcac1ca548d89c08"
-dependencies = [
- "adler",
-]
-
 [[package]]
 name = "miniz_oxide"
 version = "0.8.9"
@@ -7409,6 +7426,19 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.9.4",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
 [[package]]
 name = "nkeys"
 version = "0.4.5"
@@ -8126,6 +8156,8 @@ dependencies = [
  "rand 0.8.5",
  "serde_json",
  "thiserror 1.0.69",
+ "tokio",
+ "tokio-stream",
  "tracing",
 ]
 
@@ -8200,20 +8232,14 @@ dependencies = [
 
 [[package]]
 name = "os_pipe"
-version = "1.1.5"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57119c3b893986491ec9aa85056780d3a0f3cf4da7cc09dd3650dbd6c6738fb9"
+checksum = "5ffd2b0a5634335b135d5728d84c5e0fd726954b87111f7506a61c502280d982"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "outref"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f222829ae9293e33a9f5e9f440c6760a3d450a64affe1846486b140db81c1f4"
-
 [[package]]
 name = "outref"
 version = "0.5.2"
@@ -8258,6 +8284,15 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
+[[package]]
+name = "par-core"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e96cbd21255b7fb29a5d51ef38a779b517a91abd59e2756c039583f43ef4c90f"
+dependencies = [
+ "once_cell",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -10096,9 +10131,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-tokio-stream"
-version = "0.3.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22557157d7395bc30727745b365d923f1ecc230c4c80b176545f3f4f08c46e33"
+checksum = "faa7dc7c991d9164e55bbf1558029eb5b84d32cc4d61a7df5b8641b2deedc4b3"
 dependencies = [
  "futures",
  "rustls 0.23.35",
@@ -10480,9 +10515,9 @@ checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.220"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ceecad4c782e936ac90ecfd6b56532322e3262b14320abf30ce89a92ffdbfe22"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -10523,18 +10558,18 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.220"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddba47394f3b862d6ff6efdbd26ca4673e3566a307880a0ffb98f274bbe0ec32"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.220"
+version = "1.0.228"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60e1f3b1761e96def5ec6d04a6e7421c0404fa3cf5c0155f1e2848fae3d8cc08"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -10629,11 +10664,11 @@ dependencies = [
 
 [[package]]
 name = "serde_v8"
-version = "0.245.0"
+version = "0.261.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945f93c91e0c7e4799b5fefff076756141aae92e262c4dc4833310dd3d2d845e"
+checksum = "3495190857461e87a2716141043218aad5281f219f54a03b7ebbe605b3b931df"
 dependencies = [
- "deno_error",
+ "deno_error 0.6.1",
  "num-bigint",
  "serde",
  "smallvec",
@@ -10839,15 +10874,6 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
-[[package]]
-name = "simd-abstraction"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cadb29c57caadc51ff8346233b5cec1d240b68ce55cf1afc764818791876987"
-dependencies = [
- "outref 0.1.0",
-]
-
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
@@ -10968,32 +10994,13 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "sourcemap"
-version = "8.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "208d40b9e8cad9f93613778ea295ed8f3c2b1824217c6cfc7219d3f6f45b96d4"
-dependencies = [
- "base64-simd 0.7.0",
- "bitvec",
- "data-encoding",
- "debugid",
- "if_chain",
- "rustc-hash 1.1.0",
- "rustc_version 0.2.3",
- "serde",
- "serde_json",
- "unicode-id-start",
- "url",
-]
-
 [[package]]
 name = "sourcemap"
 version = "9.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "314d62a489431668f719ada776ca1d49b924db951b7450f8974c9ae51ab05ad7"
 dependencies = [
- "base64-simd 0.8.0",
+ "base64-simd",
  "bitvec",
  "data-encoding",
  "debugid",
@@ -11327,11 +11334,10 @@ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
 
 [[package]]
 name = "string_enum"
-version = "0.4.4"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05e383308aebc257e7d7920224fa055c632478d92744eca77f99be8fa1545b90"
+checksum = "ae36a4951ca7bd1cfd991c241584a9824a70f6aff1e7d4f693fb3f2465e4030e"
 dependencies = [
- "proc-macro2",
  "quote",
  "swc_macros_common",
  "syn 2.0.117",
@@ -11339,9 +11345,9 @@ dependencies = [
 
 [[package]]
 name = "stringcase"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04028eeb851ed08af6aba5caa29f2d59a13ed168cee4d6bd753aeefcf1d636b0"
+checksum = "72abeda133c49d7bddece6c154728f83eec8172380c80ab7096da9487e20d27c"
 
 [[package]]
 name = "stringprep"
@@ -11447,64 +11453,48 @@ checksum = "b7401a30af6cb5818bb64852270bb722533397edcfc7344954a38f420819ece2"
 
 [[package]]
 name = "swc_allocator"
-version = "0.1.10"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76aa0eb65c0f39f9b6d82a7e5192c30f7ac9a78f084a21f270de1d8c600ca388"
+checksum = "9d7eefd2c8b228a8c73056482b2ae4b3a1071fbe07638e3b55ceca8570cc48bb"
 dependencies = [
+ "allocator-api2",
  "bumpalo",
  "hashbrown 0.14.5",
- "ptr_meta",
- "rustc-hash 1.1.0",
- "triomphe",
+ "rustc-hash 2.1.2",
 ]
 
 [[package]]
 name = "swc_atoms"
-version = "0.6.7"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb6567e4e67485b3e7662b486f1565bdae54bd5b9d6b16b2ba1a9babb1e42125"
+checksum = "3500dcf04c84606b38464561edc5e46f5132201cb3e23cf9613ed4033d6b1bb2"
 dependencies = [
  "hstr",
  "once_cell",
- "rustc-hash 1.1.0",
- "serde",
-]
-
-[[package]]
-name = "swc_cached"
-version = "0.3.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83406221c501860fce9c27444f44125eafe9e598b8b81be7563d7036784cd05c"
-dependencies = [
- "ahash 0.8.12",
- "anyhow",
- "dashmap 5.5.3",
- "once_cell",
- "regex",
  "serde",
 ]
 
 [[package]]
 name = "swc_common"
-version = "0.37.5"
+version = "14.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12d0a8eaaf1606c9207077d75828008cb2dfb51b095a766bd2b72ef893576e31"
+checksum = "c2bb772b3a26b8b71d4e8c112ced5b5867be2266364b58517407a270328a2696"
 dependencies = [
+ "anyhow",
  "ast_node",
  "better_scoped_tls",
- "cfg-if",
+ "bytes-str",
  "either",
  "from_variant",
  "new_debug_unreachable",
  "num-bigint",
  "once_cell",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "serde",
  "siphasher 0.3.11",
- "sourcemap 9.3.2",
- "swc_allocator",
  "swc_atoms",
  "swc_eq_ignore_macros",
+ "swc_sourcemap",
  "swc_visit",
  "tracing",
  "unicode-width 0.1.14",
@@ -11513,23 +11503,23 @@ dependencies = [
 
 [[package]]
 name = "swc_config"
-version = "0.1.15"
+version = "3.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4740e53eaf68b101203c1df0937d5161a29f3c13bceed0836ddfe245b72dd000"
+checksum = "72e90b52ee734ded867104612218101722ad87ff4cf74fe30383bd244a533f97"
 dependencies = [
  "anyhow",
+ "bytes-str",
  "indexmap 2.14.0",
  "serde",
  "serde_json",
- "swc_cached",
  "swc_config_macro",
 ]
 
 [[package]]
 name = "swc_config_macro"
-version = "0.1.4"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c5f56139042c1a95b54f5ca48baa0e0172d369bcc9d3d473dad1de36bae8399"
+checksum = "7b416e8ce6de17dc5ea496e10c7012b35bbc0e3fef38d2e065eed936490db0b3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -11539,78 +11529,72 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_ast"
-version = "0.118.2"
+version = "15.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6f866d12e4d519052b92a0a86d1ac7ff17570da1272ca0c89b3d6f802cd79df"
+checksum = "65c25af97d53cf8aab66a6c68f3418663313fc969ad267fc2a4d19402c329be1"
 dependencies = [
  "bitflags 2.9.4",
  "is-macro",
  "num-bigint",
+ "once_cell",
  "phf 0.11.3",
- "scoped-tls",
+ "rustc-hash 2.1.2",
  "serde",
  "string_enum",
  "swc_atoms",
  "swc_common",
+ "swc_visit",
  "unicode-id-start",
 ]
 
 [[package]]
 name = "swc_ecma_codegen"
-version = "0.155.1"
+version = "17.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc7641608ef117cfbef9581a99d02059b522fcca75e5244fa0cbbd8606689c6f"
+checksum = "bcf55c2d7555c93f4945e29f93b7529562be97ba16e60dd94c25724d746174ac"
 dependencies = [
+ "ascii",
+ "compact_str",
  "memchr",
  "num-bigint",
  "once_cell",
+ "regex",
+ "rustc-hash 2.1.2",
+ "ryu-js",
  "serde",
- "sourcemap 9.3.2",
  "swc_allocator",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_codegen_macros",
+ "swc_sourcemap",
  "tracing",
 ]
 
 [[package]]
 name = "swc_ecma_codegen_macros"
-version = "0.7.7"
+version = "2.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "859fabde36db38634f3fad548dd5e3410c1aebba1b67a3c63e67018fa57a0bca"
+checksum = "e276dc62c0a2625a560397827989c82a93fd545fcf6f7faec0935a82cc4ddbb8"
 dependencies = [
  "proc-macro2",
- "quote",
  "swc_macros_common",
  "syn 2.0.117",
 ]
 
 [[package]]
-name = "swc_ecma_loader"
-version = "0.49.1"
+name = "swc_ecma_lexer"
+version = "23.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55fa3d55045b97894bfb04d38aff6d6302ac8a6a38e3bb3dfb0d20475c4974a9"
-dependencies = [
- "anyhow",
- "pathdiff",
- "serde",
- "swc_atoms",
- "swc_common",
- "tracing",
-]
-
-[[package]]
-name = "swc_ecma_parser"
-version = "0.149.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "683dada14722714588b56481399c699378b35b2ba4deb5c4db2fb627a97fb54b"
+checksum = "017d06ea85008234aa9fb34d805c7dc563f2ea6e03869ed5ac5a2dc27d561e4d"
 dependencies = [
+ "arrayvec",
+ "bitflags 2.9.4",
  "either",
- "new_debug_unreachable",
  "num-bigint",
- "num-traits",
  "phf 0.11.3",
+ "rustc-hash 2.1.2",
+ "seq-macro",
  "serde",
  "smallvec",
  "smartstring",
@@ -11619,23 +11603,52 @@ dependencies = [
  "swc_common",
  "swc_ecma_ast",
  "tracing",
- "typed-arena",
+]
+
+[[package]]
+name = "swc_ecma_loader"
+version = "14.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c675d14700c92f12585049b22b02356f1e142f4b0c32a4d0eb4b7a968a4c0c1e"
+dependencies = [
+ "anyhow",
+ "pathdiff",
+ "rustc-hash 2.1.2",
+ "serde",
+ "swc_atoms",
+ "swc_common",
+ "tracing",
+]
+
+[[package]]
+name = "swc_ecma_parser"
+version = "24.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e9011783c975ba592ffc09cd208ced92b1dfabb2e5e0ef453559e2e25286127"
+dependencies = [
+ "either",
+ "num-bigint",
+ "serde",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_lexer",
+ "tracing",
 ]
 
 [[package]]
 name = "swc_ecma_transforms_base"
-version = "0.145.0"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65f21494e75d0bd8ef42010b47cabab9caaed8f2207570e809f6f4eb51a710d1"
+checksum = "6c6f1b8f4232e7a7f614ff7c0f6ccb89c2d028cdf7629f79ad710cff5b28b62c"
 dependencies = [
  "better_scoped_tls",
- "bitflags 2.9.4",
  "indexmap 2.14.0",
  "once_cell",
+ "par-core",
  "phf 0.11.3",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "serde",
- "smallvec",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
@@ -11647,11 +11660,10 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_transforms_classes"
-version = "0.134.0"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3d884594385bea9405a2e1721151470d9a14d3ceec5dd773c0ca6894791601"
+checksum = "108d4d52db6151f768a516fe86e6f21fc783b03fa2d20292999f29275fd0c71d"
 dependencies = [
- "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_transforms_base",
@@ -11661,9 +11673,9 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_transforms_macros"
-version = "0.5.5"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500a1dadad1e0e41e417d633b3d6d5de677c9e0d3159b94ba3348436cdb15aab"
+checksum = "bc777288799bf6786e5200325a56e4fbabba590264a4a48a0c70b16ad0cf5cd8"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -11673,56 +11685,54 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_transforms_proposal"
-version = "0.179.0"
+version = "27.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79938ff510fc647febd8c6c3ef4143d099fdad87a223680e632623d056dae2dd"
+checksum = "39b3b34f6a28348416174912009d09994ab71c867682ec78d641a9feb3a96b4e"
 dependencies = [
  "either",
- "rustc-hash 1.1.0",
+ "rustc-hash 2.1.2",
  "serde",
- "smallvec",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_transforms_base",
  "swc_ecma_transforms_classes",
- "swc_ecma_transforms_macros",
  "swc_ecma_utils",
  "swc_ecma_visit",
 ]
 
 [[package]]
 name = "swc_ecma_transforms_react"
-version = "0.191.0"
+version = "30.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76c76d8b9792ce51401d38da0fa62158d61f6d80d16d68fe5b03ce4bf5fba383"
+checksum = "69ea0052ac23b5b9fbc85bbdb1791b36b918f9d55f594b0ed8e25babb4c32d16"
 dependencies = [
- "base64 0.21.7",
- "dashmap 5.5.3",
+ "base64 0.22.1",
+ "bytes-str",
  "indexmap 2.14.0",
  "once_cell",
+ "rustc-hash 2.1.2",
  "serde",
  "sha1",
  "string_enum",
- "swc_allocator",
  "swc_atoms",
  "swc_common",
  "swc_config",
  "swc_ecma_ast",
  "swc_ecma_parser",
  "swc_ecma_transforms_base",
- "swc_ecma_transforms_macros",
  "swc_ecma_utils",
  "swc_ecma_visit",
 ]
 
 [[package]]
 name = "swc_ecma_transforms_typescript"
-version = "0.198.1"
+version = "30.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15455da4768f97186c40523e83600495210c11825d3a44db43383fd81eace88d"
+checksum = "3872c006ccfdcc19f1cf5c01c15915a69964ba7982c9f581cdb7e727e77b9a2c"
 dependencies = [
- "ryu-js",
+ "bytes-str",
+ "rustc-hash 2.1.2",
  "serde",
  "swc_atoms",
  "swc_common",
@@ -11735,28 +11745,28 @@ dependencies = [
 
 [[package]]
 name = "swc_ecma_utils"
-version = "0.134.2"
+version = "21.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "029eec7dd485923a75b5a45befd04510288870250270292fc2c1b3a9e7547408"
+checksum = "83259addd99ed4022aa9fc4d39428c008d3d42533769e1a005529da18cde4568"
 dependencies = [
  "indexmap 2.14.0",
  "num_cpus",
  "once_cell",
- "rustc-hash 1.1.0",
+ "par-core",
+ "rustc-hash 2.1.2",
  "ryu-js",
  "swc_atoms",
  "swc_common",
  "swc_ecma_ast",
  "swc_ecma_visit",
  "tracing",
- "unicode-id",
 ]
 
 [[package]]
 name = "swc_ecma_visit"
-version = "0.104.8"
+version = "15.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b1c6802e68e51f336e8bc9644e9ff9da75d7da9c1a6247d532f2e908aa33e81"
+checksum = "75a579aa8f9e212af521588df720ccead079c09fe5c8f61007cf724324aed3a0"
 dependencies = [
  "new_debug_unreachable",
  "num-bigint",
@@ -11769,9 +11779,9 @@ dependencies = [
 
 [[package]]
 name = "swc_eq_ignore_macros"
-version = "0.1.4"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63db0adcff29d220c3d151c5b25c0eabe7e32dd936212b84cdaa1392e3130497"
+checksum = "c16ce73424a6316e95e09065ba6a207eba7765496fed113702278b7711d4b632"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -11780,38 +11790,44 @@ dependencies = [
 
 [[package]]
 name = "swc_macros_common"
-version = "0.3.13"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f486687bfb7b5c560868f69ed2d458b880cebc9babebcb67e49f31b55c5bf847"
+checksum = "aae1efbaa74943dc5ad2a2fb16cbd78b77d7e4d63188f3c5b4df2b4dcd2faaae"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "swc_sourcemap"
+version = "9.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de08ef00f816acdd1a58ee8a81c0e1a59eefef2093aefe5611f256fa6b64c4d7"
+dependencies = [
+ "base64-simd",
+ "bitvec",
+ "bytes-str",
+ "data-encoding",
+ "debugid",
+ "if_chain",
+ "rustc-hash 2.1.2",
+ "serde",
+ "serde_json",
+ "unicode-id-start",
+ "url",
+]
+
 [[package]]
 name = "swc_visit"
-version = "0.6.2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ceb044142ba2719ef9eb3b6b454fce61ab849eb696c34d190f04651955c613d"
+checksum = "62fb71484b486c185e34d2172f0eabe7f4722742aad700f426a494bb2de232a2"
 dependencies = [
  "either",
  "new_debug_unreachable",
 ]
 
-[[package]]
-name = "swc_visit_macros"
-version = "0.5.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92807d840959f39c60ce8a774a3f83e8193c658068e6d270dbe0a05e40e90b41"
-dependencies = [
- "Inflector",
- "proc-macro2",
- "quote",
- "swc_macros_common",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "symlink"
 version = "0.1.0"
@@ -11871,9 +11887,23 @@ dependencies = [
 
 [[package]]
 name = "sys_traits"
-version = "0.1.7"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b46ac05dfbe9fd3a9703eff20e17f5b31e7b6a54daf27a421dcd56c7a27ecdd"
+checksum = "dc4707edf3196e8037ee45018d1bb1bfb233b0e4fc440fa3d3f25bc69bfdaf26"
+dependencies = [
+ "sys_traits_macros",
+]
+
+[[package]]
+name = "sys_traits_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "181f22127402abcf8ee5c83ccd5b408933fec36a6095cf82cda545634692657e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
 
 [[package]]
 name = "sysctl"
@@ -12101,6 +12131,15 @@ dependencies = [
  "xattr",
 ]
 
+[[package]]
+name = "temp_deno_which"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "366c5ccd670145885feb6efd6bbf2478ed236c4c3839046fcc8e2a1a84c51091"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -12615,6 +12654,19 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-vsock"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b319ef9394889dab2e1b4f0085b45ba11d0c79dc9d1a9d1afc057d009d0f1c7"
+dependencies = [
+ "bytes",
+ "futures",
+ "libc",
+ "tokio",
+ "vsock",
+]
+
 [[package]]
 name = "tokio-websockets"
 version = "0.10.1"
@@ -13105,12 +13157,6 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ea3136b675547379c4bd395ca6b938e5ad3c3d20fad76e7fe85f9e0d011419c"
 
-[[package]]
-name = "typed-arena"
-version = "2.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
-
 [[package]]
 name = "typed-path"
 version = "0.12.3"
@@ -13246,12 +13292,6 @@ version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
 
-[[package]]
-name = "unicode-id"
-version = "0.3.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70ba288e709927c043cbe476718d37be306be53fb1fafecd0dbe36d072be2580"
-
 [[package]]
 name = "unicode-id-start"
 version = "1.4.0"
@@ -13475,17 +13515,16 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "130.0.7"
+version = "137.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a511192602f7b435b0a241c1947aa743eb7717f20a9195f4b5e8ed1952e01db1"
+checksum = "33995a1fee055ff743281cde33a41f0d618ee0bdbe8bdf6859e11864499c2595"
 dependencies = [
- "bindgen 0.70.1",
+ "bindgen 0.71.1",
  "bitflags 2.9.4",
  "fslock",
  "gzip-header",
  "home",
- "miniz_oxide 0.7.4",
- "once_cell",
+ "miniz_oxide",
  "paste",
  "which 6.0.3",
 ]
@@ -13514,6 +13553,16 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
 
+[[package]]
+name = "vsock"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ba782755fc073877e567c2253c0be48e4aa9a254c232d36d3985dfae0bd5205"
+dependencies = [
+ "libc",
+ "nix 0.31.3",
+]
+
 [[package]]
 name = "vte"
 version = "0.14.1"
@@ -13712,11 +13761,11 @@ dependencies = [
 
 [[package]]
 name = "wasm_dep_analyzer"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2eeee3bdea6257cc36d756fa745a70f9d393571e47d69e0ed97581676a5369ca"
+checksum = "e51cf5f08b357e64cd7642ab4bbeb11aecab9e15520692129624fb9908b8df2c"
 dependencies = [
- "deno_error",
+ "deno_error 0.6.1",
  "thiserror 2.0.18",
 ]
 
@@ -13766,6 +13815,18 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web-transport-proto"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "974fa1e325e6cc5327de8887f189a441fcff4f8eedcd31ec87f0ef0cc5283fbc"
+dependencies = [
+ "bytes",
+ "http 1.4.0",
+ "thiserror 2.0.18",
+ "url",
+]
+
 [[package]]
 name = "webpki-root-certs"
 version = "1.0.7"
@@ -14029,7 +14090,7 @@ dependencies = [
  "const_format",
  "cookie",
  "cron",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion",
  "ed25519-dalek",
  "eventsource-stream",
@@ -14545,7 +14606,7 @@ dependencies = [
  "argon2",
  "axum 0.8.4",
  "chrono",
- "dashmap 6.1.0",
+ "dashmap",
  "http 1.4.0",
  "hyper 1.9.0",
  "lazy_static",
@@ -14671,7 +14732,7 @@ dependencies = [
  "crc",
  "cron",
  "croner",
- "dashmap 6.1.0",
+ "dashmap",
  "datafusion",
  "equivalent",
  "futures",
@@ -15240,7 +15301,7 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "cron",
- "dashmap 6.1.0",
+ "dashmap",
  "futures",
  "futures-core",
  "hex",
@@ -15275,8 +15336,9 @@ dependencies = [
  "deno_ast",
  "deno_console",
  "deno_core",
- "deno_error",
+ "deno_error 0.6.1",
  "deno_fetch",
+ "deno_fs",
  "deno_io",
  "deno_net",
  "deno_permissions",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index fbee476402..b48b911b99 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -387,8 +387,7 @@ tokio-stream = { version = "0.1.17" }
 tower = "^0"
 tower-http = { version = "^0.6", features = ["trace", "cors", "catch-panic"] }
 tower-cookies = "^0.11"
-#stuck because of swc for now
-serde = "=1.0.220"
+serde = "^1"
 serde_json = { version = "^1", features = ["preserve_order", "raw_value"] }
 serde_yml = "0.0.12"
 uuid = { version = "^1", features = ["serde", "v4", "js"] }
@@ -443,20 +442,29 @@ aws-sdk-rds = "^1"
 async-trait = "0.1.88"
 
 
-v8 = "=130.0.7"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
-deno_fetch = "0.214.0"
-deno_tls = "0.177.0"
-deno_console = "0.190.0"
-deno_url = "0.190.0"
-deno_webidl = "0.190.0"
-deno_web = "0.221.0"
-deno_io = "0.100.0"
-deno_net = "0.182.0"
-deno_core = "0.336.0"
-deno_ast = { version = "=0.44.0", features = ["transpiling"] }
-deno_permissions = "0.49.0"
-deno_telemetry = "0.12.0"
-deno_error = "=0.5.5"
+v8 = "=137.1.0"  # Exact version NOTE: Do not forget to update version and hash in flake.nix
+# deno_* pin set: deno v2.4.0 base, with deno_ast force-overridden to =0.51.0.
+# Rationale: deno_ast 0.51.0 is the first version pulling swc_common =14.0.4,
+# the first swc_common patch that dropped `pub use serde::__private as serde;`
+# (the line that capped our workspace serde pin at =1.0.220). v2.4.0's other
+# pins keep deno_tls at 0.196.0 which uses permissive `rustls ^0.23.11`,
+# compatible with aws-sdk-bedrockruntime's `^0.23.31` requirement. deno_tls
+# 0.198+ tightened that to exact `=0.23.28`, which would have made any
+# meaningful deno bump resolver-impossible against aws-sdk.
+deno_fetch = "0.233.0"
+deno_tls = "0.196.0"
+deno_console = "0.209.0"
+deno_url = "0.209.0"
+deno_webidl = "0.209.0"
+deno_web = "0.240.0"
+deno_io = "0.119.0"
+deno_fs = "0.119.0"
+deno_net = "0.201.0"
+deno_core = "0.352.0"
+deno_ast = { version = "=0.51.0", features = ["transpiling"] }
+deno_permissions = "0.68.0"
+deno_telemetry = "0.31.0"
+deno_error = "=0.6.1"
 rustls-pemfile = "2.2.0"
 
 # only used with special deno_core_mac feature to prevent ffi issue on macos, requires libffi to be installed
@@ -469,10 +477,10 @@ google-cloud-googleapis = {version = "0.16.1", features = ["pubsub"]}
 winapi = { version = "0.3.9", features = ["sysinfoapi"] }
 sysinfo = { version = "0.32.1" }
 
-swc_common = "=0.37.5"
-swc_ecma_parser = "=0.149.1"
-swc_ecma_ast = "=0.118.2"
-swc_ecma_visit = "=0.104.8"
+swc_common = "=14.0.4"
+swc_ecma_parser = "=24.0.3"
+swc_ecma_ast = "=15.0.0"
+swc_ecma_visit = "=15.0.0"
 
 
 async-recursion = "^1"
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 2e43e667c1..8298e1c013 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-d3bc7fa85195b46b7a38d43c2f806520bf8b5454
+4d01d171228196f28ddabc1150242bfab623d5cf
diff --git a/backend/parsers/windmill-parser-ts-asset/src/lib.rs b/backend/parsers/windmill-parser-ts-asset/src/lib.rs
index bc31a16c99..3c04ef7447 100644
--- a/backend/parsers/windmill-parser-ts-asset/src/lib.rs
+++ b/backend/parsers/windmill-parser-ts-asset/src/lib.rs
@@ -12,7 +12,7 @@ use AssetUsageAccessType::*;
 
 pub fn parse_assets(code: &str) -> anyhow::Result<ParseAssetsOutput> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         // We want to parse ecmascript
         Syntax::Typescript(TsSyntax::default()),
diff --git a/backend/parsers/windmill-parser-ts/src/lib.rs b/backend/parsers/windmill-parser-ts/src/lib.rs
index 1ae22879b6..1e78ec8665 100644
--- a/backend/parsers/windmill-parser-ts/src/lib.rs
+++ b/backend/parsers/windmill-parser-ts/src/lib.rs
@@ -129,7 +129,7 @@ impl Visit for ImportsFinder {
 /// See also: [`parse_relative_imports`] for resolved absolute paths.
 pub fn parse_expr_for_imports(code: &str, skip_type_only: bool) -> anyhow::Result<Vec<String>> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.d.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.d.ts".into()).into(), code.to_string());
     let mut tss = TsSyntax::default();
     tss.disallow_ambiguous_jsx_like;
     tss.tsx = true;
@@ -263,7 +263,7 @@ impl Visit for OutputFinder {
 
 pub fn parse_expr_for_ids(code: &str) -> anyhow::Result<Vec<(String, String)>> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         // We want to parse ecmascript
         Syntax::Es(EsSyntax { jsx: false, ..Default::default() }),
@@ -305,7 +305,7 @@ pub fn parse_deno_signature(
     entrypoint_override: Option<String>,
 ) -> anyhow::Result<MainArgSignature> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("main.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         // We want to parse ecmascript
         Syntax::Typescript(TsSyntax::default()),
diff --git a/backend/parsers/windmill-parser-wac/src/typescript.rs b/backend/parsers/windmill-parser-wac/src/typescript.rs
index 87fa7cef01..9ad84a2e97 100644
--- a/backend/parsers/windmill-parser-wac/src/typescript.rs
+++ b/backend/parsers/windmill-parser-wac/src/typescript.rs
@@ -712,7 +712,7 @@ fn extract_ts_params(params: &[swc_ecma_ast::Param], cm: &Lrc<SourceMap>) -> Vec
 
 pub fn parse_ts_workflow(code: &str) -> Result<WorkflowDag, Vec<CompileError>> {
     let cm: Lrc<SourceMap> = Default::default();
-    let fm = cm.new_source_file(FileName::Custom("workflow.ts".into()).into(), code.into());
+    let fm = cm.new_source_file(FileName::Custom("workflow.ts".into()).into(), code.to_string());
     let lexer = Lexer::new(
         Syntax::Typescript(TsSyntax::default()),
         Default::default(),
diff --git a/backend/windmill-runtime-nativets/Cargo.toml b/backend/windmill-runtime-nativets/Cargo.toml
index c4f3461815..edad615ae5 100644
--- a/backend/windmill-runtime-nativets/Cargo.toml
+++ b/backend/windmill-runtime-nativets/Cargo.toml
@@ -28,6 +28,7 @@ deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
 deno_io.workspace = true
+deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
 winapi.workspace = true
@@ -59,6 +60,7 @@ deno_ast.workspace = true
 deno_tls.workspace = true
 deno_permissions.workspace = true
 deno_io.workspace = true
+deno_fs.workspace = true
 deno_telemetry.workspace = true
 deno_error.workspace = true
 winapi.workspace = true
diff --git a/backend/windmill-runtime-nativets/build.rs b/backend/windmill-runtime-nativets/build.rs
index 6598c974eb..8262827815 100644
--- a/backend/windmill-runtime-nativets/build.rs
+++ b/backend/windmill-runtime-nativets/build.rs
@@ -25,10 +25,30 @@ impl FetchPermissions for PermissionsContainer {
     #[inline(always)]
     fn check_read<'a>(
         &mut self,
-        _resolved: bool,
-        _p: &'a std::path::Path,
+        _path: Cow<'a, Path>,
         _api_name: &str,
-    ) -> Result<Cow<'a, std::path::Path>, deno_io::fs::FsError> {
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        unreachable!("snapshotting")
+    }
+
+    #[inline(always)]
+    fn check_write<'a>(
+        &mut self,
+        _path: Cow<'a, Path>,
+        _api_name: &str,
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        unreachable!("snapshotting")
+    }
+
+    #[inline(always)]
+    fn check_net_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
         unreachable!("snapshotting")
     }
 }
@@ -41,17 +61,17 @@ impl TimersPermission for PermissionsContainer {
 }
 
 impl NetPermissions for PermissionsContainer {
-    fn check_read<'a>(
+    fn check_read(
         &mut self,
-        _p: &'a str,
+        _p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         unreachable!("snapshotting")
     }
 
-    fn check_write<'a>(
+    fn check_write(
         &mut self,
-        _p: &'a str,
+        _p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         unreachable!("snapshotting")
@@ -67,10 +87,19 @@ impl NetPermissions for PermissionsContainer {
 
     fn check_write_path<'a>(
         &mut self,
-        _: &'a Path,
-        _: &str,
+        _p: Cow<'a, Path>,
+        _api_name: &str,
     ) -> Result<Cow<'a, Path>, deno_permissions::PermissionCheckError> {
-        todo!()
+        unreachable!("snapshotting")
+    }
+
+    fn check_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
+        unreachable!("snapshotting")
     }
 }
 
@@ -83,7 +112,7 @@ deno_core::extension!(
 // `extension_transpiler` callback for `deno_core::snapshot::create_snapshot`.
 //
 // Specialized to our snapshot's inputs. Of the seven deno_* extensions
-// we register via `init_ops_and_esm()`, six ship pre-built `.js` files
+// we register via `init()`, six ship pre-built `.js` files
 // in their `esm` lists (webidl/url/console/web/fetch/net) — only
 // `deno_telemetry`'s `extension!` macro lists `.ts` files
 // (`telemetry.ts`, `util.ts`), so the TypeScript branch is needed
@@ -153,17 +182,14 @@ fn main() {
     println!("cargo:rustc-env=PROFILE={}", env::var("PROFILE").unwrap());
 
     let exts = vec![
-        deno_telemetry::deno_telemetry::init_ops_and_esm(),
-        deno_webidl::deno_webidl::init_ops_and_esm(),
-        deno_url::deno_url::init_ops_and_esm(),
-        deno_console::deno_console::init_ops_and_esm(),
-        deno_web::deno_web::init_ops_and_esm::<PermissionsContainer>(
-            Arc::new(BlobStore::default()),
-            None,
-        ),
-        deno_fetch::deno_fetch::init_ops_and_esm::<PermissionsContainer>(Default::default()),
-        deno_net::deno_net::init_ops_and_esm::<PermissionsContainer>(None, None),
-        fetch::init_ops_and_esm(),
+        deno_telemetry::deno_telemetry::init(),
+        deno_webidl::deno_webidl::init(),
+        deno_url::deno_url::init(),
+        deno_console::deno_console::init(),
+        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
+        deno_fetch::deno_fetch::init::<PermissionsContainer>(Default::default()),
+        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+        fetch::init(),
     ];
 
     // Build the file path to the snapshot.
diff --git a/backend/windmill-runtime-nativets/src/lib.rs b/backend/windmill-runtime-nativets/src/lib.rs
index 83de806716..52e23f11da 100644
--- a/backend/windmill-runtime-nativets/src/lib.rs
+++ b/backend/windmill-runtime-nativets/src/lib.rs
@@ -50,6 +50,28 @@ use windmill_common::error::Error;
 use windmill_common::result_stream::append_result_stream_db;
 use windmill_common::worker::{write_file, Connection, WINDMILL_DIR};
 
+// ── Snapshot-matched extensions ──────────────────────────────────────
+//
+// `deno_core` 0.352 validates that the snapshot's extension list is a
+// *prefix* of the runtime's extension list (snapshot does not need an
+// exact match — runtime is allowed to add extensions at the tail, but
+// must not reorder or omit any that the snapshot baked in).
+//
+// Our snapshot (in build.rs) is the same eight deno_* extensions ending
+// with this local `fetch` ext. The runtime adds one extra entry at the
+// end — the windmill `ext` carrying our own ops — which is fine because
+// it's after the snapshot prefix.
+//
+// This local `fetch` extension declaration must be present in both
+// build.rs and lib.rs so the type passes through the `init()` macro.
+// The ESM is already in the snapshot, so this `init()` call at runtime
+// is a no-op for esm — the registration just records the ext.
+deno_core::extension!(
+    fetch,
+    esm_entry_point = "ext:fetch/src/runtime.js",
+    esm = ["src/runtime.js"],
+);
+
 // ── Permission container ─────────────────────────────────────────────
 
 pub struct PermissionsContainer;
@@ -67,11 +89,31 @@ impl FetchPermissions for PermissionsContainer {
     #[inline(always)]
     fn check_read<'a>(
         &mut self,
-        _resolved: bool,
-        p: &'a std::path::Path,
+        path: Cow<'a, std::path::Path>,
         _api_name: &str,
-    ) -> Result<Cow<'a, std::path::Path>, deno_io::fs::FsError> {
-        Ok(Cow::Borrowed(p))
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        Ok(deno_fs::CheckedPath::Unresolved(path))
+    }
+
+    #[inline(always)]
+    fn check_write<'a>(
+        &mut self,
+        path: Cow<'a, std::path::Path>,
+        _api_name: &str,
+        _get_path: &'a dyn deno_fs::GetPath,
+    ) -> Result<deno_fs::CheckedPath<'a>, deno_io::fs::FsError> {
+        Ok(deno_fs::CheckedPath::Unresolved(path))
+    }
+
+    #[inline(always)]
+    fn check_net_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
+        Ok(())
     }
 }
 
@@ -83,17 +125,17 @@ impl TimersPermission for PermissionsContainer {
 }
 
 impl NetPermissions for PermissionsContainer {
-    fn check_read<'a>(
+    fn check_read(
         &mut self,
-        p: &'a str,
+        p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         Ok(PathBuf::from(p))
     }
 
-    fn check_write<'a>(
+    fn check_write(
         &mut self,
-        p: &'a str,
+        p: &str,
         _api_name: &str,
     ) -> Result<PathBuf, deno_permissions::PermissionCheckError> {
         Ok(PathBuf::from(p))
@@ -109,10 +151,19 @@ impl NetPermissions for PermissionsContainer {
 
     fn check_write_path<'a>(
         &mut self,
-        p: &'a std::path::Path,
+        p: Cow<'a, std::path::Path>,
         _api_name: &str,
-    ) -> Result<std::borrow::Cow<'a, std::path::Path>, deno_permissions::PermissionCheckError> {
-        Ok(Cow::Borrowed(p))
+    ) -> Result<Cow<'a, std::path::Path>, deno_permissions::PermissionCheckError> {
+        Ok(p)
+    }
+
+    fn check_vsock(
+        &mut self,
+        _cid: u32,
+        _port: u32,
+        _api_name: &str,
+    ) -> Result<(), deno_permissions::PermissionCheckError> {
+        Ok(())
     }
 }
 
@@ -384,7 +435,7 @@ pub(crate) fn create_nativets_runtime(
     let fetch_options = deno_fetch::Options {
         root_cert_store_provider: None,
         user_agent: ann.useragent.unwrap_or_else(|| "windmill/beta".to_string()),
-        proxy: ann.proxy.map(|x| deno_tls::Proxy {
+        proxy: ann.proxy.map(|x| deno_tls::Proxy::Http {
             url: x.0,
             basic_auth: x
                 .1
@@ -394,13 +445,14 @@ pub(crate) fn create_nativets_runtime(
     };
 
     let exts: Vec<Extension> = vec![
-        deno_telemetry::deno_telemetry::init_ops(),
-        deno_webidl::deno_webidl::init_ops(),
-        deno_url::deno_url::init_ops(),
-        deno_console::deno_console::init_ops(),
-        deno_web::deno_web::init_ops::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
-        deno_fetch::deno_fetch::init_ops::<PermissionsContainer>(fetch_options),
-        deno_net::deno_net::init_ops::<PermissionsContainer>(None, None),
+        deno_telemetry::deno_telemetry::init(),
+        deno_webidl::deno_webidl::init(),
+        deno_url::deno_url::init(),
+        deno_console::deno_console::init(),
+        deno_web::deno_web::init::<PermissionsContainer>(Arc::new(BlobStore::default()), None),
+        deno_fetch::deno_fetch::init::<PermissionsContainer>(fetch_options),
+        deno_net::deno_net::init::<PermissionsContainer>(None, None),
+        fetch::init(),
         ext,
     ];
 
diff --git a/flake.nix b/flake.nix
index aaf06c882e..3872ee636f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -79,11 +79,11 @@
         # ---------------------------------------------------------------
 
         rustyV8Archive = let
-          version = "130.0.7";
+          version = "137.1.0";
           target = stdenv.hostPlatform.rust.rustcTarget;
           sha256 = {
             x86_64-linux =
-              "sha256-pkdsuU6bAkcIHEZUJOt5PXdzK424CEgTLXjLtQ80t10=";
+              "sha256-Tiscfy2bzYGR3s0T+SC1IB3xWvTVpVcSEdjq3MCRoRw=";
             aarch64-linux = lib.fakeHash;
             x86_64-darwin = lib.fakeHash;
             aarch64-darwin = lib.fakeHash;

From e3a914fd480988278c57c5d62e88353fce7d3faf Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 21:39:41 +0000
Subject: [PATCH 31/50] download files via openapi client when token is set
 (#9102)

---
 .../src/lib/components/DisplayResult.svelte   | 62 +++++++++++++------
 .../components/FlowStatusViewerInner.svelte   | 32 +++++++---
 frontend/src/lib/components/LogViewer.svelte  | 50 ++++++++++-----
 .../components/ParqetCsvTableRenderer.svelte  | 13 ++--
 .../lib/components/S3FilePickerInner.svelte   | 30 ++++++---
 .../common/fileDownload/FileDownload.svelte   | 30 +++++++--
 .../propertyPicker/ObjectViewer.svelte        | 14 +++--
 frontend/src/lib/utils/downloadFile.ts        | 48 ++++++++++++++
 .../(logged)/workspace_settings/+page.svelte  | 28 ++++++---
 9 files changed, 235 insertions(+), 72 deletions(-)
 create mode 100644 frontend/src/lib/utils/downloadFile.ts

diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index 4e2b07b1c5..ff4196443d 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -5,6 +5,7 @@
 	import { json } from 'svelte-highlight/languages'
 	import { copyToClipboard, parseS3Object, roughSizeOfObject } from '$lib/utils'
 	import { base } from '$lib/base'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { Button, Drawer, DrawerContent } from './common'
 	import {
 		ClipboardCopy,
@@ -173,6 +174,25 @@
 
 	let largeObject: boolean | undefined = $state(undefined)
 
+	let resultApiPath = $derived(
+		workspaceId && jobId
+			? nodeId
+				? `/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
+				: `/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
+			: undefined
+	)
+	let resultDownloadHref = $derived(
+		resultApiPath
+			? `${base}/api${resultApiPath}`
+			: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`
+	)
+	let resultDownloadName = $derived(`${filename ?? 'result'}.json`)
+	async function onResultDownload(e: MouseEvent) {
+		if (!resultApiPath || !shouldDownloadViaClient()) return
+		e.preventDefault()
+		await downloadViaClient(resultApiPath, resultDownloadName)
+	}
+
 	function checkIfS3(result: any, keys: string[]) {
 		return keys.includes('s3') && typeof result.s3 === 'string'
 	}
@@ -1001,12 +1021,9 @@
 						{#if largeObject}
 							<div class="text-xs text-emphasis"
 								><a
-									download="{filename ?? 'result'}.json"
-									href={workspaceId && jobId
-										? nodeId
-											? `${base}/api/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
-											: `${base}/api/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
-										: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
+									download={resultDownloadName}
+									href={resultDownloadHref}
+									onclick={onResultDownload}
 								>
 									Download {filename ? '' : 'as JSON'}
 								</a>
@@ -1074,19 +1091,26 @@
 			<DrawerContent title="Expanded Result" on:close={jsonViewer.closeDrawer}>
 				{#snippet actions()}
 					{#if customUi?.disableDownload !== true}
-						<Button
-							download="{filename ?? 'result'}.json"
-							href={workspaceId && jobId
-								? nodeId
-									? `${base}/api/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
-									: `${base}/api/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
-								: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
-							startIcon={{ icon: Download }}
-							variant="subtle"
-							unifiedSize="md"
-						>
-							Download
-						</Button>
+						{#if resultApiPath && shouldDownloadViaClient()}
+							<Button
+								on:click={() => downloadViaClient(resultApiPath!, resultDownloadName)}
+								startIcon={{ icon: Download }}
+								variant="subtle"
+								unifiedSize="md"
+							>
+								Download
+							</Button>
+						{:else}
+							<Button
+								download={resultDownloadName}
+								href={resultDownloadHref}
+								startIcon={{ icon: Download }}
+								variant="subtle"
+								unifiedSize="md"
+							>
+								Download
+							</Button>
+						{/if}
 					{/if}
 					<Button
 						on:click={() => copyToClipboard(toJsonStr(result))}
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index e9288ca4aa..809eff58d9 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -27,6 +27,7 @@
 	import { type DurationStatus, type FlowStatusViewerContext, type GraphModuleState } from './graph'
 	import ModuleStatus from './ModuleStatus.svelte'
 	import { clone, isScriptPreview, msToSec, readFieldsRecursively, truncateRev } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import JobArgs from './JobArgs.svelte'
 	import { ChevronDown, Download, ExternalLink, Hourglass } from 'lucide-svelte'
 	import { deepEqual } from 'fast-equals'
@@ -1838,16 +1839,29 @@
 				style="min-height: {minTabHeight}px"
 			>
 				{#if !hideDownloadLogs && !isReplay && job?.id}
+					{@const logsApiPath = `/w/${workspace}/jobs_u/get_flow_all_logs/${job.id}`}
+					{@const logsName = `windmill_flow_logs_${job.id}.txt`}
 					<div class="flex justify-end p-1">
-						<Button
-							href="{base}/api/w/{workspace}/jobs_u/get_flow_all_logs/{job.id}"
-							download="windmill_flow_logs_{job.id}.txt"
-							color="light"
-							size="xs"
-							startIcon={{ icon: Download }}
-						>
-							Download all logs
-						</Button>
+						{#if shouldDownloadViaClient()}
+							<Button
+								on:click={() => downloadViaClient(logsApiPath, logsName)}
+								color="light"
+								size="xs"
+								startIcon={{ icon: Download }}
+							>
+								Download all logs
+							</Button>
+						{:else}
+							<Button
+								href="{base}/api{logsApiPath}"
+								download={logsName}
+								color="light"
+								size="xs"
+								startIcon={{ icon: Download }}
+							>
+								Download all logs
+							</Button>
+						{/if}
 					</div>
 				{/if}
 				<FlowLogViewerWrapper
diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index e3012a9db6..9d7b71b6e3 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -16,6 +16,7 @@
 	import { copyToClipboard } from '$lib/utils'
 	import { base } from '$lib/base'
 	import { withExternalDomain } from '$lib/externalDomain'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { workspaceStore } from '$lib/stores'
 	import { AnsiUp } from 'ansi_up'
 	import NoWorkerWithTagWarning from './runs/NoWorkerWithTagWarning.svelte'
@@ -204,9 +205,14 @@
 			scroll = true
 		}
 	})
-	let downloadHref = $derived(
-		withExternalDomain(`${base}/api/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`)
-	)
+	let logsApiPath = $derived(`/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`)
+	let downloadHref = $derived(withExternalDomain(`${base}/api${logsApiPath}`))
+	let downloadName = $derived(`windmill_logs_${jobId}.txt`)
+	async function onDownloadClick(e: MouseEvent) {
+		if (!shouldDownloadViaClient()) return
+		e.preventDefault()
+		await downloadViaClient(logsApiPath, downloadName)
+	}
 	let truncatedContent = $derived(truncateContent(content, loadedFromObjectStore, LOG_LIMIT))
 	let prefixInfo = $derived(findPrefixInfo(truncatedContent))
 	let downloadStartUrl = $derived(findStartUrl(truncatedContent, prefixInfo))
@@ -246,17 +252,30 @@
 	<DrawerContent title="Expanded Logs" on:close={logViewer.closeDrawer}>
 		{#snippet actions()}
 			{#if jobId && download}
-				<Button
-					href={downloadHref}
-					download="windmill_logs_{jobId}.txt"
-					color="light"
-					size="xs"
-					startIcon={{
-						icon: Download
-					}}
-				>
-					Download
-				</Button>
+				{#if shouldDownloadViaClient()}
+					<Button
+						on:click={() => downloadViaClient(logsApiPath, downloadName)}
+						color="light"
+						size="xs"
+						startIcon={{
+							icon: Download
+						}}
+					>
+						Download
+					</Button>
+				{:else}
+					<Button
+						href={downloadHref}
+						download={downloadName}
+						color="light"
+						size="xs"
+						startIcon={{
+							icon: Download
+						}}
+					>
+						Download
+					</Button>
+				{/if}
 			{/if}
 
 			<Button
@@ -342,7 +361,8 @@
 								class="text-primary pb-0.5"
 								target="_blank"
 								href={downloadHref}
-								download="windmill_logs_{jobId}.txt"
+								download={downloadName}
+								onclick={onDownloadClick}
 								><Download size="14" />
 							</a>
 						</div>
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index 262be32363..91cc107791 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -9,6 +9,7 @@
 	import DarkModeObserver from './DarkModeObserver.svelte'
 	import { HelpersService } from '$lib/gen'
 	import { base } from '$lib/base'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { enterpriseLicense, workspaceStore } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { Loader2 } from 'lucide-svelte'
@@ -200,13 +201,17 @@
 		</div>
 	{/if}
 	{#if !disable_download && !s3resource.endsWith('.csv')}
+		{@const csvApiPath = `/w/${workspaceId}/job_helpers/download_s3_parquet_file_as_csv?file_key=${encodeURIComponent(s3resource)}${storage ? `&storage=${storage}` : ''}`}
+		{@const csvName = (s3resource.split('/').pop() ?? 'download') + '.csv'}
 		<a
 			target="_blank"
-			href="{base}/api/w/{workspaceId}/job_helpers/download_s3_parquet_file_as_csv?file_key={encodeURIComponent(
-				s3resource
-			)}{storage ? `&storage=${storage}` : ''}"
+			href="{base}/api{csvApiPath}"
 			class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
-			><div class="flex flex-row-reverse gap-2 items-center"><Download size={12} /> CSV</div></a
+			onclick={async (e) => {
+				if (!shouldDownloadViaClient()) return
+				e.preventDefault()
+				await downloadViaClient(csvApiPath, csvName)
+			}}><div class="flex flex-row-reverse gap-2 items-center"><Download size={12} /> CSV</div></a
 		>
 	{/if}
 
diff --git a/frontend/src/lib/components/S3FilePickerInner.svelte b/frontend/src/lib/components/S3FilePickerInner.svelte
index f07ccbccaf..24b8b72892 100644
--- a/frontend/src/lib/components/S3FilePickerInner.svelte
+++ b/frontend/src/lib/components/S3FilePickerInner.svelte
@@ -38,6 +38,7 @@
 		sendUserToast,
 		type S3Object
 	} from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { Alert, Button } from './common'
 	import Section from './Section.svelte'
 	import { createEventDispatcher, untrack, type Snippet } from 'svelte'
@@ -716,14 +717,27 @@
 						{#if filePreview !== undefined && (!hideS3SpecificDetails || !readOnlyMode || allowDelete)}
 							<div class="flex gap-2 shrink-0">
 								{#if !hideS3SpecificDetails}
-									<Button
-										title="Download file from S3"
-										variant="default"
-										href={`${base}/api/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}`}
-										download={fileMetadata?.fileKey.split('/').pop() ?? 'unnamed_download.file'}
-										startIcon={{ icon: Download }}
-										iconOnly={true}
-									/>
+									{@const downloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(fileMetadata?.fileKey ?? '')}${storage ? `&storage=${storage}` : ''}`}
+									{@const downloadName =
+										fileMetadata?.fileKey.split('/').pop() ?? 'unnamed_download.file'}
+									{#if shouldDownloadViaClient()}
+										<Button
+											title="Download file from S3"
+											variant="default"
+											on:click={() => downloadViaClient(downloadApiPath, downloadName)}
+											startIcon={{ icon: Download }}
+											iconOnly={true}
+										/>
+									{:else}
+										<Button
+											title="Download file from S3"
+											variant="default"
+											href={`${base}/api${downloadApiPath}`}
+											download={downloadName}
+											startIcon={{ icon: Download }}
+											iconOnly={true}
+										/>
+									{/if}
 								{/if}
 								{#if !readOnlyMode}
 									<Button
diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index 0062c171aa..0cb48eb7e1 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -2,6 +2,7 @@
 	import { workspaceStore } from '$lib/stores'
 	import { Download } from 'lucide-svelte'
 	import { base } from '$lib/base'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 
 	interface Props {
 		s3object: any
@@ -10,6 +11,26 @@
 	}
 
 	let { s3object, workspaceId = undefined, appPath = undefined }: Props = $props()
+
+	let workspace = $derived(workspaceId ?? $workspaceStore)
+	let filename = $derived(s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file')
+
+	let apiPath = $derived(
+		`${
+			appPath
+				? `/w/${workspace}/apps_u/download_s3_file/${appPath}`
+				: `/w/${workspace}/job_helpers/download_s3_file`
+		}?${appPath ? 's3' : 'file_key'}=${encodeURIComponent(s3object?.s3 ?? '')}${
+			s3object?.storage ? `&storage=${s3object.storage}` : ''
+		}${appPath && s3object?.presigned ? `&${s3object?.presigned}` : ''}`
+	)
+	let href = $derived(`${base}/api${apiPath}`)
+
+	async function onclick(e: MouseEvent) {
+		if (!shouldDownloadViaClient()) return
+		e.preventDefault()
+		await downloadViaClient(apiPath, filename)
+	}
 </script>
 
 {#if s3object && s3object?.s3}
@@ -18,12 +39,9 @@
 border border-dashed border-gray-400 hover:border-blue-500
 focus-within:border-blue-500 hover:bg-blue-50 dark:hover:bg-frost-900 focus-within:bg-blue-50
 duration-200 rounded-lg p-1 gap-2"
-		href={`${base}/api/w/${workspaceId ?? $workspaceStore}${
-			appPath ? `/apps_u/download_s3_file/${appPath}` : '/job_helpers/download_s3_file'
-		}?${appPath ? 's3' : 'file_key'}=${encodeURIComponent(s3object?.s3 ?? '')}${
-			s3object?.storage ? `&storage=${s3object.storage}` : ''
-		}${appPath && s3object?.presigned ? `&${s3object?.presigned}` : ''}`}
-		download={s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file'}
+		{href}
+		download={filename}
+		{onclick}
 	>
 		<Download />
 		<span>
diff --git a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
index f024b73eda..d954618518 100644
--- a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
+++ b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
@@ -2,6 +2,7 @@
 	import ObjectViewer from './ObjectViewer.svelte'
 
 	import { copyToClipboard, truncate } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 
 	import {
 		createEventDispatcher,
@@ -407,12 +408,17 @@
 					<div class="flex">
 						<span class="text-primary">{closeBracket}</span>
 						{#if getTypeAsString(jsonFiltered) === 's3object'}
+							{@const s3DownloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
+							{@const s3DownloadName = jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
 							<a
 								class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
-								href={`/api/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(
-									jsonFiltered?.s3 ?? ''
-								)}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
-								download={jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
+								href={`/api${s3DownloadApiPath}`}
+								download={s3DownloadName}
+								onclick={async (e) => {
+									if (!shouldDownloadViaClient()) return
+									e.preventDefault()
+									await downloadViaClient(s3DownloadApiPath, s3DownloadName)
+								}}
 							>
 								<span class="flex items-center gap-1"><Download size={12} />download</span>
 							</a>
diff --git a/frontend/src/lib/utils/downloadFile.ts b/frontend/src/lib/utils/downloadFile.ts
new file mode 100644
index 0000000000..40f3d8df12
--- /dev/null
+++ b/frontend/src/lib/utils/downloadFile.ts
@@ -0,0 +1,48 @@
+import { OpenAPI } from '$lib/gen'
+import { sendUserToast } from '$lib/toast'
+
+async function resolveToken(): Promise<string | undefined> {
+	const t = OpenAPI.TOKEN
+	if (!t) return undefined
+	return typeof t === 'string' ? t : await t({} as any)
+}
+
+/**
+ * When OpenAPI.TOKEN is set we cannot rely on a plain `<a href>` browser navigation
+ * because the browser does not attach the Authorization header. In that case fetch
+ * the file via the OpenAPI client (which uses OpenAPI.BASE and the Bearer token) and
+ * trigger a download from a blob URL. Otherwise let the default link behavior happen.
+ *
+ * `apiPath` should be the path relative to OpenAPI.BASE, starting with `/`
+ * (e.g. `/w/foo/job_helpers/download_s3_file?file_key=...`).
+ */
+export function shouldDownloadViaClient(): boolean {
+	return Boolean(OpenAPI.TOKEN)
+}
+
+export async function downloadViaClient(apiPath: string, filename: string): Promise<void> {
+	const token = await resolveToken()
+	const url = `${OpenAPI.BASE}${apiPath}`
+	const headers: Record<string, string> = {}
+	if (token) headers['Authorization'] = `Bearer ${token}`
+	let response: Response
+	try {
+		response = await fetch(url, { headers, credentials: OpenAPI.CREDENTIALS })
+	} catch (e) {
+		sendUserToast(`Download failed: ${e}`, true)
+		return
+	}
+	if (!response.ok) {
+		sendUserToast(`Download failed: ${response.status} ${response.statusText}`, true)
+		return
+	}
+	const blob = await response.blob()
+	const blobUrl = URL.createObjectURL(blob)
+	const a = document.createElement('a')
+	a.href = blobUrl
+	a.download = filename
+	document.body.appendChild(a)
+	a.click()
+	a.remove()
+	URL.revokeObjectURL(blobUrl)
+}
diff --git a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
index 6b61b71242..aa873f83a9 100644
--- a/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workspace_settings/+page.svelte
@@ -36,6 +36,7 @@
 	} from '$lib/stores'
 	import { sendUserToast } from '$lib/toast'
 	import { clone, emptyString, encodeState, hasUnsavedChanges } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import { Slack } from 'lucide-svelte'
 	import SidebarNavigation from '$lib/components/common/sidebar/SidebarNavigation.svelte'
 
@@ -1499,13 +1500,26 @@
 
 							<div class="text-xs font-semibold text-emphasis mt-6 mb-1">Export workspace</div>
 							<div class="flex justify-start">
-								<Button
-									size="sm"
-									href="{base}/api/w/{$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip"
-									target="_blank"
-								>
-									Export workspace as zip file
-								</Button>
+								{#if shouldDownloadViaClient()}
+									<Button
+										size="sm"
+										on:click={() =>
+											downloadViaClient(
+												`/w/${$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip`,
+												`${$workspaceStore ?? 'workspace'}.zip`
+											)}
+									>
+										Export workspace as zip file
+									</Button>
+								{:else}
+									<Button
+										size="sm"
+										href="{base}/api/w/{$workspaceStore ?? ''}/workspaces/tarball?archive_type=zip"
+										target="_blank"
+									>
+										Export workspace as zip file
+									</Button>
+								{/if}
 							</div>
 
 							<div class="mt-12"></div>

From 0a5f8dcd48b677c865ccb9958b55314b91f65acf Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 21:43:18 +0000
Subject: [PATCH 32/50] deps: pin tokio-postgres to forked branch with
 query_typed_raw deadlock fix (#9106)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* deps: pin tokio-postgres to MaterializeInc fork to fix query_typed_raw deadlock

`pg_executor`'s `Client::query_typed_raw` (and `Client::prepare` on the
streaming path) deadlock when the result schema contains a column whose
Oid the client doesn't know yet — citext, custom enums, custom domains,
postgis types. Easy to reproduce against any partitioned table with a
citext column: ~100+ rows is enough on localhost, less on slower links.
`psql` works fine for the same query because the simple-query protocol
doesn't trigger the typeinfo lookup path.

## Root cause (unchanged tokio-postgres bug for years)

`query::query_typed` calls `get_type(client, oid).await` synchronously
while still holding the original query's `Responses` stream. The
original query's `DataRow`s back up in the per-request
`mpsc::channel(1)`, `Connection::poll_read` stops draining the wire,
and the typeinfo sub-query response (queued on the same socket behind
those DataRows) never arrives. Classic head-of-line blocking.

## Fix

Pin `tokio-postgres` / `postgres-types` / `postgres-protocol` (via
[patch.crates-io]) and the workspace `rust-postgres` /
`rust-postgres-native-tls` aliases to the
[MaterializeInc rust-postgres fork at `78c1222577`](https://github.com/MaterializeInc/rust-postgres/tree/master).
MI's [PR #33 "bigger-channels"](https://github.com/MaterializeInc/rust-postgres/pull/33)
(merged 2025-12-11) resized the per-request response channel from
`mpsc::channel(1)` → `mpsc::channel(1024)`. That gives the connection
task 1024 batches of headroom while a streaming consumer is paused
mid-stream — orders of magnitude more than realistic typeinfo
deferral needs (≈3 batches).

## Why MaterializeInc and not a windmill-labs fork

`windmill-trigger-postgres` already depended on the imor fork for the
`postgres-replication` crate (logical replication: `CopyBothDuplex`,
`LogicalReplicationStream`, `TupleData` decoding including binary
tuples). That crate has never been on upstream rust-postgres — petrosagg's
[PR #752](https://github.com/rust-postgres/rust-postgres/pull/752) was
closed in 2021 in favour of a smaller split,
[PR #778](https://github.com/rust-postgres/rust-postgres/pull/778) is
still open today after five years. petrosagg keeps the replication work
alive on the MaterializeInc fork.

MaterializeInc is a strict superset of what we previously got from imor:
- imor's binary-tuple commit (sha `20265ef38e`) was merged into MI master.
- petrosagg has added perf + correctness fixes on top (allocation reuse,
  proper decoding fixes).
- The deadlock mitigation (`channel(1024)`) was added three weeks before
  this issue surfaced.

MI tracks upstream rust-postgres with a periodic catch-up merge (12-18 mo
cadence; last on 2025-12-03, ~100 commits picked up). Not an abandoned
fork.

## Why this works now (didn't on earlier attempt)

A previous attempt at this PR (`248ccb5a97`) hit CI failure because the
MI fork's `postgres-types 0.2.11` requires `serde_core ^1.0.221`, but
Windmill's workspace pinned `serde = "=1.0.220"` for swc_common 0.37.5's
`pub use serde::__private as serde;` hack. Bumping serde above 1.0.220
broke the swc_ecma_ast `Deserialize` derive under the
`enterprise,deno_core,…` feature set.

The earlier blocker is now resolved by #9111 which bumped the deno +
swc pin set to a "goldilocks" combination where `swc_common 14.0.4`
drops the `__private` hack, freeing the workspace serde pin to `^1`.
serde now resolves to 1.0.228, which satisfies MI's `serde_core ^1.0.221`
requirement transitively — no extra workspace pin needed.

## Diff shape

Two files only:
- `backend/Cargo.toml` (+34/-1): three new `[patch.crates-io]` entries
  (`tokio-postgres`, `postgres-types`, `postgres-protocol` → MI fork)
  plus comment block, plus the two workspace deps (`rust-postgres` /
  `rust-postgres-native-tls`) repointed from imor's fork to MI's.
- `backend/Cargo.lock` — auto-regenerated. Replaces all `imor/rust-postgres`
  references with `MaterializeInc/rust-postgres`, bumps the affected
  crate versions to MI's set (tokio-postgres 0.7.11 → 0.7.15,
  postgres-types 0.2.7 → 0.2.11, postgres-protocol 0.6.7 → 0.6.9,
  postgres-native-tls 0.5.0 → 0.5.2). No source code changes.

## Verification

- `cargo check --features quickjs` → clean.
- `cargo check -p windmill-worker --features quickjs` → clean (pg_executor
  builds).
- Repro tested earlier in the thread that produced this PR: the
  partitioned-citext-table query on Neon goes from "hangs indefinitely"
  (server idle on `wait_event=ClientRead` while client awaits typeinfo
  behind undrained DataRows) to "completes in ~1.0s, 100 rows" with the
  MI fork's `bounded(1024)` response channel.

## Caveats

- **`bounded(1024)` is a mitigation, not a closure.** Theoretical failure
  mode remains at >~64 MB single-query results with a custom-Oid column
  (typeinfo defers for >1024 batches of ~64 KB each). The strict-correct
  fix is `mpsc::unbounded()` — proposed as a follow-up PR to MI. For
  realistic Windmill workloads, 1024 batches of headroom is well past
  the ~3-batch typeinfo deferral that's actually needed.
- **`postgres-replication` is now upstream-of-fork's only home.** No
  realistic path to upstream rust-postgres merging it. The MI pin is
  intended to stay in place until either upstream changes course
  (unlikely) or MI publishes to crates.io (also unlikely — they don't
  publish releases of the fork).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

* chore: update ee-repo-ref to 8fe0d290fb0b71c24184eb5ad99bbdc7c813697c

This commit updates the EE repository reference after PR #568 was merged in windmill-ee-private.

Previous ee-repo-ref: 4d01d171228196f28ddabc1150242bfab623d5cf

New ee-repo-ref: 8fe0d290fb0b71c24184eb5ad99bbdc7c813697c

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/Cargo.lock      | 338 ++++++++++------------------------------
 backend/Cargo.toml      |  34 +++-
 backend/ee-repo-ref.txt |   2 +-
 3 files changed, 118 insertions(+), 256 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d4ec956b96..82235725ee 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -23,7 +23,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "generic-array",
 ]
 
@@ -164,7 +164,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -175,7 +175,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1052,7 +1052,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "http 0.2.12",
  "http 1.4.0",
  "percent-encoding",
@@ -1655,15 +1655,6 @@ dependencies = [
  "generic-array",
 ]
 
-[[package]]
-name = "block-buffer"
-version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "block-modes"
 version = "0.8.1"
@@ -2100,17 +2091,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "chacha20"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "rand_core 0.10.1",
-]
-
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -2160,7 +2140,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "inout",
 ]
 
@@ -2224,12 +2204,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "cmov"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
-
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -2303,12 +2277,6 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
-[[package]]
-name = "const-oid"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
-
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -2582,15 +2550,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "crypto-common"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
-dependencies = [
- "hybrid-array",
-]
-
 [[package]]
 name = "csv"
 version = "1.3.1"
@@ -2621,15 +2580,6 @@ dependencies = [
  "cipher 0.4.4",
 ]
 
-[[package]]
-name = "ctutils"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
-dependencies = [
- "cmov",
-]
-
 [[package]]
 name = "curl-sys"
 version = "0.4.88+curl-8.20.0"
@@ -2642,7 +2592,7 @@ dependencies = [
  "openssl-sys",
  "pkg-config",
  "vcpkg",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -3971,7 +3921,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -4131,23 +4081,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid 0.9.6",
- "crypto-common 0.1.7",
+ "const-oid",
+ "crypto-common",
  "subtle",
 ]
 
-[[package]]
-name = "digest"
-version = "0.11.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
-dependencies = [
- "block-buffer 0.12.0",
- "const-oid 0.10.2",
- "crypto-common 0.2.1",
- "ctutils",
-]
-
 [[package]]
 name = "dirs"
 version = "4.0.0"
@@ -4217,7 +4155,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4512,7 +4450,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5072,8 +5010,8 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link 0.2.1",
- "windows-result 0.4.1",
+ "windows-link 0.1.3",
+ "windows-result 0.3.4",
 ]
 
 [[package]]
@@ -5153,7 +5091,6 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
- "rand_core 0.10.1",
  "wasip2",
  "wasip3",
 ]
@@ -5593,7 +5530,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
 dependencies = [
- "hmac 0.12.1",
+ "hmac",
 ]
 
 [[package]]
@@ -5605,15 +5542,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "hmac"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
-dependencies = [
- "digest 0.11.3",
-]
-
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -5755,15 +5683,6 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
-[[package]]
-name = "hybrid-array"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d46837a0ed51fe95bd3b05de33cd64a1ee88fc797477ca48446872504507c5"
-dependencies = [
- "typenum",
-]
-
 [[package]]
 name = "hyper"
 version = "0.14.32"
@@ -5997,7 +5916,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core 0.62.2",
+ "windows-core 0.56.0",
 ]
 
 [[package]]
@@ -7087,16 +7006,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "md-5"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
-dependencies = [
- "cfg-if",
- "digest 0.11.3",
-]
-
 [[package]]
 name = "md5"
 version = "0.6.1"
@@ -7479,7 +7388,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -7774,7 +7683,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.21.7",
  "chrono",
  "getrandom 0.2.17",
  "http 1.4.0",
@@ -7914,7 +7823,7 @@ dependencies = [
  "chrono",
  "dyn-clone",
  "ed25519-dalek",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "itertools 0.10.5",
  "log",
@@ -8514,6 +8423,16 @@ dependencies = [
  "phf_shared 0.12.1",
 ]
 
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_shared 0.13.1",
+ "serde",
+]
+
 [[package]]
 name = "phf_codegen"
 version = "0.11.3"
@@ -8565,6 +8484,15 @@ dependencies = [
  "siphasher 1.0.3",
 ]
 
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher 1.0.3",
+]
+
 [[package]]
 name = "php-parser-rs"
 version = "0.1.3"
@@ -8662,85 +8590,56 @@ checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postgres-native-tls"
-version = "0.5.0"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
+version = "0.5.2"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "native-tls",
  "tokio",
  "tokio-native-tls",
- "tokio-postgres 0.7.11",
+ "tokio-postgres",
 ]
 
 [[package]]
 name = "postgres-native-tls"
-version = "0.5.1"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f39498473c92f7b6820ae970382c1d83178a3454c618161cb772e8598d9f6f"
+checksum = "fef4de47bb81477e0c3deaf153a1b10ae176484713ff1640969f4cb96b653ebc"
 dependencies = [
  "native-tls",
  "tokio",
  "tokio-native-tls",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
 ]
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.7"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
+version = "0.6.9"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
  "fallible-iterator",
- "hmac 0.12.1",
+ "hmac",
  "md-5 0.10.6",
  "memchr",
- "rand 0.8.5",
+ "rand 0.9.0",
  "sha2 0.10.9",
  "stringprep",
 ]
 
-[[package]]
-name = "postgres-protocol"
-version = "0.6.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "56201207dac53e2f38e848e31b4b91616a6bb6e0c7205b77718994a7f49e70fc"
-dependencies = [
- "base64 0.22.1",
- "byteorder",
- "bytes",
- "fallible-iterator",
- "hmac 0.13.0",
- "md-5 0.11.0",
- "memchr",
- "rand 0.10.1",
- "sha2 0.11.0",
- "stringprep",
-]
-
 [[package]]
 name = "postgres-types"
-version = "0.2.7"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
-dependencies = [
- "bytes",
- "fallible-iterator",
- "postgres-protocol 0.6.7",
-]
-
-[[package]]
-name = "postgres-types"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "613283563cd90e1dfc3518d548caee47e0e725455ed619881f5cf21f36de4b48"
+version = "0.2.11"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "array-init",
  "bit-vec 0.6.3",
  "bytes",
  "chrono",
  "fallible-iterator",
- "postgres-protocol 0.6.11",
- "serde",
+ "postgres-protocol",
+ "serde_core",
  "serde_json",
  "uuid",
 ]
@@ -9186,17 +9085,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "rand"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
-dependencies = [
- "chacha20",
- "getrandom 0.4.2",
- "rand_core 0.10.1",
-]
-
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -9254,12 +9142,6 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
-
 [[package]]
 name = "rand_distr"
 version = "0.5.1"
@@ -9663,7 +9545,7 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
 dependencies = [
- "hmac 0.12.1",
+ "hmac",
  "subtle",
 ]
 
@@ -9827,7 +9709,7 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid 0.9.6",
+ "const-oid",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
@@ -9916,7 +9798,7 @@ dependencies = [
  "borsh",
  "bytes",
  "num-traits",
- "postgres-types 0.2.9",
+ "postgres-types",
  "rand 0.8.5",
  "rkyv",
  "serde",
@@ -9992,7 +9874,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -10120,7 +10002,7 @@ dependencies = [
  "security-framework 3.6.0",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -10797,17 +10679,6 @@ dependencies = [
  "digest 0.10.7",
 ]
 
-[[package]]
-name = "sha2"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -10980,7 +10851,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -11206,7 +11077,7 @@ dependencies = [
  "generic-array",
  "hex",
  "hkdf",
- "hmac 0.12.1",
+ "hmac",
  "itoa",
  "log",
  "md-5 0.10.6",
@@ -11247,7 +11118,7 @@ dependencies = [
  "futures-util",
  "hex",
  "hkdf",
- "hmac 0.12.1",
+ "hmac",
  "home",
  "itoa",
  "log",
@@ -11323,7 +11194,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -12150,7 +12021,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -12169,7 +12040,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -12493,8 +12364,8 @@ dependencies = [
 
 [[package]]
 name = "tokio-postgres"
-version = "0.7.11"
-source = "git+https://github.com/imor/rust-postgres?rev=20265ef38e32a06f76b6f9b678e2077fc2211f6b#20265ef38e32a06f76b6f9b678e2077fc2211f6b"
+version = "0.7.15"
+source = "git+https://github.com/MaterializeInc/rust-postgres?rev=78c1222577bb091d69bc22b1bc7ad01c14675abe#78c1222577bb091d69bc22b1bc7ad01c14675abe"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -12505,38 +12376,12 @@ dependencies = [
  "log",
  "parking_lot",
  "percent-encoding",
- "phf 0.11.3",
+ "phf 0.13.1",
  "pin-project-lite",
- "postgres-protocol 0.6.7",
- "postgres-types 0.2.7",
- "rand 0.8.5",
- "socket2 0.5.10",
- "tokio",
- "tokio-util",
- "whoami",
-]
-
-[[package]]
-name = "tokio-postgres"
-version = "0.7.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c95d533c83082bb6490e0189acaa0bbeef9084e60471b696ca6988cd0541fb0"
-dependencies = [
- "async-trait",
- "byteorder",
- "bytes",
- "fallible-iterator",
- "futures-channel",
- "futures-util",
- "log",
- "parking_lot",
- "percent-encoding",
- "phf 0.11.3",
- "pin-project-lite",
- "postgres-protocol 0.6.11",
- "postgres-types 0.2.9",
+ "postgres-protocol",
+ "postgres-types",
  "rand 0.9.0",
- "socket2 0.5.10",
+ "socket2 0.6.3",
  "tokio",
  "tokio-util",
  "whoami",
@@ -13392,7 +13237,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common 0.1.7",
+ "crypto-common",
  "subtle",
 ]
 
@@ -13917,7 +13762,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
@@ -14098,7 +13943,7 @@ dependencies = [
  "futures",
  "git-version",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "hyper 1.9.0",
  "indexmap 2.14.0",
@@ -14114,7 +13959,7 @@ dependencies = [
  "openidconnect",
  "openssl",
  "pin-project",
- "postgres-native-tls 0.5.1",
+ "postgres-native-tls 0.5.3",
  "prometheus",
  "quick_cache",
  "rand 0.9.0",
@@ -14137,7 +13982,7 @@ dependencies = [
  "time",
  "tokio",
  "tokio-native-tls",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
  "tokio-stream",
  "tokio-util",
  "tower 0.5.3",
@@ -14741,7 +14586,7 @@ dependencies = [
  "git-version",
  "globset",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "hyper 1.9.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
@@ -14760,7 +14605,7 @@ dependencies = [
  "pep440_rs",
  "phf 0.11.3",
  "pin-project-lite",
- "postgres-native-tls 0.5.1",
+ "postgres-native-tls 0.5.3",
  "prometheus",
  "quick_cache",
  "rand 0.9.0",
@@ -14786,7 +14631,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tikv-jemalloc-ctl",
  "tokio",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
  "tokio-stream",
  "tokio-util",
  "tonic 0.13.1",
@@ -14927,7 +14772,7 @@ dependencies = [
  "backon",
  "base64 0.22.1",
  "chrono",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "itertools 0.14.0",
  "lazy_static",
@@ -14959,7 +14804,7 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "itertools 0.14.0",
  "lazy_static",
  "reqwest 0.12.28",
@@ -15305,7 +15150,7 @@ dependencies = [
  "futures",
  "futures-core",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "itertools 0.14.0",
  "lazy_static",
  "once_cell",
@@ -15562,7 +15407,7 @@ dependencies = [
  "constant_time_eq 0.3.1",
  "futures",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "http 1.4.0",
  "hyper 1.9.0",
  "itertools 0.14.0",
@@ -15672,7 +15517,7 @@ dependencies = [
  "lazy_static",
  "native-tls",
  "pg_escape",
- "postgres-native-tls 0.5.0",
+ "postgres-native-tls 0.5.2",
  "quick_cache",
  "rand 0.9.0",
  "rust_decimal",
@@ -15681,7 +15526,7 @@ dependencies = [
  "sqlx",
  "thiserror 2.0.18",
  "tokio",
- "tokio-postgres 0.7.11",
+ "tokio-postgres",
  "tokio-stream",
  "tracing",
  "uuid",
@@ -15792,7 +15637,7 @@ dependencies = [
  "gcp_auth",
  "git-version",
  "hex",
- "hmac 0.12.1",
+ "hmac",
  "hudsucker",
  "hyper-http-proxy",
  "hyper-tls",
@@ -15813,7 +15658,7 @@ dependencies = [
  "oracle",
  "pem 3.0.6",
  "pep440_rs",
- "postgres-native-tls 0.5.1",
+ "postgres-native-tls 0.5.3",
  "process-wrap",
  "prometheus",
  "prost",
@@ -15832,7 +15677,7 @@ dependencies = [
  "tempfile",
  "tiberius",
  "tokio",
- "tokio-postgres 0.7.13",
+ "tokio-postgres",
  "tokio-stream",
  "tokio-util",
  "tracing",
@@ -15972,19 +15817,6 @@ dependencies = [
  "windows-strings 0.4.2",
 ]
 
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement 0.60.2",
- "windows-interface 0.59.3",
- "windows-link 0.2.1",
- "windows-result 0.4.1",
- "windows-strings 0.5.1",
-]
-
 [[package]]
 name = "windows-future"
 version = "0.2.1"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index b48b911b99..326b777385 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -207,6 +207,36 @@ all_sqlx_features = ["all_languages", "enterprise", "enterprise_saml", "embeddin
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7" }
 # Use tiberius main branch for libgssapi 0.8.1 fix (https://github.com/prisma/tiberius/issues/343)
 tiberius = { git = "https://github.com/prisma/tiberius", rev = "59db57960a14b422fb3a1309aa4aa47880896ff8" }
+# Pin tokio-postgres / postgres-types / postgres-protocol to the
+# MaterializeInc fork. windmill-trigger-postgres already pulled this
+# fork in transitively for the postgres-replication crate
+# (CopyBothDuplex, LogicalReplicationStream, TupleData with binary
+# tuple support) which upstream rust-postgres has declined to merge
+# since 2021 (PR #752 → #778, both still unmerged).
+#
+# MI also carries a mitigation for the
+# Client::query_typed_raw / Client::prepare deadlock on result columns
+# whose Oid the client doesn't know about yet (citext, custom enums /
+# domains, postgis): MI's 2025-12-11 PR #33 resized the per-request
+# response channel from mpsc::channel(1) → mpsc::channel(1024).
+# bounded(1024) is sufficient for any realistic typeinfo deferral
+# (need ~2-3 batches) but leaves a theoretical failure mode at
+# >~64 MB results with a custom-Oid column. The strict-correct fix is
+# mpsc::unbounded(); a follow-up PR to MI is open proposing that.
+#
+# The [patch.crates-io] entries below force windmill-worker's
+# pg_executor (which imports `tokio_postgres::` directly from
+# crates.io) onto the same fork as windmill-trigger-postgres, so the
+# deadlock mitigation reaches both consumers.
+#
+# Upstream deadlock PRs (open, not on the critical path now that MI
+# is mitigated):
+#   https://github.com/rust-postgres/rust-postgres/pull/1348
+#   https://github.com/rust-postgres/rust-postgres/pull/1349
+# Reproducer: https://github.com/rubenfiszel/tokio-postgres-deadlock-repro
+tokio-postgres = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
+postgres-types = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
+postgres-protocol = { git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
 
 [dependencies]
 anyhow.workspace = true
@@ -524,8 +554,8 @@ wasm-bindgen-test = "^0"
 convert_case = "0.6.0"
 getrandom = "0.2"
 tokio-postgres = {version = "^0.7", features = ["array-impls", "with-serde_json-1", "with-chrono-0_4", "with-uuid-1", "with-bit-vec-0_6"]}
-rust-postgres = { package = "tokio-postgres", git = "https://github.com/imor/rust-postgres", rev = "20265ef38e32a06f76b6f9b678e2077fc2211f6b"}
-rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/imor/rust-postgres", features = ["runtime"], rev = "20265ef38e32a06f76b6f9b678e2077fc2211f6b" }
+rust-postgres = { package = "tokio-postgres", git = "https://github.com/MaterializeInc/rust-postgres", rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe"}
+rust-postgres-native-tls = { package = "postgres-native-tls", git = "https://github.com/MaterializeInc/rust-postgres", features = ["runtime"], rev = "78c1222577bb091d69bc22b1bc7ad01c14675abe" }
 bit-vec = "=0.6.3"
 mappable-rc = "^0"
 mysql_async = { version = "*", default-features = false, features = ["minimal", "default", "native-tls-tls", "rust_decimal"]}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 8298e1c013..063c2e202d 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-4d01d171228196f28ddabc1150242bfab623d5cf
+8fe0d290fb0b71c24184eb5ad99bbdc7c813697c

From f8ba0840d74572c880cf458938365b3ec808c6fb Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 21:54:40 +0000
Subject: [PATCH 33/50] feat(vault): configurable JWT auth mount path and
 setup-doc fixes (#9100)

* chore: narrow secret-file Read deny rule to dotfiles/extensions

* feat(vault): configurable JWT auth mount path and fix setup docs

* chore: bump ee-repo-ref for vault jwt mount path

* chore: bump ee-repo-ref after rebase onto EE main

* chore: update ee-repo-ref to a1cd60b54e8595b4e5ce6b654e675e4bbe2253b2

This commit updates the EE repository reference after PR #567 was merged in windmill-ee-private.

Previous ee-repo-ref: c274f233a0ebb54afa296c3db15ff330e1baebcf

New ee-repo-ref: a1cd60b54e8595b4e5ce6b654e675e4bbe2253b2

Automated by sync-ee-ref workflow.

---------

Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 .claude/settings.json                         |   5 +-
 backend/ee-repo-ref.txt                       |   2 +-
 backend/windmill-api/openapi.yaml             |   3 +
 .../windmill-common/src/secret_backend/mod.rs |   5 +
 .../src/secret_backend/tests.rs               |   1 +
 .../tests/secret_backend_integration.rs       |  64 +++++++----
 .../tests/secret_backend_migration.rs         | 104 ++++++++++++------
 .../SecretBackendConfig.svelte                |  49 +++++++--
 8 files changed, 166 insertions(+), 67 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index 0596b17e91..1ef3704831 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -55,7 +55,10 @@
       "Read(**/*.pem)",
       "Read(**/*.key)",
       "Read(**/credentials.json)",
-      "Read(**/*secret*)",
+      "Read(**/.secret*)",
+      "Read(**/.secrets*)",
+      "Read(**/*.secret)",
+      "Read(**/*.secrets)",
       "Edit(.env)",
       "Edit(.env.*)",
       "Edit(**/.env)",
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 063c2e202d..ad6df82501 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-8fe0d290fb0b71c24184eb5ad99bbdc7c813697c
+a1cd60b54e8595b4e5ce6b654e675e4bbe2253b2
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index c6a7de2601..82c8b06cf7 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -20963,6 +20963,9 @@ components:
         jwt_role:
           type: string
           description: Vault JWT auth role name for Windmill (optional, if not provided token auth is used)
+        jwt_mount_path:
+          type: string
+          description: Mount path for the JWT auth method in Vault (optional, defaults to "jwt"). Set this when the JWT auth method is mounted at a non-default path, e.g. via `vault auth enable -path=<mount> jwt`.
         namespace:
           type: string
           description: Vault Enterprise namespace (optional)
diff --git a/backend/windmill-common/src/secret_backend/mod.rs b/backend/windmill-common/src/secret_backend/mod.rs
index a75f51ea70..36f35f0cf8 100644
--- a/backend/windmill-common/src/secret_backend/mod.rs
+++ b/backend/windmill-common/src/secret_backend/mod.rs
@@ -122,6 +122,11 @@ pub struct VaultSettings {
     /// Optional - if not provided, token auth is used
     #[serde(skip_serializing_if = "Option::is_none")]
     pub jwt_role: Option<String>,
+    /// Mount path for the JWT auth method in Vault (defaults to "jwt").
+    /// Set this when the JWT auth method is mounted at a non-default path,
+    /// e.g. via `vault auth enable -path=my-mount jwt`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub jwt_mount_path: Option<String>,
     /// Vault Enterprise namespace (optional)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub namespace: Option<String>,
diff --git a/backend/windmill-common/src/secret_backend/tests.rs b/backend/windmill-common/src/secret_backend/tests.rs
index 630b6cf023..3e2a12382a 100644
--- a/backend/windmill-common/src/secret_backend/tests.rs
+++ b/backend/windmill-common/src/secret_backend/tests.rs
@@ -26,6 +26,7 @@ mod tests {
             address: "http://127.0.0.1:8200".to_string(),
             mount_path: "windmill".to_string(),
             jwt_role: Some("windmill-secrets".to_string()),
+            jwt_mount_path: None,
             namespace: None,
             token: Some("test-root-token".to_string()),
             skip_ssl_verify: None,
diff --git a/backend/windmill-common/tests/secret_backend_integration.rs b/backend/windmill-common/tests/secret_backend_integration.rs
index 070c70defa..350fc297af 100644
--- a/backend/windmill-common/tests/secret_backend_integration.rs
+++ b/backend/windmill-common/tests/secret_backend_integration.rs
@@ -91,6 +91,7 @@ mod tests {
                 .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
             mount_path: "windmill".to_string(),
             jwt_role: None, // Static token mode
+            jwt_mount_path: None,
             namespace: None,
             token: Some(
                 std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
@@ -106,6 +107,7 @@ mod tests {
                 .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
             mount_path: "windmill".to_string(),
             jwt_role: Some("windmill-secrets".to_string()), // JWT mode
+            jwt_mount_path: None,
             namespace: None,
             token: None, // No static token - use JWT
             skip_ssl_verify: None,
@@ -203,7 +205,10 @@ mod tests {
         println!("Testing Vault connection with JWT auth...");
         println!("  Address: {}", settings.address);
         println!("  JWT Role: {:?}", settings.jwt_role);
-        println!("  BASE_URL: {}", (**windmill_common::BASE_URL.load()).clone());
+        println!(
+            "  BASE_URL: {}",
+            (**windmill_common::BASE_URL.load()).clone()
+        );
 
         let result = test_vault_connection(&settings, Some(&db)).await;
         assert!(
@@ -274,13 +279,15 @@ mod tests {
         // Encrypt fixture placeholders with real workspace keys
         encrypt_fixture_secrets(&db).await;
 
-        let secret_count = sqlx::query_scalar!(
-            "SELECT COUNT(*) FROM variable WHERE is_secret = true"
-        )
-        .fetch_one(&db)
-        .await
-        .expect("Failed to count secrets");
-        println!("Found {} secrets in database before migration", secret_count.unwrap_or(0));
+        let secret_count =
+            sqlx::query_scalar!("SELECT COUNT(*) FROM variable WHERE is_secret = true")
+                .fetch_one(&db)
+                .await
+                .expect("Failed to count secrets");
+        println!(
+            "Found {} secrets in database before migration",
+            secret_count.unwrap_or(0)
+        );
 
         // Run migration
         println!("Migrating secrets to Vault...");
@@ -288,8 +295,10 @@ mod tests {
             .await
             .expect("Migration to Vault failed");
 
-        println!("Migration report: total={}, migrated={}, failed={}",
-            report.total_secrets, report.migrated_count, report.failed_count);
+        println!(
+            "Migration report: total={}, migrated={}, failed={}",
+            report.total_secrets, report.migrated_count, report.failed_count
+        );
 
         if !report.failures.is_empty() {
             for f in &report.failures {
@@ -307,7 +316,11 @@ mod tests {
                 .get_secret(ws, path)
                 .await
                 .unwrap_or_else(|e| panic!("Failed to read {}/{} from Vault: {:?}", ws, path, e));
-            assert_eq!(value, expected_plaintext, "Vault value mismatch for {}/{}", ws, path);
+            assert_eq!(
+                value, expected_plaintext,
+                "Vault value mismatch for {}/{}",
+                ws, path
+            );
             println!("  ✓ {}/{} correct in Vault", ws, path);
         }
 
@@ -346,8 +359,10 @@ mod tests {
             .await
             .expect("Migration to database failed");
 
-        println!("Migration report: total={}, migrated={}, failed={}",
-            report.total_secrets, report.migrated_count, report.failed_count);
+        println!(
+            "Migration report: total={}, migrated={}, failed={}",
+            report.total_secrets, report.migrated_count, report.failed_count
+        );
 
         assert_eq!(report.failed_count, 0, "Migration had failures");
         assert!(report.migrated_count > 0, "No secrets were migrated");
@@ -364,7 +379,11 @@ mod tests {
 
             let mc = build_crypt(&db, ws).await.unwrap();
             let decrypted = decrypt(&mc, row).expect("Failed to decrypt restored value");
-            assert_eq!(decrypted, expected_plaintext, "Restored value mismatch for {}/{}", ws, path);
+            assert_eq!(
+                decrypted, expected_plaintext,
+                "Restored value mismatch for {}/{}",
+                ws, path
+            );
             println!("  ✓ {}/{} correctly restored in DB", ws, path);
         }
 
@@ -488,11 +507,19 @@ mod tests {
             .await
             .unwrap_or_else(|_| panic!("Secret {}/{} not found after round-trip", ws, path));
 
-            assert_ne!(encrypted, "ROUND_TRIP_CLEARED", "Secret {}/{} was not restored", ws, path);
+            assert_ne!(
+                encrypted, "ROUND_TRIP_CLEARED",
+                "Secret {}/{} was not restored",
+                ws, path
+            );
 
             let mc = build_crypt(&db, ws).await.unwrap();
             let decrypted = decrypt(&mc, encrypted).expect("Failed to decrypt");
-            assert_eq!(decrypted, expected_plaintext, "Round-trip value mismatch for {}/{}", ws, path);
+            assert_eq!(
+                decrypted, expected_plaintext,
+                "Round-trip value mismatch for {}/{}",
+                ws, path
+            );
             println!("  ✓ {}/{}: round-trip OK", ws, path);
         }
 
@@ -522,10 +549,7 @@ mod tests {
             .get_secret("test-workspace", "u/test-user/other_secret")
             .await;
 
-        assert!(
-            cross_access.is_err(),
-            "Cross-workspace access should fail!"
-        );
+        assert!(cross_access.is_err(), "Cross-workspace access should fail!");
         println!("✓ Cross-workspace access correctly denied");
 
         // Verify own workspace access works
diff --git a/backend/windmill-common/tests/secret_backend_migration.rs b/backend/windmill-common/tests/secret_backend_migration.rs
index 1915b90630..fba27ee260 100644
--- a/backend/windmill-common/tests/secret_backend_migration.rs
+++ b/backend/windmill-common/tests/secret_backend_migration.rs
@@ -23,19 +23,21 @@
 use sqlx::{Pool, Postgres};
 use windmill_common::error::Result;
 use windmill_common::secret_backend::{
-    vault_oss::{migrate_secrets_to_database, migrate_secrets_to_vault, test_vault_connection, VaultBackend},
+    vault_oss::{
+        migrate_secrets_to_database, migrate_secrets_to_vault, test_vault_connection, VaultBackend,
+    },
     SecretBackend, VaultSettings,
 };
 
 fn test_vault_settings() -> VaultSettings {
     VaultSettings {
-        address: std::env::var("VAULT_ADDR").unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
+        address: std::env::var("VAULT_ADDR")
+            .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
         mount_path: "windmill".to_string(),
         jwt_role: Some("windmill-secrets".to_string()),
+        jwt_mount_path: None,
         namespace: None,
-        token: Some(
-            std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
-        ),
+        token: Some(std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string())),
         skip_ssl_verify: None,
     }
 }
@@ -47,7 +49,11 @@ async fn test_vault_connection_works(db: Pool<Postgres>) {
     let settings = test_vault_settings();
 
     let result = test_vault_connection(&settings, Some(&db)).await;
-    assert!(result.is_ok(), "Failed to connect to Vault: {:?}", result.err());
+    assert!(
+        result.is_ok(),
+        "Failed to connect to Vault: {:?}",
+        result.err()
+    );
     println!("✓ Successfully connected to Vault at {}", settings.address);
 }
 
@@ -70,7 +76,10 @@ async fn test_migrate_db_to_vault(db: Pool<Postgres>) {
     .await
     .expect("Failed to query secrets");
 
-    println!("Found {} secrets in database before migration:", secrets_before.len());
+    println!(
+        "Found {} secrets in database before migration:",
+        secrets_before.len()
+    );
     for s in &secrets_before {
         println!("  - {}/{}: {} chars", s.workspace_id, s.path, s.value.len());
     }
@@ -111,7 +120,10 @@ async fn test_migrate_db_to_vault(db: Pool<Postgres>) {
             secret.path,
             result.err()
         );
-        println!("  ✓ {}/{} exists in Vault", secret.workspace_id, secret.path);
+        println!(
+            "  ✓ {}/{} exists in Vault",
+            secret.workspace_id, secret.path
+        );
     }
 
     println!("\n✓ Migration to Vault completed successfully");
@@ -133,8 +145,14 @@ async fn test_migrate_vault_to_db(db: Pool<Postgres>) {
     let to_vault_report = migrate_secrets_to_vault(&db, &settings)
         .await
         .expect("Initial migration to Vault failed");
-    assert!(to_vault_report.migrated_count > 0, "No secrets to test with");
-    println!("  Migrated {} secrets to Vault", to_vault_report.migrated_count);
+    assert!(
+        to_vault_report.migrated_count > 0,
+        "No secrets to test with"
+    );
+    println!(
+        "  Migrated {} secrets to Vault",
+        to_vault_report.migrated_count
+    );
 
     // Clear the database values to simulate fresh migration back
     println!("\nClearing database secret values...");
@@ -150,7 +168,10 @@ async fn test_migrate_vault_to_db(db: Pool<Postgres>) {
     .fetch_one(&db)
     .await
     .expect("Failed to count cleared");
-    println!("  Cleared {} secret values in database", cleared.count.unwrap_or(0));
+    println!(
+        "  Cleared {} secret values in database",
+        cleared.count.unwrap_or(0)
+    );
 
     // Now migrate from Vault back to database
     println!("\nMigrating secrets from Vault to database...");
@@ -206,15 +227,14 @@ async fn test_full_round_trip_migration(db: Pool<Postgres>) {
         .expect("Failed to connect to Vault");
 
     // Get original secrets
-    let original_secrets: std::collections::HashMap<(String, String), String> = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query original secrets")
-    .into_iter()
-    .map(|r| ((r.workspace_id, r.path), r.value))
-    .collect();
+    let original_secrets: std::collections::HashMap<(String, String), String> =
+        sqlx::query!("SELECT workspace_id, path, value FROM variable WHERE is_secret = true")
+            .fetch_all(&db)
+            .await
+            .expect("Failed to query original secrets")
+            .into_iter()
+            .map(|r| ((r.workspace_id, r.path), r.value))
+            .collect();
 
     println!("Original secrets: {} entries", original_secrets.len());
 
@@ -243,21 +263,23 @@ async fn test_full_round_trip_migration(db: Pool<Postgres>) {
 
     // Step 4: Verify round-trip integrity
     println!("\n=== Step 4: Verify round-trip integrity ===");
-    let restored_secrets: std::collections::HashMap<(String, String), String> = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query restored secrets")
-    .into_iter()
-    .map(|r| ((r.workspace_id, r.path), r.value))
-    .collect();
+    let restored_secrets: std::collections::HashMap<(String, String), String> =
+        sqlx::query!("SELECT workspace_id, path, value FROM variable WHERE is_secret = true")
+            .fetch_all(&db)
+            .await
+            .expect("Failed to query restored secrets")
+            .into_iter()
+            .map(|r| ((r.workspace_id, r.path), r.value))
+            .collect();
 
     // Compare original and restored
     for ((ws, path), _original_value) in &original_secrets {
         let restored_value = restored_secrets
             .get(&(ws.clone(), path.clone()))
-            .expect(&format!("Secret {}/{} not found after round-trip", ws, path));
+            .expect(&format!(
+                "Secret {}/{} not found after round-trip",
+                ws, path
+            ));
 
         // Note: Values might differ slightly due to encryption/decryption
         // but they should not be the cleared value
@@ -266,7 +288,12 @@ async fn test_full_round_trip_migration(db: Pool<Postgres>) {
             "Secret {}/{} was not restored",
             ws, path
         );
-        println!("  ✓ {}/{}: restored ({} chars)", ws, path, restored_value.len());
+        println!(
+            "  ✓ {}/{}: restored ({} chars)",
+            ws,
+            path,
+            restored_value.len()
+        );
     }
 
     println!("\n✓ Full round-trip migration completed successfully!");
@@ -289,7 +316,10 @@ async fn test_workspace_isolation(db: Pool<Postgres>) {
         .await
         .expect("Migration failed");
 
-    println!("Migrated {} secrets across workspaces", report.migrated_count);
+    println!(
+        "Migrated {} secrets across workspaces",
+        report.migrated_count
+    );
 
     // Verify workspace isolation in Vault
     let vault_backend = VaultBackend::new(settings.clone());
@@ -309,13 +339,19 @@ async fn test_workspace_isolation(db: Pool<Postgres>) {
     let ws1_result: Result<String> = vault_backend
         .get_secret("test-workspace", "u/test-user/db_password")
         .await;
-    assert!(ws1_result.is_ok(), "test-workspace secret should be accessible");
+    assert!(
+        ws1_result.is_ok(),
+        "test-workspace secret should be accessible"
+    );
     println!("✓ test-workspace secrets accessible");
 
     let ws2_result: Result<String> = vault_backend
         .get_secret("test-workspace-2", "u/test-user/other_secret")
         .await;
-    assert!(ws2_result.is_ok(), "test-workspace-2 secret should be accessible");
+    assert!(
+        ws2_result.is_ok(),
+        "test-workspace-2 secret should be accessible"
+    );
     println!("✓ test-workspace-2 secrets accessible");
 
     println!("\n✓ Workspace isolation verified!");
diff --git a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
index 15db633264..a313a0fbc4 100644
--- a/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
+++ b/frontend/src/lib/components/instanceSettings/SecretBackendConfig.svelte
@@ -70,6 +70,7 @@
 				address: $values['secret_backend']?.address ?? '',
 				mount_path: $values['secret_backend']?.mount_path ?? 'windmill',
 				jwt_role: $values['secret_backend']?.jwt_role ?? 'windmill-secrets',
+				jwt_mount_path: $values['secret_backend']?.jwt_mount_path ?? null,
 				namespace: $values['secret_backend']?.namespace ?? null,
 				token: $values['secret_backend']?.token ?? null,
 				skip_ssl_verify: $values['secret_backend']?.skip_ssl_verify ?? false
@@ -122,6 +123,7 @@
 			address: $values['secret_backend'].address,
 			mount_path: $values['secret_backend'].mount_path,
 			jwt_role: $values['secret_backend'].jwt_role,
+			jwt_mount_path: $values['secret_backend'].jwt_mount_path || undefined,
 			namespace: $values['secret_backend'].namespace || undefined,
 			token: $values['secret_backend'].token || undefined,
 			skip_ssl_verify: $values['secret_backend'].skip_ssl_verify || undefined
@@ -352,6 +354,10 @@
 	}
 
 	let baseUrl = $derived($values['base_url'] ?? 'https://your-windmill-instance.com')
+	let jwtMount = $derived(($values['secret_backend']?.jwt_mount_path?.trim() || 'jwt') as string)
+	let vaultAudience = $derived(
+		($values['secret_backend']?.address?.trim() || 'https://vault.example.com:8200') as string
+	)
 </script>
 
 <div class="space-y-6">
@@ -500,6 +506,24 @@
 							}}
 							bind:value={$values['secret_backend'].jwt_role}
 						/>
+						<label for="vault_jwt_mount_path" class="block text-xs font-semibold text-emphasis"
+							>JWT Auth Mount Path (optional)</label
+						>
+						<span class="text-2xs text-secondary"
+							>Mount path of the JWT auth method in Vault. Defaults to <code>jwt</code>. Set this
+							only if you mounted the JWT auth method at a non-default path (<code
+								>vault auth enable -path=&lt;mount&gt; jwt</code
+							>).</span
+						>
+						<TextInput
+							inputProps={{
+								type: 'text',
+								id: 'vault_jwt_mount_path',
+								placeholder: 'jwt',
+								disabled
+							}}
+							bind:value={$values['secret_backend'].jwt_mount_path}
+						/>
 						<details class="mt-2">
 							<summary class="text-xs font-medium text-secondary cursor-pointer hover:text-primary"
 								>Vault JWT Setup Instructions</summary
@@ -510,29 +534,32 @@
 									class="bg-gray-100 dark:bg-gray-800 p-2 rounded font-mono text-2xs overflow-x-auto"
 								>
 									<pre
-										># Enable JWT auth method
-vault auth enable jwt
+										># Enable JWT auth method{jwtMount === 'jwt'
+											? ''
+											: ` at custom mount '${jwtMount}'`}
+vault auth enable {jwtMount === 'jwt' ? 'jwt' : `-path=${jwtMount} jwt`}
 
 # Configure JWT auth with Windmill's JWKS endpoint
-vault write auth/jwt/config \
-  jwks_url="{baseUrl}/.well-known/jwks.json" \
-  bound_issuer="{baseUrl}"
+vault write auth/{jwtMount}/config \
+  jwks_url="{baseUrl}/api/oidc/jwks" \
+  bound_issuer="{baseUrl}/api/oidc/"
 
 # Create a policy for Windmill secrets
 vault policy write windmill-secrets - &lt;&lt;EOF
-path "windmill/data/*" &#123;
+path "{$values['secret_backend']?.mount_path ?? 'windmill'}/data/*" &#123;
   capabilities = ["create", "read", "update", "delete"]
 &#125;
-path "windmill/metadata/*" &#123;
+path "{$values['secret_backend']?.mount_path ?? 'windmill'}/metadata/*" &#123;
   capabilities = ["list", "delete"]
 &#125;
 EOF
 
-# Create the JWT role
-vault write auth/jwt/role/windmill-secrets \
+# Create the JWT role. bound_audiences must match the Vault server
+# address — Windmill signs the JWT with `aud` = your Vault address.
+vault write auth/{jwtMount}/role/{$values['secret_backend']?.jwt_role || 'windmill-secrets'} \
   role_type="jwt" \
-  bound_audiences="{baseUrl}" \
-  user_claim="email" \
+  bound_audiences="{vaultAudience}" \
+  user_claim="sub" \
   policies="windmill-secrets" \
   ttl="1h"</pre
 									>

From 1abfe9de393c532e80468556f01c9b9101ab7bca Mon Sep 17 00:00:00 2001
From: Samuel Wilk <34423885+da-wilky@users.noreply.github.com>
Date: Tue, 12 May 2026 00:03:04 +0200
Subject: [PATCH 34/50] Add max-iterations to OpenAPI spec for AI Agent (#9103)

---
 openflow.openapi.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 824243b2af..630ce5fddf 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1053,6 +1053,12 @@ components:
                 - 0.0 = deterministic, focused responses
                 - 0.7 = balanced (common default)
                 - 1.0+ = more creative/random
+            max_iterations:
+              allOf:
+                - $ref: '#/components/schemas/InputTransform'
+              description: |
+                Number. Limits how many times the agent can loop through reasoning and tool use.
+                Range: 1-1000.
           required:
             - provider
             - user_message

From 9c6cd8c852ee544848bb04fc4a4f52a111f11fda Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Tue, 12 May 2026 00:09:21 +0200
Subject: [PATCH 35/50] offline (URL-bound) license keys (#9089)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* [ee] feat(license): offline (URL-bound) license keys

Offline keys are a 4-segment variant for air-gapped customers — no
phone-home, embedded seat/CU caps, locked to the instance's base_url.
Existing 3-segment online keys are unchanged.

Companion PRs:
- windmill-labs/windmill-ee-private (full design + EE impl)
- windmill-labs/windmill-customer-service (issuance + portal)
- windmill-labs/windmill-cf-worker-keygen (signing)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] refactor(license): bind offline keys via instance hash; simpler CU enforcement

- /settings/license_status now surfaces an `instance_hash` superadmins share
  with support when requesting an offline key
- OfflineMetadata: `hash` replaces `base_url`; OfflineCapStatus reports
  `current_cu` (last 2min) and drops the grace-period fields
- verify_license_key now takes a db so EE can recheck the hash
- InstanceSetting.svelte: hash copy-block + simpler status panel
- Bump ee-repo-ref

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] chore(license): bump ee-repo-ref

Pulls in the current_cu clamp + prod public key restoration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] refactor(license): split instance_hash endpoint; minimal cap UI; restore workers expiry toast

- `instance_hash` is no longer part of /settings/license_status responses; it
  lives at GET /settings/instance_hash (super-admin only) so it isn't re-emitted
  on every status poll. The UI doesn't show it — admins fetch it explicitly when
  requesting a key from support.
- InstanceSetting offline cap UI is now two compact green/red status lines
  (Seats X.X/Y and CUs X.X/Y) placed above the action buttons, matching the
  existing "Latest key renewal" badge style. The block-panel is gone.
- "Latest key renewal" line and the "Renew key" button are now hidden when an
  offline key is loaded (renewal is server-disabled for offline keys).
- Restore parseLicenseKey + checkLicenseExpiration toast on /workers
  (works for both 3- and 4-segment keys).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] chore(license): bump ee-repo-ref

Pulls in the plain-SHA256 instance hash + stats_ee revert.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] chore(license): bump ee-repo-ref

Picks up the alert wording change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] chore(license): bump ee-repo-ref

Picks up the instance_uid cache so the periodic verify_license_key cycle
no longer hits global_settings.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] refactor(license): rename /settings/license_status → /offline_license_status

The endpoint was only used by the offline-license UI; the other fields it
returned (license_key_id, license_key_valid, kind, offline metadata) were
unused. Rename to clarify scope and flatten the response — it now returns
just the OfflineCapStatus (or null when no offline license is loaded).

Frontend uses `offlineCapStatus != null` as the "is offline" check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] fix(ci): regenerate sqlx cache for the inline worker_ping query

After reverting unused stats_ee helpers (fetch_worker_pings*), the
inline `sqlx::query_as!(WorkerPingRecord, ...)` in get_stats_payload
lost its cache entry — CI's check_ee_full + cargo_test were failing
under SQLX_OFFLINE=true with E0282 type-inference errors.

Re-running update_sqlx.sh regenerates the cache file under its
current hash and prunes a couple of stale entries.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] fix(license): address cubic-bot review

- get_offline_license_status: propagate enforce_offline_caps errors as 500
  instead of swallowing into a "no offline license" (Option::None) response
- canonical_base_url: rewrite the doc to match the actual fallback behavior
  (lowercase + trailing-slash strip on URL parse failure); the original
  cross-service contract is gone since the customer-service no longer
  canonicalizes (treats the instance hash as opaque)
- check_seat_cap_for_new_user: take an email and short-circuit when the
  email is already in `usr ∪ workspace_invite` so net-zero invite upserts
  and invite→user transitions aren't spuriously blocked at cap. Mirrors
  the dedup rule the count itself uses.
- Bump ee-repo-ref to pull in the EE-side change

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] chore(license): bump ee-repo-ref

Picks up the exact-delta seat-cap check (replaces the simple existence
short-circuit). Regenerates the new sqlx cache for the bool_and query.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* [ee] fix(license): propagate get_instance_hash errors; bump ee-repo-ref

- get_instance_hash: replace `.ok().flatten()` with map_err+? so DB errors
  during instance_uid lookup surface as 500 instead of silently returning
  `{"instance_hash": null}` (same pattern get_offline_license_status already uses)
- Bump ee-repo-ref to pull in the enforce_offline_caps cached-state preservation

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to c6cd1afe2d9e04809b30751cd1687b28a65e62b1

This commit updates the EE repository reference after PR #566 was merged in windmill-ee-private.

Previous ee-repo-ref: a6d91016ae0d43c46604313aecae3aa9c778c8e0

New ee-repo-ref: c6cd1afe2d9e04809b30751cd1687b28a65e62b1

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 ...1f7f387f5055c47f493271d26731336257384.json | 10 +--
 ...c1ed508d83695ef6d62ca06cfb612fd332b87.json | 28 ---------
 ...49b8082c0052d626bf67e08317e56ab9ad026.json | 58 ------------------
 ...153c43903f929ae5d62fbba12610f89c36d55.json |  2 +-
 ...320bb3eff65255a44bd66799ae14288312ba4.json | 23 -------
 ...c31e10f89481908c479b4039af5e94fa0f8ac.json | 28 ---------
 ...cf6b4946e1fd337f00d243f518283783833c9.json | 22 +++++++
 ...69657fd73742b6ee8289b1e9736e381314cfb.json | 23 -------
 ...7ad51a4cd5cbdc2fa34038530070d6a579455.json | 26 ++++++++
 ...d8c74cdc672a903d566baf5ac5ef50a4da1bd.json | 32 ++++++++++
 backend/ee-repo-ref.txt                       |  2 +-
 backend/src/ee_oss.rs                         |  2 +-
 backend/src/main.rs                           |  2 +-
 backend/src/monitor.rs                        | 20 +++++-
 backend/windmill-api-settings/src/ee_oss.rs   |  6 +-
 backend/windmill-api-settings/src/lib.rs      | 53 +++++++++++++++-
 .../windmill-api-workspaces/src/workspaces.rs | 14 +++++
 backend/windmill-api/openapi.yaml             | 57 +++++++++++++++++
 backend/windmill-api/src/ee_oss.rs            |  6 +-
 backend/windmill-common/src/ee_oss.rs         | 54 ++++++++++++++++
 backend/windmill-common/src/lib.rs            | 30 +++++++++
 backend/windmill-common/src/utils.rs          |  4 +-
 .../src/lib/components/InstanceSetting.svelte | 61 +++++++++++++++++--
 .../(root)/(logged)/workers/+page.svelte      | 29 ++++-----
 24 files changed, 396 insertions(+), 196 deletions(-)
 delete mode 100644 backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json
 delete mode 100644 backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json
 delete mode 100644 backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json
 delete mode 100644 backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json
 create mode 100644 backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json
 delete mode 100644 backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json
 create mode 100644 backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json
 create mode 100644 backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json

diff --git a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
index d29a18c691..e7ed0aee65 100644
--- a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
+++ b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
+      false,
+      false,
+      false,
+      false,
+      false,
       true,
       true
     ]
diff --git a/backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json b/backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json
deleted file mode 100644
index 7de0416a12..0000000000
--- a/backend/.sqlx/query-0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT item_kind, path FROM ws_specific WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "item_kind",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0c6e8f03a4e9f543cb85582e0aec1ed508d83695ef6d62ca06cfb612fd332b87"
-}
diff --git a/backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json b/backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json
deleted file mode 100644
index 2b5b68dfae..0000000000
--- a/backend/.sqlx/query-406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT label, email, scopes, workspace_id, super_admin, owner, expiration FROM token WHERE token_hash = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "label",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "scopes",
-        "type_info": "TextArray"
-      },
-      {
-        "ordinal": 3,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "super_admin",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 5,
-        "name": "owner",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 6,
-        "name": "expiration",
-        "type_info": "Timestamptz"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      true,
-      true,
-      true,
-      true,
-      false,
-      true,
-      true
-    ]
-  },
-  "hash": "406bcbf55758b10243c8eaff1c349b8082c0052d626bf67e08317e56ab9ad026"
-}
diff --git a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
index 713ccb9dd3..36ddb8ab9f 100644
--- a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
+++ b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      null
+      true
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"
diff --git a/backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json b/backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json
deleted file mode 100644
index 0a39db6822..0000000000
--- a/backend/.sqlx/query-6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM variable WHERE workspace_id = $1 AND path = $2)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "6be4bf59c404d2f557d1106c48c320bb3eff65255a44bd66799ae14288312ba4"
-}
diff --git a/backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json b/backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json
deleted file mode 100644
index 415544ece9..0000000000
--- a/backend/.sqlx/query-8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT s.item_kind, s.path\n        FROM ws_specific s\n        WHERE s.workspace_id = $1\n          AND (\n              (s.item_kind = 'resource' AND EXISTS (\n                  SELECT 1 FROM resource r\n                  WHERE r.workspace_id = s.workspace_id AND r.path = s.path\n              ))\n              OR (s.item_kind = 'variable' AND EXISTS (\n                  SELECT 1 FROM variable v\n                  WHERE v.workspace_id = s.workspace_id AND v.path = s.path\n              ))\n          )\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "item_kind",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "8b92a7d04fcdd8e61178d7dab97c31e10f89481908c479b4039af5e94fa0f8ac"
-}
diff --git a/backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json b/backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json
new file mode 100644
index 0000000000..fce125c6d5
--- /dev/null
+++ b/backend/.sqlx/query-9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT bool_and(operator) FROM (\n            SELECT operator FROM usr WHERE email = $1\n            UNION ALL\n            SELECT operator FROM workspace_invite WHERE email = $1\n        ) t",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "bool_and",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "9c85ba8d41bedbcb5466f44a7d4cf6b4946e1fd337f00d243f518283783833c9"
+}
diff --git a/backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json b/backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json
deleted file mode 100644
index 327032afb5..0000000000
--- a/backend/.sqlx/query-b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM ws_specific WHERE workspace_id = $1 AND item_kind = 'variable' AND path = $2)",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "exists",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "b4162468afae99cf31c4668ca6769657fd73742b6ee8289b1e9736e381314cfb"
-}
diff --git a/backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json b/backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json
new file mode 100644
index 0000000000..f38c023cb3
--- /dev/null
+++ b/backend/.sqlx/query-e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455.json
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH potential AS (\n            SELECT email, operator FROM usr\n            UNION\n            SELECT email, operator FROM workspace_invite\n        ),\n        per_user AS (\n            SELECT email, bool_and(operator) AS only_operator FROM potential GROUP BY email\n        )\n        SELECT\n            COUNT(*) FILTER (WHERE NOT only_operator) AS \"authors!\",\n            COUNT(*) FILTER (WHERE only_operator) AS \"operators!\"\n        FROM per_user",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "authors!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "operators!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null
+    ]
+  },
+  "hash": "e1ada31c1625b453c2ff85edbcd7ad51a4cd5cbdc2fa34038530070d6a579455"
+}
diff --git a/backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json b/backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json
new file mode 100644
index 0000000000..e4125ddab9
--- /dev/null
+++ b/backend/.sqlx/query-f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd.json
@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT memory, worker, native_mode FROM worker_ping WHERE ping_at > now() - interval '2 minutes'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "memory",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 1,
+        "name": "worker",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "native_mode",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      false,
+      false
+    ]
+  },
+  "hash": "f8f756bc498e5f084851f98e1e8d8c74cdc672a903d566baf5ac5ef50a4da1bd"
+}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index ad6df82501..91d8581950 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-a1cd60b54e8595b4e5ce6b654e675e4bbe2253b2
+c6cd1afe2d9e04809b30751cd1687b28a65e62b1
diff --git a/backend/src/ee_oss.rs b/backend/src/ee_oss.rs
index 2aefaf7431..4dcaf2437b 100644
--- a/backend/src/ee_oss.rs
+++ b/backend/src/ee_oss.rs
@@ -8,6 +8,6 @@ pub async fn set_license_key(_license_key: String, _db: Option<&windmill_common:
 }
 
 #[cfg(all(feature = "enterprise", not(feature = "private")))]
-pub async fn verify_license_key() -> () {
+pub async fn verify_license_key(_db: Option<&windmill_common::db::DB>) -> () {
     // Implementation is not open source
 }
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 3049064624..9a2709e9a9 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -1441,7 +1441,7 @@ Windmill Community Edition {GIT_VERSION}
                                         tracing::error!("Failed to reload license key on agent: {e:#}");
                                     }
                                     #[cfg(feature = "enterprise")]
-                                    ee_oss::verify_license_key().await;
+                                    ee_oss::verify_license_key(conn.as_sql()).await;
                                 }
 
                                 // update min version explicitly.
diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs
index 59a2f47ed0..0ddc02b256 100644
--- a/backend/src/monitor.rs
+++ b/backend/src/monitor.rs
@@ -2373,7 +2373,19 @@ pub async fn monitor_db(
     let verify_license_key_f = async {
         #[cfg(feature = "enterprise")]
         if !initial_load {
-            verify_license_key().await;
+            verify_license_key(conn.as_sql()).await;
+        }
+    };
+
+    let enforce_offline_caps_f = async {
+        #[cfg(feature = "enterprise")]
+        if server_mode && !initial_load {
+            if let Some(db) = conn.as_sql() {
+                // Cheap: one query for workers active in the last 2 minutes.
+                if let Err(e) = windmill_common::ee_oss::enforce_offline_caps(db).await {
+                    tracing::error!("Failed to enforce offline license caps: {e:#}");
+                }
+            }
         }
     };
 
@@ -2522,6 +2534,7 @@ pub async fn monitor_db(
         vacuum_queue_f,
         expose_queue_metrics_f,
         verify_license_key_f,
+        enforce_offline_caps_f,
         worker_groups_alerts_f,
         jobs_waiting_alerts_f,
         low_disk_alerts_f,
@@ -2853,6 +2866,11 @@ pub async fn reload_base_url_setting(conn: &Connection) -> error::Result<()> {
 
     IS_SECURE.store(is_secure, Ordering::Relaxed);
 
+    #[cfg(feature = "enterprise")]
+    {
+        crate::ee_oss::verify_license_key(conn.as_sql()).await;
+    }
+
     Ok(())
 }
 
diff --git a/backend/windmill-api-settings/src/ee_oss.rs b/backend/windmill-api-settings/src/ee_oss.rs
index d0e0f69b62..92b3d6ad53 100644
--- a/backend/windmill-api-settings/src/ee_oss.rs
+++ b/backend/windmill-api-settings/src/ee_oss.rs
@@ -8,7 +8,11 @@ use anyhow::anyhow;
 pub async fn validate_license_key(
     _license_key: String,
     _db: Option<&windmill_common::DB>,
-) -> anyhow::Result<(String, bool)> {
+) -> anyhow::Result<(
+    String,
+    bool,
+    Option<windmill_common::ee_oss::OfflineMetadata>,
+)> {
     // Implementation is not open source
     Err(anyhow!("License can't be validated in Windmill CE"))
 }
diff --git a/backend/windmill-api-settings/src/lib.rs b/backend/windmill-api-settings/src/lib.rs
index f027046808..09b52a3d22 100644
--- a/backend/windmill-api-settings/src/lib.rs
+++ b/backend/windmill-api-settings/src/lib.rs
@@ -37,13 +37,13 @@ use axum::{
 use serde_json::json;
 
 use serde::{Deserialize, Serialize};
+use windmill_ai::ai_cache::bump_instance_ai_config_revision;
 #[cfg(feature = "enterprise")]
 use windmill_common::ee_oss::{send_critical_alert, CriticalAlertKind, CriticalErrorChannel};
 #[cfg(all(feature = "private", feature = "enterprise"))]
 use windmill_common::secret_backend::{
     AwsSecretsManagerSettings, AzureKeyVaultSettings, SecretMigrationReport, VaultSettings,
 };
-use windmill_ai::ai_cache::bump_instance_ai_config_revision;
 use windmill_common::{
     email_oss::send_email_plain_text,
     error::{self, JsonResult, Result},
@@ -118,6 +118,8 @@ pub fn global_service() -> Router {
             get(get_latest_key_renewal_attempt),
         )
         .route("/renew_license_key", post(renew_license_key))
+        .route("/offline_license_status", get(get_offline_license_status))
+        .route("/instance_hash", get(get_instance_hash))
         .route("/customer_portal", post(create_customer_portal_session))
         .route("/test_critical_channels", post(test_critical_channels))
         .route("/critical_alerts", get(get_critical_alerts))
@@ -340,7 +342,7 @@ pub async fn test_license_key(
     Json(TestKey { license_key }): Json<TestKey>,
 ) -> error::Result<String> {
     require_super_admin(&db, &authed.email).await?;
-    let (_, expired) = validate_license_key(license_key, Some(&db)).await?;
+    let (_, expired, _offline_meta) = validate_license_key(license_key, Some(&db)).await?;
 
     if expired {
         Err(error::Error::BadRequest("Expired license key".to_string()))
@@ -349,6 +351,53 @@ pub async fn test_license_key(
     }
 }
 
+#[derive(serde::Serialize)]
+pub struct InstanceHash {
+    pub instance_hash: Option<String>,
+}
+
+/// Returns the live cap status for an offline license, or `null` when no
+/// offline license is loaded. Used by the superadmin settings panel.
+pub async fn get_offline_license_status(
+    Extension(db): Extension<DB>,
+    authed: ApiAuthed,
+) -> error::JsonResult<Option<windmill_common::ee_oss::OfflineCapStatus>> {
+    require_super_admin(&db, &authed.email).await?;
+
+    let offline = (**windmill_common::ee_oss::LICENSE_OFFLINE_METADATA.load()).clone();
+    let is_offline = matches!(&offline, Some(m) if m.is_offline());
+
+    if !is_offline {
+        return Ok(Json(None));
+    }
+
+    #[cfg(feature = "enterprise")]
+    let cap = windmill_common::ee_oss::enforce_offline_caps(&db)
+        .await
+        .map_err(|e| error::Error::internal_err(format!("enforce_offline_caps: {e:#}")))?;
+    #[cfg(not(feature = "enterprise"))]
+    let cap: Option<windmill_common::ee_oss::OfflineCapStatus> = None;
+
+    Ok(Json(cap))
+}
+
+/// Returns the per-instance binding hash that goes into offline license keys.
+/// Admin invokes via `curl` with their personal token when requesting a key
+/// from support.
+pub async fn get_instance_hash(
+    Extension(db): Extension<DB>,
+    authed: ApiAuthed,
+) -> error::JsonResult<InstanceHash> {
+    require_super_admin(&db, &authed.email).await?;
+    #[cfg(feature = "enterprise")]
+    let hash = windmill_common::ee_oss::compute_instance_hash(&db)
+        .await
+        .map_err(|e| error::Error::internal_err(format!("compute_instance_hash: {e:#}")))?;
+    #[cfg(not(feature = "enterprise"))]
+    let hash: Option<String> = None;
+    Ok(Json(InstanceHash { instance_hash: hash }))
+}
+
 pub async fn get_local_settings(
     Extension(db): Extension<DB>,
     authed: ApiAuthed,
diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 94e2026ad3..95c7157d61 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -5233,6 +5233,13 @@ async fn invite_user(
 
     nu.email = nu.email.to_lowercase();
 
+    #[cfg(feature = "enterprise")]
+    if let Some(msg) =
+        windmill_common::ee_oss::check_seat_cap_for_new_user(&db, &nu.email, nu.operator).await?
+    {
+        return Err(Error::BadRequest(msg));
+    }
+
     let mut tx = db.begin().await?;
 
     let already_in_workspace = sqlx::query_scalar!(
@@ -5306,6 +5313,13 @@ async fn add_user(
 
     nu.email = nu.email.to_lowercase();
 
+    #[cfg(feature = "enterprise")]
+    if let Some(msg) =
+        windmill_common::ee_oss::check_seat_cap_for_new_user(&db, &nu.email, nu.operator).await?
+    {
+        return Err(Error::BadRequest(msg));
+    }
+
     let mut tx = db.begin().await?;
 
     let already_exists_email = sqlx::query_scalar!(
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 82c8b06cf7..16448c622b 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1779,6 +1779,63 @@ paths:
               schema:
                 type: string
 
+  /settings/offline_license_status:
+    get:
+      summary: get cap-usage status for the currently-loaded offline license
+      description: |
+        Returns the live cap status (seats used vs cap, current CU vs cap) for
+        the offline license key currently in use. Returns `null` if no offline
+        license is loaded. Super-admin only.
+      operationId: getOfflineLicenseStatus
+      tags:
+        - setting
+      responses:
+        "200":
+          description: cap status (or null when no offline license)
+          content:
+            application/json:
+              schema:
+                type: object
+                nullable: true
+                properties:
+                  seats_used:
+                    type: number
+                    description: Author-equivalent seats consumed (authors + 0.5 × operators)
+                  seats_cap:
+                    type: integer
+                  author_count:
+                    type: integer
+                  operator_count:
+                    type: integer
+                  current_cu:
+                    type: number
+                    description: Sum of CU rate across workers that pinged in the last 2 minutes.
+                  cu_cap:
+                    type: number
+                  cu_over_cap:
+                    type: boolean
+
+  /settings/instance_hash:
+    get:
+      summary: per-instance binding hash for offline license issuance
+      description: |
+        Returns the hash a superadmin shares with Windmill support when
+        requesting an offline license. Super-admin only.
+      operationId: getInstanceHash
+      tags:
+        - setting
+      responses:
+        '200':
+          description: instance hash
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  instance_hash:
+                    type: string
+                    nullable: true
+
   /settings/customer_portal:
     post:
       summary: create customer portal session
diff --git a/backend/windmill-api/src/ee_oss.rs b/backend/windmill-api/src/ee_oss.rs
index a1f7a54d20..e5a7f71cbc 100644
--- a/backend/windmill-api/src/ee_oss.rs
+++ b/backend/windmill-api/src/ee_oss.rs
@@ -10,7 +10,11 @@ use anyhow::anyhow;
 pub async fn validate_license_key(
     _license_key: String,
     _db: Option<&crate::db::DB>,
-) -> anyhow::Result<(String, bool)> {
+) -> anyhow::Result<(
+    String,
+    bool,
+    Option<windmill_common::ee_oss::OfflineMetadata>,
+)> {
     // Implementation is not open source
     Err(anyhow!("License can't be validated in Windmill CE"))
 }
diff --git a/backend/windmill-common/src/ee_oss.rs b/backend/windmill-common/src/ee_oss.rs
index 15d9e7cb5e..e68bc00c6e 100644
--- a/backend/windmill-common/src/ee_oss.rs
+++ b/backend/windmill-common/src/ee_oss.rs
@@ -18,6 +18,60 @@ lazy_static::lazy_static! {
   pub static ref LICENSE_KEY_VALID: AtomicBool = AtomicBool::new(true);
   pub static ref LICENSE_KEY_ID: arc_swap::ArcSwap<String> = arc_swap::ArcSwap::from_pointee("".to_string());
   pub static ref LICENSE_KEY: arc_swap::ArcSwap<String> = arc_swap::ArcSwap::from_pointee("".to_string());
+  pub static ref LICENSE_OFFLINE_METADATA: arc_swap::ArcSwap<Option<OfflineMetadata>> = arc_swap::ArcSwap::from_pointee(None);
+  pub static ref LICENSE_OFFLINE_OVER_CU_CAP: AtomicBool = AtomicBool::new(false);
+  pub static ref LICENSE_OFFLINE_LAST_STATUS: arc_swap::ArcSwap<Option<OfflineCapStatus>> = arc_swap::ArcSwap::from_pointee(None);
+  pub static ref LICENSE_OFFLINE_LAST_CHECKED_AT: arc_swap::ArcSwap<Option<chrono::DateTime<chrono::Utc>>> = arc_swap::ArcSwap::from_pointee(None);
+}
+
+#[cfg(not(feature = "private"))]
+#[derive(Clone, Debug, Deserialize, serde::Serialize)]
+pub struct OfflineMetadata {
+    pub v: u32,
+    pub kind: String,
+    pub hash: String,
+    pub seats: i64,
+    pub cu_limit: f64,
+}
+
+#[cfg(not(feature = "private"))]
+impl OfflineMetadata {
+    pub fn is_offline(&self) -> bool {
+        self.kind == "offline"
+    }
+}
+
+#[cfg(not(feature = "private"))]
+#[derive(Clone, Debug, serde::Serialize)]
+pub struct OfflineCapStatus {
+    pub seats_used: f64,
+    pub seats_cap: i64,
+    pub author_count: i64,
+    pub operator_count: i64,
+    pub current_cu: f64,
+    pub cu_cap: f64,
+    pub cu_over_cap: bool,
+}
+
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn check_seat_cap_for_new_user(
+    _db: &DB,
+    _email: &str,
+    _new_user_is_operator: bool,
+) -> anyhow::Result<Option<String>> {
+    Ok(None)
+}
+
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn compute_instance_hash(_db: &DB) -> anyhow::Result<Option<String>> {
+    // Implementation is not open source
+    Ok(None)
+}
+
+#[cfg(all(feature = "enterprise", not(feature = "private")))]
+pub async fn enforce_offline_caps(_db: &DB) -> anyhow::Result<Option<OfflineCapStatus>> {
+    // Implementation is not open source
+    Ok(None)
 }
 
 #[cfg(not(feature = "private"))]
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 7c7e3f79ed..39884e3d35 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -121,6 +121,36 @@ pub const PRIVATE_HUB_MIN_VERSION: i32 = 10_000_000;
 pub const SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 14; // 2 weeks retention period for logs
 pub const WM_DEPLOYERS_GROUP: &str = "wm_deployers";
 
+/// Canonical form of a base URL, used as one of the inputs to the offline-license
+/// instance hash (`compute_instance_hash`).
+///
+/// Rules: lowercase scheme and host, drop default ports (80/443), strip path/query/fragment,
+/// strip trailing slash. If URL parsing fails, falls back to a best-effort lowercase +
+/// trailing-slash strip so two semantically-equivalent inputs still produce the same
+/// canonical form.
+pub fn canonical_base_url(input: &str) -> String {
+    let trimmed = input.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+    match url::Url::parse(trimmed) {
+        Ok(u) => {
+            let scheme = u.scheme().to_ascii_lowercase();
+            let host = u
+                .host_str()
+                .map(|h| h.to_ascii_lowercase())
+                .unwrap_or_default();
+            let port = match (u.port(), scheme.as_str()) {
+                (Some(80), "http") | (Some(443), "https") => String::new(),
+                (Some(p), _) => format!(":{p}"),
+                (None, _) => String::new(),
+            };
+            format!("{scheme}://{host}{port}")
+        }
+        Err(_) => trimmed.trim_end_matches('/').to_ascii_lowercase(),
+    }
+}
+
 /// Checks if the user is allowed to preserve on_behalf_of values (admin or deployer).
 pub fn can_preserve_on_behalf_of(authed: &impl db::Authable) -> bool {
     authed.is_admin() || authed.groups().iter().any(|g| g == &WM_DEPLOYERS_GROUP)
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index efe5481e1d..17d9cfd804 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -447,7 +447,9 @@ pub async fn get_license_id_or_uid<'c, E: sqlx::Executor<'c, Database = Postgres
     }
 }
 
-async fn get_instance_uid<'c, E: sqlx::Executor<'c, Database = Postgres>>(db: E) -> Result<String> {
+pub async fn get_instance_uid<'c, E: sqlx::Executor<'c, Database = Postgres>>(
+    db: E,
+) -> Result<String> {
     let uid_value = sqlx::query_scalar!(
         "SELECT value FROM global_settings WHERE name = $1",
         UNIQUE_ID_SETTING
diff --git a/frontend/src/lib/components/InstanceSetting.svelte b/frontend/src/lib/components/InstanceSetting.svelte
index f0097b877a..4964fb9c1d 100644
--- a/frontend/src/lib/components/InstanceSetting.svelte
+++ b/frontend/src/lib/components/InstanceSetting.svelte
@@ -56,6 +56,16 @@
 		attempted_at: string
 	} | null = $state(null)
 
+	let offlineCapStatus: {
+		seats_used: number
+		seats_cap: number
+		author_count: number
+		operator_count: number
+		current_cu: number
+		cu_cap: number
+		cu_over_cap: boolean
+	} | null = $state(null)
+
 	function showSetting(setting: string, values: Record<string, any>) {
 		if (setting == 'dev_instance') {
 			if (values['license_key'] == undefined) {
@@ -72,6 +82,14 @@
 		latestKeyRenewalAttempt = await SettingService.getLatestKeyRenewalAttempt()
 	}
 
+	async function reloadLicenseStatus() {
+		try {
+			offlineCapStatus = (await SettingService.getOfflineLicenseStatus()) as any
+		} catch {
+			offlineCapStatus = null
+		}
+	}
+
 	async function reloadLicenseKey() {
 		$values['license_key'] = await SettingService.getGlobal({
 			key: 'license_key'
@@ -80,7 +98,10 @@
 
 	$effect(() => {
 		if (setting.key == 'license_key') {
-			untrack(() => reloadKeyrenewalAttemptInfo())
+			untrack(() => {
+				reloadKeyrenewalAttemptInfo()
+				reloadLicenseStatus()
+			})
 		}
 	})
 
@@ -430,7 +451,7 @@
 								</div>
 							{/if}
 						{/if}
-						{#if latestKeyRenewalAttempt}
+						{#if latestKeyRenewalAttempt && !offlineCapStatus}
 							{@const attemptedAt = new Date(latestKeyRenewalAttempt.attempted_at).toLocaleString()}
 							{@const isTrial = latestKeyRenewalAttempt.result.startsWith('error: trial:')}
 							<div class="relative">
@@ -500,11 +521,41 @@
 							</div>
 						{/if}
 
+						{#if offlineCapStatus}
+							{@const cap = offlineCapStatus}
+							{@const seatsOver = cap.seats_used > cap.seats_cap}
+							{@const cuOver = cap.cu_over_cap}
+							<div class="mt-1 flex flex-row items-center gap-2 text-xs">
+								<div class="flex flex-row items-center gap-1">
+									{#if seatsOver}
+										<BadgeX class="text-red-600" size={12} />
+									{:else}
+										<BadgeCheck class="text-green-600" size={12} />
+									{/if}
+									<span class={seatsOver ? 'text-red-600' : 'text-green-600'}>
+										Seats: {cap.seats_used.toFixed(1)} / {cap.seats_cap}
+									</span>
+								</div>
+								<div class="flex flex-row items-center gap-1">
+									{#if cuOver}
+										<BadgeX class="text-red-600" size={12} />
+									{:else}
+										<BadgeCheck class="text-green-600" size={12} />
+									{/if}
+									<span class={cuOver ? 'text-red-600' : 'text-green-600'}>
+										CUs: {cap.current_cu.toFixed(2)} / {cap.cu_cap.toFixed(2)}
+									</span>
+								</div>
+							</div>
+						{/if}
+
 						{#if valid || expiration}
 							<div class="flex flex-row gap-2 mt-1">
-								<Button on:click={renewLicenseKey} loading={renewing} size="xs" variant="accent"
-									>Renew key
-								</Button>
+								{#if !offlineCapStatus}
+									<Button on:click={renewLicenseKey} loading={renewing} size="xs" variant="accent"
+										>Renew key
+									</Button>
+								{/if}
 								<Button variant="accent" size="xs" loading={opening} on:click={openCustomerPortal}>
 									Open customer portal
 								</Button>
diff --git a/frontend/src/routes/(root)/(logged)/workers/+page.svelte b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
index 9bc4d1d710..c2de0b81d8 100644
--- a/frontend/src/routes/(root)/(logged)/workers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
@@ -194,19 +194,6 @@
 		}
 	}
 
-	let defaultTagPerWorkspace: boolean | undefined = $state(undefined)
-	let defaultTagWorkspaces: string[] = $state([])
-	async function loadDefaultTagsPerWorkspace() {
-		try {
-			defaultTagPerWorkspace = await WorkerService.isDefaultTagsPerWorkspace()
-			defaultTagWorkspaces = (await SettingService.getGlobal({
-				key: DEFAULT_TAGS_WORKSPACES_SETTING
-			})) as any
-		} catch (err) {
-			sendUserToast(`Could not load default tag per workspace setting: ${err}`, true)
-		}
-	}
-
 	function parseLicenseKey(key: string): {
 		valid: boolean
 		expiration?: Date
@@ -247,13 +234,11 @@
 			const { valid, expiration } = parseLicenseKey(licenseKey)
 
 			if (!valid && expiration) {
-				// License is expired
 				sendUserToast(
 					`Enterprise license key expired on ${expiration.toLocaleDateString()}. Please renew your license key to continue using Windmill.`,
 					true
 				)
 			} else if (expiration) {
-				// Check if expires within 7 days
 				const daysUntilExpiration = Math.floor(
 					(expiration.getTime() - Date.now()) / (1000 * 60 * 60 * 24)
 				)
@@ -266,11 +251,23 @@
 				}
 			}
 		} catch (err) {
-			// Silently fail - don't show errors for license check
 			console.error('Failed to check license expiration:', err)
 		}
 	}
 
+	let defaultTagPerWorkspace: boolean | undefined = $state(undefined)
+	let defaultTagWorkspaces: string[] = $state([])
+	async function loadDefaultTagsPerWorkspace() {
+		try {
+			defaultTagPerWorkspace = await WorkerService.isDefaultTagsPerWorkspace()
+			defaultTagWorkspaces = (await SettingService.getGlobal({
+				key: DEFAULT_TAGS_WORKSPACES_SETTING
+			})) as any
+		} catch (err) {
+			sendUserToast(`Could not load default tag per workspace setting: ${err}`, true)
+		}
+	}
+
 	onMount(() => {
 		intervalId = setInterval(() => {
 			loadWorkers()

From 07d3ffbf3434738e53b54720b2006fec154b2466 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 22:13:58 +0000
Subject: [PATCH 36/50] system prompts refresh

---
 system_prompts/auto-generated/prompts.d.ts | 26 +++++++++++-----------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/system_prompts/auto-generated/prompts.d.ts b/system_prompts/auto-generated/prompts.d.ts
index e9e6136470..fe4156afd4 100644
--- a/system_prompts/auto-generated/prompts.d.ts
+++ b/system_prompts/auto-generated/prompts.d.ts
@@ -1,6 +1,6 @@
 export declare const SCRIPT_BASE = "# Windmill Script Writing Guide\n\n## General Principles\n\n- Scripts must export a main function (do not call it)\n- Libraries are installed automatically - do not show installation instructions\n- Credentials and configuration are stored in resources and passed as parameters\n- The windmill client (`wmill`) provides APIs for interacting with the platform\n\n## Function Naming\n\n- Main function: `main` (or `preprocessor` for preprocessor scripts)\n- Must be async for TypeScript variants\n\n## Return Values\n\n- Scripts can return any JSON-serializable value\n- Return values become available to subsequent flow steps via `results.step_id`\n\n## Preprocessor Scripts\n\nPreprocessor scripts process raw trigger data from various sources (webhook, custom HTTP route, SQS, WebSocket, Kafka, NATS, MQTT, Postgres, or email) before passing it to the flow. This separates the trigger logic from the flow logic and keeps the auto-generated UI clean.\n\nThe returned object determines the parameter values passed to the flow.\ne.g., `{ b: 1, a: 2 }` calls the flow with `a = 2` and `b = 1`, assuming the flow has two inputs called `a` and `b`.\n\nThe preprocessor receives a single parameter called `event`.\n";
-export declare const FLOW_BASE = "# Windmill Flow Building Guide\n\n## Creating a Flow\n\n**You \u2014 the AI agent \u2014 scaffold the flow yourself by running `wmill flow new <path>` with the right flags. Do NOT hand-create the folder + `flow.yaml`, and do NOT tell the user to \"run `wmill flow new` and follow the prompts\".**\n\n`wmill flow new` creates the folder with the correct suffix (`__flow` or `.flow` depending on the workspace's `nonDottedPaths` setting), writes a minimal `flow.yaml` shell, and prints Claude-specific next-step hints. Scaffolding by hand skips all of that and often picks the wrong suffix.\n\n### Step 1 \u2014 Gather path + summary by asking the user\n\nYou need two things:\n\n1. **path** \u2014 the windmill path, e.g. `f/folder/my_flow` or `u/username/my_flow`.\n2. **summary** \u2014 a short description of the flow.\n\nIf the user's request didn't supply both, ask for both in a single round-trip. Use whichever interactive question facility your runtime provides \u2014 a structured multi-choice tool if available, otherwise plain chat \u2014 and provide one or two example values for each (with an \"Other\" / free-form fallback). Do not guess paths or summaries.\n\n### Step 2 \u2014 Run the command yourself\n\n```bash\nwmill flow new f/folder/my_flow --summary \"Short description\"\n```\n\nAdd `--description \"...\"` when the user provided a longer explanation worth preserving separately from the summary.\n\n### Step 3 \u2014 Fill in `flow.yaml`\n\nOpen the generated `flow.yaml` (under the folder the command just created) and replace the empty `value.modules` + `schema` with the real flow definition.\n\nFor rawscript modules, use `!inline path/to/script.ts` for the content key. Inline script files should NOT include `.inline_script.` in their names (e.g. use `a.ts`, not `a.inline_script.ts`).\n\nOnce the flow has real content, **offer** to open the visual preview as a one-sentence next step (e.g. \"Want me to open the visual preview?\"). Don't auto-open \u2014 opening the dev page has side effects (browser window, possibly a `launch.json` entry) and the user should consent.\n\n### Anti-patterns to avoid\n\n- \u274C Hand-creating the `__flow` folder + `flow.yaml` instead of running `wmill flow new`. You'll miss the suffix-setting resolution, the default shape, and the Claude hints.\n- \u274C Telling the user to \"run `wmill flow new <path>`\" \u2014 you can and should run it yourself.\n- \u274C Inventing a path/summary instead of asking the user.\n\n## CLI Commands \u2014 running, previewing, deploying\n\nAfter writing, tell the user which command fits what they want to do:\n\n- `wmill flow preview <flow_path>` \u2014 **default when iterating on a local flow.** Runs the local `flow.yaml` against local inline scripts without deploying. Add `--remote` to use deployed workspace scripts for PathScript steps instead of local files.\n- `wmill flow run <path>` \u2014 runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.\n- `wmill generate-metadata` \u2014 regenerate stale `.lock` and `.script.yaml` files. By default it scans **scripts, flows, and apps** across the workspace; pass `--skip-flows --skip-apps` (or run from a subdirectory) to limit the scope when you only care about the flow you edited.\n- `wmill sync push` \u2014 deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push \u2014 not when they say \"run\", \"try\", or \"test\".\n\n### Preview vs run \u2014 choose by intent, not habit\n\nIf the user says \"run the flow\", \"try it\", \"test it\", \"does it work\" while there are **local edits to a `flow.yaml`**, use `flow preview`. Do NOT push the flow to then `flow run` it \u2014 pushing is a deploy, and deploying just to test overwrites the workspace version with untested changes.\n\nOnly use `flow run` when:\n- The user explicitly says \"run the deployed version\" / \"run what's on the server\".\n- There is no local `flow.yaml` being edited (you're just invoking an existing flow).\n\nOnly use `sync push` when:\n- The user explicitly asks to deploy, publish, push, or ship.\n- The preview has already validated the change and the user wants it in the workspace.\n\n### After writing \u2014 offer to run, don't wait passively\n\nThis is about **programmatic execution** (`wmill flow preview -d '<args>'`), which actually runs the flow and has side effects. Visual preview (the `preview` skill) is offered separately \u2014 see \"Visual preview\" below.\n\nIf the user hasn't already told you to run/test the flow, offer it as a one-sentence next step (e.g. \"Want me to run `wmill flow preview` with sample args?\"). Do not present a multi-option menu.\n\nIf the user already asked to test/run/try the flow in their original request, skip the offer and just execute `wmill flow preview <path> -d '<args>'` directly \u2014 pick plausible args from the flow's input schema.\n\n`wmill flow preview` is safe to run yourself (it does not deploy). `wmill sync push` and `wmill generate-metadata` modify workspace state or local files \u2014 only run these when the user explicitly asks; otherwise tell them which to run.\n\n### Visual preview\n\nTo open the flow visually in the dev page (graph + live reload), use the `preview` skill. Always **offer** it as a one-sentence next step (e.g. \"Want me to open the visual preview?\") rather than opening it automatically \u2014 opening the dev page has side effects (browser window, possibly a `launch.json` entry under MCP-preview branches) the user should consent to. If the user already asked to see/preview/visualize the flow in their original request, skip the offer and just invoke the skill.\n\n## OpenFlow Schema\n\nThe OpenFlow schema (openflow.openapi.yaml) is the source of truth for flow structure. Refer to OPENFLOW_SCHEMA for the complete type definitions.\n\n## Reserved Module IDs\n\n- `failure` - Reserved for failure handler module\n- `preprocessor` - Reserved for preprocessor module\n- `Input` - Reserved for flow input reference\n\n## Hard Structural Rules\n\nThese are strict Windmill schema rules. Follow them exactly.\n\n- `value.modules` is only for normal sequential steps\n- `value.preprocessor_module` and `value.failure_module` are special top-level fields inside `value`, not entries in `value.modules`\n- If a flow needs a preprocessor, create `value.preprocessor_module` with `id: preprocessor`\n- If a flow needs a failure handler, create `value.failure_module` with `id: failure`\n- Do NOT create regular modules inside `value.modules` named `preprocessor` or `failure`\n- `preprocessor_module` and `failure_module` only support `script` or `rawscript`\n- `preprocessor_module` runs before normal modules and cannot reference `results.*`\n- `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`\n\nCorrect shape:\n\n```yaml\nvalue:\n  preprocessor_module:\n    id: preprocessor\n    value:\n      type: rawscript\n      ...\n  failure_module:\n    id: failure\n    value:\n      type: rawscript\n      ...\n  modules:\n    - id: process_event\n      value:\n        type: rawscript\n        ...\n```\n\nIncorrect shape:\n\n```yaml\nvalue:\n  modules:\n    - id: preprocessor\n      ...\n    - id: process_event\n      ...\n    - id: failure\n      ...\n```\n\n## Module ID Rules\n\n- Must be unique across the entire flow\n- Use underscores, not spaces (e.g., `fetch_data` not `fetch data`)\n- Use descriptive names that reflect the step's purpose\n\n## Common Mistakes to Avoid\n\n- Missing `input_transforms` - Rawscript parameters won't receive values without them\n- Referencing future steps - `results.step_id` only works for steps that execute before the current one\n- Duplicate module IDs - Each module ID must be unique in the flow\n\n## Data Flow Between Steps\n\n- `flow_input.property` - Access flow input parameters\n- `results.step_id` - Access output from a previous step only when that step result is in scope\n- `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope\n- `flow_input.iter.value` - Current iteration value when inside a loop (`forloopflow` or `whileloopflow`)\n- `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)\n\n## Loop Structure Rules\n\n- For `whileloopflow`, use module-level `stop_after_if` on the loop module itself when the loop should stop after an iteration result\n- Do NOT put `stop_after_if` inside `value` of a `whileloopflow`\n- `stop_after_all_iters_if` is for checks after the whole loop finishes, not the normal per-iteration break condition\n- When a `whileloopflow` carries state forward between iterations, use `flow_input.iter.value` as the current loop value and provide an explicit first-iteration fallback when needed\n- Use `flow_input.iter.index` only when the loop logic is truly based on the iteration index, not as a replacement for the current loop value\n- If the user asks for a final scalar/object after a loop, add a normal step after the loop that extracts the final value from the loop result instead of returning the whole loop result array\n\nCorrect `whileloopflow` shape:\n\n```yaml\n- id: loop_until_done\n  stop_after_if:\n    expr: result.done === true\n    skip_if_stopped: false\n  value:\n    type: whileloopflow\n    skip_failures: false\n    modules:\n      - id: advance_state\n        value:\n          type: rawscript\n          input_transforms:\n            state:\n              type: javascript\n              expr: flow_input.iter && flow_input.iter.value !== undefined ? flow_input.iter.value : flow_input.initial_state\n- id: return_final_state\n  value:\n    type: rawscript\n    input_transforms:\n      final_state:\n        type: javascript\n        expr: results.loop_until_done[results.loop_until_done.length - 1]\n```\n\nIncorrect `whileloopflow` patterns:\n\n```yaml\n- id: loop_until_done\n  value:\n    type: whileloopflow\n    stop_after_if:\n      expr: result.done === true\n```\n\n```yaml\ninput_transforms:\n  state:\n    type: javascript\n    expr: flow_input.iter.index\n```\n\n```yaml\ninput_transforms:\n  final_state:\n    type: javascript\n    expr: results.loop_until_done\n```\n\n## Approval / Suspend Structure\n\n- `suspend` belongs on the flow module object itself, as a sibling of `id` and `value`\n- Never put `suspend` inside `value`\n\nCorrect shape:\n\n```yaml\n- id: request_approval\n  suspend:\n    required_events: 1\n    resume_form:\n      schema:\n        type: object\n        properties:\n          comment:\n            type: string\n        required: [comment]\n  value:\n    type: identity\n```\n\nIncorrect shape:\n\n```yaml\n- id: request_approval\n  value:\n    type: rawscript\n    suspend:\n      required_events: 1\n```\n\n## Branch Result Scope Rules\n\n- Inside a branch, you may reference earlier outer steps and earlier steps in the same branch\n- Outside a `branchone`, do NOT reference ids of steps that only exist inside its branches or default branch. Use `results.<branchone_module_id>` instead\n- Outside a `branchall`, do NOT reference ids of steps inside its branches. Use `results.<branchall_module_id>` instead\n- If downstream steps need a stable shape after a branch, make each branch return the same fields\n- When needed, add a normalization step immediately after the branch and consume `results.<branch_module_id>` there\n\nCorrect after `branchone`:\n\n```yaml\n- id: route_order\n  value:\n    type: branchone\n    ...\n- id: send_confirmation\n  value:\n    input_transforms:\n      routed:\n        type: javascript\n        expr: results.route_order\n```\n\nIncorrect after `branchone`:\n\n```yaml\nexpr: results.create_shipment\nexpr: results.create_backorder\n```\n\nCorrect after `branchall`:\n\n```yaml\n- id: enrich_parallel\n  value:\n    type: branchall\n    parallel: true\n    ...\n- id: combine_data\n  value:\n    input_transforms:\n      enrichments:\n        type: javascript\n        expr: results.enrich_parallel\n```\n\n## Input Transforms\n\nEvery rawscript module needs `input_transforms` to map function parameters to values:\n\nStatic transform (fixed value):\n{\"param_name\": {\"type\": \"static\", \"value\": \"fixed_string\"}}\n\nJavaScript transform (dynamic expression):\n{\"param_name\": {\"type\": \"javascript\", \"expr\": \"results.previous_step.data\"}}\n\n## Resource References\n\n- For flow inputs: Use type `\"object\"` with format `\"resource-{type}\"` (e.g., `\"resource-postgresql\"`)\n- For step inputs: Use static value `\"$res:path/to/resource\"`\n\n## Final Structural Self-Check\n\nBefore finalizing a flow, verify:\n\n- any preprocessor is in `value.preprocessor_module`\n- any failure handler is in `value.failure_module`\n- any approval step has module-level `suspend`\n- no downstream step references inner branch step ids from outside the branch\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\nTo accept an S3 object as flow input:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"file\": {\n      \"type\": \"object\",\n      \"format\": \"resource-s3_object\",\n      \"description\": \"File to process\"\n    }\n  }\n}\n```\n\n## Using Resources in Flows\n\nOn Windmill, credentials and configuration are stored in resources. Resource types define the format of the resource.\n\n### As Flow Input\n\nIn the flow schema, set the property type to `\"object\"` with format `\"resource-{type}\"`:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"database\": {\n      \"type\": \"object\",\n      \"format\": \"resource-postgresql\",\n      \"description\": \"Database connection\"\n    }\n  }\n}\n```\n\n### As Step Input (Static Reference)\n\nReference a specific resource using `$res:` prefix:\n\n```json\n{\n  \"database\": {\n    \"type\": \"static\",\n    \"value\": \"$res:f/folder/my_database\"\n  }\n}\n```\n";
-export declare const WORKFLOW_AS_CODE_BASE = "# Windmill Workflow-as-Code Writing Guide\n\n## Scope\n\nUse this guide when writing or modifying Windmill Workflow-as-Code (WAC) scripts.\nWAC is authored as a Windmill script and deployed with the normal script workflow. It is not an OpenFlow YAML flow.\n\nSupported WAC authoring targets:\n- TypeScript scripts that import from `windmill-client`\n- Python 3 scripts that import from `wmill`\n\n## File Shape\n\nTypeScript:\n\n```typescript\nimport {\n  task,\n  taskScript,\n  taskFlow,\n  step,\n  sleep,\n  waitForApproval,\n  getResumeUrls,\n  parallel,\n  workflow,\n} from \"windmill-client\";\n\nconst process = task(async (x: string): Promise<string> => {\n  return `processed: ${x}`;\n});\n\nexport const main = workflow(async (x: string) => {\n  const result = await process(x);\n  return { result };\n});\n```\n\nPython:\n\n```python\nfrom wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow\n\n@task()\nasync def process(x: str) -> str:\n    return f\"processed: {x}\"\n\n@workflow\nasync def main(x: str):\n    result = await process(x)\n    return {\"result\": result}\n```\n\nRules:\n- Do not call `main`.\n- TypeScript should export the workflow entrypoint, preferably `export const main = workflow(async (...) => { ... })`.\n- Python must use `@workflow` on an async top-level function, usually `main`.\n- Define task functions and `taskScript`/`task_script` or `taskFlow`/`task_flow` assignments at module top level with stable names.\n- Use the exact SDK names. Do not alias `workflow`, `task`, `taskScript`, `taskFlow`, `step`, `sleep`, `waitForApproval`, `task_script`, `task_flow`, or `wait_for_approval`; the WAC parser recognizes these names directly.\n\n## Checkpoint And Replay Model\n\nThe parent workflow may rerun from the top after any suspension, retry, approval, or child task completion. Completed durable steps are replayed from the checkpoint.\n\nPut every side effect or non-deterministic value behind a durable WAC boundary:\n- Use `task()` / `@task()` for substantial work that should run as its own child job.\n- Use `taskScript()` / `task_script()` for an existing script or a relative module file.\n- Use `taskFlow()` / `task_flow()` for an existing Windmill flow.\n- Use `step(name, fn)` for lightweight inline work whose result must be checkpointed.\n- Use `sleep(seconds)` for server-side sleeps that do not hold a worker.\n- Use `waitForApproval()` / `wait_for_approval()` for external approval suspension.\n\nNever put API calls, database writes, notifications, random values, timestamps, or irreversible changes directly in the top-level workflow body. The workflow body can be rerun. Put those operations in a task or in `step()`.\n\nBranching on task or step results is safe because those results are checkpointed. Branching on current time, random data, environment reads, or external state is unsafe unless the value is first captured with `step()`.\n\n## Tasks\n\nUse `task()` / `@task()` for inline functions that become workflow steps:\n\n```typescript\nconst enrich = task(async (customerId: string) => {\n  return await fetchCustomer(customerId);\n});\n```\n\n```python\n@task(timeout=600, tag=\"etl\")\nasync def enrich(customer_id: str):\n    return await fetch_customer(customer_id)\n```\n\nIn TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with `@task()` or `@task`.\n\nFor existing scripts:\n\n```typescript\nconst helper = taskScript(\"./helper.ts\");\nconst existing = taskScript(\"f/data/extract\", { timeout: 600 });\nconst value = await helper({ input: x });\n```\n\n```python\nhelper = task_script(\"./helper.py\")\nexisting = task_script(\"f/data/extract\", timeout=600)\nvalue = await helper(input=x)\n```\n\nFor existing flows:\n\n```typescript\nconst pipeline = taskFlow(\"f/etl/pipeline\");\nconst output = await pipeline({ input: data });\n```\n\n```python\npipeline = task_flow(\"f/etl/pipeline\")\noutput = await pipeline(input=data)\n```\n\n## Inline Steps\n\nUse `step()` for lightweight inline values that must not change during replay:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nconst startedAt = await step(\"started_at\", () => new Date().toISOString());\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\n```\n\nUse stable, descriptive step names. Do not generate step names dynamically.\n\n## Parallelism\n\nTo run independent work in parallel, start task promises/coroutines before awaiting them together:\n\n```typescript\nconst [a, b] = await Promise.all([process(\"a\"), process(\"b\")]);\nconst many = await parallel(items, process, { concurrency: 5 });\n```\n\n```python\nimport asyncio\n\na, b = await asyncio.gather(process(\"a\"), process(\"b\"))\nmany = await parallel(items, process, concurrency=5)\n```\n\nOnly parallelize independent steps. Do not read the result of a task before it is awaited.\n\n## Approvals\n\nGenerate resume URLs inside `step()` before sending them:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nawait step(\"notify\", () => sendApprovalEmail(urls.approvalPage));\nconst approval = await waitForApproval({ timeout: 3600 });\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\nawait step(\"notify\", lambda: send_approval_email(urls[\"approvalPage\"]))\napproval = await wait_for_approval(timeout=3600)\n```\n\n`selfApproval: false` and `self_approval=False` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.\n\n## Error Handling\n\nLet task errors fail the workflow unless the user asks for recovery logic.\n\nPython: `except Exception` is safe around WAC calls because internal suspension inherits from `BaseException`. Avoid bare `except:` in workflow code. If the user asks for recovery logic around failed child work, catch `TaskError` from `wmill` for task failures.\n\nTypeScript: avoid broad `try/catch` around WAC SDK calls. The SDK uses an internal suspension error during initial dispatch; catching it can break workflow suspension. If a broad catch is unavoidable, rethrow internal suspension errors before handling business errors.\n";
+export declare const FLOW_BASE = "# Windmill Flow Building Guide\n\n## OpenFlow Schema\n\nThe OpenFlow schema (openflow.openapi.yaml) is the source of truth for flow structure. Refer to OPENFLOW_SCHEMA for the complete type definitions.\n\n## Reserved Module IDs\n\n- `failure` - Reserved for failure handler module\n- `preprocessor` - Reserved for preprocessor module\n- `Input` - Reserved for flow input reference\n\n## Hard Structural Rules\n\nThese are strict Windmill schema rules. Follow them exactly.\n\n- `value.modules` is only for normal sequential steps\n- `value.preprocessor_module` and `value.failure_module` are special top-level fields inside `value`, not entries in `value.modules`\n- If a flow needs a preprocessor, create `value.preprocessor_module` with `id: preprocessor`\n- If a flow needs a failure handler, create `value.failure_module` with `id: failure`\n- Do NOT create regular modules inside `value.modules` named `preprocessor` or `failure`\n- `preprocessor_module` and `failure_module` only support `script` or `rawscript`\n- `preprocessor_module` runs before normal modules and cannot reference `results.*`\n- `failure_module` can use the `error` object with `error.message`, `error.step_id`, `error.name`, and `error.stack`\n\nCorrect shape:\n\n```yaml\nvalue:\n  preprocessor_module:\n    id: preprocessor\n    value:\n      type: rawscript\n      ...\n  failure_module:\n    id: failure\n    value:\n      type: rawscript\n      ...\n  modules:\n    - id: process_event\n      value:\n        type: rawscript\n        ...\n```\n\nIncorrect shape:\n\n```yaml\nvalue:\n  modules:\n    - id: preprocessor\n      ...\n    - id: process_event\n      ...\n    - id: failure\n      ...\n```\n\n## Module ID Rules\n\n- Must be unique across the entire flow\n- Use underscores, not spaces (e.g., `fetch_data` not `fetch data`)\n- Use descriptive names that reflect the step's purpose\n\n## Common Mistakes to Avoid\n\n- Missing `input_transforms` - Rawscript parameters won't receive values without them\n- Referencing future steps - `results.step_id` only works for steps that execute before the current one\n- Duplicate module IDs - Each module ID must be unique in the flow\n\n## Data Flow Between Steps\n\n- `flow_input.property` - Access flow input parameters\n- `results.step_id` - Access output from a previous step only when that step result is in scope\n- `results.step_id.property` - Access specific property from a previous step output only when that step result is in scope\n- `flow_input.iter.value` - Current iteration value when inside a loop (`forloopflow` or `whileloopflow`)\n- `flow_input.iter.index` - Current loop index when inside a loop (`forloopflow` or `whileloopflow`)\n\n## Loop Structure Rules\n\n- For `whileloopflow`, use module-level `stop_after_if` on the loop module itself when the loop should stop after an iteration result\n- Do NOT put `stop_after_if` inside `value` of a `whileloopflow`\n- `stop_after_all_iters_if` is for checks after the whole loop finishes, not the normal per-iteration break condition\n- When a `whileloopflow` carries state forward between iterations, use `flow_input.iter.value` as the current loop value and provide an explicit first-iteration fallback when needed\n- Use `flow_input.iter.index` only when the loop logic is truly based on the iteration index, not as a replacement for the current loop value\n- If the user asks for a final scalar/object after a loop, add a normal step after the loop that extracts the final value from the loop result instead of returning the whole loop result array\n\nCorrect `whileloopflow` shape:\n\n```yaml\n- id: loop_until_done\n  stop_after_if:\n    expr: result.done === true\n    skip_if_stopped: false\n  value:\n    type: whileloopflow\n    skip_failures: false\n    modules:\n      - id: advance_state\n        value:\n          type: rawscript\n          input_transforms:\n            state:\n              type: javascript\n              expr: flow_input.iter && flow_input.iter.value !== undefined ? flow_input.iter.value : flow_input.initial_state\n- id: return_final_state\n  value:\n    type: rawscript\n    input_transforms:\n      final_state:\n        type: javascript\n        expr: results.loop_until_done[results.loop_until_done.length - 1]\n```\n\nIncorrect `whileloopflow` patterns:\n\n```yaml\n- id: loop_until_done\n  value:\n    type: whileloopflow\n    stop_after_if:\n      expr: result.done === true\n```\n\n```yaml\ninput_transforms:\n  state:\n    type: javascript\n    expr: flow_input.iter.index\n```\n\n```yaml\ninput_transforms:\n  final_state:\n    type: javascript\n    expr: results.loop_until_done\n```\n\n## Approval / Suspend Structure\n\n- `suspend` belongs on the flow module object itself, as a sibling of `id` and `value`\n- Never put `suspend` inside `value`\n\nCorrect shape:\n\n```yaml\n- id: request_approval\n  suspend:\n    required_events: 1\n    resume_form:\n      schema:\n        type: object\n        properties:\n          comment:\n            type: string\n        required: [comment]\n  value:\n    type: identity\n```\n\nIncorrect shape:\n\n```yaml\n- id: request_approval\n  value:\n    type: rawscript\n    suspend:\n      required_events: 1\n```\n\n## Branch Result Scope Rules\n\n- Inside a branch, you may reference earlier outer steps and earlier steps in the same branch\n- Outside a `branchone`, do NOT reference ids of steps that only exist inside its branches or default branch. Use `results.<branchone_module_id>` instead\n- Outside a `branchall`, do NOT reference ids of steps inside its branches. Use `results.<branchall_module_id>` instead\n- If downstream steps need a stable shape after a branch, make each branch return the same fields\n- When needed, add a normalization step immediately after the branch and consume `results.<branch_module_id>` there\n\nCorrect after `branchone`:\n\n```yaml\n- id: route_order\n  value:\n    type: branchone\n    ...\n- id: send_confirmation\n  value:\n    input_transforms:\n      routed:\n        type: javascript\n        expr: results.route_order\n```\n\nIncorrect after `branchone`:\n\n```yaml\nexpr: results.create_shipment\nexpr: results.create_backorder\n```\n\nCorrect after `branchall`:\n\n```yaml\n- id: enrich_parallel\n  value:\n    type: branchall\n    parallel: true\n    ...\n- id: combine_data\n  value:\n    input_transforms:\n      enrichments:\n        type: javascript\n        expr: results.enrich_parallel\n```\n\n## Input Transforms\n\nEvery rawscript module needs `input_transforms` to map function parameters to values:\n\nStatic transform (fixed value):\n{\"param_name\": {\"type\": \"static\", \"value\": \"fixed_string\"}}\n\nJavaScript transform (dynamic expression):\n{\"param_name\": {\"type\": \"javascript\", \"expr\": \"results.previous_step.data\"}}\n\n## Resource References\n\n- For flow inputs: Use type `\"object\"` with format `\"resource-{type}\"` (e.g., `\"resource-postgresql\"`)\n- For step inputs: Use static value `\"$res:path/to/resource\"`\n\n## Final Structural Self-Check\n\nBefore finalizing a flow, verify:\n\n- any preprocessor is in `value.preprocessor_module`\n- any failure handler is in `value.failure_module`\n- any approval step has module-level `suspend`\n- no downstream step references inner branch step ids from outside the branch\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\nTo accept an S3 object as flow input:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"file\": {\n      \"type\": \"object\",\n      \"format\": \"resource-s3_object\",\n      \"description\": \"File to process\"\n    }\n  }\n}\n```\n\n## Using Resources in Flows\n\nOn Windmill, credentials and configuration are stored in resources. Resource types define the format of the resource.\n\n### As Flow Input\n\nIn the flow schema, set the property type to `\"object\"` with format `\"resource-{type}\"`:\n\n```json\n{\n  \"type\": \"object\",\n  \"properties\": {\n    \"database\": {\n      \"type\": \"object\",\n      \"format\": \"resource-postgresql\",\n      \"description\": \"Database connection\"\n    }\n  }\n}\n```\n\n### As Step Input (Static Reference)\n\nReference a specific resource using `$res:` prefix:\n\n```json\n{\n  \"database\": {\n    \"type\": \"static\",\n    \"value\": \"$res:f/folder/my_database\"\n  }\n}\n```\n";
+export declare const WORKFLOW_AS_CODE_BASE = "# Windmill Workflow-as-Code Writing Guide\n\n## Scope\n\nUse this guide when writing or modifying Windmill Workflow-as-Code (WAC) scripts.\nWAC is authored as a Windmill script and deployed with the normal script workflow. It is not an OpenFlow YAML flow.\n\nSupported WAC authoring targets:\n- Bun TypeScript scripts that import from `windmill-client`\n- Python 3 scripts that import from `wmill`\n\n## File Shape\n\nBun TypeScript:\n\n```typescript\nimport {\n  task,\n  taskScript,\n  taskFlow,\n  step,\n  sleep,\n  waitForApproval,\n  getResumeUrls,\n  parallel,\n  workflow,\n} from \"windmill-client\";\n\nconst process = task(async (x: string): Promise<string> => {\n  return `processed: ${x}`;\n});\n\nexport const main = workflow(async (x: string) => {\n  const result = await process(x);\n  return { result };\n});\n```\n\nPython:\n\n```python\nfrom wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow\n\n@task()\nasync def process(x: str) -> str:\n    return f\"processed: {x}\"\n\n@workflow\nasync def main(x: str):\n    result = await process(x)\n    return {\"result\": result}\n```\n\nRules:\n- Do not call `main`.\n- Bun TypeScript should export the workflow entrypoint, preferably `export const main = workflow(async (...) => { ... })`.\n- Python must use `@workflow` on an async top-level function, usually `main`.\n- Define task functions and `taskScript`/`task_script` or `taskFlow`/`task_flow` assignments at module top level with stable names.\n- Use the exact SDK names. Do not alias `workflow`, `task`, `taskScript`, `taskFlow`, `step`, `sleep`, `waitForApproval`, `task_script`, `task_flow`, or `wait_for_approval`; the WAC parser recognizes these names directly.\n\n## Checkpoint And Replay Model\n\nThe parent workflow may rerun from the top after any suspension, retry, approval, or child task completion. Completed durable steps are replayed from the checkpoint.\n\nPut every side effect or non-deterministic value behind a durable WAC boundary:\n- Use `task()` / `@task()` for substantial work that should run as its own child job.\n- Use `taskScript()` / `task_script()` for an existing script or a relative module file.\n- Use `taskFlow()` / `task_flow()` for an existing Windmill flow.\n- Use `step(name, fn)` for lightweight inline work whose result must be checkpointed.\n- Use `sleep(seconds)` for server-side sleeps that do not hold a worker.\n- Use `waitForApproval()` / `wait_for_approval()` for external approval suspension.\n\nNever put API calls, database writes, notifications, random values, timestamps, or irreversible changes directly in the top-level workflow body. The workflow body can be rerun. Put those operations in a task or in `step()`.\n\nBranching on task or step results is safe because those results are checkpointed. Branching on current time, random data, environment reads, or external state is unsafe unless the value is first captured with `step()`.\n\n## Tasks\n\nUse `task()` / `@task()` for inline functions that become workflow steps:\n\n```typescript\nconst enrich = task(async (customerId: string) => {\n  return await fetchCustomer(customerId);\n});\n```\n\n```python\n@task(timeout=600, tag=\"etl\")\nasync def enrich(customer_id: str):\n    return await fetch_customer(customer_id)\n```\n\nIn TypeScript, prefer assigning each task to a named top-level const. In Python, prefer top-level async functions decorated with `@task()` or `@task`.\n\nFor existing scripts:\n\n```typescript\nconst helper = taskScript(\"./helper.ts\");\nconst existing = taskScript(\"f/data/extract\", { timeout: 600 });\nconst value = await helper({ input: x });\n```\n\n```python\nhelper = task_script(\"./helper.py\")\nexisting = task_script(\"f/data/extract\", timeout=600)\nvalue = await helper(input=x)\n```\n\nFor existing flows:\n\n```typescript\nconst pipeline = taskFlow(\"f/etl/pipeline\");\nconst output = await pipeline({ input: data });\n```\n\n```python\npipeline = task_flow(\"f/etl/pipeline\")\noutput = await pipeline(input=data)\n```\n\n## Inline Steps\n\nUse `step()` for lightweight inline values that must not change during replay:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nconst startedAt = await step(\"started_at\", () => new Date().toISOString());\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\n```\n\nUse stable, descriptive step names. Do not generate step names dynamically.\n\n## Parallelism\n\nTo run independent work in parallel, start task promises/coroutines before awaiting them together:\n\n```typescript\nconst [a, b] = await Promise.all([process(\"a\"), process(\"b\")]);\nconst many = await parallel(items, process, { concurrency: 5 });\n```\n\n```python\nimport asyncio\n\na, b = await asyncio.gather(process(\"a\"), process(\"b\"))\nmany = await parallel(items, process, concurrency=5)\n```\n\nOnly parallelize independent steps. Do not read the result of a task before it is awaited.\n\n## Approvals\n\nGenerate resume URLs inside `step()` before sending them:\n\n```typescript\nconst urls = await step(\"get_urls\", () => getResumeUrls());\nawait step(\"notify\", () => sendApprovalEmail(urls.approvalPage));\nconst approval = await waitForApproval({ timeout: 3600 });\n```\n\n```python\nurls = await step(\"get_urls\", lambda: get_resume_urls())\nawait step(\"notify\", lambda: send_approval_email(urls[\"approvalPage\"]))\napproval = await wait_for_approval(timeout=3600)\n```\n\n`selfApproval: false` and `self_approval=False` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.\n\n## Error Handling\n\nLet task errors fail the workflow unless the user asks for recovery logic.\n\nPython: `except Exception` is safe around WAC calls because internal suspension inherits from `BaseException`. Avoid bare `except:` in workflow code. If the user asks for recovery logic around failed child work, catch `TaskError` from `wmill` for task failures.\n\nTypeScript: avoid broad `try/catch` around WAC SDK calls. The SDK uses an internal suspension error during initial dispatch; catching it can break workflow suspension. If a broad catch is unavoidable, rethrow internal suspension errors before handling business errors.\n";
 export declare const FLOW_CHAT_SPECIAL_MODULES = "## Special Modules\n\n- Use `set_preprocessor_module` to add, replace, or remove the top-level `value.preprocessor_module`\n- Use `set_failure_module` to add, replace, or remove the top-level `value.failure_module`\n- Use `set_flow_json` only when you are replacing the whole flow, including normal modules and optional special modules\n\n**Example - Update only the special modules:**\n```javascript\nset_preprocessor_module({\n  module: JSON.stringify({\n    id: \"preprocessor\",\n    value: {\n      type: \"rawscript\",\n      language: \"bun\",\n      content: \"export async function preprocessor(payload: string) { const trimmed = payload.trim(); if (!trimmed) { throw new Error('payload must not be empty'); } return { payload: trimmed }; }\",\n      input_transforms: {\n        payload: { type: \"javascript\", expr: \"flow_input.payload\" }\n      }\n    }\n  })\n})\n\nset_failure_module({\n  module: JSON.stringify({\n    id: \"failure\",\n    value: {\n      type: \"rawscript\",\n      language: \"bun\",\n      content: \"export async function main(message: string, name: string, step_id: string) { return { message, name, step_id }; }\",\n      input_transforms: {\n        message: { type: \"javascript\", expr: \"error.message\" },\n        name: { type: \"javascript\", expr: \"error.name\" },\n        step_id: { type: \"javascript\", expr: \"error.step_id\" }\n      }\n    }\n  })\n})\n```\n";
 export declare const SDK_TYPESCRIPT = "# TypeScript SDK (windmill-client)\n\nImport: import * as wmill from 'windmill-client'\n\nworkerHasInternalServer(): boolean\n\n/**\n * Initialize the Windmill client with authentication token and base URL\n * @param token - Authentication token (defaults to WM_TOKEN env variable)\n * @param baseUrl - API base URL (defaults to BASE_INTERNAL_URL or BASE_URL env variable)\n */\nsetClient(token?: string, baseUrl?: string): void\n\n/**\n * Create a client configuration from env variables\n * @returns client configuration\n */\ngetWorkspace(): string\n\n/**\n * Get a resource value by path\n * @param path path of the resource,  default to internal state path\n * @param undefinedIfEmpty if the resource does not exist, return undefined instead of throwing an error\n * @returns resource value\n */\nasync getResource(path?: string, undefinedIfEmpty?: boolean): Promise<any>\n\n/**\n * Get the true root job id\n * @param jobId job id to get the root job id from (default to current job)\n * @returns root job id\n */\nasync getRootJobId(jobId?: string): Promise<string>\n\n/**\n * @deprecated Use runScriptByPath or runScriptByHash instead\n */\nasync runScript(path: string | null = null, hash_: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Run a script synchronously by its path and wait for the result\n * @param path - Script path in Windmill\n * @param args - Arguments to pass to the script\n * @param verbose - Enable verbose logging\n * @returns Script execution result\n */\nasync runScriptByPath(path: string, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Run a script synchronously by its hash and wait for the result\n * @param hash_ - Script hash in Windmill\n * @param args - Arguments to pass to the script\n * @param verbose - Enable verbose logging\n * @returns Script execution result\n */\nasync runScriptByHash(hash_: string, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Append a text to the result stream\n * @param text text to append to the result stream\n */\nappendToResultStream(text: string): void\n\n/**\n * Stream to the result stream\n * @param stream stream to stream to the result stream\n */\nasync streamResult(stream: AsyncIterable<string>): Promise<void>\n\n/**\n * Run a flow synchronously by its path and wait for the result\n * @param path - Flow path in Windmill\n * @param args - Arguments to pass to the flow\n * @param verbose - Enable verbose logging\n * @returns Flow execution result\n */\nasync runFlow(path: string | null = null, args: Record<string, any> | null = null, verbose: boolean = false): Promise<any>\n\n/**\n * Wait for a job to complete and return its result\n * @param jobId - ID of the job to wait for\n * @param verbose - Enable verbose logging\n * @returns Job result when completed\n */\nasync waitJob(jobId: string, verbose: boolean = false): Promise<any>\n\n/**\n * Get the result of a completed job\n * @param jobId - ID of the completed job\n * @returns Job result\n */\nasync getResult(jobId: string): Promise<any>\n\n/**\n * Get the result of a job if completed, or its current status\n * @param jobId - ID of the job\n * @returns Object with started, completed, success, and result properties\n */\nasync getResultMaybe(jobId: string): Promise<any>\n\n/**\n * @deprecated Use runScriptByPathAsync or runScriptByHashAsync instead\n */\nasync runScriptAsync(path: string | null, hash_: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null): Promise<string>\n\n/**\n * Run a script asynchronously by its path\n * @param path - Script path in Windmill\n * @param args - Arguments to pass to the script\n * @param scheduledInSeconds - Schedule execution for a future time (in seconds)\n * @returns Job ID of the created job\n */\nasync runScriptByPathAsync(path: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null): Promise<string>\n\n/**\n * Run a script asynchronously by its hash\n * @param hash_ - Script hash in Windmill\n * @param args - Arguments to pass to the script\n * @param scheduledInSeconds - Schedule execution for a future time (in seconds)\n * @returns Job ID of the created job\n */\nasync runScriptByHashAsync(hash_: string, args: Record<string, any> | null = null, scheduledInSeconds: number | null = null): Promise<string>\n\n/**\n * Run a flow asynchronously by its path\n * @param path - Flow path in Windmill\n * @param args - Arguments to pass to the flow\n * @param scheduledInSeconds - Schedule execution for a future time (in seconds)\n * @param doNotTrackInParent - If false, tracks state in parent job (only use when fully awaiting the job)\n * @returns Job ID of the created job\n */\nasync runFlowAsync(path: string | null, args: Record<string, any> | null, scheduledInSeconds: number | null = null, // can only be set to false if this the job will be fully await and not concurrent with any other job // as otherwise the child flow and its own child will store their state in the parent job which will // lead to incorrectness and failures doNotTrackInParent: boolean = true): Promise<string>\n\n/**\n * Resolve a resource value in case the default value was picked because the input payload was undefined\n * @param obj resource value or path of the resource under the format `$res:path`\n * @returns resource value\n */\nasync resolveDefaultResource(obj: any): Promise<any>\n\n/**\n * Get the state file path from environment variables\n * @returns State path string\n */\ngetStatePath(): string\n\n/**\n * Set a resource value by path\n * @param path path of the resource to set, default to state path\n * @param value new value of the resource to set\n * @param initializeToTypeIfNotExist if the resource does not exist, initialize it with this type\n */\nasync setResource(value: any, path?: string, initializeToTypeIfNotExist?: string): Promise<void>\n\n/**\n * Set the state\n * @param state state to set\n * @deprecated use setState instead\n */\nasync setInternalState(state: any): Promise<void>\n\n/**\n * Set the state\n * @param state state to set\n * @param path Optional state resource path override. Defaults to `getStatePath()`.\n */\nasync setState(state: any, path?: string): Promise<void>\n\n/**\n * Set the progress\n * Progress cannot go back and limited to 0% to 99% range\n * @param percent Progress to set in %\n * @param jobId? Job to set progress for\n */\nasync setProgress(percent: number, jobId?: any): Promise<void>\n\n/**\n * Get the progress\n * @param jobId? Job to get progress from\n * @returns Optional clamped between 0 and 100 progress value\n */\nasync getProgress(jobId?: any): Promise<number | null>\n\n/**\n * Set a flow user state\n * @param key key of the state\n * @param value value of the state\n */\nasync setFlowUserState(key: string, value: any, errorIfNotPossible?: boolean): Promise<void>\n\n/**\n * Get a flow user state\n * @param path path of the variable\n */\nasync getFlowUserState(key: string, errorIfNotPossible?: boolean): Promise<any>\n\n/**\n * Get the internal state\n * @deprecated use getState instead\n */\nasync getInternalState(): Promise<any>\n\n/**\n * Get the state shared across executions\n * @param path Optional state resource path override. Defaults to `getStatePath()`.\n */\nasync getState(path?: string): Promise<any>\n\n/**\n * Get a variable by path\n * @param path path of the variable\n * @returns variable value\n */\nasync getVariable(path: string): Promise<string>\n\n/**\n * Set a variable by path, create if not exist\n * @param path path of the variable\n * @param value value of the variable\n * @param isSecretIfNotExist if the variable does not exist, create it as secret or not (default: false)\n * @param descriptionIfNotExist if the variable does not exist, create it with this description (default: \"\")\n */\nasync setVariable(path: string, value: string, isSecretIfNotExist?: boolean, descriptionIfNotExist?: string): Promise<void>\n\n/**\n * Build a PostgreSQL connection URL from a database resource\n * @param path - Path to the database resource\n * @returns PostgreSQL connection URL string\n */\nasync databaseUrlFromResource(path: string): Promise<string>\n\nasync polarsConnectionSettings(s3_resource_path: string | undefined): Promise<any>\n\nasync duckdbConnectionSettings(s3_resource_path: string | undefined): Promise<any>\n\n/**\n * Get S3 client settings from a resource or workspace default\n * @param s3_resource_path - Path to S3 resource (uses workspace default if undefined)\n * @returns S3 client configuration settings\n */\nasync denoS3LightClientSettings(s3_resource_path: string | undefined): Promise<DenoS3LightClientSettings>\n\n/**\n * Load the content of a file stored in S3. If the s3ResourcePath is undefined, it will default to the workspace S3 resource.\n * \n * ```typescript\n * let fileContent = await wmill.loadS3FileContent(inputFile)\n * // if the file is a raw text file, it can be decoded and printed directly:\n * const text = new TextDecoder().decode(fileContentStream)\n * console.log(text);\n * ```\n */\nasync loadS3File(s3object: S3Object, s3ResourcePath: string | undefined = undefined): Promise<Uint8Array | undefined>\n\n/**\n * Load the content of a file stored in S3 as a stream. If the s3ResourcePath is undefined, it will default to the workspace S3 resource.\n * \n * ```typescript\n * let fileContentBlob = await wmill.loadS3FileStream(inputFile)\n * // if the content is plain text, the blob can be read directly:\n * console.log(await fileContentBlob.text());\n * ```\n */\nasync loadS3FileStream(s3object: S3Object, s3ResourcePath: string | undefined = undefined): Promise<Blob | undefined>\n\n/**\n * Persist a file to the S3 bucket. If the s3ResourcePath is undefined, it will default to the workspace S3 resource.\n * \n * ```typescript\n * const s3object = await writeS3File(s3Object, \"Hello Windmill!\")\n * const fileContentAsUtf8Str = (await s3object.toArray()).toString('utf-8')\n * console.log(fileContentAsUtf8Str)\n * ```\n */\nasync writeS3File(s3object: S3Object | undefined, fileContent: string | Blob, s3ResourcePath: string | undefined = undefined, contentType: string | undefined = undefined, contentDisposition: string | undefined = undefined): Promise<S3Object>\n\n/**\n * Sign S3 objects to be used by anonymous users in public apps\n * @param s3objects s3 objects to sign\n * @returns signed s3 objects\n */\nasync signS3Objects(s3objects: S3Object[]): Promise<S3Object[]>\n\n/**\n * Sign S3 object to be used by anonymous users in public apps\n * @param s3object s3 object to sign\n * @returns signed s3 object\n */\nasync signS3Object(s3object: S3Object): Promise<S3Object>\n\n/**\n * Generate a presigned public URL for an array of S3 objects.\n * If an S3 object is not signed yet, it will be signed first.\n * @param s3Objects s3 objects to sign\n * @returns list of signed public URLs\n */\nasync getPresignedS3PublicUrls(s3Objects: S3Object[], { baseUrl }: { baseUrl?: string } = {}): Promise<string[]>\n\n/**\n * Generate a presigned public URL for an S3 object. If the S3 object is not signed yet, it will be signed first.\n * @param s3Object s3 object to sign\n * @returns signed public URL\n */\nasync getPresignedS3PublicUrl(s3Objects: S3Object, { baseUrl }: { baseUrl?: string } = {}): Promise<string>\n\n/**\n * Get URLs needed for resuming a flow after this step\n * @param approver approver name\n * @param flowLevel if true, generate resume URLs for the parent flow instead of the specific step.\n *                  This allows pre-approvals that can be consumed by any later suspend step in the same flow.\n * @returns approval page UI URL, resume and cancel API URLs for resuming the flow\n */\nasync getResumeUrls(approver?: string, flowLevel?: boolean): Promise<{\n  approvalPage: string;\n  resume: string;\n  cancel: string;\n}>\n\n/**\n * @deprecated use getResumeUrls instead\n */\ngetResumeEndpoints(approver?: string): Promise<{\n  approvalPage: string;\n  resume: string;\n  cancel: string;\n}>\n\n/**\n * Get an OIDC jwt token for auth to external services (e.g: Vault, AWS) (ee only)\n * @param audience audience of the token\n * @param expiresIn Optional number of seconds until the token expires\n * @returns jwt token\n */\nasync getIdToken(audience: string, expiresIn?: number): Promise<string>\n\n/**\n * Convert a base64-encoded string to Uint8Array\n * @param data - Base64-encoded string\n * @returns Decoded Uint8Array\n */\nbase64ToUint8Array(data: string): Uint8Array\n\n/**\n * Convert a Uint8Array to base64-encoded string\n * @param arrayBuffer - Uint8Array to encode\n * @returns Base64-encoded string\n */\nuint8ArrayToBase64(arrayBuffer: Uint8Array): string\n\n/**\n * Get email from workspace username\n * This method is particularly useful for apps that require the email address of the viewer.\n * Indeed, in the viewer context, WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.\n * @param username\n * @returns email address\n */\nasync usernameToEmail(username: string): Promise<string>\n\n/**\n * Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.\n * \n * **[Enterprise Edition Only]** To include form fields in the Slack approval request, go to **Advanced -> Suspend -> Form**\n * and define a form. Learn more at [Windmill Documentation](https://www.windmill.dev/docs/flows/flow_approval#form).\n * \n * @param {Object} options - The configuration options for the Slack approval request.\n * @param {string} options.slackResourcePath - The path to the Slack resource in Windmill.\n * @param {string} options.channelId - The Slack channel ID where the approval request will be sent.\n * @param {string} [options.message] - Optional custom message to include in the Slack approval request.\n * @param {string} [options.approver] - Optional user ID or name of the approver for the request.\n * @param {DefaultArgs} [options.defaultArgsJson] - Optional object defining or overriding the default arguments to a form field.\n * @param {Enums} [options.dynamicEnumsJson] - Optional object overriding the enum default values of an enum form field.\n * @param {string} [options.resumeButtonText] - Optional text for the resume button.\n * @param {string} [options.cancelButtonText] - Optional text for the cancel button.\n * \n * @returns {Promise<void>} Resolves when the Slack approval request is successfully sent.\n * \n * @throws {Error} If the function is not called within a flow or flow preview.\n * @throws {Error} If the `JobService.getSlackApprovalPayload` call fails.\n * \n * **Usage Example:**\n * ```typescript\n * await requestInteractiveSlackApproval({\n *   slackResourcePath: \"/u/alex/my_slack_resource\",\n *   channelId: \"admins-slack-channel\",\n *   message: \"Please approve this request\",\n *   approver: \"approver123\",\n *   defaultArgsJson: { key1: \"value1\", key2: 42 },\n *   dynamicEnumsJson: { foo: [\"choice1\", \"choice2\"], bar: [\"optionA\", \"optionB\"] },\n *   resumeButtonText: \"Resume\",\n *   cancelButtonText: \"Cancel\",\n * });\n * ```\n * \n * **Note:** This function requires execution within a Windmill flow or flow preview.\n */\nasync requestInteractiveSlackApproval({ slackResourcePath, channelId, message, approver, defaultArgsJson, dynamicEnumsJson, resumeButtonText, cancelButtonText, }: SlackApprovalOptions): Promise<void>\n\n/**\n * Sends an interactive approval request via Teams, allowing optional customization of the message, approver, and form fields.\n * \n * **[Enterprise Edition Only]** To include form fields in the Teams approval request, go to **Advanced -> Suspend -> Form**\n * and define a form. Learn more at [Windmill Documentation](https://www.windmill.dev/docs/flows/flow_approval#form).\n * \n * @param {Object} options - The configuration options for the Teams approval request.\n * @param {string} options.teamName - The Teams team name where the approval request will be sent.\n * @param {string} options.channelName - The Teams channel name where the approval request will be sent.\n * @param {string} [options.message] - Optional custom message to include in the Teams approval request.\n * @param {string} [options.approver] - Optional user ID or name of the approver for the request.\n * @param {DefaultArgs} [options.defaultArgsJson] - Optional object defining or overriding the default arguments to a form field.\n * @param {Enums} [options.dynamicEnumsJson] - Optional object overriding the enum default values of an enum form field.\n * \n * @returns {Promise<void>} Resolves when the Teams approval request is successfully sent.\n * \n * @throws {Error} If the function is not called within a flow or flow preview.\n * @throws {Error} If the `JobService.getTeamsApprovalPayload` call fails.\n * \n * **Usage Example:**\n * ```typescript\n * await requestInteractiveTeamsApproval({\n *   teamName: \"admins-teams\",\n *   channelName: \"admins-teams-channel\",\n *   message: \"Please approve this request\",\n *   approver: \"approver123\",\n *   defaultArgsJson: { key1: \"value1\", key2: 42 },\n *   dynamicEnumsJson: { foo: [\"choice1\", \"choice2\"], bar: [\"optionA\", \"optionB\"] },\n * });\n * ```\n * \n * **Note:** This function requires execution within a Windmill flow or flow preview.\n */\nasync requestInteractiveTeamsApproval({ teamName, channelName, message, approver, defaultArgsJson, dynamicEnumsJson, }: TeamsApprovalOptions): Promise<void>\n\n/**\n * Parse an S3 object from URI string or record format\n * @param s3Object - S3 object as URI string (s3://storage/key) or record\n * @returns S3 object record with storage and s3 key\n */\nparseS3Object(s3Object: S3Object): S3ObjectRecord\n\nsetWorkflowCtx(ctx: WorkflowCtx | null): void\n\nasync sleep(seconds: number): Promise<void>\n\nasync step<T>(name: string, fn: () => T | Promise<T>): Promise<T>\n\n/**\n * Create a task that dispatches to a separate Windmill script.\n * \n * @example\n * const extract = taskScript(\"f/data/extract\");\n * // inside workflow: await extract({ url: \"https://...\" })\n */\ntaskScript(path: string, options?: TaskOptions): (...args: any[]) => PromiseLike<any>\n\n/**\n * Create a task that dispatches to a separate Windmill flow.\n * \n * @example\n * const pipeline = taskFlow(\"f/etl/pipeline\");\n * // inside workflow: await pipeline({ input: data })\n */\ntaskFlow(path: string, options?: TaskOptions): (...args: any[]) => PromiseLike<any>\n\n/**\n * Mark an async function as a workflow-as-code entry point.\n * \n * The function must be **deterministic**: given the same inputs it must call\n * tasks in the same order on every replay. Branching on task results is fine\n * (results are replayed from checkpoint), but branching on external state\n * (current time, random values, external API calls) must use `step()` to\n * checkpoint the value so replays see the same result.\n */\nworkflow<T>(fn: (...args: any[]) => Promise<T>): void\n\n/**\n * Suspend the workflow and wait for an external approval.\n * \n * Use `getResumeUrls()` (wrapped in `step()`) to obtain resume/cancel/approvalPage\n * URLs before calling this function.\n * \n * @example\n * const urls = await step(\"urls\", () => getResumeUrls());\n * await step(\"notify\", () => sendEmail(urls.approvalPage));\n * const { value, approver } = await waitForApproval({ timeout: 3600 });\n */\nwaitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>\n\n/**\n * Process items in parallel with optional concurrency control.\n * \n * Each item is processed by calling `fn(item)`, which should be a task().\n * Items are dispatched in batches of `concurrency` (default: all at once).\n * \n * @example\n * const process = task(async (item: string) => { ... });\n * const results = await parallel(items, process, { concurrency: 5 });\n */\nasync parallel<T, R>(items: T[], fn: (item: T) => PromiseLike<R> | R, options?: { concurrency?: number },): Promise<R[]>\n\n/**\n * Commit Kafka offsets for a trigger with auto_commit disabled.\n * @param triggerPath - Path to the Kafka trigger (from event.wm_trigger.trigger_path)\n * @param topic - Kafka topic name (from event.topic)\n * @param partition - Partition number (from event.partition)\n * @param offset - Message offset to commit (from event.offset)\n */\nasync commitKafkaOffsets(triggerPath: string, topic: string, partition: number, offset: number,): Promise<void>\n\n/**\n * Create a SQL template function for PostgreSQL/datatable queries\n * @param name - Database/datatable name (default: \"main\")\n * @returns SQL template function for building parameterized queries\n * @example\n * let sql = wmill.datatable()\n * let name = 'Robin'\n * let age = 21\n * await sql`\n *   SELECT * FROM friends\n *     WHERE name = ${name} AND age = ${age}::int\n * `.fetch()\n */\ndatatable(name: string = \"main\"): DatatableSqlTemplateFunction\n\n/**\n * Create a SQL template function for DuckDB/ducklake queries\n * @param name - DuckDB database name (default: \"main\")\n * @returns SQL template function for building parameterized queries\n * @example\n * let sql = wmill.ducklake()\n * let name = 'Robin'\n * let age = 21\n * await sql`\n *   SELECT * FROM friends\n *     WHERE name = ${name} AND age = ${age}\n * `.fetch()\n */\nducklake(name: string = \"main\"): SqlTemplateFunction\n";
 export declare const SDK_PYTHON = "# Python SDK (wmill)\n\nImport: import wmill\n\ndef worker_has_internal_server() -> bool\n\ndef get_mocked_api() -> Optional[dict]\n\n# Get the HTTP client instance.\n# \n# Returns:\n#     Configured httpx.Client for API requests\ndef get_client() -> httpx.Client\n\n# Make an HTTP GET request to the Windmill API.\n# \n# Args:\n#     endpoint: API endpoint path\n#     raise_for_status: Whether to raise an exception on HTTP errors\n#     **kwargs: Additional arguments passed to httpx.get\n# \n# Returns:\n#     HTTP response object\ndef get(endpoint, raise_for_status = True, **kwargs) -> httpx.Response\n\n# Make an HTTP POST request to the Windmill API.\n# \n# Args:\n#     endpoint: API endpoint path\n#     raise_for_status: Whether to raise an exception on HTTP errors\n#     **kwargs: Additional arguments passed to httpx.post\n# \n# Returns:\n#     HTTP response object\ndef post(endpoint, raise_for_status = True, **kwargs) -> httpx.Response\n\n# Create a new authentication token.\n# \n# Args:\n#     duration: Token validity duration (default: 1 day)\n# \n# Returns:\n#     New authentication token string\ndef create_token(duration = dt.timedelta(days=1)) -> str\n\n# Create a script job and return its job id.\n# \n# .. deprecated:: Use run_script_by_path_async or run_script_by_hash_async instead.\ndef run_script_async(path: str = None, hash_: str = None, args: dict = None, scheduled_in_secs: int = None) -> str\n\n# Create a script job by path and return its job id.\ndef run_script_by_path_async(path: str, args: dict = None, scheduled_in_secs: int = None) -> str\n\n# Create a script job by hash and return its job id.\ndef run_script_by_hash_async(hash_: str, args: dict = None, scheduled_in_secs: int = None) -> str\n\n# Create a flow job and return its job id.\ndef run_flow_async(path: str, args: dict = None, scheduled_in_secs: int = None, do_not_track_in_parent: bool = True) -> str\n\n# Run script synchronously and return its result.\n# \n# .. deprecated:: Use run_script_by_path or run_script_by_hash instead.\ndef run_script(path: str = None, hash_: str = None, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False) -> Any\n\n# Run script by path synchronously and return its result.\ndef run_script_by_path(path: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False) -> Any\n\n# Run script by hash synchronously and return its result.\ndef run_script_by_hash(hash_: str, args: dict = None, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False) -> Any\n\n# Run a script on the current worker without creating a job.\n# \n# On agent workers (no internal server), falls back to running a normal\n# preview job and waiting for the result.\ndef run_inline_script_preview(content: str, language: str, args: dict = None) -> Any\n\n# Wait for a job to complete and return its result.\n# \n# Args:\n#     job_id: ID of the job to wait for\n#     timeout: Maximum time to wait (seconds or timedelta)\n#     verbose: Enable verbose logging\n#     cleanup: Register cleanup handler to cancel job on exit\n#     assert_result_is_not_none: Raise exception if result is None\n# \n# Returns:\n#     Job result when completed\n# \n# Raises:\n#     TimeoutError: If timeout is reached\n#     Exception: If job fails\ndef wait_job(job_id, timeout: dt.timedelta | int | float | None = None, verbose: bool = False, cleanup: bool = True, assert_result_is_not_none: bool = False)\n\n# Cancel a specific job by ID.\n# \n# Args:\n#     job_id: UUID of the job to cancel\n#     reason: Optional reason for cancellation\n# \n# Returns:\n#     Response message from the cancel endpoint\ndef cancel_job(job_id: str, reason: str = None) -> str\n\n# Cancel currently running executions of the same script.\ndef cancel_running() -> dict\n\n# Get job details by ID.\n# \n# Args:\n#     job_id: UUID of the job\n# \n# Returns:\n#     Job details dictionary\ndef get_job(job_id: str) -> dict\n\n# Get the root job ID for a flow hierarchy.\n# \n# Args:\n#     job_id: Job ID (defaults to current WM_JOB_ID)\n# \n# Returns:\n#     Root job ID\ndef get_root_job_id(job_id: str | None = None) -> dict\n\n# Get an OIDC JWT token for authentication to external services.\n# \n# Args:\n#     audience: Token audience (e.g., \"vault\", \"aws\")\n#     expires_in: Optional expiration time in seconds\n# \n# Returns:\n#     JWT token string\ndef get_id_token(audience: str, expires_in: int | None = None) -> str\n\n# Get the status of a job.\n# \n# Args:\n#     job_id: UUID of the job\n# \n# Returns:\n#     Job status: \"RUNNING\", \"WAITING\", or \"COMPLETED\"\ndef get_job_status(job_id: str) -> JobStatus\n\n# Get the result of a completed job.\n# \n# Args:\n#     job_id: UUID of the completed job\n#     assert_result_is_not_none: Raise exception if result is None\n# \n# Returns:\n#     Job result\ndef get_result(job_id: str, assert_result_is_not_none: bool = True) -> Any\n\n# Get a variable value by path.\n# \n# Args:\n#     path: Variable path in Windmill\n# \n# Returns:\n#     Variable value as string\ndef get_variable(path: str) -> str\n\n# Set a variable value by path, creating it if it doesn't exist.\n# \n# Args:\n#     path: Variable path in Windmill\n#     value: Variable value to set\n#     is_secret: Whether the variable should be secret (default: False)\ndef set_variable(path: str, value: str, is_secret: bool = False) -> None\n\n# Get a resource value by path.\n# \n# Args:\n#     path: Resource path in Windmill\n#     none_if_undefined: Return None instead of raising if not found\n#     interpolated: if variables and resources are fully unrolled\n# \n# Returns:\n#     Resource value dictionary or None\ndef get_resource(path: str, none_if_undefined: bool = False, interpolated: bool = True) -> dict | None\n\n# Set a resource value by path, creating it if it doesn't exist.\n# \n# Args:\n#     value: Resource value to set\n#     path: Resource path in Windmill\n#     resource_type: Resource type for creation\ndef set_resource(value: Any, path: str, resource_type: str)\n\n# List resources from Windmill workspace.\n# \n# Args:\n#     resource_type: Optional resource type to filter by (e.g., \"postgresql\", \"mysql\", \"s3\")\n#     page: Optional page number for pagination\n#     per_page: Optional number of results per page\n#     \n# Returns:\n#     List of resource dictionaries\ndef list_resources(resource_type: str = None, page: int = None, per_page: int = None) -> list[dict]\n\n# Set the workflow state.\n# \n# Args:\n#     value: State value to set\n#     path: Optional state resource path override.\ndef set_state(value: Any, path: str | None = None) -> None\n\n# Get the workflow state.\n# \n# Args:\n#     path: Optional state resource path override.\n# \n# Returns:\n#     State value or None if not set\ndef get_state(path: str | None = None) -> Any\n\n# Set job progress percentage (0-99).\n# \n# Args:\n#     value: Progress percentage\n#     job_id: Job ID (defaults to current WM_JOB_ID)\ndef set_progress(value: int, job_id: Optional[str] = None)\n\n# Get job progress percentage.\n# \n# Args:\n#     job_id: Job ID (defaults to current WM_JOB_ID)\n# \n# Returns:\n#     Progress value (0-100) or None if not set\ndef get_progress(job_id: Optional[str] = None) -> Any\n\n# Set the user state of a flow at a given key\ndef set_flow_user_state(key: str, value: Any) -> None\n\n# Get the user state of a flow at a given key\ndef get_flow_user_state(key: str) -> Any\n\n# Get the Windmill server version.\n# \n# Returns:\n#     Version string\ndef version()\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from DuckDB\ndef get_duckdb_connection_settings(s3_resource_path: str = '') -> DuckDbConnectionSettings | None\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from Polars\ndef get_polars_connection_settings(s3_resource_path: str = '') -> PolarsConnectionSettings\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection using boto3\ndef get_boto3_connection_settings(s3_resource_path: str = '') -> Boto3ConnectionSettings\n\n# Load a file from the workspace s3 bucket and returns its content as bytes.\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# my_obj_content = client.load_s3_file(s3_obj)\n# file_content = my_obj_content.decode(\"utf-8\")\n# '''\ndef load_s3_file(s3object: S3Object | str, s3_resource_path: str | None) -> bytes\n\n# Load a file from the workspace s3 bucket and returns the bytes stream.\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# with wmill.load_s3_file_reader(s3object, s3_resource_path) as file_reader:\n#     print(file_reader.read())\n# '''\ndef load_s3_file_reader(s3object: S3Object | str, s3_resource_path: str | None) -> BufferedReader\n\n# Write a file to the workspace S3 bucket\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# \n# # for an in memory bytes array:\n# file_content = b'Hello Windmill!'\n# client.write_s3_file(s3_obj, file_content)\n# \n# # for a file:\n# with open(\"my_file.txt\", \"rb\") as my_file:\n#     client.write_s3_file(s3_obj, my_file)\n# '''\ndef write_s3_file(s3object: S3Object | str | None, file_content: BufferedReader | bytes, s3_resource_path: str | None, content_type: str | None = None, content_disposition: str | None = None) -> S3Object\n\n# Permanently delete a file from the workspace S3 bucket.\n# \n# '''python\n# from wmill import S3Object\n# \n# s3_obj = S3Object(s3=\"/path/to/my_file.txt\")\n# client.delete_s3_object(s3_obj)\n# '''\ndef delete_s3_object(s3object: S3Object | str, s3_resource_path: str | None = None) -> None\n\n# Sign S3 objects for use by anonymous users in public apps.\n# \n# Args:\n#     s3_objects: List of S3 objects to sign\n# \n# Returns:\n#     List of signed S3 objects\ndef sign_s3_objects(s3_objects: list[S3Object | str]) -> list[S3Object]\n\n# Sign a single S3 object for use by anonymous users in public apps.\n# \n# Args:\n#     s3_object: S3 object to sign\n# \n# Returns:\n#     Signed S3 object\ndef sign_s3_object(s3_object: S3Object | str) -> S3Object\n\n# Generate presigned public URLs for an array of S3 objects.\n# If an S3 object is not signed yet, it will be signed first.\n# \n# Args:\n#     s3_objects: List of S3 objects to sign\n#     base_url: Optional base URL for the presigned URLs (defaults to WM_BASE_URL)\n# \n# Returns:\n#     List of signed public URLs\n# \n# Example:\n#     >>> s3_objs = [S3Object(s3=\"/path/to/file1.txt\"), S3Object(s3=\"/path/to/file2.txt\")]\n#     >>> urls = client.get_presigned_s3_public_urls(s3_objs)\ndef get_presigned_s3_public_urls(s3_objects: list[S3Object | str], base_url: str | None = None) -> list[str]\n\n# Generate a presigned public URL for an S3 object.\n# If the S3 object is not signed yet, it will be signed first.\n# \n# Args:\n#     s3_object: S3 object to sign\n#     base_url: Optional base URL for the presigned URL (defaults to WM_BASE_URL)\n# \n# Returns:\n#     Signed public URL\n# \n# Example:\n#     >>> s3_obj = S3Object(s3=\"/path/to/file.txt\")\n#     >>> url = client.get_presigned_s3_public_url(s3_obj)\ndef get_presigned_s3_public_url(s3_object: S3Object | str, base_url: str | None = None) -> str\n\n# Get the current user information.\n# \n# Returns:\n#     User details dictionary\ndef whoami() -> dict\n\n# Get the current user information (alias for whoami).\n# \n# Returns:\n#     User details dictionary\ndef user() -> dict\n\n# Get the state resource path from environment.\n# \n# Returns:\n#     State path string\ndef state_path() -> str\n\n# Get the workflow state.\n# \n# Returns:\n#     State value or None if not set\ndef state() -> Any\n\n# Set the state in the shared folder using pickle\ndef set_shared_state_pickle(value: Any, path: str = 'state.pickle') -> None\n\n# Get the state in the shared folder using pickle\ndef get_shared_state_pickle(path: str = 'state.pickle') -> Any\n\n# Set the state in the shared folder using pickle\ndef set_shared_state(value: Any, path: str = 'state.json') -> None\n\n# Get the state in the shared folder using pickle\ndef get_shared_state(path: str = 'state.json') -> None\n\n# Get URLs needed for resuming a flow after suspension.\n# \n# Args:\n#     approver: Optional approver name\n#     flow_level: If True, generate resume URLs for the parent flow instead of the\n#         specific step. This allows pre-approvals that can be consumed by any later\n#         suspend step in the same flow.\n# \n# Returns:\n#     Dictionary with approvalPage, resume, and cancel URLs\ndef get_resume_urls(approver: str = None, flow_level: bool = None) -> dict\n\n# Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.\n# \n# **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the \"Advanced -> Suspend -> Form\" functionality.\n# Learn more at: https://www.windmill.dev/docs/flows/flow_approval#form\n# \n# :param slack_resource_path: The path to the Slack resource in Windmill.\n# :type slack_resource_path: str\n# :param channel_id: The Slack channel ID where the approval request will be sent.\n# :type channel_id: str\n# :param message: Optional custom message to include in the Slack approval request.\n# :type message: str, optional\n# :param approver: Optional user ID or name of the approver for the request.\n# :type approver: str, optional\n# :param default_args_json: Optional dictionary defining or overriding the default arguments for form fields.\n# :type default_args_json: dict, optional\n# :param dynamic_enums_json: Optional dictionary overriding the enum default values of enum form fields.\n# :type dynamic_enums_json: dict, optional\n# \n# :raises Exception: If the function is not called within a flow or flow preview.\n# :raises Exception: If the required flow job or flow step environment variables are not set.\n# \n# :return: None\n# \n# **Usage Example:**\n#     >>> client.request_interactive_slack_approval(\n#     ...     slack_resource_path=\"/u/alex/my_slack_resource\",\n#     ...     channel_id=\"admins-slack-channel\",\n#     ...     message=\"Please approve this request\",\n#     ...     approver=\"approver123\",\n#     ...     default_args_json={\"key1\": \"value1\", \"key2\": 42},\n#     ...     dynamic_enums_json={\"foo\": [\"choice1\", \"choice2\"], \"bar\": [\"optionA\", \"optionB\"]},\n#     ... )\n# \n# **Notes:**\n# - This function must be executed within a Windmill flow or flow preview.\n# - The function checks for required environment variables (`WM_FLOW_JOB_ID`, `WM_FLOW_STEP_ID`) to ensure it is run in the appropriate context.\ndef request_interactive_slack_approval(slack_resource_path: str, channel_id: str, message: str = None, approver: str = None, default_args_json: dict = None, dynamic_enums_json: dict = None) -> None\n\n# Get email from workspace username\n# This method is particularly useful for apps that require the email address of the viewer.\n# Indeed, in the viewer context WM_USERNAME is set to the username of the viewer but WM_EMAIL is set to the email of the creator of the app.\ndef username_to_email(username: str) -> str\n\n# Send a message to a Microsoft Teams conversation with conversation_id, where success is used to style the message\ndef send_teams_message(conversation_id: str, text: str, success: bool = True, card_block: dict = None)\n\n# Get a DataTable client for SQL queries.\n# \n# Args:\n#     name: Database name (default: \"main\")\n# \n# Returns:\n#     DataTableClient instance\ndef datatable(name: str = 'main')\n\n# Get a DuckLake client for DuckDB queries.\n# \n# Args:\n#     name: Database name (default: \"main\")\n# \n# Returns:\n#     DucklakeClient instance\ndef ducklake(name: str = 'main')\n\ndef init_global_client(f)\n\ndef deprecate(in_favor_of: str)\n\n# Get the current workspace ID.\n# \n# Returns:\n#     Workspace ID string\ndef get_workspace() -> str\n\ndef get_version() -> str\n\n# Run a script synchronously by hash and return its result.\n# \n# Args:\n#     hash: Script hash\n#     args: Script arguments\n#     verbose: Enable verbose logging\n#     assert_result_is_not_none: Raise exception if result is None\n#     cleanup: Register cleanup handler to cancel job on exit\n#     timeout: Maximum time to wait\n# \n# Returns:\n#     Script result\ndef run_script_sync(hash: str, args: Dict[str, Any] = None, verbose: bool = False, assert_result_is_not_none: bool = True, cleanup: bool = True, timeout: dt.timedelta = None) -> Any\n\n# Run a script synchronously by path and return its result.\n# \n# Args:\n#     path: Script path\n#     args: Script arguments\n#     verbose: Enable verbose logging\n#     assert_result_is_not_none: Raise exception if result is None\n#     cleanup: Register cleanup handler to cancel job on exit\n#     timeout: Maximum time to wait\n# \n# Returns:\n#     Script result\ndef run_script_by_path_sync(path: str, args: Dict[str, Any] = None, verbose: bool = False, assert_result_is_not_none: bool = True, cleanup: bool = True, timeout: dt.timedelta = None) -> Any\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from DuckDB\ndef duckdb_connection_settings(s3_resource_path: str = '') -> DuckDbConnectionSettings\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection from Polars\ndef polars_connection_settings(s3_resource_path: str = '') -> PolarsConnectionSettings\n\n# Convenient helpers that takes an S3 resource as input and returns the settings necessary to\n# initiate an S3 connection using boto3\ndef boto3_connection_settings(s3_resource_path: str = '') -> Boto3ConnectionSettings\n\n# Get the state resource path from environment.\n# \n# Returns:\n#     State path string\ndef get_state_path() -> str\n\n# Parse resource syntax from string.\ndef parse_resource_syntax(s: str) -> Optional[str]\n\n# Parse S3 object from string or S3Object format.\ndef parse_s3_object(s3_object: S3Object | str) -> S3Object\n\n# Parse variable syntax from string.\ndef parse_variable_syntax(s: str) -> Optional[str]\n\n# Append a text to the result stream.\n# \n# Args:\n#     text: text to append to the result stream\ndef append_to_result_stream(text: str) -> None\n\n# Stream to the result stream.\n# \n# Args:\n#     stream: stream to stream to the result stream\ndef stream_result(stream) -> None\n\n# Execute a SQL query against the DataTable.\n# \n# Args:\n#     sql: SQL query string with $1, $2, etc. placeholders\n#     *args: Positional arguments to bind to query placeholders\n# \n# Returns:\n#     SqlQuery instance for fetching results\ndef query(sql: str, *args) -> SqlQuery\n\n# Execute query and fetch results.\n# \n# Args:\n#     result_collection: Optional result collection mode\n# \n# Returns:\n#     Query results\ndef fetch(result_collection: str | None = None)\n\n# Execute query and fetch first row of results.\n# \n# Returns:\n#     First row of query results\ndef fetch_one()\n\n# Execute query and fetch first row of results. Return result as a scalar value.\n# \n# Returns:\n#     First row of query result as a scalar value\ndef fetch_one_scalar()\n\n# Execute query and don't return any results.\n#         \ndef execute()\n\n# DuckDB executor requires explicit argument types at declaration\n# These types exist in both DuckDB and Postgres\n# Check that the types exist if you plan to extend this function for other SQL engines.\ndef infer_sql_type(value) -> str\n\ndef parse_sql_client_name(name: str) -> tuple[str, Optional[str]]\n\n# Decorator that marks a function as a workflow task.\n# \n# Works in both WAC v1 (sync, HTTP-based dispatch) and WAC v2\n# (async, checkpoint/replay) modes:\n# \n# - **v2 (inside @workflow)**: dispatches as a checkpoint step.\n# - **v1 (WM_JOB_ID set, no @workflow)**: dispatches via HTTP API.\n# - **Standalone**: executes the function body directly.\n# \n# Usage::\n# \n#     @task\n#     async def extract_data(url: str): ...\n# \n#     @task(path=\"f/external_script\", timeout=600, tag=\"gpu\")\n#     async def run_external(x: int): ...\ndef task(_func = None, path: Optional[str] = None, tag: Optional[str] = None, timeout: Optional[int] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None)\n\n# Create a task that dispatches to a separate Windmill script.\n# \n# Usage::\n# \n#     extract = task_script(\"f/data/extract\", timeout=600)\n# \n#     @workflow\n#     async def main():\n#         data = await extract(url=\"https://...\")\ndef task_script(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None)\n\n# Create a task that dispatches to a separate Windmill flow.\n# \n# Usage::\n# \n#     pipeline = task_flow(\"f/etl/pipeline\", priority=10)\n# \n#     @workflow\n#     async def main():\n#         result = await pipeline(input=data)\ndef task_flow(path: str, timeout: Optional[int] = None, tag: Optional[str] = None, cache_ttl: Optional[int] = None, priority: Optional[int] = None, concurrency_limit: Optional[int] = None, concurrency_key: Optional[str] = None, concurrency_time_window_s: Optional[int] = None)\n\n# Decorator marking an async function as a workflow-as-code entry point.\n# \n# The function must be **deterministic**: given the same inputs it must call\n# tasks in the same order on every replay. Branching on task results is fine\n# (results are replayed from checkpoint), but branching on external state\n# (current time, random values, external API calls) must use ``step()`` to\n# checkpoint the value so replays see the same result.\ndef workflow(func)\n\n# Execute ``fn`` inline and checkpoint the result.\n# \n# On replay the cached value is returned without re-executing ``fn``.\n# Use for lightweight deterministic operations (timestamps, random IDs,\n# config reads) that should not incur the overhead of a child job.\nasync def step(name: str, fn)\n\n# Server-side sleep \u2014 suspend the workflow for the given duration without holding a worker.\n# \n# Inside a @workflow, the parent job suspends and auto-resumes after ``seconds``.\n# Outside a workflow, falls back to ``asyncio.sleep``.\nasync def sleep(seconds: int)\n\n# Suspend the workflow and wait for an external approval.\n# \n# Use ``get_resume_urls()`` (wrapped in ``step()``) to obtain\n# resume/cancel/approval URLs before calling this function.\n# \n# Returns a dict with ``value`` (form data), ``approver``, and ``approved``.\n# \n# Args:\n#     timeout: Approval timeout in seconds (default 1800).\n#     form: Optional form schema for the approval page.\n#     self_approval: Whether the user who triggered the flow can approve it (default True).\n# \n# Example::\n# \n#     urls = await step(\"urls\", lambda: get_resume_urls())\n#     await step(\"notify\", lambda: send_email(urls[\"approvalPage\"]))\n#     result = await wait_for_approval(timeout=3600)\nasync def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict\n\n# Process items in parallel with optional concurrency control.\n# \n# Each item is processed by calling ``fn(item)``, which should be a @task.\n# Items are dispatched in batches of ``concurrency`` (default: all at once).\n# \n# Example::\n# \n#     @task\n#     async def process(item: str):\n#         ...\n# \n#     results = await parallel(items, process, concurrency=5)\nasync def parallel(items, fn, concurrency: Optional[int] = None)\n\n# Commit Kafka offsets for a trigger with auto_commit disabled.\n# \n# Args:\n#     trigger_path: Path to the Kafka trigger (from event['wm_trigger']['trigger_path'])\n#     topic: Kafka topic name (from event['topic'])\n#     partition: Partition number (from event['partition'])\n#     offset: Message offset to commit (from event['offset'])\ndef commit_kafka_offsets(trigger_path: str, topic: str, partition: int, offset: int) -> None\n\n";
@@ -9,24 +9,24 @@ export declare const WAC_SDK_PYTHON = "## Python Workflow-as-Code API (wmill)\n\
 export declare const DATATABLE_SDK_TYPESCRIPT = "## TypeScript Datatable API (windmill-client)\n\nImport: `import * as wmill from 'windmill-client'`\n\nSQL statement object with query content, arguments, and execution methods\n```typescript\ntype SqlStatement<T> = {\n  /** Raw SQL content with formatted arguments */\n  content: string;\n\n  /** Argument values keyed by parameter name */\n  args: Record<string, any>;\n\n  /**\n  * Execute the SQL query and return results\n  * @param params - Optional parameters including result collection mode\n  * @returns Query results based on the result collection mode\n  */\n  fetch<ResultCollectionT extends ResultCollection = \"last_statement_all_rows\">(\n  params?: FetchParams<ResultCollectionT | ResultCollection> // The union is for auto-completion\n  ): Promise<SqlResult<T, ResultCollectionT>>;\n\n  /**\n  * Execute the SQL query and return only the first row\n  * @param params - Optional parameters\n  * @returns First row of the query result\n  */\n  fetchOne(\n  params?: Omit<FetchParams<\"last_statement_first_row\">, \"resultCollection\">\n  ): Promise<SqlResult<T, \"last_statement_first_row\">>;\n\n  /**\n  * Execute the SQL query and return only the first row as a scalar value\n  * @param params - Optional parameters\n  * @returns First row of the query result\n  */\n  fetchOneScalar(\n  params?: Omit<\n  FetchParams<\"last_statement_first_row_scalar\">,\n  \"resultCollection\"\n  >\n  ): Promise<SqlResult<T, \"last_statement_first_row_scalar\">>;\n\n  /**\n  * Execute the SQL query without fetching rows\n  * @param params - Optional parameters\n  */\n  execute(\n  params?: Omit<FetchParams<\"last_statement_first_row\">, \"resultCollection\">\n  ): Promise<void>;\n};\n```\n\n```typescript\n// Template tag function: sql`SELECT * FROM table WHERE id = ${id}`.fetch()\ninterface DatatableSqlTemplateFunction {\n  // Tagged template usage:\n  <T = any>(strings: TemplateStringsArray, ...values: any[]): SqlStatement<T>;\n  query<T = any>(sql: string, ...params: any[]): SqlStatement<T>;\n};\n```\n\nCreate a SQL template function for PostgreSQL/datatable queries\n@param name - Database/datatable name (default: \"main\")\n@returns SQL template function for building parameterized queries\n@example\nlet sql = wmill.datatable()\nlet name = 'Robin'\nlet age = 21\nawait sql`\n  SELECT * FROM friends\n    WHERE name = ${name} AND age = ${age}::int\n`.fetch()\n```typescript\nfunction datatable(name: string = \"main\"): DatatableSqlTemplateFunction\n```\n";
 export declare const DATATABLE_SDK_PYTHON = "## Python Datatable API (wmill)\n\nImport: `import wmill`\n\n# Get a DataTable client for SQL queries.\n# \n# Args:\n#     name: Database name (default: \"main\")\n# \n# Returns:\n#     DataTableClient instance\ndef datatable(name: str = 'main') -> DataTableClient\n\n# Client for executing SQL queries against Windmill DataTables.\nclass DataTableClient:\n    # Initialize DataTableClient.\n    # \n    # Args:\n    #     client: Windmill client instance\n    #     name: DataTable name\n    def __init__(client: Windmill, name: str)\n\n    # Execute a SQL query against the DataTable.\n    # \n    # Args:\n    #     sql: SQL query string with $1, $2, etc. placeholders\n    #     *args: Positional arguments to bind to query placeholders\n    # \n    # Returns:\n    #     SqlQuery instance for fetching results\n    def query(sql: str, *args) -> SqlQuery\n\n\n# Query result handler for DataTable and DuckLake queries.\nclass SqlQuery:\n    # Initialize SqlQuery.\n    # \n    # Args:\n    #     sql: SQL query string\n    #     fetch_fn: Function to execute the query\n    def __init__(sql: str, fetch_fn)\n\n    # Execute query and fetch results.\n    # \n    # Args:\n    #     result_collection: Optional result collection mode\n    # \n    # Returns:\n    #     Query results\n    def fetch(result_collection: str | None = None)\n\n    # Execute query and fetch first row of results.\n    # \n    # Returns:\n    #     First row of query results\n    def fetch_one()\n\n    # Execute query and fetch first row of results. Return result as a scalar value.\n    # \n    # Returns:\n    #     First row of query result as a scalar value\n    def fetch_one_scalar()\n\n    # Execute query and don't return any results.\n    #         \n    def execute()\n\n\n";
 export declare const OPENFLOW_SCHEMA = "## OpenFlow Schema\n\n{\"OpenFlow\":{\"type\":\"object\",\"description\":\"Top-level flow definition containing metadata, configuration, and the flow structure\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Short description of what this flow does\"},\"description\":{\"type\":\"string\",\"description\":\"Detailed documentation for this flow\"},\"value\":{\"$ref\":\"#/components/schemas/FlowValue\"},\"schema\":{\"type\":\"object\",\"description\":\"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')\"},\"on_behalf_of_email\":{\"type\":\"string\",\"description\":\"The flow will be run with the permissions of the user with this email.\"}},\"required\":[\"summary\",\"value\"]},\"FlowValue\":{\"type\":\"object\",\"description\":\"The flow structure containing modules and optional preprocessor/failure handlers\",\"properties\":{\"modules\":{\"type\":\"array\",\"description\":\"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"failure_module\":{\"description\":\"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types\",\"$ref\":\"#/components/schemas/FlowModule\"},\"preprocessor_module\":{\"description\":\"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results\",\"$ref\":\"#/components/schemas/FlowModule\"},\"same_worker\":{\"type\":\"boolean\",\"description\":\"If true, all steps run on the same worker for better performance\"},\"concurrent_limit\":{\"type\":\"number\",\"description\":\"Maximum number of concurrent executions of this flow\"},\"concurrency_key\":{\"type\":\"string\",\"description\":\"Expression to group concurrent executions (e.g., by user ID)\"},\"concurrency_time_window_s\":{\"type\":\"number\",\"description\":\"Time window in seconds for concurrent_limit\"},\"debounce_delay_s\":{\"type\":\"integer\",\"description\":\"Delay in seconds to debounce flow executions\"},\"debounce_key\":{\"type\":\"string\",\"description\":\"Expression to group debounced executions\"},\"debounce_args_to_accumulate\":{\"type\":\"array\",\"description\":\"Arguments to accumulate across debounced executions\",\"items\":{\"type\":\"string\"}},\"max_total_debouncing_time\":{\"type\":\"integer\",\"description\":\"Maximum total time in seconds that a job can be debounced\"},\"max_total_debounces_amount\":{\"type\":\"integer\",\"description\":\"Maximum number of times a job can be debounced\"},\"skip_expr\":{\"type\":\"string\",\"description\":\"JavaScript expression to conditionally skip the entire flow\"},\"cache_ttl\":{\"type\":\"number\",\"description\":\"Cache duration in seconds for flow results\"},\"cache_ignore_s3_path\":{\"type\":\"boolean\"},\"delete_after_secs\":{\"type\":\"integer\",\"description\":\"If set, delete the flow job's args, result and logs after this many seconds following job completion\"},\"flow_env\":{\"type\":\"object\",\"description\":\"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).\",\"additionalProperties\":{}},\"priority\":{\"type\":\"number\",\"description\":\"Execution priority (higher numbers run first)\"},\"early_return\":{\"type\":\"string\",\"description\":\"JavaScript expression to return early from the flow\"},\"chat_input_enabled\":{\"type\":\"boolean\",\"description\":\"Whether this flow accepts chat-style input\"},\"notes\":{\"type\":\"array\",\"description\":\"Sticky notes attached to the flow\",\"items\":{\"$ref\":\"#/components/schemas/FlowNote\"}},\"groups\":{\"type\":\"array\",\"description\":\"Semantic groups of modules for organizational purposes\",\"items\":{\"$ref\":\"#/components/schemas/FlowGroup\"}}},\"required\":[\"modules\"]},\"Retry\":{\"type\":\"object\",\"description\":\"Retry configuration for failed module executions\",\"properties\":{\"constant\":{\"type\":\"object\",\"description\":\"Retry with constant delay between attempts\",\"properties\":{\"attempts\":{\"type\":\"integer\",\"description\":\"Number of retry attempts\"},\"seconds\":{\"type\":\"integer\",\"description\":\"Seconds to wait between retries\"}}},\"exponential\":{\"type\":\"object\",\"description\":\"Retry with exponential backoff (delay doubles each time)\",\"properties\":{\"attempts\":{\"type\":\"integer\",\"description\":\"Number of retry attempts\"},\"multiplier\":{\"type\":\"integer\",\"description\":\"Multiplier for exponential backoff\"},\"seconds\":{\"type\":\"integer\",\"minimum\":1,\"description\":\"Initial delay in seconds\"},\"random_factor\":{\"type\":\"integer\",\"minimum\":0,\"maximum\":100,\"description\":\"Random jitter percentage (0-100) to avoid thundering herd\"}}},\"retry_if\":{\"$ref\":\"#/components/schemas/RetryIf\"}}},\"FlowNote\":{\"type\":\"object\",\"description\":\"A sticky note attached to a flow for documentation and annotation\",\"properties\":{\"id\":{\"type\":\"string\",\"description\":\"Unique identifier for the note\"},\"text\":{\"type\":\"string\",\"description\":\"Content of the note\"},\"position\":{\"type\":\"object\",\"description\":\"Position of the note in the flow editor\",\"properties\":{\"x\":{\"type\":\"number\",\"description\":\"X coordinate\"},\"y\":{\"type\":\"number\",\"description\":\"Y coordinate\"}},\"required\":[\"x\",\"y\"]},\"size\":{\"type\":\"object\",\"description\":\"Size of the note in the flow editor\",\"properties\":{\"width\":{\"type\":\"number\",\"description\":\"Width in pixels\"},\"height\":{\"type\":\"number\",\"description\":\"Height in pixels\"}},\"required\":[\"width\",\"height\"]},\"color\":{\"type\":\"string\",\"description\":\"Color of the note (e.g., \\\"yellow\\\", \\\"#ffff00\\\")\"},\"type\":{\"type\":\"string\",\"enum\":[\"free\",\"group\"],\"description\":\"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes\"},\"locked\":{\"type\":\"boolean\",\"default\":false,\"description\":\"Whether the note is locked and cannot be edited or moved\"},\"contained_node_ids\":{\"type\":\"array\",\"items\":{\"type\":\"string\"},\"description\":\"For group notes, the IDs of nodes contained within this group\"}},\"required\":[\"id\",\"text\",\"color\",\"type\"]},\"FlowGroup\":{\"type\":\"object\",\"description\":\"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Display name for this group\"},\"note\":{\"type\":\"string\",\"description\":\"Markdown note shown below the group header\"},\"autocollapse\":{\"type\":\"boolean\",\"default\":false,\"description\":\"If true, this group is collapsed by default in the flow editor. UI hint only.\"},\"start_id\":{\"type\":\"string\",\"description\":\"ID of the first flow module in this group (topological entry point)\"},\"end_id\":{\"type\":\"string\",\"description\":\"ID of the last flow module in this group (topological exit point)\"},\"color\":{\"type\":\"string\",\"description\":\"Color for the group in the flow editor\"}},\"required\":[\"start_id\",\"end_id\"]},\"RetryIf\":{\"type\":\"object\",\"description\":\"Conditional retry based on error or result\",\"properties\":{\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables\"}},\"required\":[\"expr\"]},\"StopAfterIf\":{\"type\":\"object\",\"description\":\"Early termination condition for a module\",\"properties\":{\"skip_if_stopped\":{\"type\":\"boolean\",\"description\":\"If true, following steps are skipped when this condition triggers\"},\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop\"},\"error_message\":{\"type\":\"string\",\"nullable\":true,\"description\":\"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised.\"}},\"required\":[\"expr\"]},\"FlowModule\":{\"type\":\"object\",\"description\":\"A single step in a flow. Can be a script, subflow, loop, or branch\",\"properties\":{\"id\":{\"type\":\"string\",\"description\":\"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)\"},\"value\":{\"$ref\":\"#/components/schemas/FlowModuleValue\"},\"stop_after_if\":{\"description\":\"Early termination condition evaluated after this step completes\",\"$ref\":\"#/components/schemas/StopAfterIf\"},\"stop_after_all_iters_if\":{\"description\":\"For loops only - early termination condition evaluated after all iterations complete\",\"$ref\":\"#/components/schemas/StopAfterIf\"},\"skip_if\":{\"type\":\"object\",\"description\":\"Conditionally skip this step based on previous results or flow inputs\",\"properties\":{\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'\"}},\"required\":[\"expr\"]},\"sleep\":{\"description\":\"Delay before executing this step (in seconds or as expression)\",\"$ref\":\"#/components/schemas/InputTransform\"},\"cache_ttl\":{\"type\":\"number\",\"description\":\"Cache duration in seconds for this step's results\"},\"cache_ignore_s3_path\":{\"type\":\"boolean\"},\"timeout\":{\"description\":\"Maximum execution time in seconds (static value or expression)\",\"$ref\":\"#/components/schemas/InputTransform\"},\"delete_after_secs\":{\"type\":\"integer\",\"description\":\"If set, delete the step's args, result and logs after this many seconds following job completion\"},\"summary\":{\"type\":\"string\",\"description\":\"Short description of what this step does\"},\"mock\":{\"type\":\"object\",\"description\":\"Mock configuration for testing without executing the actual step\",\"properties\":{\"enabled\":{\"type\":\"boolean\",\"description\":\"If true, return mock value instead of executing\"},\"return_value\":{\"description\":\"Value to return when mocked\"}}},\"suspend\":{\"type\":\"object\",\"description\":\"Configuration for approval/resume steps that wait for user input\",\"properties\":{\"required_events\":{\"type\":\"integer\",\"description\":\"Number of approvals required before continuing\"},\"timeout\":{\"type\":\"integer\",\"description\":\"Timeout in seconds before auto-continuing or canceling\"},\"resume_form\":{\"type\":\"object\",\"description\":\"Form schema for collecting input when resuming\",\"properties\":{\"schema\":{\"type\":\"object\",\"description\":\"JSON Schema for the resume form\"}}},\"user_auth_required\":{\"type\":\"boolean\",\"description\":\"If true, only authenticated users can approve\"},\"user_groups_required\":{\"description\":\"Expression or list of groups that can approve\",\"$ref\":\"#/components/schemas/InputTransform\"},\"self_approval_disabled\":{\"type\":\"boolean\",\"description\":\"If true, the user who started the flow cannot approve\"},\"hide_cancel\":{\"type\":\"boolean\",\"description\":\"If true, hide the cancel button on the approval form\"},\"continue_on_disapprove_timeout\":{\"type\":\"boolean\",\"description\":\"If true, continue flow on timeout instead of canceling\"}}},\"priority\":{\"type\":\"number\",\"description\":\"Execution priority for this step (higher numbers run first)\"},\"continue_on_error\":{\"type\":\"boolean\",\"description\":\"If true, flow continues even if this step fails\"},\"retry\":{\"description\":\"Retry configuration if this step fails\",\"$ref\":\"#/components/schemas/Retry\"},\"debouncing\":{\"description\":\"Debounce configuration for this step (EE only)\",\"type\":\"object\",\"properties\":{\"debounce_delay_s\":{\"type\":\"integer\",\"description\":\"Delay in seconds to debounce this step's executions across flow runs\"},\"debounce_key\":{\"type\":\"string\",\"description\":\"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>\"},\"debounce_args_to_accumulate\":{\"type\":\"array\",\"description\":\"Array-type arguments to accumulate across debounced executions\",\"items\":{\"type\":\"string\"}},\"max_total_debouncing_time\":{\"type\":\"integer\",\"description\":\"Maximum total time in seconds before forced execution\"},\"max_total_debounces_amount\":{\"type\":\"integer\",\"description\":\"Maximum number of debounces before forced execution\"}}}},\"required\":[\"value\",\"id\"]},\"InputTransform\":{\"description\":\"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs\",\"oneOf\":[{\"$ref\":\"#/components/schemas/StaticTransform\"},{\"$ref\":\"#/components/schemas/JavascriptTransform\"},{\"$ref\":\"#/components/schemas/AiTransform\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"static\":\"#/components/schemas/StaticTransform\",\"javascript\":\"#/components/schemas/JavascriptTransform\",\"ai\":\"#/components/schemas/AiTransform\"}}},\"StaticTransform\":{\"type\":\"object\",\"description\":\"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'\",\"properties\":{\"value\":{\"description\":\"The static value. For resources, use format '$res:path/to/resource'\"},\"type\":{\"type\":\"string\",\"enum\":[\"static\"]}},\"required\":[\"type\"]},\"JavascriptTransform\":{\"type\":\"object\",\"description\":\"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value\",\"properties\":{\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)\"},\"type\":{\"type\":\"string\",\"enum\":[\"javascript\"]}},\"required\":[\"expr\",\"type\"]},\"AiTransform\":{\"type\":\"object\",\"description\":\"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"ai\"]}},\"required\":[\"type\"]},\"AIProviderKind\":{\"type\":\"string\",\"description\":\"Supported AI provider types\",\"enum\":[\"openai\",\"azure_openai\",\"anthropic\",\"mistral\",\"deepseek\",\"googleai\",\"groq\",\"openrouter\",\"togetherai\",\"customai\",\"aws_bedrock\"]},\"ProviderConfig\":{\"type\":\"object\",\"description\":\"Complete AI provider configuration with resource reference and model selection\",\"properties\":{\"kind\":{\"$ref\":\"#/components/schemas/AIProviderKind\"},\"resource\":{\"type\":\"string\",\"description\":\"Resource reference in format '$res:{resource_path}' pointing to provider credentials\"},\"model\":{\"type\":\"string\",\"description\":\"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')\"}},\"required\":[\"kind\",\"resource\",\"model\"]},\"StaticProviderTransform\":{\"type\":\"object\",\"description\":\"Static provider configuration passed directly to the AI agent\",\"properties\":{\"value\":{\"$ref\":\"#/components/schemas/ProviderConfig\"},\"type\":{\"type\":\"string\",\"enum\":[\"static\"]}},\"required\":[\"type\",\"value\"]},\"ProviderTransform\":{\"description\":\"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined\",\"oneOf\":[{\"$ref\":\"#/components/schemas/StaticProviderTransform\"},{\"$ref\":\"#/components/schemas/JavascriptTransform\"},{\"$ref\":\"#/components/schemas/AiTransform\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"static\":\"#/components/schemas/StaticProviderTransform\",\"javascript\":\"#/components/schemas/JavascriptTransform\",\"ai\":\"#/components/schemas/AiTransform\"}}},\"MemoryOff\":{\"type\":\"object\",\"description\":\"No conversation memory/context\",\"properties\":{\"kind\":{\"type\":\"string\",\"enum\":[\"off\"]}},\"required\":[\"kind\"]},\"MemoryAuto\":{\"type\":\"object\",\"description\":\"Automatic context management\",\"properties\":{\"kind\":{\"type\":\"string\",\"enum\":[\"auto\"]},\"context_length\":{\"type\":\"integer\",\"description\":\"Maximum number of messages to retain in context\"},\"memory_id\":{\"type\":\"string\",\"description\":\"Identifier for persistent memory across agent invocations\"}},\"required\":[\"kind\"]},\"MemoryMessage\":{\"type\":\"object\",\"description\":\"A single message in conversation history\",\"properties\":{\"role\":{\"type\":\"string\",\"enum\":[\"user\",\"assistant\",\"system\"]},\"content\":{\"type\":\"string\"}},\"required\":[\"role\",\"content\"]},\"MemoryManual\":{\"type\":\"object\",\"description\":\"Explicit message history\",\"properties\":{\"kind\":{\"type\":\"string\",\"enum\":[\"manual\"]},\"messages\":{\"type\":\"array\",\"items\":{\"$ref\":\"#/components/schemas/MemoryMessage\"}}},\"required\":[\"kind\",\"messages\"]},\"MemoryConfig\":{\"description\":\"Conversation memory configuration\",\"oneOf\":[{\"$ref\":\"#/components/schemas/MemoryOff\"},{\"$ref\":\"#/components/schemas/MemoryAuto\"},{\"$ref\":\"#/components/schemas/MemoryManual\"}],\"discriminator\":{\"propertyName\":\"kind\",\"mapping\":{\"off\":\"#/components/schemas/MemoryOff\",\"auto\":\"#/components/schemas/MemoryAuto\",\"manual\":\"#/components/schemas/MemoryManual\"}}},\"StaticMemoryTransform\":{\"type\":\"object\",\"description\":\"Static memory configuration passed directly to the AI agent\",\"properties\":{\"value\":{\"$ref\":\"#/components/schemas/MemoryConfig\"},\"type\":{\"type\":\"string\",\"enum\":[\"static\"]}},\"required\":[\"type\",\"value\"]},\"MemoryTransform\":{\"description\":\"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined\",\"oneOf\":[{\"$ref\":\"#/components/schemas/StaticMemoryTransform\"},{\"$ref\":\"#/components/schemas/JavascriptTransform\"},{\"$ref\":\"#/components/schemas/AiTransform\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"static\":\"#/components/schemas/StaticMemoryTransform\",\"javascript\":\"#/components/schemas/JavascriptTransform\",\"ai\":\"#/components/schemas/AiTransform\"}}},\"FlowModuleValue\":{\"description\":\"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type\",\"oneOf\":[{\"$ref\":\"#/components/schemas/RawScript\"},{\"$ref\":\"#/components/schemas/PathScript\"},{\"$ref\":\"#/components/schemas/PathFlow\"},{\"$ref\":\"#/components/schemas/ForloopFlow\"},{\"$ref\":\"#/components/schemas/WhileloopFlow\"},{\"$ref\":\"#/components/schemas/BranchOne\"},{\"$ref\":\"#/components/schemas/BranchAll\"},{\"$ref\":\"#/components/schemas/Identity\"},{\"$ref\":\"#/components/schemas/AiAgent\"}],\"discriminator\":{\"propertyName\":\"type\",\"mapping\":{\"rawscript\":\"#/components/schemas/RawScript\",\"script\":\"#/components/schemas/PathScript\",\"flow\":\"#/components/schemas/PathFlow\",\"forloopflow\":\"#/components/schemas/ForloopFlow\",\"whileloopflow\":\"#/components/schemas/WhileloopFlow\",\"branchone\":\"#/components/schemas/BranchOne\",\"branchall\":\"#/components/schemas/BranchAll\",\"identity\":\"#/components/schemas/Identity\",\"aiagent\":\"#/components/schemas/AiAgent\"}}},\"RawScript\":{\"type\":\"object\",\"description\":\"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments\",\"additionalProperties\":{\"$ref\":\"#/components/schemas/InputTransform\"}},\"content\":{\"type\":\"string\",\"description\":\"The script source code. Should export a 'main' function\"},\"language\":{\"type\":\"string\",\"description\":\"Programming language for this script\",\"enum\":[\"deno\",\"bun\",\"python3\",\"go\",\"bash\",\"powershell\",\"postgresql\",\"mysql\",\"bigquery\",\"snowflake\",\"mssql\",\"oracledb\",\"graphql\",\"nativets\",\"php\",\"rust\",\"ansible\",\"csharp\",\"nu\",\"java\",\"ruby\",\"rlang\",\"duckdb\"]},\"path\":{\"type\":\"string\",\"description\":\"Optional path for saving this script\"},\"lock\":{\"type\":\"string\",\"description\":\"Lock file content for dependencies\"},\"type\":{\"type\":\"string\",\"enum\":[\"rawscript\"]},\"tag\":{\"type\":\"string\",\"description\":\"Worker group tag for execution routing\"},\"concurrent_limit\":{\"type\":\"number\",\"description\":\"Maximum concurrent executions of this script\"},\"concurrency_time_window_s\":{\"type\":\"number\",\"description\":\"Time window for concurrent_limit\"},\"custom_concurrency_key\":{\"type\":\"string\",\"description\":\"Custom key for grouping concurrent executions\"},\"is_trigger\":{\"type\":\"boolean\",\"description\":\"If true, this script is a trigger that can start the flow\"},\"assets\":{\"type\":\"array\",\"description\":\"External resources this script accesses (S3 objects, resources, etc.)\",\"items\":{\"type\":\"object\",\"required\":[\"path\",\"kind\"],\"properties\":{\"path\":{\"type\":\"string\",\"description\":\"Path to the asset\"},\"kind\":{\"type\":\"string\",\"description\":\"Type of asset\",\"enum\":[\"s3object\",\"resource\",\"ducklake\",\"datatable\",\"volume\"]},\"access_type\":{\"type\":\"string\",\"nullable\":true,\"description\":\"Access level for this asset\",\"enum\":[\"r\",\"w\",\"rw\"]},\"alt_access_type\":{\"type\":\"string\",\"nullable\":true,\"description\":\"Alternative access level\",\"enum\":[\"r\",\"w\",\"rw\"]}}}}},\"required\":[\"type\",\"content\",\"language\",\"input_transforms\"]},\"PathScript\":{\"type\":\"object\",\"description\":\"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments\",\"additionalProperties\":{\"$ref\":\"#/components/schemas/InputTransform\"}},\"path\":{\"type\":\"string\",\"description\":\"Path to the script in the workspace (e.g., 'f/scripts/send_email')\"},\"hash\":{\"type\":\"string\",\"description\":\"Optional specific version hash of the script to use\"},\"type\":{\"type\":\"string\",\"enum\":[\"script\"]},\"tag_override\":{\"type\":\"string\",\"description\":\"Override the script's default worker group tag\"},\"is_trigger\":{\"type\":\"boolean\",\"description\":\"If true, this script is a trigger that can start the flow\"}},\"required\":[\"type\",\"path\",\"input_transforms\"]},\"PathFlow\":{\"type\":\"object\",\"description\":\"Reference to an existing flow by path. Use this to call another flow as a subflow\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments\",\"additionalProperties\":{\"$ref\":\"#/components/schemas/InputTransform\"}},\"path\":{\"type\":\"string\",\"description\":\"Path to the flow in the workspace (e.g., 'f/flows/process_user')\"},\"type\":{\"type\":\"string\",\"enum\":[\"flow\"]}},\"required\":[\"type\",\"path\",\"input_transforms\"]},\"ForloopFlow\":{\"type\":\"object\",\"description\":\"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations\",\"properties\":{\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"iterator\":{\"description\":\"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'\",\"$ref\":\"#/components/schemas/InputTransform\"},\"skip_failures\":{\"type\":\"boolean\",\"description\":\"If true, iteration failures don't stop the loop. Failed iterations return null\"},\"type\":{\"type\":\"string\",\"enum\":[\"forloopflow\"]},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency\"},\"parallelism\":{\"description\":\"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression\",\"$ref\":\"#/components/schemas/InputTransform\"},\"squash\":{\"type\":\"boolean\"}},\"required\":[\"modules\",\"iterator\",\"skip_failures\",\"type\"]},\"WhileloopFlow\":{\"type\":\"object\",\"description\":\"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination\",\"properties\":{\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute in each iteration. Use stop_after_if to control when the loop ends\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"skip_failures\":{\"type\":\"boolean\",\"description\":\"If true, iteration failures don't stop the loop. Failed iterations return null\"},\"type\":{\"type\":\"string\",\"enum\":[\"whileloopflow\"]},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, iterations run concurrently (use with caution in while loops)\"},\"parallelism\":{\"description\":\"Maximum number of concurrent iterations when parallel=true\",\"$ref\":\"#/components/schemas/InputTransform\"},\"squash\":{\"type\":\"boolean\"}},\"required\":[\"modules\",\"skip_failures\",\"type\"]},\"BranchOne\":{\"type\":\"object\",\"description\":\"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes\",\"properties\":{\"branches\":{\"type\":\"array\",\"description\":\"Array of branches to evaluate in order. The first branch with expr evaluating to true executes\",\"items\":{\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Short description of this branch condition\"},\"expr\":{\"type\":\"string\",\"description\":\"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins\"},\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute if this branch's expr is true\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}}},\"required\":[\"modules\",\"expr\"]}},\"default\":{\"type\":\"array\",\"description\":\"Steps to execute if no branch expressions match\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}},\"type\":{\"type\":\"string\",\"enum\":[\"branchone\"]}},\"required\":[\"branches\",\"default\",\"type\"]},\"BranchAll\":{\"type\":\"object\",\"description\":\"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently\",\"properties\":{\"branches\":{\"type\":\"array\",\"description\":\"Array of branches that all execute (either in parallel or sequentially)\",\"items\":{\"type\":\"object\",\"properties\":{\"summary\":{\"type\":\"string\",\"description\":\"Short description of this branch's purpose\"},\"skip_failure\":{\"type\":\"boolean\",\"description\":\"If true, failure in this branch doesn't fail the entire flow\"},\"modules\":{\"type\":\"array\",\"description\":\"Steps to execute in this branch\",\"items\":{\"$ref\":\"#/components/schemas/FlowModule\"}}},\"required\":[\"modules\"]}},\"type\":{\"type\":\"string\",\"enum\":[\"branchall\"]},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, all branches execute concurrently. If false, they execute sequentially\"}},\"required\":[\"branches\",\"type\"]},\"AgentTool\":{\"type\":\"object\",\"description\":\"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool\",\"properties\":{\"id\":{\"type\":\"string\",\"description\":\"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')\"},\"summary\":{\"type\":\"string\",\"description\":\"Short description of what this tool does (shown to the AI)\"},\"value\":{\"$ref\":\"#/components/schemas/ToolValue\"}},\"required\":[\"id\",\"value\"]},\"ToolValue\":{\"description\":\"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference\",\"oneOf\":[{\"$ref\":\"#/components/schemas/FlowModuleTool\"},{\"$ref\":\"#/components/schemas/McpToolValue\"},{\"$ref\":\"#/components/schemas/WebsearchToolValue\"}],\"discriminator\":{\"propertyName\":\"tool_type\",\"mapping\":{\"flowmodule\":\"#/components/schemas/FlowModuleTool\",\"mcp\":\"#/components/schemas/McpToolValue\",\"websearch\":\"#/components/schemas/WebsearchToolValue\"}}},\"FlowModuleTool\":{\"description\":\"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module\",\"allOf\":[{\"type\":\"object\",\"properties\":{\"tool_type\":{\"type\":\"string\",\"enum\":[\"flowmodule\"]}},\"required\":[\"tool_type\"]},{\"$ref\":\"#/components/schemas/FlowModuleValue\"}]},\"WebsearchToolValue\":{\"type\":\"object\",\"description\":\"A tool implemented as a websearch tool. The AI can call this like any other websearch tool\",\"properties\":{\"tool_type\":{\"type\":\"string\",\"enum\":[\"websearch\"]}},\"required\":[\"tool_type\"]},\"McpToolValue\":{\"type\":\"object\",\"description\":\"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers\",\"properties\":{\"tool_type\":{\"type\":\"string\",\"enum\":[\"mcp\"]},\"resource_path\":{\"type\":\"string\",\"description\":\"Path to the MCP resource/server configuration\"},\"include_tools\":{\"type\":\"array\",\"description\":\"Whitelist of specific tools to include from this MCP server\",\"items\":{\"type\":\"string\"}},\"exclude_tools\":{\"type\":\"array\",\"description\":\"Blacklist of tools to exclude from this MCP server\",\"items\":{\"type\":\"string\"}}},\"required\":[\"tool_type\",\"resource_path\"]},\"AiAgent\":{\"type\":\"object\",\"description\":\"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task\",\"properties\":{\"input_transforms\":{\"type\":\"object\",\"description\":\"Input parameters for the AI agent mapped to their values\",\"properties\":{\"provider\":{\"$ref\":\"#/components/schemas/ProviderTransform\"},\"output_type\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n\"},\"user_message\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax.\"},\"system_prompt\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"System instructions that guide the AI's behavior, persona, and response style. Optional.\"},\"streaming\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n\"},\"memory\":{\"$ref\":\"#/components/schemas/MemoryTransform\"},\"output_schema\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n\"},\"user_attachments\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n\"},\"max_completion_tokens\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n\"},\"temperature\":{\"allOf\":[{\"$ref\":\"#/components/schemas/InputTransform\"}],\"description\":\"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n\"}},\"required\":[\"provider\",\"user_message\",\"output_type\"]},\"tools\":{\"type\":\"array\",\"description\":\"Array of tools the agent can use. The agent decides which tools to call based on the task\",\"items\":{\"$ref\":\"#/components/schemas/AgentTool\"}},\"type\":{\"type\":\"string\",\"enum\":[\"aiagent\"]},\"omit_output_from_conversation\":{\"type\":\"boolean\",\"default\":false,\"description\":\"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled.\"},\"parallel\":{\"type\":\"boolean\",\"description\":\"If true, the agent can execute multiple tool calls in parallel\"}},\"required\":[\"tools\",\"type\",\"input_transforms\"]},\"Identity\":{\"type\":\"object\",\"description\":\"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"identity\"]},\"flow\":{\"type\":\"boolean\",\"description\":\"If true, marks this as a flow identity (special handling)\"}},\"required\":[\"type\"]},\"FlowStatus\":{\"type\":\"object\",\"properties\":{\"step\":{\"type\":\"integer\"},\"modules\":{\"type\":\"array\",\"items\":{\"$ref\":\"#/components/schemas/FlowStatusModule\"}},\"user_states\":{\"additionalProperties\":true},\"preprocessor_module\":{\"allOf\":[{\"$ref\":\"#/components/schemas/FlowStatusModule\"}]},\"failure_module\":{\"allOf\":[{\"$ref\":\"#/components/schemas/FlowStatusModule\"},{\"type\":\"object\",\"properties\":{\"parent_module\":{\"type\":\"string\"}}}]},\"retry\":{\"type\":\"object\",\"properties\":{\"fail_count\":{\"type\":\"integer\"},\"failed_jobs\":{\"type\":\"array\",\"items\":{\"type\":\"string\",\"format\":\"uuid\"}}}}},\"required\":[\"step\",\"modules\",\"failure_module\"]},\"FlowStatusModule\":{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"WaitingForPriorSteps\",\"WaitingForEvents\",\"WaitingForExecutor\",\"InProgress\",\"Success\",\"Failure\"]},\"id\":{\"type\":\"string\"},\"job\":{\"type\":\"string\",\"format\":\"uuid\"},\"count\":{\"type\":\"integer\"},\"progress\":{\"type\":\"integer\"},\"iterator\":{\"type\":\"object\",\"properties\":{\"index\":{\"type\":\"integer\"},\"itered\":{\"type\":\"array\",\"items\":{}},\"itered_len\":{\"type\":\"integer\"},\"args\":{}}},\"flow_jobs\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}},\"flow_jobs_success\":{\"type\":\"array\",\"items\":{\"type\":\"boolean\"}},\"flow_jobs_duration\":{\"type\":\"object\",\"properties\":{\"started_at\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}},\"duration_ms\":{\"type\":\"array\",\"items\":{\"type\":\"integer\"}}}},\"branch_chosen\":{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"branch\",\"default\"]},\"branch\":{\"type\":\"integer\"}},\"required\":[\"type\"]},\"branchall\":{\"type\":\"object\",\"properties\":{\"branch\":{\"type\":\"integer\"},\"len\":{\"type\":\"integer\"}},\"required\":[\"branch\",\"len\"]},\"approvers\":{\"type\":\"array\",\"items\":{\"type\":\"object\",\"properties\":{\"resume_id\":{\"type\":\"integer\"},\"approver\":{\"type\":\"string\"}},\"required\":[\"resume_id\",\"approver\"]}},\"failed_retries\":{\"type\":\"array\",\"items\":{\"type\":\"string\",\"format\":\"uuid\"}},\"skipped\":{\"type\":\"boolean\"},\"agent_actions\":{\"type\":\"array\",\"items\":{\"type\":\"object\",\"oneOf\":[{\"type\":\"object\",\"properties\":{\"job_id\":{\"type\":\"string\",\"format\":\"uuid\"},\"function_name\":{\"type\":\"string\"},\"type\":{\"type\":\"string\",\"enum\":[\"tool_call\"]},\"module_id\":{\"type\":\"string\"}},\"required\":[\"job_id\",\"function_name\",\"type\",\"module_id\"]},{\"type\":\"object\",\"properties\":{\"call_id\":{\"type\":\"string\",\"format\":\"uuid\"},\"function_name\":{\"type\":\"string\"},\"resource_path\":{\"type\":\"string\"},\"type\":{\"type\":\"string\",\"enum\":[\"mcp_tool_call\"]},\"arguments\":{\"type\":\"object\"}},\"required\":[\"call_id\",\"function_name\",\"resource_path\",\"type\"]},{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"web_search\"]}},\"required\":[\"type\"]},{\"type\":\"object\",\"properties\":{\"type\":{\"type\":\"string\",\"enum\":[\"message\"]}},\"required\":[\"content\",\"type\"]}]}},\"agent_actions_success\":{\"type\":\"array\",\"items\":{\"type\":\"boolean\"}}},\"required\":[\"type\"]}}";
-export declare const CLI_COMMANDS = "# Windmill CLI Commands\n\nThe Windmill CLI (`wmill`) provides commands for managing scripts, flows, apps, and other resources.\n\n## Global Options\n\n- `--workspace <workspace:string>` - Specify the target workspace. This overrides the default workspace.\n- `--debug --verbose` - Show debug/verbose logs\n- `--show-diffs` - Show diff informations when syncing (may show sensitive informations)\n- `--token <token:string>` - Specify an API token. This will override any stored token.\n- `--base-url <baseUrl:string>` - Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.\n- `--config-dir <configDir:string>` - Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.\n\n## Commands\n\n### app\n\napp related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `app list` - list all apps\n  - `--json` - Output as JSON (for piping to jq)\n- `app get <path:string>` - get an app's details\n  - `--json` - Output as JSON (for piping to jq)\n- `app push <file_path:string> <remote_path:string>` - push a local app \n- `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement\n  - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)\n  - `--host <host:string>` - Host to bind the dev server to\n  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)\n  - `--no-open` - Don't automatically open the browser\n- `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability\n  - `--fix` - Attempt to fix common issues (not implemented yet)\n- `app new` - create a new raw app from a template\n  - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.\n  - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.\n  - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.\n  - `--overwrite` - Overwrite the target directory if it already exists, without prompting.\n  - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop.\n- `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace\n- `app set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for an app (requires admin or wm_deployers group)\n\n### audit\n\nView audit logs (requires admin)\n\n**Subcommands:**\n\n- `audit list` - List audit log entries\n- `audit get <id:string>` - Get a specific audit log entry\n  - `--json` - Output as JSON (for piping to jq)\n\n### config\n\nShow all available wmill.yaml configuration options\n\n**Options:**\n- `--json` - Output as JSON for programmatic consumption\n\n**Subcommands:**\n\n- `config migrate` - Migrate wmill.yaml from gitBranches/environments to workspaces format\n\n### dependencies\n\nworkspace dependencies related commands\n\n**Alias:** `deps`\n\n**Subcommands:**\n\n- `dependencies push <file_path:string>` - Push workspace dependencies from a local file\n\n### dev\n\nWatch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace \u2014 use wmill sync push for that.\n\n**Options:**\n- `--includes <pattern...:string>` - Filter paths given a glob pattern or path\n- `--proxy-port <port:number>` - Port for a localhost reverse proxy to the remote Windmill server\n- `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)\n- `--no-open` - Do not open the browser automatically\n\n### docs\n\nSearch Windmill documentation.\n\n**Arguments:** `<query:string>`\n\n**Options:**\n- `--json` - Output results as JSON.\n\n### flow\n\nflow related commands\n\n**Options:**\n- `--show-archived` - Enable archived flows in output\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `flow list` - list all flows\n  - `--show-archived` - Enable archived flows in output\n  - `--json` - Output as JSON (for piping to jq)\n- `flow get <path:string>` - get a flow's details\n  - `--json` - Output as JSON (for piping to jq)\n- `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.\n  - `--message <message:string>` - Deployment message\n- `flow run <path:string>` - run a flow by path.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.\n- `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n  - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.\n- `flow new <flow_path:string>` - create a new empty flow\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow bootstrap <flow_path:string>` - create a new empty flow (alias for new)\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow history <path:string>` - Show version history for a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow show-version <path:string> <version:string>` - Show a specific version of a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)\n\n### folder\n\nfolder related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `folder list` - list all folders\n  - `--json` - Output as JSON (for piping to jq)\n- `folder get <name:string>` - get a folder's details\n  - `--json` - Output as JSON (for piping to jq)\n- `folder new <name:string>` - create a new folder locally\n  - `--summary <summary:string>` - folder summary\n- `folder push <name:string>` - push a local folder to the remote by name. This overrides any remote versions.\n- `folder add-missing` - create default folder.meta.yaml for all subdirectories of f/ that are missing one\n  - `-y, --yes` - skip confirmation prompt\n- `folder show-rules <name:string>` - Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.\n  - `--test-path <path:string>` - Test which rule matches this item path (e.g. f/prod/jobs/my_script)\n  - `--json` - Output as JSON\n\n### generate-metadata\n\nGenerate metadata (locks, schemas) for all scripts, flows, and apps\n\n**Arguments:** `[folder:string]`\n\n**Options:**\n- `--yes` - Skip confirmation prompt\n- `--dry-run` - Show what would be updated without making changes\n- `--lock-only` - Re-generate only the lock files\n- `--schema-only` - Re-generate only script schemas (skips flows and apps)\n- `--skip-scripts` - Skip processing scripts\n- `--skip-flows` - Skip processing flows\n- `--skip-apps` - Skip processing apps\n- `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)\n- `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include\n- `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude\n\n### gitsync-settings\n\nManage git-sync settings between local wmill.yaml and Windmill backend\n\n**Subcommands:**\n\n- `gitsync-settings pull` - Pull git-sync settings from Windmill backend to local wmill.yaml\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--default` - Write settings to top-level defaults instead of overrides\n  - `--replace` - Replace existing settings (non-interactive mode)\n  - `--override` - Add branch-specific override (non-interactive mode)\n  - `--diff` - Show differences without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n- `gitsync-settings push` - Push git-sync settings from local wmill.yaml to Windmill backend\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--diff` - Show what would be pushed without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n\n### group\n\nManage workspace groups\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `group list` - List all groups in the workspace\n  - `--json` - Output as JSON (for piping to jq)\n- `group get <name:string>` - Get group details and members\n  - `--json` - Output as JSON (for piping to jq)\n- `group create <name:string>` - Create a new group\n  - `--summary <summary:string>` - Group summary/description\n- `group delete <name:string>` - Delete a group\n- `group add-user <name:string> <username:string>` - Add a user to a group\n- `group remove-user <name:string> <username:string>` - Remove a user from a group\n\n### hub\n\nHub related commands. EXPERIMENTAL. INTERNAL USE ONLY.\n\n**Subcommands:**\n\n- `hub pull` - pull any supported definitions. EXPERIMENTAL.\n\n### init\n\nBootstrap a windmill project with a wmill.yaml file\n\n**Options:**\n- `--use-default` - Use default settings without checking backend\n- `--use-backend` - Use backend git-sync settings if available\n- `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when using backend settings\n- `--bind-profile` - Automatically bind active workspace profile to current Git branch\n- `--no-bind-profile` - Skip workspace profile binding prompt\n\n### instance\n\nsync local with a remote instance or the opposite (push or pull)\n\n**Subcommands:**\n\n- `instance add [instance_name:string] [remote:string] [token:string]` - Add a new instance\n- `instance remove <instance:string:instance>` - Remove an instance\n- `instance switch <instance:string:instance>` - Switch the current instance\n- `instance pull` - Pull instance settings, users, configs, instance groups and overwrite local\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pulling users\n  - `--skip-settings` - Skip pulling settings\n  - `--skip-configs` - Skip pulling configs (worker groups)\n  - `--skip-groups` - Skip pulling instance groups\n  - `--include-workspaces` - Also pull workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to pull from, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance push` - Push instance settings, users, configs, group and overwrite remote\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pushing users\n  - `--skip-settings` - Skip pushing settings\n  - `--skip-configs` - Skip pushing configs (worker groups)\n  - `--skip-groups` - Skip pushing instance groups\n  - `--include-workspaces` - Also push workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to push to, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces folders to push\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance whoami` - Display information about the currently logged-in user\n- `instance get-config` - Dump the current instance config (global settings + worker configs) as YAML\n  - `-o, --output-file <file:string>` - Write YAML to a file instead of stdout\n  - `--show-secrets` - Include sensitive fields (license key, JWT secret) without prompting\n  - `--instance <instance:string>` - Name of the instance, override the active instance\n- `instance connect-slack`\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n  - `--instance <instance:string>` - Instance profile to connect against (defaults to the active instance)\n\n### job\n\nManage jobs (list, inspect, cancel)\n\n**Subcommands:**\n\n- `job list` - List recent jobs\n- `job get <id:string>` - Get job details. For flows: shows step tree with sub-job IDs\n  - `--json` - Output as JSON (for piping to jq)\n- `job result <id:string>` - Get the result of a completed job (machine-friendly)\n- `job logs <id:string>` - Get job logs. For flows: aggregates all step logs\n- `job cancel <id:string>` - Cancel a running or queued job\n  - `--reason <reason:string>` - Reason for cancellation\n\n### jobs\n\nPull completed and queued jobs from workspace\n\n**Arguments:** `[workspace:string]`\n\n**Options:**\n- `-c, --completed-output <file:string>` - Completed jobs output file (default: completed_jobs.json)\n- `-q, --queued-output <file:string>` - Queued jobs output file (default: queued_jobs.json)\n- `--skip-worker-check` - Skip checking for active workers before export\n\n**Subcommands:**\n\n- `jobs pull`\n- `jobs push`\n\n### lint\n\nValidate Windmill flow, schedule, and trigger YAML files in a directory\n\n**Arguments:** `[directory:string]`\n\n**Options:**\n- `--json` - Output results in JSON format\n- `--fail-on-warn` - Exit with code 1 when warnings are emitted\n- `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n- `-w, --watch` - Watch for file changes and re-lint automatically\n\n### queues\n\nList all queues with their metrics\n\n**Arguments:** `[workspace:string] the optional workspace to filter by (default to all workspaces)`\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### resource\n\nresource related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource list` - list all resources\n  - `--json` - Output as JSON (for piping to jq)\n- `resource get <path:string>` - get a resource's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource new <path:string>` - create a new resource locally\n- `resource push <file_path:string> <remote_path:string>` - push a local resource spec. This overrides any remote versions.\n\n### resource-type\n\nresource type related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource-type list` - list all resource types\n  - `--schema` - Show schema in the output\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type get <path:string>` - get a resource type's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type new <name:string>` - create a new resource type locally\n- `resource-type push <file_path:string> <name:string>` - push a local resource spec. This overrides any remote versions.\n- `resource-type generate-namespace` - Create a TypeScript definition file with the RT namespace generated from the resource types\n\n### schedule\n\nschedule related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `schedule list` - list all schedules\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule get <path:string>` - get a schedule's details\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule new <path:string>` - create a new schedule locally\n- `schedule push <file_path:string> <remote_path:string>` - push a local schedule spec. This overrides any remote versions.\n- `schedule enable <path:string>` - Enable a schedule\n- `schedule disable <path:string>` - Disable a schedule\n- `schedule set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a schedule (requires admin or wm_deployers group)\n\n### script\n\nscript related commands\n\n**Options:**\n- `--show-archived` - Show archived scripts instead of active ones\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `script list` - list all scripts\n  - `--show-archived` - Show archived scripts instead of active ones\n  - `--json` - Output as JSON (for piping to jq)\n- `script push <path:file>` - push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)\n  - `--message <message:string>` - Deployment message\n- `script get <path:file>` - get a script's details\n  - `--json` - Output as JSON (for piping to jq)\n- `script show <path:file>` - show a script's content (alias for get)\n- `script run <path:file>` - run a script by path\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n- `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other than the final output. Useful for scripting.\n- `script new <path:file> <language:string>` - create a new script\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script bootstrap <path:file> <language:string>` - create a new script (alias for new)\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a script (requires admin or wm_deployers group)\n- `script history <path:string>` - show version history for a script\n  - `--json` - Output as JSON (for piping to jq)\n\n### sync\n\nsync local with a remote workspaces or the opposite (push or pull)\n\n**Subcommands:**\n\n- `sync pull` - Pull any remote changes and apply them locally.\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Show changes that would be pulled without actually pushing\n  - `--plain-secrets` - Pull secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing  schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n- `sync push` - Push any local changes and apply them remotely.\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Show changes that would be pushed without actually pushing\n  - `--plain-secrets` - Push secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account.\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--message <message:string>` - Include a message that will be added to all scripts/flows/apps updated during this push\n  - `--parallel <number>` - Number of changes to process in parallel\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n  - `--lint` - Run lint validation before pushing\n  - `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n  - `--auto-metadata` - Automatically regenerate stale metadata (locks and schemas) before pushing\n  - `--accept-overriding-permissioned-as-with-self` - Accept that items with a different permissioned_as will be updated with your own user\n\n### token\n\nManage API tokens\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `token list` - List API tokens\n  - `--json` - Output as JSON (for piping to jq)\n- `token create` - Create a new API token\n  - `--label <label:string>` - Token label\n  - `--expiration <expiration:string>` - Token expiration (ISO 8601 timestamp)\n- `token delete <token_prefix:string>` - Delete a token by its prefix\n\n### trigger\n\ntrigger related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `trigger list` - list all triggers\n  - `--json` - Output as JSON (for piping to jq)\n- `trigger get <path:string>` - get a trigger's details\n  - `--json` - Output as JSON (for piping to jq)\n  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup\n- `trigger new <path:string>` - create a new trigger locally\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n- `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.\n- `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n\n### user\n\nuser related commands\n\n**Subcommands:**\n\n- `user add <email:string> [password:string]` - Create a user\n  - `--superadmin` - Specify to make the new user superadmin.\n  - `--company <company:string>` - Specify to set the company of the new user.\n  - `--name <name:string>` - Specify to set the name of the new user.\n- `user remove <email:string>` - Delete a user\n- `user create-token` - Create a new API token for the authenticated user\n  - `--email <email:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n  - `--password <password:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n\n### variable\n\nvariable related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `variable list` - list all variables\n  - `--json` - Output as JSON (for piping to jq)\n- `variable get <path:string>` - get a variable's details\n  - `--json` - Output as JSON (for piping to jq)\n- `variable new <path:string>` - create a new variable locally\n- `variable push <file_path:string> <remote_path:string>` - Push a local variable spec. This overrides any remote versions.\n  - `--plain-secrets` - Push secrets as plain text\n- `variable add <value:string> <remote_path:string>` - Create a new variable on the remote. This will update the variable if it already exists.\n  - `--plain-secrets` - Push secrets as plain text\n  - `--public` - Legacy option, use --plain-secrets instead\n\n### version\n\nShow version information\n\n### worker-groups\n\ndisplay worker groups, pull and push worker groups configs\n\n**Subcommands:**\n\n- `worker-groups pull` - Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)\n  - `--instance` - Name of the instance to push to, override the active instance\n  - `--base-url` - Base url to be passed to the instance settings instead of the local one\n  - `--yes` - Pull without needing confirmation\n- `worker-groups push` - Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)\n  - `--instance [instance]` - Name of the instance to push to, override the active instance\n  - `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n  - `--yes` - Push without needing confirmation\n\n### workers\n\nList all workers grouped by worker groups\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### workspace\n\nworkspace related commands\n\n**Alias:** `profile`\n\n**Subcommands:**\n\n- `workspace switch <workspace_name:string:workspace>` - Switch to another workspace\n- `workspace add [workspace_name:string] [workspace_id:string] [remote:string]` - Add a workspace\n  - `-c --create` - Create the workspace if it does not exist\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--create-username <username:string>` - Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.\n- `workspace remove <workspace_name:string>` - Remove a workspace\n- `workspace whoami` - Show the currently active user\n- `workspace list` - List local workspace profiles\n- `workspace list-remote` - List workspaces on the remote server that you have access to\n- `workspace list-forks` - List forked workspaces on the remote server\n- `workspace bind` - Create or update a workspace entry in wmill.yaml from the active profile\n  - `--workspace <name:string>` - Workspace name (default: current branch or workspaceId)\n  - `--branch <branch:string>` - Git branch to associate (default: workspace name)\n- `workspace unbind` - Remove baseUrl and workspaceId from a workspace entry\n  - `--workspace <name:string>` - Workspace to unbind\n- `workspace fork [workspace_name:string] [workspace_id:string]` - Create a forked workspace\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--color <color:string>` - Workspace color (hex code, e.g. #ff0000)\n  - `--datatable-behavior <behavior:string>` - How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)\n  - `-y --yes` - Skip interactive prompts (defaults datatable behavior to 'skip')\n- `workspace delete-fork <fork_name:string>` - Delete a forked workspace and git branch\n  - `-y --yes` - Skip confirmation prompt\n- `workspace merge` - Compare and deploy changes between a fork and its parent workspace\n  - `--direction <direction:string>` - Deploy direction: to-parent or to-fork\n  - `--all` - Deploy all changed items including conflicts\n  - `--skip-conflicts` - Skip items modified in both workspaces\n  - `--include <items:string>` - Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)\n  - `--exclude <items:string>` - Comma-separated kind:path items to exclude\n  - `--preserve-on-behalf-of` - Preserve original on_behalf_of/permissioned_as values\n  - `-y --yes` - Non-interactive mode (deploy without prompts)\n- `workspace connect-slack` - Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n- `workspace disconnect-slack`\n\n";
+export declare const CLI_COMMANDS = "# Windmill CLI Commands\n\nThe Windmill CLI (`wmill`) provides commands for managing scripts, flows, apps, and other resources.\n\n## Global Options\n\n- `--workspace <workspace:string>` - Specify the target workspace. This overrides the default workspace.\n- `--debug --verbose` - Show debug/verbose logs\n- `--show-diffs` - Show diff informations when syncing (may show sensitive informations)\n- `--token <token:string>` - Specify an API token. This will override any stored token.\n- `--base-url <baseUrl:string>` - Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.\n- `--config-dir <configDir:string>` - Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.\n\n## Commands\n\n### app\n\napp related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `app list` - list all apps\n  - `--json` - Output as JSON (for piping to jq)\n- `app get <path:string>` - get an app's details\n  - `--json` - Output as JSON (for piping to jq)\n- `app push [file_path:string] [remote_path:string]` - push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.\n- `app dev [app_folder:string]` - Start a development server for building apps with live reload and hot module replacement\n  - `--port <port:number>` - Port to run the dev server on (will find next available port if occupied)\n  - `--host <host:string>` - Host to bind the dev server to\n  - `--entry <entry:string>` - Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)\n  - `--no-open` - Don't automatically open the browser\n- `app lint [app_folder:string]` - Lint a raw app folder to validate structure and buildability\n  - `--fix` - Attempt to fix common issues (not implemented yet)\n- `app new` - create a new raw app from a template\n  - `--summary <summary:string>` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--path <path:string>` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.\n  - `--framework <framework:string>` - Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.\n  - `--datatable <datatable:string>` - Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.\n  - `--schema <schema:string>` - Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.\n  - `--overwrite` - Overwrite the target directory if it already exists, without prompting.\n  - `--no-open-in-desktop` - Do not prompt to open the new app in Claude Desktop.\n- `app generate-agents [app_folder:string]` - regenerate AGENTS.md and DATATABLES.md from remote workspace\n- `app set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for an app (requires admin or wm_deployers group)\n\n### audit\n\nView audit logs (requires admin)\n\n**Subcommands:**\n\n- `audit list` - List audit log entries\n- `audit get <id:string>` - Get a specific audit log entry\n  - `--json` - Output as JSON (for piping to jq)\n\n### config\n\nShow all available wmill.yaml configuration options\n\n**Options:**\n- `--json` - Output as JSON for programmatic consumption\n\n**Subcommands:**\n\n- `config migrate` - Migrate wmill.yaml from gitBranches/environments to workspaces format\n\n### dependencies\n\nworkspace dependencies related commands\n\n**Alias:** `deps`\n\n**Subcommands:**\n\n- `dependencies push <file_path:string>` - Push workspace dependencies from a local file\n\n### dev\n\nWatch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace \u2014 use wmill sync push for that.\n\n**Options:**\n- `--includes <pattern...:string>` - Filter paths given a glob pattern or path\n- `--proxy-port <port:number>` - Port for a localhost reverse proxy to the remote Windmill server\n- `--path <path:string>` - Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)\n- `--no-open` - Do not open the browser automatically\n\n### docs\n\nSearch Windmill documentation.\n\n**Arguments:** `<query:string>`\n\n**Options:**\n- `--json` - Output results as JSON.\n\n### flow\n\nflow related commands\n\n**Options:**\n- `--show-archived` - Enable archived flows in output\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `flow list` - list all flows\n  - `--show-archived` - Enable archived flows in output\n  - `--json` - Output as JSON (for piping to jq)\n- `flow get <path:string>` - get a flow's details\n  - `--json` - Output as JSON (for piping to jq)\n- `flow push <file_path:string> <remote_path:string>` - push a local flow spec. This overrides any remote versions.\n  - `--message <message:string>` - Deployment message\n- `flow run <path:string>` - run a flow by path.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not ouput anything other then the final output. Useful for scripting.\n- `flow preview <flow_path:string>` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.\n  - `-d --data <data:string>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n  - `--remote` - Use deployed workspace scripts for PathScript steps instead of local files.\n- `flow new <flow_path:string>` - create a new empty flow\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow bootstrap <flow_path:string>` - create a new empty flow (alias for new)\n  - `--summary <summary:string>` - flow summary\n  - `--description <description:string>` - flow description\n- `flow history <path:string>` - Show version history for a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow show-version <path:string> <version:string>` - Show a specific version of a flow\n  - `--json` - Output as JSON (for piping to jq)\n- `flow set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)\n\n### folder\n\nfolder related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `folder list` - list all folders\n  - `--json` - Output as JSON (for piping to jq)\n- `folder get <name:string>` - get a folder's details\n  - `--json` - Output as JSON (for piping to jq)\n- `folder new <name:string>` - create a new folder locally\n  - `--summary <summary:string>` - folder summary\n- `folder push <name:string>` - push a local folder to the remote by name. This overrides any remote versions.\n- `folder add-missing` - create default folder.meta.yaml for all subdirectories of f/ that are missing one\n  - `-y, --yes` - skip confirmation prompt\n- `folder show-rules <name:string>` - Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.\n  - `--test-path <path:string>` - Test which rule matches this item path (e.g. f/prod/jobs/my_script)\n  - `--json` - Output as JSON\n\n### generate-metadata\n\nGenerate metadata (locks, schemas) for all scripts, flows, and apps\n\n**Arguments:** `[folder:string]`\n\n**Options:**\n- `--yes` - Skip confirmation prompt\n- `--dry-run` - Show what would be updated without making changes\n- `--lock-only` - Re-generate only the lock files\n- `--schema-only` - Re-generate only script schemas (skips flows and apps)\n- `--skip-scripts` - Skip processing scripts\n- `--skip-flows` - Skip processing flows\n- `--skip-apps` - Skip processing apps\n- `--strict-folder-boundaries` - Only update items inside the specified folder (requires folder argument)\n- `--parallel <n:number>` - Number of items to process in parallel\n- `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include\n- `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude\n\n**Subcommands:**\n\n- `generate-metadata rehash [folder:string]`\n  - `--skip-scripts` - Skip processing scripts\n  - `--skip-flows` - Skip processing flows\n  - `--skip-apps` - Skip processing apps\n  - `--parallel <n:number>` - Number of items to process in parallel\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which files to include\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which files to exclude\n\n### gitsync-settings\n\nManage git-sync settings between local wmill.yaml and Windmill backend\n\n**Subcommands:**\n\n- `gitsync-settings pull` - Pull git-sync settings from Windmill backend to local wmill.yaml\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--default` - Write settings to top-level defaults instead of overrides\n  - `--replace` - Replace existing settings (non-interactive mode)\n  - `--override` - Add branch-specific override (non-interactive mode)\n  - `--diff` - Show differences without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n- `gitsync-settings push` - Push git-sync settings from local wmill.yaml to Windmill backend\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo)\n  - `--diff` - Show what would be pushed without applying changes\n  - `--json-output` - Output in JSON format\n  - `--with-backend-settings <json:string>` - Use provided JSON settings instead of querying backend (for testing)\n  - `--yes` - Skip interactive prompts and use default behavior\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n\n### group\n\nManage workspace groups\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `group list` - List all groups in the workspace\n  - `--json` - Output as JSON (for piping to jq)\n- `group get <name:string>` - Get group details and members\n  - `--json` - Output as JSON (for piping to jq)\n- `group create <name:string>` - Create a new group\n  - `--summary <summary:string>` - Group summary/description\n- `group delete <name:string>` - Delete a group\n- `group add-user <name:string> <username:string>` - Add a user to a group\n- `group remove-user <name:string> <username:string>` - Remove a user from a group\n\n### hub\n\nHub related commands. EXPERIMENTAL. INTERNAL USE ONLY.\n\n**Subcommands:**\n\n- `hub pull` - pull any supported definitions. EXPERIMENTAL.\n\n### init\n\nBootstrap a windmill project with a wmill.yaml file\n\n**Options:**\n- `--use-default` - Use default settings without checking backend\n- `--use-backend` - Use backend git-sync settings if available\n- `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when using backend settings\n- `--bind-profile` - Automatically bind active workspace profile to current Git branch\n- `--no-bind-profile` - Skip workspace profile binding prompt\n\n### instance\n\nsync local with a remote instance or the opposite (push or pull)\n\n**Subcommands:**\n\n- `instance add [instance_name:string] [remote:string] [token:string]` - Add a new instance\n- `instance remove <instance:string:instance>` - Remove an instance\n- `instance switch <instance:string:instance>` - Switch the current instance\n- `instance pull` - Pull instance settings, users, configs, instance groups and overwrite local\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pulling users\n  - `--skip-settings` - Skip pulling settings\n  - `--skip-configs` - Skip pulling configs (worker groups)\n  - `--skip-groups` - Skip pulling instance groups\n  - `--include-workspaces` - Also pull workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to pull from, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance push` - Push instance settings, users, configs, group and overwrite remote\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Perform a dry run without making changes\n  - `--skip-users` - Skip pushing users\n  - `--skip-settings` - Skip pushing settings\n  - `--skip-configs` - Skip pushing configs (worker groups)\n  - `--skip-groups` - Skip pushing instance groups\n  - `--include-workspaces` - Also push workspaces\n  - `--folder-per-instance` - Create a folder per instance\n  - `--instance <instance:string>` - Name of the instance to push to, override the active instance\n  - `--prefix <prefix:string>` - Prefix of the local workspaces folders to push\n  - `--prefix-settings` - Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance\n- `instance whoami` - Display information about the currently logged-in user\n- `instance get-config` - Dump the current instance config (global settings + worker configs) as YAML\n  - `-o, --output-file <file:string>` - Write YAML to a file instead of stdout\n  - `--show-secrets` - Include sensitive fields (license key, JWT secret) without prompting\n  - `--instance <instance:string>` - Name of the instance, override the active instance\n- `instance connect-slack`\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n  - `--instance <instance:string>` - Instance profile to connect against (defaults to the active instance)\n\n### job\n\nManage jobs (list, inspect, cancel)\n\n**Subcommands:**\n\n- `job list` - List recent jobs\n- `job get <id:string>` - Get job details. For flows: shows step tree with sub-job IDs\n  - `--json` - Output as JSON (for piping to jq)\n- `job result <id:string>` - Get the result of a completed job (machine-friendly)\n- `job logs <id:string>` - Get job logs. For flows: aggregates all step logs\n- `job cancel <id:string>` - Cancel a running or queued job\n  - `--reason <reason:string>` - Reason for cancellation\n\n### jobs\n\nPull completed and queued jobs from workspace\n\n**Arguments:** `[workspace:string]`\n\n**Options:**\n- `-c, --completed-output <file:string>` - Completed jobs output file (default: completed_jobs.json)\n- `-q, --queued-output <file:string>` - Queued jobs output file (default: queued_jobs.json)\n- `--skip-worker-check` - Skip checking for active workers before export\n\n**Subcommands:**\n\n- `jobs pull`\n- `jobs push`\n\n### lint\n\nValidate Windmill flow, schedule, and trigger YAML files in a directory\n\n**Arguments:** `[directory:string]`\n\n**Options:**\n- `--json` - Output results in JSON format\n- `--fail-on-warn` - Exit with code 1 when warnings are emitted\n- `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n- `-w, --watch` - Watch for file changes and re-lint automatically\n\n### queues\n\nList all queues with their metrics\n\n**Arguments:** `[workspace:string] the optional workspace to filter by (default to all workspaces)`\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### resource\n\nresource related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource list` - list all resources\n  - `--json` - Output as JSON (for piping to jq)\n- `resource get <path:string>` - get a resource's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource new <path:string>` - create a new resource locally\n- `resource push <file_path:string> <remote_path:string>` - push a local resource spec. This overrides any remote versions.\n\n### resource-type\n\nresource type related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `resource-type list` - list all resource types\n  - `--schema` - Show schema in the output\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type get <path:string>` - get a resource type's details\n  - `--json` - Output as JSON (for piping to jq)\n- `resource-type new <name:string>` - create a new resource type locally\n- `resource-type push <file_path:string> <name:string>` - push a local resource spec. This overrides any remote versions.\n- `resource-type generate-namespace` - Create a TypeScript definition file with the RT namespace generated from the resource types\n\n### schedule\n\nschedule related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `schedule list` - list all schedules\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule get <path:string>` - get a schedule's details\n  - `--json` - Output as JSON (for piping to jq)\n- `schedule new <path:string>` - create a new schedule locally\n- `schedule push <file_path:string> <remote_path:string>` - push a local schedule spec. This overrides any remote versions.\n- `schedule enable <path:string>` - Enable a schedule\n  - `--force` - Bypass the fork-conflict warning when the parent workspace has the same schedule (acknowledges that both crons will fire)\n- `schedule disable <path:string>` - Disable a schedule\n- `schedule set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a schedule (requires admin or wm_deployers group)\n\n### script\n\nscript related commands\n\n**Options:**\n- `--show-archived` - Show archived scripts instead of active ones\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `script list` - list all scripts\n  - `--show-archived` - Show archived scripts instead of active ones\n  - `--json` - Output as JSON (for piping to jq)\n- `script push <path:file>` - push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)\n  - `--message <message:string>` - Deployment message\n- `script get <path:file>` - get a script's details\n  - `--json` - Output as JSON (for piping to jq)\n- `script show <path:file>` - show a script's content (alias for get)\n- `script run <path:file>` - run a script by path\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other then the final output. Useful for scripting.\n- `script preview <path:file>` - preview a local script without deploying it. Supports both regular and codebase scripts.\n  - `-d --data <data:file>` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.\n  - `-s --silent` - Do not output anything other than the final output. Useful for scripting.\n- `script new <path:file> <language:string>` - create a new script\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script bootstrap <path:file> <language:string>` - create a new script (alias for new)\n  - `--summary <summary:string>` - script summary\n  - `--description <description:string>` - script description\n- `script set-permissioned-as <path:string> <email:string>` - Set the on_behalf_of_email for a script (requires admin or wm_deployers group)\n- `script history <path:string>` - show version history for a script\n  - `--json` - Output as JSON (for piping to jq)\n\n### sync\n\nsync local with a remote workspaces or the opposite (push or pull)\n\n**Subcommands:**\n\n- `sync pull` - Pull any remote changes and apply them locally.\n  - `--yes` - Pull without needing confirmation\n  - `--dry-run` - Show changes that would be pulled without actually pushing\n  - `--plain-secrets` - Pull secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing  schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--promotion <branch:string>` - Use promotionOverrides from the specified branch instead of regular overrides\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n- `sync push` - Push any local changes and apply them remotely.\n  - `--yes` - Push without needing confirmation\n  - `--dry-run` - Show changes that would be pushed without actually pushing\n  - `--plain-secrets` - Push secrets as plain text\n  - `--json` - Use JSON instead of YAML\n  - `--skip-variables` - Skip syncing variables (including secrets)\n  - `--skip-secrets` - Skip syncing only secrets variables\n  - `--include-secrets` - Include secrets in sync (overrides skipSecrets in wmill.yaml)\n  - `--skip-resources` - Skip syncing  resources\n  - `--skip-resource-types` - Skip syncing  resource types\n  - `--skip-scripts` - Skip syncing scripts\n  - `--skip-flows` - Skip syncing flows\n  - `--skip-apps` - Skip syncing apps\n  - `--skip-folders` - Skip syncing folders\n  - `--skip-workspace-dependencies` - Skip syncing workspace dependencies\n  - `--skip-scripts-metadata` - Skip syncing scripts metadata, focus solely on logic\n  - `--include-schedules` - Include syncing schedules\n  - `--include-triggers` - Include syncing triggers\n  - `--include-users` - Include syncing users\n  - `--include-groups` - Include syncing groups\n  - `--include-settings` - Include syncing workspace settings\n  - `--include-key` - Include workspace encryption key\n  - `--skip-branch-validation` - Skip git branch validation and prompts\n  - `--json-output` - Output results in JSON format\n  - `-i --includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)\n  - `-e --excludes <patterns:file[]>` - Comma separated patterns to specify which file to NOT take into account.\n  - `--extra-includes <patterns:file[]>` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy\n  - `--message <message:string>` - Include a message that will be added to all scripts/flows/apps updated during this push\n  - `--parallel <number>` - Number of changes to process in parallel\n  - `--repository <repo:string>` - Specify repository path (e.g., u/user/repo) when multiple repositories exist\n  - `--branch, --env <branch:string>` - [Deprecated: use --workspace] Override the current git branch/environment\n  - `--lint` - Run lint validation before pushing\n  - `--locks-required` - Fail if scripts or flow inline scripts that need locks have no locks\n  - `--auto-metadata` - Automatically regenerate stale metadata (locks and schemas) before pushing\n  - `--accept-overriding-permissioned-as-with-self` - Accept that items with a different permissioned_as will be updated with your own user\n\n### token\n\nManage API tokens\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `token list` - List API tokens\n  - `--json` - Output as JSON (for piping to jq)\n- `token create` - Create a new API token\n  - `--label <label:string>` - Token label\n  - `--expiration <expiration:string>` - Token expiration (ISO 8601 timestamp)\n- `token delete <token_prefix:string>` - Delete a token by its prefix\n\n### trigger\n\ntrigger related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `trigger list` - list all triggers\n  - `--json` - Output as JSON (for piping to jq)\n- `trigger get <path:string>` - get a trigger's details\n  - `--json` - Output as JSON (for piping to jq)\n  - `--kind <kind:string>` - Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup\n- `trigger new <path:string>` - create a new trigger locally\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n- `trigger push <file_path:string> <remote_path:string>` - push a local trigger spec. This overrides any remote versions.\n- `trigger set-permissioned-as <path:string> <email:string>` - Set the email (run-as user) for a trigger (requires admin or wm_deployers group)\n  - `--kind <kind:string>` - Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)\n\n### user\n\nuser related commands\n\n**Subcommands:**\n\n- `user add <email:string> [password:string]` - Create a user\n  - `--superadmin` - Specify to make the new user superadmin.\n  - `--company <company:string>` - Specify to set the company of the new user.\n  - `--name <name:string>` - Specify to set the name of the new user.\n- `user remove <email:string>` - Delete a user\n- `user create-token` - Create a new API token for the authenticated user\n  - `--email <email:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n  - `--password <password:string>` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.\n\n### variable\n\nvariable related commands\n\n**Options:**\n- `--json` - Output as JSON (for piping to jq)\n\n**Subcommands:**\n\n- `variable list` - list all variables\n  - `--json` - Output as JSON (for piping to jq)\n- `variable get <path:string>` - get a variable's details\n  - `--json` - Output as JSON (for piping to jq)\n- `variable new <path:string>` - create a new variable locally\n- `variable push <file_path:string> <remote_path:string>` - Push a local variable spec. This overrides any remote versions.\n  - `--plain-secrets` - Push secrets as plain text\n- `variable add <value:string> <remote_path:string>` - Create a new variable on the remote. This will update the variable if it already exists.\n  - `--plain-secrets` - Push secrets as plain text\n  - `--public` - Legacy option, use --plain-secrets instead\n\n### version\n\nShow version information\n\n### worker-groups\n\ndisplay worker groups, pull and push worker groups configs\n\n**Subcommands:**\n\n- `worker-groups pull` - Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)\n  - `--instance` - Name of the instance to push to, override the active instance\n  - `--base-url` - Base url to be passed to the instance settings instead of the local one\n  - `--yes` - Pull without needing confirmation\n- `worker-groups push` - Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)\n  - `--instance [instance]` - Name of the instance to push to, override the active instance\n  - `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n  - `--yes` - Push without needing confirmation\n\n### workers\n\nList all workers grouped by worker groups\n\n**Options:**\n- `--instance [instance]` - Name of the instance to push to, override the active instance\n- `--base-url [baseUrl]` - If used with --token, will be used as the base url for the instance\n\n### workspace\n\nworkspace related commands\n\n**Alias:** `profile`\n\n**Subcommands:**\n\n- `workspace switch <workspace_name:string:workspace>` - Switch to another workspace\n- `workspace add [workspace_name:string] [workspace_id:string] [remote:string]` - Add a workspace\n  - `-c --create` - Create the workspace if it does not exist\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--create-username <username:string>` - Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.\n- `workspace remove <workspace_name:string>` - Remove a workspace\n- `workspace whoami` - Show the currently active user\n- `workspace list` - List local workspace profiles\n- `workspace list-remote` - List workspaces on the remote server that you have access to\n  - `--as-superadmin` - List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)\n- `workspace list-forks` - List forked workspaces on the remote server\n- `workspace bind` - Create or update a workspace entry in wmill.yaml from the active profile\n  - `--workspace <name:string>` - Workspace name (default: current branch or workspaceId)\n  - `--branch <branch:string>` - Git branch to associate (default: workspace name)\n- `workspace unbind` - Remove baseUrl and workspaceId from a workspace entry\n  - `--workspace <name:string>` - Workspace to unbind\n- `workspace fork [workspace_name:string] [workspace_id:string]` - Create a forked workspace\n  - `--create-workspace-name <workspace_name:string>` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.\n  - `--color <color:string>` - Workspace color (hex code, e.g. #ff0000)\n  - `--datatable-behavior <behavior:string>` - How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)\n  - `-y --yes` - Skip interactive prompts (defaults datatable behavior to 'skip')\n- `workspace delete-fork <fork_name:string>` - Delete a forked workspace and git branch\n  - `-y --yes` - Skip confirmation prompt\n- `workspace merge` - Compare and deploy changes between a fork and its parent workspace\n  - `--direction <direction:string>` - Deploy direction: to-parent or to-fork\n  - `--all` - Deploy all changed items including conflicts\n  - `--skip-conflicts` - Skip items modified in both workspaces\n  - `--include <items:string>` - Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)\n  - `--exclude <items:string>` - Comma-separated kind:path items to exclude\n  - `--preserve-on-behalf-of` - Preserve original on_behalf_of/permissioned_as values\n  - `-y --yes` - Non-interactive mode (deploy without prompts)\n- `workspace connect-slack` - Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.\n  - `--bot-token <bot_token:string>` - Slack bot token (xoxb-...)\n  - `--team-id <team_id:string>` - Slack team id\n  - `--team-name <team_name:string>` - Slack team name\n- `workspace disconnect-slack`\n\n";
 export declare const LANG_BASH = "# Bash\n\n## Structure\n\nDo not include `#!/bin/bash`. Arguments are obtained as positional parameters:\n\n```bash\n# Get arguments\nvar1=\"$1\"\nvar2=\"$2\"\n\necho \"Processing $var1 and $var2\"\n\n# Return JSON by echoing to stdout\necho \"{\\\"result\\\": \\\"$var1\\\", \\\"count\\\": $var2}\"\n```\n\n**Important:**\n- Do not include shebang (`#!/bin/bash`)\n- Arguments are always strings\n- Access with `$1`, `$2`, etc.\n\n## Output\n\nThe script output is captured as the result. For structured data, output valid JSON:\n\n```bash\nname=\"$1\"\ncount=\"$2\"\n\n# Output JSON result\ncat << EOF\n{\n  \"name\": \"$name\",\n  \"count\": $count,\n  \"timestamp\": \"$(date -Iseconds)\"\n}\nEOF\n```\n\n## Environment Variables\n\nEnvironment variables set in Windmill are available:\n\n```bash\n# Access environment variable\necho \"Workspace: $WM_WORKSPACE\"\necho \"Job ID: $WM_JOB_ID\"\n```\n";
-export declare const LANG_BIGQUERY = "# BigQuery\n\nArguments use `@name` syntax.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @name1 (string)\n-- @name2 (int64) = 0\nSELECT * FROM users WHERE name = @name1 AND age > @name2;\n```\n";
-export declare const LANG_BUN = "# TypeScript (Bun)\n\nBun runtime with full npm ecosystem and fastest execution.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\nimport Stripe from \"stripe\";\nimport { someFunction } from \"some-package\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### S3Object Type\n\nThe S3Object type represents a file in S3 storage:\n\n```typescript\ntype S3Object = {\n  s3: string; // Path within the bucket\n};\n```\n\n## TypeScript Operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
-export declare const LANG_BUNNATIVE = "# TypeScript (Bun Native)\n\nNative TypeScript execution with fetch only - no external imports allowed.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n**No imports allowed.** Use the globally available `fetch` function:\n\n```typescript\nexport async function main(url: string) {\n  const response = await fetch(url);\n  return await response.json();\n}\n```\n\n## Windmill Client\n\nThe windmill client is not available in native TypeScript mode. Use fetch to call APIs directly.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### S3Object Type\n\nThe S3Object type represents a file in S3 storage:\n\n```typescript\ntype S3Object = {\n  s3: string; // Path within the bucket\n};\n```\n\n## TypeScript Operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
+export declare const LANG_BIGQUERY = "# BigQuery\n\nArguments use `@name` syntax.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @name1 (string)\n-- @name2 (int64) = 0\nSELECT * FROM users WHERE name = @name1 AND age > @name2;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as a `STRING` JSON parameter \u2014 Parquet/CSV\nfiles are decoded server-side into a JSON array of records, JSON/JSONL pass\nthrough. Consume with `JSON_EXTRACT_ARRAY` / `JSON_VALUE`:\n\n```sql\n-- @file (s3object)\nSELECT\n  CAST(JSON_VALUE(row, '$.id') AS INT64) AS id,\n  JSON_VALUE(row, '$.name') AS name\nFROM UNNEST(JSON_EXTRACT_ARRAY(@file)) AS row;\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered, bypassing the 10000-row return cap.\n";
+export declare const LANG_BUN = "# TypeScript (Bun)\n\nBun runtime with full npm ecosystem and fastest execution.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\nimport Stripe from \"stripe\";\nimport { someFunction } from \"some-package\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations. The `wmill.S3Object` type covers both the `s3://storage/key` URI form (`s3:///key` for the workspace default storage) and the `{ s3, storage? }` record form \u2014 always use it instead of redefining your own.\n\n### Receiving an S3Object as a script parameter\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\nexport async function main(file: wmill.S3Object) {\n  const content = await wmill.loadS3File(file);\n  // ...\n}\n```\n\n### S3 operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: wmill.S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
+export declare const LANG_BUNNATIVE = "# TypeScript (Bun Native)\n\nNative TypeScript execution with fetch only - no external imports allowed.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n**No imports allowed.** Use the globally available `fetch` function:\n\n```typescript\nexport async function main(url: string) {\n  const response = await fetch(url);\n  return await response.json();\n}\n```\n\n## Windmill Client\n\nThe windmill client is not available in native TypeScript mode. Use fetch to call APIs directly.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations. The `wmill.S3Object` type covers both the `s3://storage/key` URI form (`s3:///key` for the workspace default storage) and the `{ s3, storage? }` record form \u2014 always use it instead of redefining your own.\n\n### Receiving an S3Object as a script parameter\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\nexport async function main(file: wmill.S3Object) {\n  const content = await wmill.loadS3File(file);\n  // ...\n}\n```\n\n### S3 operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: wmill.S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
 export declare const LANG_CSHARP = "# C#\n\nThe script must contain a public static `Main` method inside a class:\n\n```csharp\npublic class Script\n{\n    public static object Main(string name, int count)\n    {\n        return new { Name = name, Count = count };\n    }\n}\n```\n\n**Important:**\n- Class name is irrelevant\n- Method must be `public static`\n- Return type can be `object` or specific type\n\n## NuGet Packages\n\nAdd packages using the `#r` directive at the top:\n\n```csharp\n#r \"nuget: Newtonsoft.Json, 13.0.3\"\n#r \"nuget: RestSharp, 110.2.0\"\n\nusing Newtonsoft.Json;\nusing RestSharp;\n\npublic class Script\n{\n    public static object Main(string url)\n    {\n        var client = new RestClient(url);\n        var request = new RestRequest();\n        var response = client.Get(request);\n        return JsonConvert.DeserializeObject(response.Content);\n    }\n}\n```\n";
-export declare const LANG_DENO = "# TypeScript (Deno)\n\nDeno runtime with npm support via `npm:` prefix and native Deno libraries.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\n// npm packages use npm: prefix\nimport Stripe from \"npm:stripe\";\nimport { someFunction } from \"npm:some-package\";\n\n// Deno standard library\nimport { serve } from \"https://deno.land/std/http/server.ts\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### S3Object Type\n\nThe S3Object type represents a file in S3 storage:\n\n```typescript\ntype S3Object = {\n  s3: string; // Path within the bucket\n};\n```\n\n## TypeScript Operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
-export declare const LANG_DUCKDB = "# DuckDB\n\nArguments are defined with comments and used with `$name` syntax:\n\n```sql\n-- $name (text) = default\n-- $age (integer)\nSELECT * FROM users WHERE name = $name AND age > $age;\n```\n\n## Ducklake Integration\n\nAttach Ducklake for data lake operations:\n\n```sql\n-- Main ducklake\nATTACH 'ducklake' AS dl;\n\n-- Named ducklake\nATTACH 'ducklake://my_lake' AS dl;\n\n-- Then query\nSELECT * FROM dl.schema.table;\n```\n\n## External Database Connections\n\nConnect to external databases using resources:\n\n```sql\nATTACH '$res:path/to/resource' AS db (TYPE postgres);\nSELECT * FROM db.schema.table;\n```\n\n## S3 File Operations\n\nRead files from S3 storage:\n\n```sql\n-- Default storage\nSELECT * FROM read_csv('s3:///path/to/file.csv');\n\n-- Named storage\nSELECT * FROM read_csv('s3://storage_name/path/to/file.csv');\n\n-- Parquet files\nSELECT * FROM read_parquet('s3:///path/to/file.parquet');\n\n-- JSON files\nSELECT * FROM read_json('s3:///path/to/file.json');\n```\n";
+export declare const LANG_DENO = "# TypeScript (Deno)\n\nDeno runtime with npm support via `npm:` prefix and native Deno libraries.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n```typescript\n// npm packages use npm: prefix\nimport Stripe from \"npm:stripe\";\nimport { someFunction } from \"npm:some-package\";\n\n// Deno standard library\nimport { serve } from \"https://deno.land/std/http/server.ts\";\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```typescript\nimport * as wmill from \"windmill-client\";\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id,\n  };\n}\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations. The `wmill.S3Object` type covers both the `s3://storage/key` URI form (`s3:///key` for the workspace default storage) and the `{ s3, storage? }` record form \u2014 always use it instead of redefining your own.\n\n### Receiving an S3Object as a script parameter\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\nexport async function main(file: wmill.S3Object) {\n  const content = await wmill.loadS3File(file);\n  // ...\n}\n```\n\n### S3 operations\n\n```typescript\nimport * as wmill from \"windmill-client\";\n\n// Load file content from S3\nconst content: Uint8Array = await wmill.loadS3File(s3object);\n\n// Load file as stream\nconst blob: Blob = await wmill.loadS3FileStream(s3object);\n\n// Write file to S3\nconst result: wmill.S3Object = await wmill.writeS3File(\n  s3object, // Target path (or undefined to auto-generate)\n  fileContent, // string or Blob\n  s3ResourcePath // Optional: specific S3 resource to use\n);\n```\n";
+export declare const LANG_DUCKDB = "# DuckDB\n\nArguments are defined with comments and used with `$name` syntax:\n\n```sql\n-- $name (text) = default\n-- $age (integer)\nSELECT * FROM users WHERE name = $name AND age > $age;\n```\n\n## Ducklake Integration\n\nAttach Ducklake for data lake operations:\n\n```sql\n-- Main ducklake\nATTACH 'ducklake' AS dl;\n\n-- Named ducklake\nATTACH 'ducklake://my_lake' AS dl;\n\n-- Then query\nSELECT * FROM dl.schema.table;\n```\n\n## External Database Connections\n\nConnect to external databases using resources:\n\n```sql\nATTACH '$res:path/to/resource' AS db (TYPE postgres);\nSELECT * FROM db.schema.table;\n```\n\n## S3 File Operations\n\nRead files from S3 storage:\n\n```sql\n-- Default storage\nSELECT * FROM read_csv('s3:///path/to/file.csv');\n\n-- Named storage\nSELECT * FROM read_csv('s3://storage_name/path/to/file.csv');\n\n-- Parquet files\nSELECT * FROM read_parquet('s3:///path/to/file.parquet');\n\n-- JSON files\nSELECT * FROM read_json('s3:///path/to/file.json');\n```\n\n### Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for it\nand binds the arg as the bare `s3://storage/key` URI, which DuckDB's reader\nfunctions consume directly:\n\n```sql\n-- $file (s3object)\nSELECT * FROM read_parquet($file);\n```\n\nWorks with any DuckDB reader: `read_csv($file)`, `read_json($file)`, etc.\n\n### Writing query results to S3\n\nDuckDB writes to S3 natively via `COPY ... TO`:\n\n```sql\nCOPY (SELECT * FROM users) TO 's3:///exports/users.parquet' (FORMAT PARQUET);\n```\n\nUse this instead of the `-- s3` streaming directive supported by the other SQL\ndialects \u2014 that directive is not available in DuckDB.\n";
 export declare const LANG_GO = "# Go\n\n## Structure\n\nThe file package must be `inner` and export a function called `main`:\n\n```go\npackage inner\n\nfunc main(param1 string, param2 int) (map[string]interface{}, error) {\n    return map[string]interface{}{\n        \"result\": param1,\n        \"count\":  param2,\n    }, nil\n}\n```\n\n**Important:**\n- Package must be `inner`\n- Return type must be `({return_type}, error)`\n- Function name is `main` (lowercase)\n\n## Return Types\n\nThe return type can be any Go type that can be serialized to JSON:\n\n```go\npackage inner\n\ntype Result struct {\n    Name  string `json:\"name\"`\n    Count int    `json:\"count\"`\n}\n\nfunc main(name string, count int) (Result, error) {\n    return Result{\n        Name:  name,\n        Count: count,\n    }, nil\n}\n```\n\n## Error Handling\n\nReturn errors as the second return value:\n\n```go\npackage inner\n\nimport \"errors\"\n\nfunc main(value int) (string, error) {\n    if value < 0 {\n        return \"\", errors.New(\"value must be positive\")\n    }\n    return \"success\", nil\n}\n```\n";
 export declare const LANG_GRAPHQL = "# GraphQL\n\n## Structure\n\nWrite GraphQL queries or mutations. Arguments can be added as query parameters:\n\n```graphql\nquery GetUser($id: ID!) {\n  user(id: $id) {\n    id\n    name\n    email\n  }\n}\n```\n\n## Variables\n\nVariables are passed as script arguments and automatically bound to the query:\n\n```graphql\nquery SearchProducts($query: String!, $limit: Int = 10) {\n  products(search: $query, first: $limit) {\n    edges {\n      node {\n        id\n        name\n        price\n      }\n    }\n  }\n}\n```\n\n## Mutations\n\n```graphql\nmutation CreateUser($input: CreateUserInput!) {\n  createUser(input: $input) {\n    id\n    name\n    createdAt\n  }\n}\n```\n";
 export declare const LANG_JAVA = "# Java\n\nThe script must contain a Main public class with a `public static main()` method:\n\n```java\npublic class Main {\n    public static Object main(String name, int count) {\n        java.util.Map<String, Object> result = new java.util.HashMap<>();\n        result.put(\"name\", name);\n        result.put(\"count\", count);\n        return result;\n    }\n}\n```\n\n**Important:**\n- Class must be named `Main`\n- Method must be `public static Object main(...)`\n- Return type is `Object` or `void`\n\n## Maven Dependencies\n\nAdd dependencies using comments at the top:\n\n```java\n//requirements:\n//com.google.code.gson:gson:2.10.1\n//org.apache.httpcomponents:httpclient:4.5.14\n\nimport com.google.gson.Gson;\n\npublic class Main {\n    public static Object main(String input) {\n        Gson gson = new Gson();\n        return gson.fromJson(input, Object.class);\n    }\n}\n```\n";
-export declare const LANG_MSSQL = "# Microsoft SQL Server (MSSQL)\n\nArguments use `@P1`, `@P2`, etc.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @P1 name1 (varchar)\n-- @P2 name2 (int) = 0\nSELECT * FROM users WHERE name = @P1 AND age > @P2;\n```\n";
-export declare const LANG_MYSQL = "# MySQL\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (int) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n";
+export declare const LANG_MSSQL = "# Microsoft SQL Server (MSSQL)\n\nArguments use `@P1`, `@P2`, etc.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- @P1 name1 (varchar)\n-- @P2 name2 (int) = 0\nSELECT * FROM users WHERE name = @P1 AND age > @P2;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as `nvarchar(max)` JSON text \u2014 Parquet/CSV\nfiles are decoded server-side into a JSON array of records, JSON/JSONL pass\nthrough. Consume with `OPENJSON`:\n\n```sql\n-- @P1 file (s3object)\nSELECT id, name\nFROM OPENJSON(@P1)\nWITH (id INT, name NVARCHAR(200));\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered as the script return value.\n";
+export declare const LANG_MYSQL = "# MySQL\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (int) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as JSON text \u2014 Parquet/CSV files are\ndecoded server-side into a JSON array of records, JSON/JSONL pass through.\nConsume with `JSON_TABLE`:\n\n```sql\n-- ? file (s3object)\nSELECT id, name\nFROM JSON_TABLE(?, '$[*]'\n  COLUMNS (id INT PATH '$.id', name VARCHAR(200) PATH '$.name')\n) AS r;\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered as the script return value.\n";
 export declare const LANG_NATIVETS = "# TypeScript (Native)\n\nNative TypeScript execution with fetch only - no external imports allowed.\n\n## Structure\n\nExport a single **async** function called `main`:\n\n```typescript\nexport async function main(param1: string, param2: number) {\n  // Your code here\n  return { result: param1, count: param2 };\n}\n```\n\nDo not call the main function.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nUse the `RT` namespace for resource types:\n\n```typescript\nexport async function main(stripe: RT.Stripe) {\n  // stripe contains API key and config from the resource\n}\n```\n\nOnly use resource types if you need them to satisfy the instructions. Always use the RT namespace.\n\nBefore using a resource type, check the `rt.d.ts` file in the project root to see all available resource types and their fields. This file is generated by `wmill resource-type generate-namespace`.\n\n## Imports\n\n**No imports allowed.** Use the globally available `fetch` function:\n\n```typescript\nexport async function main(url: string) {\n  const response = await fetch(url);\n  return await response.json();\n}\n```\n\n## Windmill Client\n\nThe windmill client is not available in native TypeScript mode. Use fetch to call APIs directly.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```typescript\ntype Event = {\n  kind:\n    | \"webhook\"\n    | \"http\"\n    | \"websocket\"\n    | \"kafka\"\n    | \"email\"\n    | \"nats\"\n    | \"postgres\"\n    | \"sqs\"\n    | \"mqtt\"\n    | \"gcp\";\n  body: any;\n  headers: Record<string, string>;\n  query: Record<string, string>;\n};\n\nexport async function preprocessor(event: Event) {\n  return {\n    param1: event.body.field1,\n    param2: event.query.id\n  };\n}\n```\n";
 export declare const LANG_PHP = "# PHP\n\n## Structure\n\nThe script must start with `<?php` and contain at least one function called `main`:\n\n```php\n<?php\n\nfunction main(string $param1, int $param2) {\n    return [\"result\" => $param1, \"count\" => $param2];\n}\n```\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nYou need to **redefine** the type of the resources that are needed before the main function. Always check if the class already exists using `class_exists`:\n\n```php\n<?php\n\nif (!class_exists('Postgresql')) {\n    class Postgresql {\n        public string $host;\n        public int $port;\n        public string $user;\n        public string $password;\n        public string $dbname;\n    }\n}\n\nfunction main(Postgresql $db) {\n    // $db contains the database connection details\n}\n```\n\nThe resource type name has to be exactly as specified.\n\n## Library Dependencies\n\nSpecify library dependencies as comments before the main function:\n\n```php\n<?php\n\n// require:\n// guzzlehttp/guzzle\n// stripe/stripe-php@^10.0\n\nfunction main() {\n    // Libraries are available\n}\n```\n\nOne dependency per line. No need to require autoload, it is already done.\n";
-export declare const LANG_POSTGRESQL = "# PostgreSQL\n\nArguments are obtained directly in the statement with `$1::{type}`, `$2::{type}`, etc.\n\nName the parameters by adding comments at the beginning of the script (without specifying the type):\n\n```sql\n-- $1 name1\n-- $2 name2 = default_value\nSELECT * FROM users WHERE name = $1::TEXT AND age > $2::INT;\n```\n";
+export declare const LANG_POSTGRESQL = "# PostgreSQL\n\nArguments are obtained directly in the statement with `$1::{type}`, `$2::{type}`, etc.\n\nName the parameters by adding comments at the beginning of the script (without specifying the type):\n\n```sql\n-- $1 name1\n-- $2 name2 = default_value\nSELECT * FROM users WHERE name = $1::TEXT AND age > $2::INT;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as a `jsonb` parameter \u2014 Parquet/CSV files\nare decoded server-side into a JSON array of records, JSON/JSONL pass through.\nConsume with `jsonb_to_recordset` (or any `jsonb` API):\n\n```sql\n-- $1 file (s3object)\nSELECT *\nFROM jsonb_to_recordset($1::jsonb) AS r(id INT, name TEXT);\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered as the script return value.\n";
 export declare const LANG_POWERSHELL = "# PowerShell\n\n## Structure\n\nArguments are obtained by calling the `param` function on the first line:\n\n```powershell\nparam($Name, $Count = 0, [int]$Age)\n\n# Your code here\nWrite-Output \"Processing $Name, count: $Count, age: $Age\"\n\n# Return object\n@{\n    name = $Name\n    count = $Count\n    age = $Age\n}\n```\n\n## Parameter Types\n\nYou can specify types for parameters:\n\n```powershell\nparam(\n    [string]$Name,\n    [int]$Count = 0,\n    [bool]$Enabled = $true,\n    [array]$Items\n)\n\n@{\n    name = $Name\n    count = $Count\n    enabled = $Enabled\n    items = $Items\n}\n```\n\n## Return Values\n\nReturn values by outputting them at the end of the script:\n\n```powershell\nparam($Input)\n\n$result = @{\n    processed = $true\n    data = $Input\n    timestamp = Get-Date -Format \"o\"\n}\n\n$result\n```\n";
-export declare const LANG_PYTHON3 = "# Python\n\n## Structure\n\nThe script must contain at least one function called `main`:\n\n```python\ndef main(param1: str, param2: int):\n    # Your code here\n    return {\"result\": param1, \"count\": param2}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nYou need to **redefine** the type of the resources that are needed before the main function as TypedDict:\n\n```python\nfrom typing import TypedDict\n\nclass postgresql(TypedDict):\n    host: str\n    port: int\n    user: str\n    password: str\n    dbname: str\n\ndef main(db: postgresql):\n    # db contains the database connection details\n    pass\n```\n\n**Important rules:**\n\n- The resource type name must be **IN LOWERCASE**\n- Only include resource types if they are actually needed\n- If an import conflicts with a resource type name, **rename the imported object, not the type name**\n- Make sure to import TypedDict from typing **if you're using it**\n\n## Imports\n\nLibraries are installed automatically. Do not show installation instructions.\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n```\n\nIf an import name conflicts with a resource type:\n\n```python\n# Wrong - don't rename the type\nimport stripe as stripe_lib\nclass stripe_type(TypedDict): ...\n\n# Correct - rename the import\nimport stripe as stripe_sdk\nclass stripe(TypedDict):\n    api_key: str\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```python\nimport wmill\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```python\nfrom typing import TypedDict, Literal, Any\n\nclass Event(TypedDict):\n    kind: Literal[\"webhook\", \"http\", \"websocket\", \"kafka\", \"email\", \"nats\", \"postgres\", \"sqs\", \"mqtt\", \"gcp\"]\n    body: Any\n    headers: dict[str, str]\n    query: dict[str, str]\n\ndef preprocessor(event: Event):\n    # Transform the event into flow input parameters\n    return {\n        \"param1\": event[\"body\"][\"field1\"],\n        \"param2\": event[\"query\"][\"id\"]\n    }\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n```python\nimport wmill\n\n# Load file content from S3\ncontent: bytes = wmill.load_s3_file(s3object)\n\n# Load file as stream reader\nreader: BufferedReader = wmill.load_s3_file_reader(s3object)\n\n# Write file to S3\nresult: S3Object = wmill.write_s3_file(\n    s3object,           # Target path (or None to auto-generate)\n    file_content,       # bytes or BufferedReader\n    s3_resource_path,   # Optional: specific S3 resource\n    content_type,       # Optional: MIME type\n    content_disposition # Optional: Content-Disposition header\n)\n```\n";
+export declare const LANG_PYTHON3 = "# Python\n\n## Structure\n\nThe script must contain at least one function called `main`:\n\n```python\ndef main(param1: str, param2: int):\n    # Your code here\n    return {\"result\": param1, \"count\": param2}\n```\n\nDo not call the main function. Libraries are installed automatically.\n\n## Resource Types\n\nOn Windmill, credentials and configuration are stored in resources and passed as parameters to main.\n\nYou need to **redefine** the type of the resources that are needed before the main function as TypedDict:\n\n```python\nfrom typing import TypedDict\n\nclass postgresql(TypedDict):\n    host: str\n    port: int\n    user: str\n    password: str\n    dbname: str\n\ndef main(db: postgresql):\n    # db contains the database connection details\n    pass\n```\n\n**Important rules:**\n\n- The resource type name must be **IN LOWERCASE**\n- Only include resource types if they are actually needed\n- If an import conflicts with a resource type name, **rename the imported object, not the type name**\n- Make sure to import TypedDict from typing **if you're using it**\n\n## Imports\n\nLibraries are installed automatically. Do not show installation instructions.\n\n```python\nimport requests\nimport pandas as pd\nfrom datetime import datetime\n```\n\nIf an import name conflicts with a resource type:\n\n```python\n# Wrong - don't rename the type\nimport stripe as stripe_lib\nclass stripe_type(TypedDict): ...\n\n# Correct - rename the import\nimport stripe as stripe_sdk\nclass stripe(TypedDict):\n    api_key: str\n```\n\n## Windmill Client\n\nImport the windmill client for platform interactions:\n\n```python\nimport wmill\n```\n\nSee the SDK documentation for available methods.\n\n## Preprocessor Scripts\n\nFor preprocessor scripts, the function should be named `preprocessor` and receives an `event` parameter:\n\n```python\nfrom typing import TypedDict, Literal, Any\n\nclass Event(TypedDict):\n    kind: Literal[\"webhook\", \"http\", \"websocket\", \"kafka\", \"email\", \"nats\", \"postgres\", \"sqs\", \"mqtt\", \"gcp\"]\n    body: Any\n    headers: dict[str, str]\n    query: dict[str, str]\n\ndef preprocessor(event: Event):\n    # Transform the event into flow input parameters\n    return {\n        \"param1\": event[\"body\"][\"field1\"],\n        \"param2\": event[\"query\"][\"id\"]\n    }\n```\n\n## S3 Object Operations\n\nWindmill provides built-in support for S3-compatible storage operations.\n\n### Receiving an S3Object as a script parameter\n\nTo accept a file from S3 as input to a script, type the parameter with `S3Object` (imported from `wmill`):\n\n```python\nimport wmill\nfrom wmill import S3Object\n\ndef main(file: S3Object):\n    content = wmill.load_s3_file(file)\n    # ...\n```\n\n### S3 operations\n\n```python\nimport wmill\n\n# Load file content from S3\ncontent: bytes = wmill.load_s3_file(s3object)\n\n# Load file as stream reader\nreader: BufferedReader = wmill.load_s3_file_reader(s3object)\n\n# Write file to S3\nresult: S3Object = wmill.write_s3_file(\n    s3object,           # Target path (or None to auto-generate)\n    file_content,       # bytes or BufferedReader\n    s3_resource_path,   # Optional: specific S3 resource\n    content_type,       # Optional: MIME type\n    content_disposition # Optional: Content-Disposition header\n)\n```\n";
 export declare const LANG_RLANG = "# R\n\n## Structure\n\nDefine a `main` function using `<-` or `=` assignment. Parameters become the script inputs:\n\n```r\nlibrary(dplyr)\nlibrary(jsonlite)\n\nmain <- function(x, name = \"default\", flag = TRUE) {\n    df <- tibble(x = x, name = name)\n    result <- df %>% mutate(greeting = paste(\"Hello\", name))\n    return(toJSON(result, auto_unbox = TRUE))\n}\n```\n\n**Important:**\n- The `main` function is required\n- Use `library()` to load packages \u2014 they are resolved and installed automatically\n- `jsonlite` is always available (used internally for argument parsing)\n- Return values must be JSON-serializable\n\n## Parameters\n\nR types map to Windmill types:\n- `numeric` \u2192 float/int\n- `character` \u2192 string\n- `logical` \u2192 bool (use `TRUE`/`FALSE`)\n- `list` \u2192 object/dict\n- `NULL` \u2192 null\n\nDefault values are inferred from the function signature:\n\n```r\nmain <- function(\n    name,              # required string\n    count = 10,        # optional int, default 10\n    verbose = FALSE    # optional bool, default FALSE\n) {\n    # ...\n}\n```\n\n## Resources and Variables\n\nUse the built-in Windmill helpers (no import needed):\n\n```r\nmain <- function() {\n    # Get a variable\n    api_key <- get_variable(\"f/my_folder/api_key\")\n\n    # Get a resource (returns a list)\n    db <- get_resource(\"f/my_folder/postgres_config\")\n    host <- db$host\n    port <- db$port\n\n    return(list(host = host, port = port))\n}\n```\n\n## Output\n\nReturn any JSON-serializable value from `main`. The return value becomes the step result:\n\n```r\nmain <- function(x) {\n    # Return a scalar\n    return(x + 1)\n\n    # Or a list (becomes JSON object)\n    return(list(result = x + 1, status = \"ok\"))\n}\n```\n\n## Annotations\n\nControl execution behavior with comment annotations:\n\n```r\n#renv_verbose = true        # Show verbose renv output during resolution\n#renv_install_verbose = true # Show verbose output during package installation\n#sandbox = true              # Run in nsjail sandbox (requires nsjail)\n```\n";
 export declare const LANG_RUST = "# Rust\n\n## Structure\n\nThe script must contain a function called `main` with proper return type:\n\n```rust\nuse anyhow::anyhow;\nuse serde::Serialize;\n\n#[derive(Serialize, Debug)]\nstruct ReturnType {\n    result: String,\n    count: i32,\n}\n\nfn main(param1: String, param2: i32) -> anyhow::Result<ReturnType> {\n    Ok(ReturnType {\n        result: param1,\n        count: param2,\n    })\n}\n```\n\n**Important:**\n- Arguments should be owned types\n- Return type must be serializable (`#[derive(Serialize)]`)\n- Return type is `anyhow::Result<T>`\n\n## Dependencies\n\nPackages must be specified with a partial cargo.toml at the beginning of the script:\n\n```rust\n//! ```cargo\n//! [dependencies]\n//! anyhow = \"1.0.86\"\n//! reqwest = { version = \"0.11\", features = [\"json\"] }\n//! tokio = { version = \"1\", features = [\"full\"] }\n//! ```\n\nuse anyhow::anyhow;\n// ... rest of the code\n```\n\n**Note:** Serde is already included, no need to add it again.\n\n## Async Functions\n\nIf you need to handle async functions (e.g., using tokio), keep the main function sync and create the runtime inside:\n\n```rust\n//! ```cargo\n//! [dependencies]\n//! anyhow = \"1.0.86\"\n//! tokio = { version = \"1\", features = [\"full\"] }\n//! reqwest = { version = \"0.11\", features = [\"json\"] }\n//! ```\n\nuse anyhow::anyhow;\nuse serde::Serialize;\n\n#[derive(Serialize, Debug)]\nstruct Response {\n    data: String,\n}\n\nfn main(url: String) -> anyhow::Result<Response> {\n    let rt = tokio::runtime::Runtime::new()?;\n    rt.block_on(async {\n        let resp = reqwest::get(&url).await?.text().await?;\n        Ok(Response { data: resp })\n    })\n}\n```\n";
-export declare const LANG_SNOWFLAKE = "# Snowflake\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (number) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n";
+export declare const LANG_SNOWFLAKE = "# Snowflake\n\nArguments use `?` placeholders.\n\nName the parameters by adding comments before the statement:\n\n```sql\n-- ? name1 (text)\n-- ? name2 (number) = 0\nSELECT * FROM users WHERE name = ? AND age > ?;\n```\n\n## Receiving an S3Object as a script parameter\n\nDeclare the arg with type `(s3object)`. Windmill renders an S3 file picker for\nit, downloads the file, and binds it as JSON text \u2014 Parquet/CSV files are\ndecoded server-side into a JSON array of records, JSON/JSONL pass through.\nWrap the bind with `PARSE_JSON(?)` and walk it with `LATERAL FLATTEN`:\n\n```sql\n-- ? file (s3object)\nSELECT\n  v.value:id::NUMBER AS id,\n  v.value:name::STRING AS name\nFROM LATERAL FLATTEN(input => PARSE_JSON(?)) v;\n```\n\n## Streaming query results to S3\n\nAdd a `-- s3` directive at the top of the script to stream the result set to S3\ninstead of returning rows. Windmill writes the file and returns its `S3Object`\nas the script result.\n\n```sql\n-- s3 prefix=exports/users format=parquet\nSELECT id, name FROM users;\n```\n\nAll keys are optional: `prefix` (object key prefix), `storage` (named storage \u2014\nomit to use the workspace default), `format` (`json` (default), `parquet`, or\n`csv`). Use this for large result sets \u2014 rows stream directly to S3 instead of\nbeing buffered, bypassing the 10000-row return cap.\n";

From ac3c155541eb5ca20d65c38ad13dca6c10a572c9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 22:30:15 +0000
Subject: [PATCH 37/50] fix: mask oauth client secret in instance settings
 (#9112)

* feat: mask oauth client secret in instance settings

* fix: address ci review - migrate nextcloud + use Password small prop

* fix: associate client secret labels with input via for/id
---
 .../src/lib/components/Auth0Setting.svelte    | 12 ++++++----
 .../src/lib/components/AuthSettings.svelte    | 17 ++++++++-----
 .../src/lib/components/AutheliaSetting.svelte | 20 ++++++++--------
 .../lib/components/AuthentikSetting.svelte    | 24 +++++++++++--------
 .../src/lib/components/KanidmSetting.svelte   | 20 ++++++++--------
 .../src/lib/components/KeycloakSetting.svelte | 10 ++++----
 .../lib/components/NextcloudSetting.svelte    | 10 ++++----
 .../src/lib/components/OAuthSetting.svelte    | 10 ++++----
 .../src/lib/components/OktaSetting.svelte     |  9 +++++--
 .../src/lib/components/PocketIdSetting.svelte | 10 ++++----
 .../src/lib/components/ZitadelSetting.svelte  | 20 ++++++++--------
 11 files changed, 93 insertions(+), 69 deletions(-)

diff --git a/frontend/src/lib/components/Auth0Setting.svelte b/frontend/src/lib/components/Auth0Setting.svelte
index beb9ec03f9..a246ae196d 100644
--- a/frontend/src/lib/components/Auth0Setting.svelte
+++ b/frontend/src/lib/components/Auth0Setting.svelte
@@ -7,6 +7,7 @@
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
@@ -103,14 +104,15 @@
 					class="max-w-lg"
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="auth0_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs"
 					>Client Secret <Tooltip>Client Secret of the auth0 service configuration</Tooltip></span
 				>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
-					class="max-w-lg"
+				<Password
+					id="auth0_client_secret"
+					small
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 			<CollapseLink text="Instructions">
diff --git a/frontend/src/lib/components/AuthSettings.svelte b/frontend/src/lib/components/AuthSettings.svelte
index d3d4890e9c..68ebefc148 100644
--- a/frontend/src/lib/components/AuthSettings.svelte
+++ b/frontend/src/lib/components/AuthSettings.svelte
@@ -14,6 +14,7 @@
 	import ZitadelSetting from '$lib/components/ZitadelSetting.svelte'
 	import NextcloudSetting from '$lib/components/NextcloudSetting.svelte'
 	import CustomOauth from './CustomOauth.svelte'
+	import Password from './Password.svelte'
 	import { capitalize, type Item } from '$lib/utils'
 	import ClipboardPanel from './details/ClipboardPanel.svelte'
 	import Toggle from './Toggle.svelte'
@@ -297,12 +298,12 @@
 										<span class="text-primary font-semibold text-xs">Client Id</span>
 										<input type="text" placeholder="Client Id" bind:value={oauths[k]['id']} />
 									</label>
-									<label class="block pb-6">
+									<label for="{k}_client_secret_sso" class="block pb-6">
 										<span class="text-primary font-semibold text-xs">Client Secret</span>
-										<input
-											type="text"
+										<Password
+											id="{k}_client_secret_sso"
 											placeholder="Client Secret"
-											bind:value={oauths[k]['secret']}
+											bind:password={oauths[k]['secret']}
 										/>
 									</label>
 									{#if !windmillBuiltins.includes(k) && k != 'slack'}
@@ -394,9 +395,13 @@
 									<span class="text-primary font-semibold text-xs">Client Id</span>
 									<input type="text" placeholder="Client Id" bind:value={oauths[k]['id']} />
 								</label>
-								<label>
+								<label for="{k}_client_secret_oauth">
 									<span class="text-primary font-semibold text-xs">Client Secret</span>
-									<input type="text" placeholder="Client Secret" bind:value={oauths[k]['secret']} />
+									<Password
+										id="{k}_client_secret_oauth"
+										placeholder="Client Secret"
+										bind:password={oauths[k]['secret']}
+									/>
 								</label>
 								{#if k === 'visma' || !windmillBuiltins.includes(k)}
 									<div class="mb-8">
diff --git a/frontend/src/lib/components/AutheliaSetting.svelte b/frontend/src/lib/components/AutheliaSetting.svelte
index a3aa2e3458..fccc133cd2 100644
--- a/frontend/src/lib/components/AutheliaSetting.svelte
+++ b/frontend/src/lib/components/AutheliaSetting.svelte
@@ -1,21 +1,20 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
-
+	let { value = $bindable() }: Props = $props()
 
 	let org = $state('')
 
-
 	function changeOrg(org) {
 		if (value) {
 			value = {
@@ -37,7 +36,7 @@
 	let enabled = $derived(value != undefined)
 	run(() => {
 		changeOrg(org)
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -77,11 +76,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="authelia_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="authelia_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/AuthentikSetting.svelte b/frontend/src/lib/components/AuthentikSetting.svelte
index e672970c08..117c2798e1 100644
--- a/frontend/src/lib/components/AuthentikSetting.svelte
+++ b/frontend/src/lib/components/AuthentikSetting.svelte
@@ -1,18 +1,16 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
-
-
-
+	let { value = $bindable() }: Props = $props()
 
 	function changeOrg(org) {
 		if (value && org) {
@@ -34,10 +32,12 @@
 	}
 	let enabled = $derived(value != undefined)
 	// Initialize org from existing auth_url
-	let org = $derived(value?.connect_config?.auth_url?.replace('/application/o/authorize/', '') ?? '')
+	let org = $derived(
+		value?.connect_config?.auth_url?.replace('/application/o/authorize/', '') ?? ''
+	)
 	run(() => {
 		changeOrg(org)
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -71,9 +71,13 @@
 				<span class="text-emphasis font-semibold text-xs">Client Id</span>
 				<input type="text" placeholder="Client Id" bind:value={value['id']} />
 			</label>
-			<label>
+			<label for="authentik_client_secret">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<input type="text" placeholder="Client Secret" bind:value={value['secret']} />
+				<Password
+					id="authentik_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
+				/>
 			</label>
 		</SettingCard>
 	{/if}
diff --git a/frontend/src/lib/components/KanidmSetting.svelte b/frontend/src/lib/components/KanidmSetting.svelte
index 199c4bc672..8c696fb155 100644
--- a/frontend/src/lib/components/KanidmSetting.svelte
+++ b/frontend/src/lib/components/KanidmSetting.svelte
@@ -1,23 +1,22 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
+	let { value = $bindable() }: Props = $props()
 
 	const AUTH_URL_SUFFIX = '/ui/oauth2'
 
-
 	let proxyUrlValue = $state(undefined)
 
-
 	function changeValues({ baseUrl, id }) {
 		if (value) {
 			value = {
@@ -47,7 +46,7 @@
 	let baseUrl = $derived(proxyUrlValue ?? derivedBaseUrl ?? '')
 	run(() => {
 		changeValues({ baseUrl, id: value?.id ?? '' })
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -85,11 +84,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="kanidm_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="kanidm_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/KeycloakSetting.svelte b/frontend/src/lib/components/KeycloakSetting.svelte
index 52f335b0b9..d475403d29 100644
--- a/frontend/src/lib/components/KeycloakSetting.svelte
+++ b/frontend/src/lib/components/KeycloakSetting.svelte
@@ -2,6 +2,7 @@
 	import { untrack } from 'svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
@@ -82,11 +83,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="keycloak_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="keycloak_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/NextcloudSetting.svelte b/frontend/src/lib/components/NextcloudSetting.svelte
index f52ffec7ae..44904b2811 100644
--- a/frontend/src/lib/components/NextcloudSetting.svelte
+++ b/frontend/src/lib/components/NextcloudSetting.svelte
@@ -2,6 +2,7 @@
 	import CollapseLink from './CollapseLink.svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
@@ -85,14 +86,15 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="nextcloud_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
 				<span class="text-secondary font-normal text-xs"
 					>Client Secret from your Nextcloud OAuth2 app configuration</span
 				>
-				<TextInput
-					inputProps={{ type: 'password', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="nextcloud_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 			<CollapseLink text="Instructions">
diff --git a/frontend/src/lib/components/OAuthSetting.svelte b/frontend/src/lib/components/OAuthSetting.svelte
index 8b16310877..60f8e8ef5f 100644
--- a/frontend/src/lib/components/OAuthSetting.svelte
+++ b/frontend/src/lib/components/OAuthSetting.svelte
@@ -7,6 +7,7 @@
 	import { enterpriseLicense } from '$lib/stores'
 	import Button from './common/button/Button.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
@@ -121,11 +122,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="{name}_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret</span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="{name}_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 			{#if name == 'microsoft' || name == 'teams'}
diff --git a/frontend/src/lib/components/OktaSetting.svelte b/frontend/src/lib/components/OktaSetting.svelte
index 495ed5794c..644b707204 100644
--- a/frontend/src/lib/components/OktaSetting.svelte
+++ b/frontend/src/lib/components/OktaSetting.svelte
@@ -5,6 +5,7 @@
 	import Toggle from './Toggle.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
+	import Password from './Password.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
@@ -95,12 +96,16 @@
 				>
 				<input type="text" placeholder="Client Id" bind:value={value['id']} />
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="okta_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
 				<span class="text-secondary font-normal text-xs"
 					>from the CLIENT SECRETS section of the okta service configuration</span
 				>
-				<input type="text" placeholder="Client Secret" bind:value={value['secret']} />
+				<Password
+					id="okta_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
+				/>
 			</label>
 			<CollapseLink text="Instructions">
 				<div class="text-xs text-primary border rounded-md p-4 space-y-3">
diff --git a/frontend/src/lib/components/PocketIdSetting.svelte b/frontend/src/lib/components/PocketIdSetting.svelte
index 812bc6c734..62dec08349 100644
--- a/frontend/src/lib/components/PocketIdSetting.svelte
+++ b/frontend/src/lib/components/PocketIdSetting.svelte
@@ -2,6 +2,7 @@
 	import { untrack } from 'svelte'
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
@@ -76,11 +77,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label class="flex flex-col gap-1">
+			<label for="pocketid_client_secret" class="flex flex-col gap-1">
 				<span class="text-emphasis font-semibold text-xs">Client Secret</span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="pocketid_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>
diff --git a/frontend/src/lib/components/ZitadelSetting.svelte b/frontend/src/lib/components/ZitadelSetting.svelte
index 430c4c588c..63247bf1de 100644
--- a/frontend/src/lib/components/ZitadelSetting.svelte
+++ b/frontend/src/lib/components/ZitadelSetting.svelte
@@ -1,21 +1,20 @@
 <script lang="ts">
-	import { run } from 'svelte/legacy';
+	import { run } from 'svelte/legacy'
 
 	import IconedResourceType from './IconedResourceType.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import Password from './Password.svelte'
 	import Toggle from './Toggle.svelte'
 	import SettingCard from './instanceSettings/SettingCard.svelte'
 
 	interface Props {
-		value: any;
+		value: any
 	}
 
-	let { value = $bindable() }: Props = $props();
-
+	let { value = $bindable() }: Props = $props()
 
 	let org = $state('')
 
-
 	function changeOrg(org) {
 		if (value) {
 			value = {
@@ -37,7 +36,7 @@
 	let enabled = $derived(value != undefined)
 	run(() => {
 		changeOrg(org)
-	});
+	})
 </script>
 
 <div class="flex flex-col gap-1">
@@ -75,11 +74,12 @@
 					bind:value={value['id']}
 				/>
 			</label>
-			<label>
+			<label for="zitadel_client_secret">
 				<span class="text-emphasis font-semibold text-xs">Client Secret </span>
-				<TextInput
-					inputProps={{ type: 'text', placeholder: 'Client Secret' }}
-					bind:value={value['secret']}
+				<Password
+					id="zitadel_client_secret"
+					placeholder="Client Secret"
+					bind:password={value['secret']}
 				/>
 			</label>
 		</SettingCard>

From 9da13d018046a3a866f28e1fc6ec93fb1644b366 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 22:34:09 +0000
Subject: [PATCH 38/50] update prompts

---
 cli/src/guidance/skills.gen.ts                           | 2 +-
 system_prompts/auto-generated/flow.md                    | 2 +-
 system_prompts/auto-generated/prompts.ts                 | 2 +-
 system_prompts/auto-generated/skills/write-flow/SKILL.md | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 72d2e9d76b..656f24e5a9 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -5420,7 +5420,7 @@ Reference a specific resource using \`$res:\` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`,
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`,
   "raw-app": `---
 name: raw-app
 description: MUST use when creating raw apps.
diff --git a/system_prompts/auto-generated/flow.md b/system_prompts/auto-generated/flow.md
index 88f1aa8301..806e279767 100644
--- a/system_prompts/auto-generated/flow.md
+++ b/system_prompts/auto-generated/flow.md
@@ -295,4 +295,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 53336762cc..8a9da7c4e5 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -2144,7 +2144,7 @@ class SqlQuery:
 
 export const OPENFLOW_SCHEMA = `## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \\"yellow\\", \\"#ffff00\\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \\u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\\nValid values: 'text' (default) - plain text response, 'image' - image generation\\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\\nFormat: Array<{ bucket: string, key: string }> - S3 object references\\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\\nRange: 0.0 to 2.0 (provider-dependent)\\n- 0.0 = deterministic, focused responses\\n- 0.7 = balanced (common default)\\n- 1.0+ = more creative/random\\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\\nRange: 1-1000.\\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}`;
 
 export const CLI_COMMANDS = `# Windmill CLI Commands
 
diff --git a/system_prompts/auto-generated/skills/write-flow/SKILL.md b/system_prompts/auto-generated/skills/write-flow/SKILL.md
index 402838d97e..3938d2a30f 100644
--- a/system_prompts/auto-generated/skills/write-flow/SKILL.md
+++ b/system_prompts/auto-generated/skills/write-flow/SKILL.md
@@ -375,4 +375,4 @@ Reference a specific resource using `$res:` prefix:
 
 ## OpenFlow Schema
 
-{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file
+{"OpenFlow":{"type":"object","description":"Top-level flow definition containing metadata, configuration, and the flow structure","properties":{"summary":{"type":"string","description":"Short description of what this flow does"},"description":{"type":"string","description":"Detailed documentation for this flow"},"value":{"$ref":"#/components/schemas/FlowValue"},"schema":{"type":"object","description":"JSON Schema for flow inputs. Use this to define input parameters, their types, defaults, and validation. For resource inputs, set type to 'object' and format to 'resource-<type>' (e.g., 'resource-stripe')"},"on_behalf_of_email":{"type":"string","description":"The flow will be run with the permissions of the user with this email."}},"required":["summary","value"]},"FlowValue":{"type":"object","description":"The flow structure containing modules and optional preprocessor/failure handlers","properties":{"modules":{"type":"array","description":"Array of steps that execute in sequence. Each step can be a script, subflow, loop, or branch","items":{"$ref":"#/components/schemas/FlowModule"}},"failure_module":{"description":"Special module that executes when the flow fails. Receives error object with message, name, stack, and step_id. Must have id 'failure'. Only supports script/rawscript types","$ref":"#/components/schemas/FlowModule"},"preprocessor_module":{"description":"Special module that runs before the first step on external triggers. Must have id 'preprocessor'. Only supports script/rawscript types. Cannot reference other step results","$ref":"#/components/schemas/FlowModule"},"same_worker":{"type":"boolean","description":"If true, all steps run on the same worker for better performance"},"concurrent_limit":{"type":"number","description":"Maximum number of concurrent executions of this flow"},"concurrency_key":{"type":"string","description":"Expression to group concurrent executions (e.g., by user ID)"},"concurrency_time_window_s":{"type":"number","description":"Time window in seconds for concurrent_limit"},"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce flow executions"},"debounce_key":{"type":"string","description":"Expression to group debounced executions"},"debounce_args_to_accumulate":{"type":"array","description":"Arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds that a job can be debounced"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of times a job can be debounced"},"skip_expr":{"type":"string","description":"JavaScript expression to conditionally skip the entire flow"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for flow results"},"cache_ignore_s3_path":{"type":"boolean"},"delete_after_secs":{"type":"integer","description":"If set, delete the flow job's args, result and logs after this many seconds following job completion"},"flow_env":{"type":"object","description":"Environment variables available to all steps. Values can be strings, JSON values, or special references: '$var:path' (workspace variable) or '$res:path' (resource).","additionalProperties":{}},"priority":{"type":"number","description":"Execution priority (higher numbers run first)"},"early_return":{"type":"string","description":"JavaScript expression to return early from the flow"},"chat_input_enabled":{"type":"boolean","description":"Whether this flow accepts chat-style input"},"notes":{"type":"array","description":"Sticky notes attached to the flow","items":{"$ref":"#/components/schemas/FlowNote"}},"groups":{"type":"array","description":"Semantic groups of modules for organizational purposes","items":{"$ref":"#/components/schemas/FlowGroup"}}},"required":["modules"]},"Retry":{"type":"object","description":"Retry configuration for failed module executions","properties":{"constant":{"type":"object","description":"Retry with constant delay between attempts","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"seconds":{"type":"integer","description":"Seconds to wait between retries"}}},"exponential":{"type":"object","description":"Retry with exponential backoff (delay doubles each time)","properties":{"attempts":{"type":"integer","description":"Number of retry attempts"},"multiplier":{"type":"integer","description":"Multiplier for exponential backoff"},"seconds":{"type":"integer","minimum":1,"description":"Initial delay in seconds"},"random_factor":{"type":"integer","minimum":0,"maximum":100,"description":"Random jitter percentage (0-100) to avoid thundering herd"}}},"retry_if":{"$ref":"#/components/schemas/RetryIf"}}},"FlowNote":{"type":"object","description":"A sticky note attached to a flow for documentation and annotation","properties":{"id":{"type":"string","description":"Unique identifier for the note"},"text":{"type":"string","description":"Content of the note"},"position":{"type":"object","description":"Position of the note in the flow editor","properties":{"x":{"type":"number","description":"X coordinate"},"y":{"type":"number","description":"Y coordinate"}},"required":["x","y"]},"size":{"type":"object","description":"Size of the note in the flow editor","properties":{"width":{"type":"number","description":"Width in pixels"},"height":{"type":"number","description":"Height in pixels"}},"required":["width","height"]},"color":{"type":"string","description":"Color of the note (e.g., \"yellow\", \"#ffff00\")"},"type":{"type":"string","enum":["free","group"],"description":"Type of note - 'free' for standalone notes, 'group' for notes that group other nodes"},"locked":{"type":"boolean","default":false,"description":"Whether the note is locked and cannot be edited or moved"},"contained_node_ids":{"type":"array","items":{"type":"string"},"description":"For group notes, the IDs of nodes contained within this group"}},"required":["id","text","color","type"]},"FlowGroup":{"type":"object","description":"A semantic group of flow modules for organizational purposes. Does not affect execution \u2014 modules remain in their original position in the flow. Groups provide naming and collapsibility in the editor. Members are computed dynamically from all nodes on paths between start_id and end_id.","properties":{"summary":{"type":"string","description":"Display name for this group"},"note":{"type":"string","description":"Markdown note shown below the group header"},"autocollapse":{"type":"boolean","default":false,"description":"If true, this group is collapsed by default in the flow editor. UI hint only."},"start_id":{"type":"string","description":"ID of the first flow module in this group (topological entry point)"},"end_id":{"type":"string","description":"ID of the last flow module in this group (topological exit point)"},"color":{"type":"string","description":"Color for the group in the flow editor"}},"required":["start_id","end_id"]},"RetryIf":{"type":"object","description":"Conditional retry based on error or result","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to retry. Has access to 'result' and 'error' variables"}},"required":["expr"]},"StopAfterIf":{"type":"object","description":"Early termination condition for a module","properties":{"skip_if_stopped":{"type":"boolean","description":"If true, following steps are skipped when this condition triggers"},"expr":{"type":"string","description":"JavaScript expression evaluated after the module runs. Can use 'result' (step's result) or 'flow_input'. Return true to stop"},"error_message":{"type":"string","nullable":true,"description":"Custom error message when stopping with an error. Mutually exclusive with skip_if_stopped. If set to a non-empty string, the flow stops with this error. If empty string, a default error message is used. If null or omitted, no error is raised."}},"required":["expr"]},"FlowModule":{"type":"object","description":"A single step in a flow. Can be a script, subflow, loop, or branch","properties":{"id":{"type":"string","description":"Unique identifier for this step. Used to reference results via 'results.step_id'. Must be a valid identifier (alphanumeric, underscore, hyphen)"},"value":{"$ref":"#/components/schemas/FlowModuleValue"},"stop_after_if":{"description":"Early termination condition evaluated after this step completes","$ref":"#/components/schemas/StopAfterIf"},"stop_after_all_iters_if":{"description":"For loops only - early termination condition evaluated after all iterations complete","$ref":"#/components/schemas/StopAfterIf"},"skip_if":{"type":"object","description":"Conditionally skip this step based on previous results or flow inputs","properties":{"expr":{"type":"string","description":"JavaScript expression that returns true to skip. Can use 'flow_input' or 'results.<step_id>'"}},"required":["expr"]},"sleep":{"description":"Delay before executing this step (in seconds or as expression)","$ref":"#/components/schemas/InputTransform"},"cache_ttl":{"type":"number","description":"Cache duration in seconds for this step's results"},"cache_ignore_s3_path":{"type":"boolean"},"timeout":{"description":"Maximum execution time in seconds (static value or expression)","$ref":"#/components/schemas/InputTransform"},"delete_after_secs":{"type":"integer","description":"If set, delete the step's args, result and logs after this many seconds following job completion"},"summary":{"type":"string","description":"Short description of what this step does"},"mock":{"type":"object","description":"Mock configuration for testing without executing the actual step","properties":{"enabled":{"type":"boolean","description":"If true, return mock value instead of executing"},"return_value":{"description":"Value to return when mocked"}}},"suspend":{"type":"object","description":"Configuration for approval/resume steps that wait for user input","properties":{"required_events":{"type":"integer","description":"Number of approvals required before continuing"},"timeout":{"type":"integer","description":"Timeout in seconds before auto-continuing or canceling"},"resume_form":{"type":"object","description":"Form schema for collecting input when resuming","properties":{"schema":{"type":"object","description":"JSON Schema for the resume form"}}},"user_auth_required":{"type":"boolean","description":"If true, only authenticated users can approve"},"user_groups_required":{"description":"Expression or list of groups that can approve","$ref":"#/components/schemas/InputTransform"},"self_approval_disabled":{"type":"boolean","description":"If true, the user who started the flow cannot approve"},"hide_cancel":{"type":"boolean","description":"If true, hide the cancel button on the approval form"},"continue_on_disapprove_timeout":{"type":"boolean","description":"If true, continue flow on timeout instead of canceling"}}},"priority":{"type":"number","description":"Execution priority for this step (higher numbers run first)"},"continue_on_error":{"type":"boolean","description":"If true, flow continues even if this step fails"},"retry":{"description":"Retry configuration if this step fails","$ref":"#/components/schemas/Retry"},"debouncing":{"description":"Debounce configuration for this step (EE only)","type":"object","properties":{"debounce_delay_s":{"type":"integer","description":"Delay in seconds to debounce this step's executions across flow runs"},"debounce_key":{"type":"string","description":"Expression to group debounced executions. Supports $workspace and $args[name]. Default: $workspace/flow/<flow_path>-<step_id>"},"debounce_args_to_accumulate":{"type":"array","description":"Array-type arguments to accumulate across debounced executions","items":{"type":"string"}},"max_total_debouncing_time":{"type":"integer","description":"Maximum total time in seconds before forced execution"},"max_total_debounces_amount":{"type":"integer","description":"Maximum number of debounces before forced execution"}}}},"required":["value","id"]},"InputTransform":{"description":"Maps input parameters for a step. Can be a static value or a JavaScript expression that references previous results or flow inputs","oneOf":[{"$ref":"#/components/schemas/StaticTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"StaticTransform":{"type":"object","description":"Static value passed directly to the step. Use for hardcoded values or resource references like '$res:path/to/resource'","properties":{"value":{"description":"The static value. For resources, use format '$res:path/to/resource'"},"type":{"type":"string","enum":["static"]}},"required":["type"]},"JavascriptTransform":{"type":"object","description":"JavaScript expression evaluated at runtime. Can reference previous step results via 'results.step_id' or flow inputs via 'flow_input.property'. Inside loops, use 'flow_input.iter.value' for the current iteration value","properties":{"expr":{"type":"string","description":"JavaScript expression returning the value. Available variables - results (object with all previous step results), flow_input (flow inputs), flow_input.iter (in loops)"},"type":{"type":"string","enum":["javascript"]}},"required":["expr","type"]},"AiTransform":{"type":"object","description":"Value resolved by the AI runtime for this input. The AI engine decides how to satisfy the parameter.","properties":{"type":{"type":"string","enum":["ai"]}},"required":["type"]},"AIProviderKind":{"type":"string","description":"Supported AI provider types","enum":["openai","azure_openai","anthropic","mistral","deepseek","googleai","groq","openrouter","togetherai","customai","aws_bedrock"]},"ProviderConfig":{"type":"object","description":"Complete AI provider configuration with resource reference and model selection","properties":{"kind":{"$ref":"#/components/schemas/AIProviderKind"},"resource":{"type":"string","description":"Resource reference in format '$res:{resource_path}' pointing to provider credentials"},"model":{"type":"string","description":"Model identifier (e.g., 'gpt-4', 'claude-3-opus-20240229', 'gemini-pro')"}},"required":["kind","resource","model"]},"StaticProviderTransform":{"type":"object","description":"Static provider configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/ProviderConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"ProviderTransform":{"description":"Provider configuration - can be static (ProviderConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticProviderTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticProviderTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"MemoryOff":{"type":"object","description":"No conversation memory/context","properties":{"kind":{"type":"string","enum":["off"]}},"required":["kind"]},"MemoryAuto":{"type":"object","description":"Automatic context management","properties":{"kind":{"type":"string","enum":["auto"]},"context_length":{"type":"integer","description":"Maximum number of messages to retain in context"},"memory_id":{"type":"string","description":"Identifier for persistent memory across agent invocations"}},"required":["kind"]},"MemoryMessage":{"type":"object","description":"A single message in conversation history","properties":{"role":{"type":"string","enum":["user","assistant","system"]},"content":{"type":"string"}},"required":["role","content"]},"MemoryManual":{"type":"object","description":"Explicit message history","properties":{"kind":{"type":"string","enum":["manual"]},"messages":{"type":"array","items":{"$ref":"#/components/schemas/MemoryMessage"}}},"required":["kind","messages"]},"MemoryConfig":{"description":"Conversation memory configuration","oneOf":[{"$ref":"#/components/schemas/MemoryOff"},{"$ref":"#/components/schemas/MemoryAuto"},{"$ref":"#/components/schemas/MemoryManual"}],"discriminator":{"propertyName":"kind","mapping":{"off":"#/components/schemas/MemoryOff","auto":"#/components/schemas/MemoryAuto","manual":"#/components/schemas/MemoryManual"}}},"StaticMemoryTransform":{"type":"object","description":"Static memory configuration passed directly to the AI agent","properties":{"value":{"$ref":"#/components/schemas/MemoryConfig"},"type":{"type":"string","enum":["static"]}},"required":["type","value"]},"MemoryTransform":{"description":"Memory configuration - can be static (MemoryConfig), JavaScript expression, or AI-determined","oneOf":[{"$ref":"#/components/schemas/StaticMemoryTransform"},{"$ref":"#/components/schemas/JavascriptTransform"},{"$ref":"#/components/schemas/AiTransform"}],"discriminator":{"propertyName":"type","mapping":{"static":"#/components/schemas/StaticMemoryTransform","javascript":"#/components/schemas/JavascriptTransform","ai":"#/components/schemas/AiTransform"}}},"FlowModuleValue":{"description":"The actual implementation of a flow step. Can be a script (inline or referenced), subflow, loop, branch, or special module type","oneOf":[{"$ref":"#/components/schemas/RawScript"},{"$ref":"#/components/schemas/PathScript"},{"$ref":"#/components/schemas/PathFlow"},{"$ref":"#/components/schemas/ForloopFlow"},{"$ref":"#/components/schemas/WhileloopFlow"},{"$ref":"#/components/schemas/BranchOne"},{"$ref":"#/components/schemas/BranchAll"},{"$ref":"#/components/schemas/Identity"},{"$ref":"#/components/schemas/AiAgent"}],"discriminator":{"propertyName":"type","mapping":{"rawscript":"#/components/schemas/RawScript","script":"#/components/schemas/PathScript","flow":"#/components/schemas/PathFlow","forloopflow":"#/components/schemas/ForloopFlow","whileloopflow":"#/components/schemas/WhileloopFlow","branchone":"#/components/schemas/BranchOne","branchall":"#/components/schemas/BranchAll","identity":"#/components/schemas/Identity","aiagent":"#/components/schemas/AiAgent"}}},"RawScript":{"type":"object","description":"Inline script with code defined directly in the flow. Use 'bun' as default language if unspecified. The script receives arguments from input_transforms","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"content":{"type":"string","description":"The script source code. Should export a 'main' function"},"language":{"type":"string","description":"Programming language for this script","enum":["deno","bun","python3","go","bash","powershell","postgresql","mysql","bigquery","snowflake","mssql","oracledb","graphql","nativets","php","rust","ansible","csharp","nu","java","ruby","rlang","duckdb"]},"path":{"type":"string","description":"Optional path for saving this script"},"lock":{"type":"string","description":"Lock file content for dependencies"},"type":{"type":"string","enum":["rawscript"]},"tag":{"type":"string","description":"Worker group tag for execution routing"},"concurrent_limit":{"type":"number","description":"Maximum concurrent executions of this script"},"concurrency_time_window_s":{"type":"number","description":"Time window for concurrent_limit"},"custom_concurrency_key":{"type":"string","description":"Custom key for grouping concurrent executions"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"},"assets":{"type":"array","description":"External resources this script accesses (S3 objects, resources, etc.)","items":{"type":"object","required":["path","kind"],"properties":{"path":{"type":"string","description":"Path to the asset"},"kind":{"type":"string","description":"Type of asset","enum":["s3object","resource","ducklake","datatable","volume"]},"access_type":{"type":"string","nullable":true,"description":"Access level for this asset","enum":["r","w","rw"]},"alt_access_type":{"type":"string","nullable":true,"description":"Alternative access level","enum":["r","w","rw"]}}}}},"required":["type","content","language","input_transforms"]},"PathScript":{"type":"object","description":"Reference to an existing script by path. Use this when calling a previously saved script instead of writing inline code","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the script's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the script in the workspace (e.g., 'f/scripts/send_email')"},"hash":{"type":"string","description":"Optional specific version hash of the script to use"},"type":{"type":"string","enum":["script"]},"tag_override":{"type":"string","description":"Override the script's default worker group tag"},"is_trigger":{"type":"boolean","description":"If true, this script is a trigger that can start the flow"}},"required":["type","path","input_transforms"]},"PathFlow":{"type":"object","description":"Reference to an existing flow by path. Use this to call another flow as a subflow","properties":{"input_transforms":{"type":"object","description":"Map of parameter names to their values (static or JavaScript expressions). These become the subflow's input arguments","additionalProperties":{"$ref":"#/components/schemas/InputTransform"}},"path":{"type":"string","description":"Path to the flow in the workspace (e.g., 'f/flows/process_user')"},"type":{"type":"string","enum":["flow"]}},"required":["type","path","input_transforms"]},"ForloopFlow":{"type":"object","description":"Executes nested modules in a loop over an iterator. Inside the loop, use 'flow_input.iter.value' to access the current iteration value, and 'flow_input.iter.index' for the index. Supports parallel execution for better performance on I/O-bound operations","properties":{"modules":{"type":"array","description":"Steps to execute for each iteration. These can reference the iteration value via 'flow_input.iter.value'","items":{"$ref":"#/components/schemas/FlowModule"}},"iterator":{"description":"JavaScript expression that returns an array to iterate over. Can reference 'results.step_id' or 'flow_input'","$ref":"#/components/schemas/InputTransform"},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["forloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (faster for I/O-bound operations). Use with parallelism to control concurrency"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true. Limits resource usage. Can be static number or expression","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","iterator","skip_failures","type"]},"WhileloopFlow":{"type":"object","description":"Executes nested modules repeatedly while a condition is true. The loop checks the condition after each iteration. Use stop_after_if on modules to control loop termination","properties":{"modules":{"type":"array","description":"Steps to execute in each iteration. Use stop_after_if to control when the loop ends","items":{"$ref":"#/components/schemas/FlowModule"}},"skip_failures":{"type":"boolean","description":"If true, iteration failures don't stop the loop. Failed iterations return null"},"type":{"type":"string","enum":["whileloopflow"]},"parallel":{"type":"boolean","description":"If true, iterations run concurrently (use with caution in while loops)"},"parallelism":{"description":"Maximum number of concurrent iterations when parallel=true","$ref":"#/components/schemas/InputTransform"},"squash":{"type":"boolean"}},"required":["modules","skip_failures","type"]},"BranchOne":{"type":"object","description":"Conditional branching where only the first matching branch executes. Branches are evaluated in order, and the first one with a true expression runs. If no branches match, the default branch executes","properties":{"branches":{"type":"array","description":"Array of branches to evaluate in order. The first branch with expr evaluating to true executes","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch condition"},"expr":{"type":"string","description":"JavaScript expression that returns boolean. Can use 'results.step_id' or 'flow_input'. First true expr wins"},"modules":{"type":"array","description":"Steps to execute if this branch's expr is true","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules","expr"]}},"default":{"type":"array","description":"Steps to execute if no branch expressions match","items":{"$ref":"#/components/schemas/FlowModule"}},"type":{"type":"string","enum":["branchone"]}},"required":["branches","default","type"]},"BranchAll":{"type":"object","description":"Parallel branching where all branches execute simultaneously. Unlike BranchOne, all branches run regardless of conditions. Useful for executing independent tasks concurrently","properties":{"branches":{"type":"array","description":"Array of branches that all execute (either in parallel or sequentially)","items":{"type":"object","properties":{"summary":{"type":"string","description":"Short description of this branch's purpose"},"skip_failure":{"type":"boolean","description":"If true, failure in this branch doesn't fail the entire flow"},"modules":{"type":"array","description":"Steps to execute in this branch","items":{"$ref":"#/components/schemas/FlowModule"}}},"required":["modules"]}},"type":{"type":"string","enum":["branchall"]},"parallel":{"type":"boolean","description":"If true, all branches execute concurrently. If false, they execute sequentially"}},"required":["branches","type"]},"AgentTool":{"type":"object","description":"A tool available to an AI agent. Can be a flow module or an external MCP (Model Context Protocol) tool","properties":{"id":{"type":"string","description":"Unique identifier for this tool. Cannot contain spaces - use underscores instead (e.g., 'get_user_data' not 'get user data')"},"summary":{"type":"string","description":"Short description of what this tool does (shown to the AI)"},"value":{"$ref":"#/components/schemas/ToolValue"}},"required":["id","value"]},"ToolValue":{"description":"The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference","oneOf":[{"$ref":"#/components/schemas/FlowModuleTool"},{"$ref":"#/components/schemas/McpToolValue"},{"$ref":"#/components/schemas/WebsearchToolValue"}],"discriminator":{"propertyName":"tool_type","mapping":{"flowmodule":"#/components/schemas/FlowModuleTool","mcp":"#/components/schemas/McpToolValue","websearch":"#/components/schemas/WebsearchToolValue"}}},"FlowModuleTool":{"description":"A tool implemented as a flow module (script, flow, etc.). The AI can call this like any other flow module","allOf":[{"type":"object","properties":{"tool_type":{"type":"string","enum":["flowmodule"]}},"required":["tool_type"]},{"$ref":"#/components/schemas/FlowModuleValue"}]},"WebsearchToolValue":{"type":"object","description":"A tool implemented as a websearch tool. The AI can call this like any other websearch tool","properties":{"tool_type":{"type":"string","enum":["websearch"]}},"required":["tool_type"]},"McpToolValue":{"type":"object","description":"Reference to an external MCP (Model Context Protocol) tool. The AI can call tools from MCP servers","properties":{"tool_type":{"type":"string","enum":["mcp"]},"resource_path":{"type":"string","description":"Path to the MCP resource/server configuration"},"include_tools":{"type":"array","description":"Whitelist of specific tools to include from this MCP server","items":{"type":"string"}},"exclude_tools":{"type":"array","description":"Blacklist of tools to exclude from this MCP server","items":{"type":"string"}}},"required":["tool_type","resource_path"]},"AiAgent":{"type":"object","description":"AI agent step that can use tools to accomplish tasks. The agent receives inputs and can call any of its configured tools to complete the task","properties":{"input_transforms":{"type":"object","description":"Input parameters for the AI agent mapped to their values","properties":{"provider":{"$ref":"#/components/schemas/ProviderTransform"},"output_type":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Output format type.\nValid values: 'text' (default) - plain text response, 'image' - image generation\n"},"user_message":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"The user's prompt/message to the AI agent. Supports variable interpolation with flow.input syntax."},"system_prompt":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"System instructions that guide the AI's behavior, persona, and response style. Optional."},"streaming":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Boolean. If true, stream the AI response incrementally.\nStreaming events include: token_delta, tool_call, tool_call_arguments, tool_execution, tool_result\n"},"memory":{"$ref":"#/components/schemas/MemoryTransform"},"output_schema":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"JSON Schema object defining structured output format. Used when you need the AI to return data in a specific shape.\nSupports standard JSON Schema properties: type, properties, required, items, enum, pattern, minLength, maxLength, minimum, maximum, etc.\nExample: { type: 'object', properties: { name: { type: 'string' }, age: { type: 'integer' } }, required: ['name'] }\n"},"user_attachments":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Array of file references (images or PDFs) for the AI agent.\nFormat: Array<{ bucket: string, key: string }> - S3 object references\nExample: [{ bucket: 'my-bucket', key: 'documents/report.pdf' }]\n"},"max_completion_tokens":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Integer. Maximum number of tokens the AI will generate in its response.\nRange: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.\n"},"temperature":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Float. Controls randomness/creativity of responses.\nRange: 0.0 to 2.0 (provider-dependent)\n- 0.0 = deterministic, focused responses\n- 0.7 = balanced (common default)\n- 1.0+ = more creative/random\n"},"max_iterations":{"allOf":[{"$ref":"#/components/schemas/InputTransform"}],"description":"Number. Limits how many times the agent can loop through reasoning and tool use.\nRange: 1-1000.\n"}},"required":["provider","user_message","output_type"]},"tools":{"type":"array","description":"Array of tools the agent can use. The agent decides which tools to call based on the task","items":{"$ref":"#/components/schemas/AgentTool"}},"type":{"type":"string","enum":["aiagent"]},"omit_output_from_conversation":{"type":"boolean","default":false,"description":"If true, this AI agent step does not persist its assistant or tool messages to the flow conversation when chat mode is enabled."},"parallel":{"type":"boolean","description":"If true, the agent can execute multiple tool calls in parallel"}},"required":["tools","type","input_transforms"]},"Identity":{"type":"object","description":"Pass-through module that returns its input unchanged. Useful for flow structure or as a placeholder","properties":{"type":{"type":"string","enum":["identity"]},"flow":{"type":"boolean","description":"If true, marks this as a flow identity (special handling)"}},"required":["type"]},"FlowStatus":{"type":"object","properties":{"step":{"type":"integer"},"modules":{"type":"array","items":{"$ref":"#/components/schemas/FlowStatusModule"}},"user_states":{"additionalProperties":true},"preprocessor_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"}]},"failure_module":{"allOf":[{"$ref":"#/components/schemas/FlowStatusModule"},{"type":"object","properties":{"parent_module":{"type":"string"}}}]},"retry":{"type":"object","properties":{"fail_count":{"type":"integer"},"failed_jobs":{"type":"array","items":{"type":"string","format":"uuid"}}}}},"required":["step","modules","failure_module"]},"FlowStatusModule":{"type":"object","properties":{"type":{"type":"string","enum":["WaitingForPriorSteps","WaitingForEvents","WaitingForExecutor","InProgress","Success","Failure"]},"id":{"type":"string"},"job":{"type":"string","format":"uuid"},"count":{"type":"integer"},"progress":{"type":"integer"},"iterator":{"type":"object","properties":{"index":{"type":"integer"},"itered":{"type":"array","items":{}},"itered_len":{"type":"integer"},"args":{}}},"flow_jobs":{"type":"array","items":{"type":"string"}},"flow_jobs_success":{"type":"array","items":{"type":"boolean"}},"flow_jobs_duration":{"type":"object","properties":{"started_at":{"type":"array","items":{"type":"string"}},"duration_ms":{"type":"array","items":{"type":"integer"}}}},"branch_chosen":{"type":"object","properties":{"type":{"type":"string","enum":["branch","default"]},"branch":{"type":"integer"}},"required":["type"]},"branchall":{"type":"object","properties":{"branch":{"type":"integer"},"len":{"type":"integer"}},"required":["branch","len"]},"approvers":{"type":"array","items":{"type":"object","properties":{"resume_id":{"type":"integer"},"approver":{"type":"string"}},"required":["resume_id","approver"]}},"failed_retries":{"type":"array","items":{"type":"string","format":"uuid"}},"skipped":{"type":"boolean"},"agent_actions":{"type":"array","items":{"type":"object","oneOf":[{"type":"object","properties":{"job_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"type":{"type":"string","enum":["tool_call"]},"module_id":{"type":"string"}},"required":["job_id","function_name","type","module_id"]},{"type":"object","properties":{"call_id":{"type":"string","format":"uuid"},"function_name":{"type":"string"},"resource_path":{"type":"string"},"type":{"type":"string","enum":["mcp_tool_call"]},"arguments":{"type":"object"}},"required":["call_id","function_name","resource_path","type"]},{"type":"object","properties":{"type":{"type":"string","enum":["web_search"]}},"required":["type"]},{"type":"object","properties":{"type":{"type":"string","enum":["message"]}},"required":["content","type"]}]}},"agent_actions_success":{"type":"array","items":{"type":"boolean"}}},"required":["type"]}}
\ No newline at end of file

From b972fabab41e483677aa6135ea8ef642a04a0a5c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 22:37:58 +0000
Subject: [PATCH 39/50] chore(main): release 1.700.0 (#9092)

* chore(main): release 1.700.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  23 +
 backend/Cargo.lock                            | 554 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +-
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/main.ts                               |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 349 insertions(+), 308 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 98cdc3b50a..f978732508 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,28 @@
 # Changelog
 
+## [1.700.0](https://github.com/windmill-labs/windmill/compare/v1.699.0...v1.700.0) (2026-05-11)
+
+
+### Features
+
+* **cli:** auto-infer args for `wmill app push` ([#9091](https://github.com/windmill-labs/windmill/issues/9091)) ([43b1800](https://github.com/windmill-labs/windmill/commit/43b18006f32fd5db54bbf8ae7ff0e0b314a517e5))
+* **forks:** prompt to delete forked children when deleting a fork ([#9097](https://github.com/windmill-labs/windmill/issues/9097)) ([e43a958](https://github.com/windmill-labs/windmill/commit/e43a958c5c6ae01a1fbecf3db63c6541a245be62))
+* **operators:** allow operators to access assets page ([#9095](https://github.com/windmill-labs/windmill/issues/9095)) ([20ecd90](https://github.com/windmill-labs/windmill/commit/20ecd904e7060c3cf90f2605740bb349b2a3e6ed))
+* **vault:** configurable JWT auth mount path and setup-doc fixes ([#9100](https://github.com/windmill-labs/windmill/issues/9100)) ([f8ba084](https://github.com/windmill-labs/windmill/commit/f8ba0840d74572c880cf458938365b3ec808c6fb))
+
+
+### Bug Fixes
+
+* add Input, Result, Trigger to reserved flow step IDs ([#9109](https://github.com/windmill-labs/windmill/issues/9109)) ([9f79a86](https://github.com/windmill-labs/windmill/commit/9f79a86a686708f66ccc512d4f132cb9a00397a7)), closes [#7139](https://github.com/windmill-labs/windmill/issues/7139)
+* **frontend:** mark Path dirty when folder picker changes selection ([#9096](https://github.com/windmill-labs/windmill/issues/9096)) ([23bb1b5](https://github.com/windmill-labs/windmill/commit/23bb1b541e78846d5978153fd8d9bb4f01cec72b))
+* mask oauth client secret in instance settings ([#9112](https://github.com/windmill-labs/windmill/issues/9112)) ([ac3c155](https://github.com/windmill-labs/windmill/commit/ac3c155541eb5ca20d65c38ad13dca6c10a572c9))
+* populate raw_code for flowscript and appscript runs ([#9104](https://github.com/windmill-labs/windmill/issues/9104)) ([05172ac](https://github.com/windmill-labs/windmill/commit/05172ac3bdfc3472da5e9d8a825cdd479ba9e375))
+
+
+### Performance Improvements
+
+* lazy-load script editor history and hit partial index ([#9107](https://github.com/windmill-labs/windmill/issues/9107)) ([03e8bc8](https://github.com/windmill-labs/windmill/commit/03e8bc8c14258355d7d695333c1588807fbf8cd6))
+
 ## [1.699.0](https://github.com/windmill-labs/windmill/compare/v1.698.0...v1.699.0) (2026-05-08)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 82235725ee..023e947232 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -41,9 +41,9 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.8.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac1f845298e95f983ff1944b728ae08b8cebab80d684f0a832ed0fc74dfa27e2"
+checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher 0.4.4",
@@ -57,7 +57,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
 dependencies = [
  "aead",
- "aes 0.8.3",
+ "aes 0.8.4",
  "cipher 0.4.4",
  "ctr",
  "ghash",
@@ -164,7 +164,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -175,7 +175,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1323,9 +1323,9 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.8.4"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
 dependencies = [
  "axum-core 0.5.6",
  "axum-macros",
@@ -1344,8 +1344,7 @@ dependencies = [
  "multer",
  "percent-encoding",
  "pin-project-lite",
- "rustversion",
- "serde",
+ "serde_core",
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
@@ -1522,7 +1521,7 @@ version = "0.71.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f58bf3d7db68cfbac37cfc485a8d711e87e064c3d0fe0435b92f7a407f9d6b3"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1542,7 +1541,7 @@ version = "0.72.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "993776b509cfb49c750f11b8f07a46fa23e0a1386ffc01fb1e7d343efc387895"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cexpr",
  "clang-sys",
  "itertools 0.13.0",
@@ -1585,11 +1584,11 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -1816,6 +1815,15 @@ dependencies = [
  "alloc-stdlib",
 ]
 
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
 [[package]]
 name = "bstr"
 version = "1.12.1"
@@ -2091,6 +2099,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chrono"
 version = "0.4.44"
@@ -2552,14 +2571,14 @@ dependencies = [
 
 [[package]]
 name = "csv"
-version = "1.3.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acdc4883a9c96732e4733212c01447ebd805833b7275a73ca3ee080fd77afdaf"
+checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"
 dependencies = [
  "csv-core",
  "itoa",
  "ryu",
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -2592,7 +2611,7 @@ dependencies = [
  "openssl-sys",
  "pkg-config",
  "vcpkg",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2652,16 +2671,6 @@ dependencies = [
  "darling_macro 0.20.11",
 ]
 
-[[package]]
-name = "darling"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9cdf337090841a411e2a7f3deb9187445851f91b309c0c0a29e05f74a00a48c0"
-dependencies = [
- "darling_core 0.21.3",
- "darling_macro 0.21.3",
-]
-
 [[package]]
 name = "darling"
 version = "0.23.0"
@@ -2714,20 +2723,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "darling_core"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1247195ecd7e3c85f83c8d2a366e4210d588e802133e1e355180a9870b517ea4"
-dependencies = [
- "fnv",
- "ident_case",
- "proc-macro2",
- "quote",
- "strsim 0.11.1",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "darling_core"
 version = "0.23.0"
@@ -2774,17 +2769,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "darling_macro"
-version = "0.21.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d38308df82d1080de0afee5d069fa14b0326a88c14f15c5ccda35b4a6c414c81"
-dependencies = [
- "darling_core 0.21.3",
- "quote",
- "syn 2.0.117",
-]
-
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
@@ -4155,7 +4139,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4450,7 +4434,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4575,13 +4559,12 @@ checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
 [[package]]
 name = "filetime"
-version = "0.2.27"
+version = "0.2.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f98844151eee8917efc50bd9e8318cb963ae8b297431495d3f758616ea5c57db"
+checksum = "2d5b2eef6fafbf69f877e55509ce5b11a760690ac9700a2921be067aa6afaef6"
 dependencies = [
  "cfg-if",
  "libc",
- "libredox",
 ]
 
 [[package]]
@@ -4602,7 +4585,7 @@ version = "25.12.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35f6839d7b3b98adde531effaf34f0c2badc6f4735d26fe74709d8e513a96ef3"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "rustc_version 0.4.1",
 ]
 
@@ -5010,8 +4993,8 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link 0.1.3",
- "windows-result 0.3.4",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
 ]
 
 [[package]]
@@ -5091,6 +5074,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
  "wasip2",
  "wasip3",
 ]
@@ -5367,21 +5351,22 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash 0.2.0",
  "serde",
+ "serde_core",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.17.0"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
 name = "hashify"
@@ -5916,7 +5901,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core 0.56.0",
+ "windows-core 0.62.2",
 ]
 
 [[package]]
@@ -6067,7 +6052,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.0",
+ "hashbrown 0.17.1",
  "serde",
  "serde_core",
 ]
@@ -6115,7 +6100,7 @@ version = "0.7.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d09b98f7eace8982db770e4408e7470b028ce513ac28fecdc6bf4c30fe92b62"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "libc",
 ]
@@ -6603,7 +6588,7 @@ version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9e668df13f2e97f3eed52d9301f6b1c4c1ccfccc30eab9e6628e4a8c1fc3546"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "bytes",
  "lazy_static",
  "libgssapi-sys",
@@ -6652,7 +6637,7 @@ version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "libc",
  "plain",
  "redox_syscall 0.7.5",
@@ -6771,7 +6756,7 @@ version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
 dependencies = [
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -6800,9 +6785,9 @@ dependencies = [
 
 [[package]]
 name = "lz4_flex"
-version = "0.13.0"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db9a0d582c2874f68138a16ce1867e0ffde6c0bb0a0df85e1f36d04146db488a"
+checksum = "7ef0d4ed8669f8f8826eb00dc878084aa8f253506c4fd5e8f58f5bce72ddb97e"
 
 [[package]]
 name = "lzma-sys"
@@ -7247,7 +7232,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fbb9f371618ce723f095c61fbcdc36e8936956d2b62832f9c7648689b338e052"
 dependencies = [
  "base64 0.22.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "btoi",
  "byteorder",
  "bytes",
@@ -7289,7 +7274,7 @@ dependencies = [
  "openssl-probe 0.2.1",
  "openssl-sys",
  "schannel",
- "security-framework 3.6.0",
+ "security-framework 3.7.0",
  "security-framework-sys",
  "tempfile",
 ]
@@ -7306,7 +7291,7 @@ version = "0.27.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eb04e9c688eff1c89d72b407f168cf79bb9e867a9d3323ed6c01519eb9cc053"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "libc",
 ]
@@ -7317,7 +7302,7 @@ version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -7329,7 +7314,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -7341,7 +7326,7 @@ version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -7388,7 +7373,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7683,7 +7668,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
  "http 1.4.0",
@@ -7791,7 +7776,7 @@ version = "6.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc3cbf698f9438986c11a880c90a6d04b9de27575afd28bbf45b154b6c709e2"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "libc",
  "once_cell",
  "onig_sys",
@@ -7850,7 +7835,7 @@ version = "0.10.79"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf0b434746ee2832f4f0baf10137e1cabb18cbe6912c69e2e33263c45250f542"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -8695,11 +8680,11 @@ dependencies = [
 
 [[package]]
 name = "proc-macro-crate"
-version = "3.4.0"
+version = "3.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219cb19e96be00ab2e37d6e299658a0cfa83e52429179969b0f0121b4ac46983"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
 dependencies = [
- "toml_edit 0.23.4",
+ "toml_edit 0.25.11+spec-1.1.0",
 ]
 
 [[package]]
@@ -8799,7 +8784,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc5b72d8145275d844d4b5f6d4e1eef00c8cd889edb6035c21675d1bb1f45c9f"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "chrono",
  "flate2",
  "hex",
@@ -8813,7 +8798,7 @@ version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "239df02d8349b06fc07398a3a1697b06418223b1c7725085e801e7c0fc6a12ec"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "chrono",
  "hex",
 ]
@@ -8900,7 +8885,7 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "getopts",
  "memchr",
  "unicase",
@@ -8963,7 +8948,7 @@ checksum = "5a70b1b8b47e31d0498ecbc3c5470bb931399a8bfed1fd79d1717a61ce7f96e3"
 dependencies = [
  "ahash 0.8.12",
  "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "parking_lot",
 ]
 
@@ -9085,6 +9070,17 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -9142,6 +9138,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_distr"
 version = "0.5.1"
@@ -9167,7 +9169,7 @@ version = "11.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "498cd0dc59d73224351ee52a95fee0f1a617a2eae0e7d9d720cc622c73a54186"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -9281,7 +9283,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -9290,7 +9292,7 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4666a1a60d8412eab19d94f6d13dcc9cea0a5ef4fdf6a5db306537413c661b1b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
 ]
 
 [[package]]
@@ -9532,11 +9534,11 @@ checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
 [[package]]
 name = "retry-policies"
-version = "0.5.0"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "503c78f59814e2664c9980b739b19e40f549233ecf39928040ee54fdd431f614"
+checksum = "dc05fbf560421a0357a750cbe78c7ca19d4923918490daabba313d5dbc871e47"
 dependencies = [
- "rand 0.8.5",
+ "rand 0.10.1",
 ]
 
 [[package]]
@@ -9614,7 +9616,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bef41ebc9ebed2c1b1d90203e9d1756091e8a00bbc3107676151f39868ca0ee"
 dependencies = [
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -9672,7 +9674,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8bf7840285c321c3ab20e752a9afb95548c75cd7f4632a0627cea3507e310c1"
 dependencies = [
  "async-lock",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "relative-path",
  "rquickjs-sys",
 ]
@@ -9857,7 +9859,7 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -9870,11 +9872,11 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -9953,7 +9955,7 @@ dependencies = [
  "openssl-probe 0.2.1",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.6.0",
+ "security-framework 3.7.0",
 ]
 
 [[package]]
@@ -9999,10 +10001,10 @@ dependencies = [
  "rustls-native-certs 0.8.3",
  "rustls-platform-verifier-android",
  "rustls-webpki 0.103.13",
- "security-framework 3.6.0",
+ "security-framework 3.7.0",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10137,7 +10139,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "675656c1eabb620b921efea4f9199f97fc86e36dd6ffd1fbbe48d0f59a4987f5"
 dependencies = [
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "serde",
  "serde_json",
 ]
@@ -10338,7 +10340,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "core-foundation 0.9.4",
  "core-foundation-sys",
  "libc",
@@ -10347,11 +10349,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "3.6.0"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d17b898a6d6948c3a8ee4372c17cb384f90d2e6e912ef00895b14fd7ab54ec38"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -10560,19 +10562,19 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.14.1"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c522100790450cf78eeac1507263d0a350d4d5b30df0c8e1fe051a10c22b376e"
+checksum = "e72c1c2cb7b223fafb600a619537a871c2818583d619401b785e7c0b746ccde2"
 dependencies = [
  "base64 0.22.1",
+ "bs58",
  "chrono",
  "hex",
  "indexmap 1.9.3",
  "indexmap 2.14.0",
  "schemars 0.9.0",
  "schemars 1.2.1",
- "serde",
- "serde_derive",
+ "serde_core",
  "serde_json",
  "serde_with_macros",
  "time",
@@ -10580,11 +10582,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.14.1"
+version = "3.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "327ada00f7d64abaac1e55a6911e90cf665aa051b9a561c7006c157f4633135e"
+checksum = "b90c488738ecb4fb0262f41f43bc40efc5868d9fb744319ddf5f5317f417bfac"
 dependencies = [
- "darling 0.21.3",
+ "darling 0.23.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -10851,7 +10853,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -11062,7 +11064,7 @@ dependencies = [
  "atoi",
  "base64 0.22.1",
  "bigdecimal",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "byteorder",
  "bytes",
  "chrono",
@@ -11107,7 +11109,7 @@ dependencies = [
  "atoi",
  "base64 0.22.1",
  "bigdecimal",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "byteorder",
  "chrono",
  "crc",
@@ -11194,7 +11196,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -11404,7 +11406,7 @@ version = "15.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "65c25af97d53cf8aab66a6c68f3418663313fc969ad267fc2a4d19402c329be1"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "is-macro",
  "num-bigint",
  "once_cell",
@@ -11460,7 +11462,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "017d06ea85008234aa9fb34d805c7dc563f2ea6e03869ed5ac5a2dc27d561e4d"
 dependencies = [
  "arrayvec",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "either",
  "num-bigint",
  "phf 0.11.3",
@@ -11782,7 +11784,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01198a2debb237c62b6826ec7081082d951f46dbb64b0e8c7649a452230d1dfc"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -11810,7 +11812,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -11869,7 +11871,7 @@ dependencies = [
  "levenshtein_automata",
  "log",
  "lru 0.16.4",
- "lz4_flex 0.13.0",
+ "lz4_flex 0.13.1",
  "measure_time",
  "memmap2",
  "once_cell",
@@ -12021,7 +12023,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -12040,7 +12042,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "230a1b821ccbd75b185820a1f1ff7b14d21da1e442e22c0863ea5f08771a8874"
 dependencies = [
  "rustix 1.1.4",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -12556,11 +12558,11 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.0"
+version = "1.1.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bade1c3e902f58d73d3f294cd7f20391c1cb2fbcb643b73566bc773971df91e3"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
 dependencies = [
- "serde",
+ "serde_core",
 ]
 
 [[package]]
@@ -12578,14 +12580,14 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.23.4"
+version = "0.25.11+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7211ff1b8f0d3adae1663b7da9ffe396eabe1ca25f0b0bee42b0da29a9ddce93"
+checksum = "0b59c4d22ed448339746c59b905d24568fcbb3ab65a500494f7b8c3e97739f2b"
 dependencies = [
  "indexmap 2.14.0",
- "toml_datetime 0.7.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
  "toml_parser",
- "winnow 0.7.15",
+ "winnow 1.0.2",
 ]
 
 [[package]]
@@ -12638,7 +12640,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
 dependencies = [
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "h2 0.4.14",
@@ -12725,7 +12727,7 @@ checksum = "68d6fdd9f81c2819c9a8b0e0cd91660e7746a8e6ea2ba7c6b2b057985f6bcb51"
 dependencies = [
  "async-compression",
  "base64 0.22.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -13348,13 +13350,13 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.18.1"
+version = "1.23.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f87b8aa10b915a06587d0dec516c282ff295b475d94abf425d62b57710070a2"
+checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
 dependencies = [
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "js-sys",
- "serde",
+ "serde_core",
  "wasm-bindgen",
 ]
 
@@ -13365,7 +13367,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33995a1fee055ff743281cde33a41f0d618ee0bdbe8bdf6859e11864499c2595"
 dependencies = [
  "bindgen 0.71.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "fslock",
  "gzip-header",
  "home",
@@ -13620,7 +13622,7 @@ version = "0.244.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "hashbrown 0.15.5",
  "indexmap 2.14.0",
  "semver 1.0.28",
@@ -13762,7 +13764,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -13786,14 +13788,14 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-nats",
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
@@ -13867,7 +13869,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -13897,9 +13899,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -13910,7 +13912,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -13926,7 +13928,7 @@ dependencies = [
  "aws-sdk-config",
  "aws-sigv4",
  "aws-smithy-types",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base32",
  "base64 0.22.1",
  "bytes",
@@ -14053,9 +14055,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "http 1.4.0",
  "hyper 1.9.0",
@@ -14076,9 +14078,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -14089,10 +14091,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "http 1.4.0",
  "itertools 0.14.0",
@@ -14115,7 +14117,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14125,9 +14127,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "itertools 0.14.0",
  "serde",
@@ -14142,9 +14144,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "ed25519-dalek",
@@ -14164,10 +14166,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "candle-core",
  "candle-nn",
  "candle-transformers",
@@ -14187,9 +14189,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "sql-builder",
@@ -14203,9 +14205,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "hyper 1.9.0",
  "serde",
@@ -14224,9 +14226,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "globset",
  "lazy_static",
@@ -14245,9 +14247,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -14259,14 +14261,14 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-nats",
  "aws-config",
  "aws-credential-types",
  "aws-sdk-sqs",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "futures",
  "rand 0.9.0",
@@ -14291,10 +14293,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "http 1.4.0",
@@ -14316,9 +14318,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "flate2",
  "reqwest 0.13.1",
  "serde",
@@ -14334,10 +14336,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "http 1.4.0",
  "indexmap 2.14.0",
  "itertools 0.14.0",
@@ -14356,9 +14358,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "chrono-tz",
  "serde",
@@ -14376,9 +14378,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "futures",
  "http 1.4.0",
@@ -14406,10 +14408,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -14434,7 +14436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14446,10 +14448,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "argon2",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "dashmap",
  "http 1.4.0",
@@ -14471,9 +14473,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "serde",
  "serde_json",
@@ -14485,9 +14487,9 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "hex",
  "http 1.4.0",
@@ -14518,7 +14520,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14532,10 +14534,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "axum 0.8.4",
+ "axum 0.8.9",
  "k8s-openapi",
  "kube",
  "serde",
@@ -14551,7 +14553,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14565,10 +14567,10 @@ dependencies = [
  "aws-sdk-secretsmanager",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "base64 0.22.1",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "bytes",
  "chrono",
  "chrono-tz",
@@ -14652,7 +14654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14671,7 +14673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "regex",
  "serde",
@@ -14686,7 +14688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14710,7 +14712,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14727,7 +14729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14743,7 +14745,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14764,11 +14766,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "base64 0.22.1",
  "chrono",
@@ -14795,12 +14797,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "arc-swap",
  "async-oauth2",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "hex",
@@ -14820,7 +14822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14829,7 +14831,7 @@ dependencies = [
  "aws-credential-types",
  "aws-sdk-sts",
  "aws-smithy-types-convert",
- "axum 0.8.4",
+ "axum 0.8.9",
  "bytes",
  "chrono",
  "datafusion",
@@ -14854,7 +14856,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -14872,7 +14874,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14881,7 +14883,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14893,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -14905,7 +14907,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -14917,7 +14919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14929,7 +14931,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -14941,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -14952,7 +14954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -14963,7 +14965,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -14975,7 +14977,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -14986,7 +14988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15008,7 +15010,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15020,7 +15022,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15034,7 +15036,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15051,7 +15053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15064,7 +15066,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15076,7 +15078,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15094,7 +15096,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15110,7 +15112,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15126,7 +15128,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15137,11 +15139,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "chrono",
  "chrono-tz",
@@ -15174,7 +15176,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15212,7 +15214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15223,11 +15225,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-recursion",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "futures",
  "http 1.4.0",
@@ -15253,11 +15255,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "futures",
  "serde",
@@ -15277,11 +15279,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "chrono",
  "http 1.4.0",
  "hyper 1.9.0",
@@ -15310,11 +15312,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -15343,11 +15345,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "lazy_static",
  "regex",
@@ -15363,11 +15365,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "chrono",
@@ -15397,11 +15399,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "chrono",
  "constant_time_eq 0.3.1",
@@ -15433,11 +15435,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "itertools 0.14.0",
  "rdkafka",
@@ -15456,11 +15458,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "bytes",
  "itertools 0.14.0",
@@ -15480,12 +15482,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-nats",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "base64 0.22.1",
  "itertools 0.14.0",
  "nkeys",
@@ -15504,11 +15506,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "byteorder",
  "bytes",
  "chrono",
@@ -15539,7 +15541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15548,7 +15550,7 @@ dependencies = [
  "aws-sdk-sqs",
  "aws-sdk-sts",
  "aws-smithy-types",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "chrono",
  "itertools 0.14.0",
@@ -15567,11 +15569,11 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "axum 0.8.4",
+ "axum 0.8.9",
  "futures",
  "http 1.4.0",
  "itertools 0.14.0",
@@ -15590,10 +15592,10 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "chrono",
  "hex",
  "itertools 0.14.0",
@@ -15609,7 +15611,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15620,7 +15622,7 @@ dependencies = [
  "aws-credential-types",
  "aws-sdk-bedrockruntime",
  "aws-smithy-types",
- "axum 0.8.4",
+ "axum 0.8.9",
  "backon",
  "base64 0.22.1",
  "bit-vec 0.6.3",
@@ -15722,7 +15724,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "bytes",
  "futures",
@@ -15817,6 +15819,19 @@ dependencies = [
  "windows-strings 0.4.2",
 ]
 
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement 0.60.2",
+ "windows-interface 0.59.3",
+ "windows-link 0.2.1",
+ "windows-result 0.4.1",
+ "windows-strings 0.5.1",
+]
+
 [[package]]
 name = "windows-future"
 version = "0.2.1"
@@ -15960,7 +15975,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d24d6bcc7f734a4091ecf8d7a64c5f7d7066f45585c1861eba06449909609c8a"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "widestring",
  "windows-sys 0.52.0",
 ]
@@ -16312,6 +16327,9 @@ name = "winnow"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2ee1708bef14716a11bae175f579062d4554d95be2c6829f518df847b7b3fdd0"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "winsafe"
@@ -16383,7 +16401,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
- "bitflags 2.9.4",
+ "bitflags 2.11.1",
  "indexmap 2.14.0",
  "log",
  "serde",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 326b777385..0b948de5bd 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.699.0"
+version = "1.700.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.699.0"
+version = "1.700.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index d337f4838d..73f8b83834 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6183,7 +6183,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6263,7 +6263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6275,7 +6275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "convert_case",
  "serde",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6296,7 +6296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6308,7 +6308,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6320,7 +6320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6332,7 +6332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6344,7 +6344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6378,7 +6378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6411,7 +6411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6423,7 +6423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6437,7 +6437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6454,7 +6454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6467,7 +6467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6479,7 +6479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6497,7 +6497,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6513,7 +6513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6529,7 +6529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6561,7 +6561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.699.0"
+version = "1.700.0"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 80d8c63983..162e192138 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.699.0"
+version = "1.700.0"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 16448c622b..913f734d1f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.699.0
+  version: 1.700.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 3d7b371b24..e23b7ce185 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.699.0";
+export const VERSION = "v1.700.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 372087c69a..a5e7f96b17 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -79,7 +79,7 @@ export {
   token,
 };
 
-export const VERSION = "1.699.0";
+export const VERSION = "1.700.0";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 0ce5dc49ef..ad85302e2d 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.699.0",
+	"version": "1.700.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.699.0",
+			"version": "1.700.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 82c7ad8fa9..d3097a5ff9 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.699.0",
+	"version": "1.700.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 3e38043b9e..aeebba0577 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.699.0"
+wmill = ">=1.700.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 630ce5fddf..ef418ea0a8 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.699.0
+  version: 1.700.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 244a2e0d54..ae6080304c 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.699.0'
+    ModuleVersion     = '1.700.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 5aa17d46c3..cdb26ee835 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.699.0"
+version = "1.700.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 884ac84799..b49f05ac73 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.699.0",
+  "version": "1.700.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index ec86e6d07d..2a821e470c 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.699.0",
+  "version": "1.700.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "sideEffects": false,
diff --git a/version.txt b/version.txt
index dc6966fffd..5c539588e2 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.699.0
+1.700.0

From cd65de49285ff60abdd94c883180ded65609f382 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 23:14:20 +0000
Subject: [PATCH 40/50] fix: CE build broken by enterprise-gated
 compute_instance_hash (#9113)

* [ee] fix(license): bump ee-repo-ref to fix CE build

#9089 introduced a call from `windmill-api-settings/src/ee.rs::validate_license_key`
(license-gated) to `windmill_common::ee::compute_instance_hash` (enterprise-gated).
CE builds compile the caller (private + license) but not the callee, breaking the
docker image build on main with E0425 since #9089 landed.

Companion EE PR drops the enterprise gate from `compute_instance_hash`. The
function only depends on common state (BASE_URL, get_instance_uid,
canonical_base_url) and the parent `ee` module is already gated by `private`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to f9494c6320bb5fd07c1e9e09734b7fd5fbe7aa38

This commit updates the EE repository reference after PR #569 was merged in windmill-ee-private.

Previous ee-repo-ref: 0f495da1ef984cad22342c90691c0dc8b0a20faa

New ee-repo-ref: f9494c6320bb5fd07c1e9e09734b7fd5fbe7aa38

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>
---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 91d8581950..8a34b69a0e 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-c6cd1afe2d9e04809b30751cd1687b28a65e62b1
+f9494c6320bb5fd07c1e9e09734b7fd5fbe7aa38

From 411ca47ffd20302fd1481201bc6292cb93903731 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 11 May 2026 23:23:08 +0000
Subject: [PATCH 41/50] chore(main): release 1.700.1 (#9114)

* chore(main): release 1.700.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   7 +
 backend/Cargo.lock                            | 156 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/main.ts                               |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 125 insertions(+), 118 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f978732508..13a1cdc370 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.700.1](https://github.com/windmill-labs/windmill/compare/v1.700.0...v1.700.1) (2026-05-11)
+
+
+### Bug Fixes
+
+* CE build broken by enterprise-gated compute_instance_hash ([#9113](https://github.com/windmill-labs/windmill/issues/9113)) ([cd65de4](https://github.com/windmill-labs/windmill/commit/cd65de49285ff60abdd94c883180ded65609f382))
+
 ## [1.700.0](https://github.com/windmill-labs/windmill/compare/v1.699.0...v1.700.0) (2026-05-11)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 023e947232..56d42da02b 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -13788,7 +13788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13869,7 +13869,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -13899,7 +13899,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13912,7 +13912,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14055,7 +14055,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14078,7 +14078,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14091,7 +14091,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14117,7 +14117,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14127,7 +14127,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14144,7 +14144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14166,7 +14166,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14189,7 +14189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14205,7 +14205,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14226,7 +14226,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14247,7 +14247,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14261,7 +14261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14293,7 +14293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14318,7 +14318,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14336,7 +14336,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14358,7 +14358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14378,7 +14378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14408,7 +14408,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14436,7 +14436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14448,7 +14448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14473,7 +14473,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14487,7 +14487,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14520,7 +14520,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14534,7 +14534,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14553,7 +14553,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14654,7 +14654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14673,7 +14673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "regex",
  "serde",
@@ -14688,7 +14688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14712,7 +14712,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -14729,7 +14729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14745,7 +14745,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14766,7 +14766,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14797,7 +14797,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14822,7 +14822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14856,7 +14856,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "futures",
@@ -14874,7 +14874,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14883,7 +14883,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -14907,7 +14907,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -14919,7 +14919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14931,7 +14931,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -14954,7 +14954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -14965,7 +14965,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -14977,7 +14977,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -14988,7 +14988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15010,7 +15010,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15022,7 +15022,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15036,7 +15036,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15053,7 +15053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15066,7 +15066,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15078,7 +15078,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15096,7 +15096,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15112,7 +15112,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15128,7 +15128,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15139,7 +15139,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15176,7 +15176,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15214,7 +15214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15225,7 +15225,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15255,7 +15255,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15279,7 +15279,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15312,7 +15312,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15345,7 +15345,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15365,7 +15365,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15399,7 +15399,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15435,7 +15435,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15458,7 +15458,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15482,7 +15482,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15506,7 +15506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15541,7 +15541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15569,7 +15569,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15592,7 +15592,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "bitflags 2.11.1",
@@ -15611,7 +15611,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15724,7 +15724,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "bytes",
  "futures",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 0b948de5bd..104fc6e136 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.700.0"
+version = "1.700.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.700.0"
+version = "1.700.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 73f8b83834..43780b0703 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6183,7 +6183,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6263,7 +6263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6275,7 +6275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "convert_case",
  "serde",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6296,7 +6296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6308,7 +6308,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6320,7 +6320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6332,7 +6332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6344,7 +6344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6378,7 +6378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6411,7 +6411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6423,7 +6423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6437,7 +6437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6454,7 +6454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6467,7 +6467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6479,7 +6479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6497,7 +6497,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6513,7 +6513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6529,7 +6529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6561,7 +6561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.700.0"
+version = "1.700.1"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index 162e192138..e470ae9e38 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.700.0"
+version = "1.700.1"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 913f734d1f..b1e8ceabdb 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.700.0
+  version: 1.700.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index e23b7ce185..ea5a58f71b 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.700.0";
+export const VERSION = "v1.700.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index a5e7f96b17..8980331c31 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -79,7 +79,7 @@ export {
   token,
 };
 
-export const VERSION = "1.700.0";
+export const VERSION = "1.700.1";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index ad85302e2d..8123f93c57 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.700.0",
+	"version": "1.700.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.700.0",
+			"version": "1.700.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index d3097a5ff9..8da5968bb0 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.700.0",
+	"version": "1.700.1",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index aeebba0577..73496b676f 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.700.0"
+wmill = ">=1.700.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index ef418ea0a8..be157a3961 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.700.0
+  version: 1.700.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index ae6080304c..8dfc135d48 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.700.0'
+    ModuleVersion     = '1.700.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index cdb26ee835..5d9917d249 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.700.0"
+version = "1.700.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index b49f05ac73..cffc69e164 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.700.0",
+  "version": "1.700.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 2a821e470c..caad8ab8ad 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.700.0",
+  "version": "1.700.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "sideEffects": false,
diff --git a/version.txt b/version.txt
index 5c539588e2..e52350d307 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.700.0
+1.700.1

From 01e21c7f913eaf7dffc3d6a31501418ff2104c8b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 12 May 2026 07:00:58 +0000
Subject: [PATCH 42/50] fix: preserve negative integers in Bedrock tool schema
 conversion (#9116)

json_to_document cast any i64 to u64 via `as` and wrapped in PosInt.
Negative integers in a tool's JSON schema (e.g. "default": -1,
"minimum": -1) became huge unsigned values like 18446744073709551615,
which Bedrock rejected with `tools.N.custom.input_schema: int too big
to convert`.

Try as_u64 first to preserve full u64 range, fall back to as_i64 for
negatives via NegInt, then as_f64.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 backend/windmill-ai/src/ai_bedrock.rs | 36 +++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-ai/src/ai_bedrock.rs b/backend/windmill-ai/src/ai_bedrock.rs
index 49166978e8..c05094b8f4 100644
--- a/backend/windmill-ai/src/ai_bedrock.rs
+++ b/backend/windmill-ai/src/ai_bedrock.rs
@@ -326,8 +326,10 @@ pub fn json_to_document(value: serde_json::Value) -> aws_smithy_types::Document
         }
         Value::Array(arr) => Document::Array(arr.into_iter().map(json_to_document).collect()),
         Value::Number(num) => {
-            if let Some(i) = num.as_i64() {
-                Document::Number(aws_smithy_types::Number::PosInt(i as u64))
+            if let Some(u) = num.as_u64() {
+                Document::Number(aws_smithy_types::Number::PosInt(u))
+            } else if let Some(i) = num.as_i64() {
+                Document::Number(aws_smithy_types::Number::NegInt(i))
             } else if let Some(f) = num.as_f64() {
                 Document::Number(aws_smithy_types::Number::Float(f))
             } else {
@@ -844,6 +846,36 @@ mod tests {
         }
     }
 
+    #[test]
+    fn json_to_document_preserves_negative_integers() {
+        let value = serde_json::json!(-1);
+        let doc = json_to_document(value);
+        assert!(matches!(
+            doc,
+            aws_smithy_types::Document::Number(aws_smithy_types::Number::NegInt(-1))
+        ));
+    }
+
+    #[test]
+    fn json_to_document_handles_large_u64_above_i64_max() {
+        let value = serde_json::json!(u64::MAX);
+        let doc = json_to_document(value);
+        assert!(matches!(
+            doc,
+            aws_smithy_types::Document::Number(aws_smithy_types::Number::PosInt(u)) if u == u64::MAX
+        ));
+    }
+
+    #[test]
+    fn json_to_document_handles_positive_integers() {
+        let value = serde_json::json!(42);
+        let doc = json_to_document(value);
+        assert!(matches!(
+            doc,
+            aws_smithy_types::Document::Number(aws_smithy_types::Number::PosInt(42))
+        ));
+    }
+
     #[test]
     fn openai_messages_to_bedrock_adds_cache_points_when_enabled() {
         let messages = vec![

From 110384580eabfb929092d777b31b35aaf822487a Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Tue, 12 May 2026 11:42:07 +0200
Subject: [PATCH 43/50] refactor: add global ai chat mode with workspace-item
 draft tools (#9056)

* docs: add global ai mode plan

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add global ai draft mode

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: scope global ai mode to scripts and flows

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* refactor: simplify global ai workspace item shape

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* refactor: split global ai write tool into per-type tools

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add global ai schedule and trigger workspace item tools

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add dev-only /global_drafts route to inspect ai draft store

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add edit_script and patch_flow_json global ai tools

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add deploy_workspace_item global ai tool with confirmation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: emit open-resource action card after deploy_workspace_item

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add delete_workspace_item global ai tool with confirmation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* chore(system_prompts): emit RESOURCES_BASE and resource/variable zod schemas

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* feat: add global ai resource and variable workspace item tools

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: search_resource_types uses listResourceType to avoid embedding feature dep

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Revert "fix: search_resource_types uses listResourceType to avoid embedding feature dep"

This reverts commit 6d1d19514a04fc93257b6440cb9c934857b0dfa3.

* feat: emit open-resource action card for variable and resource deploys

* feat: add global ai raw app workspace item tools

* feat: split raw-app prompt into chat-only authoring and cli prefix

* feat: add init_app global ai tool to scaffold raw apps from templates

* fix: pass write_flow value as JSON string for gemini compat

* refactor: hoist countExactMatches and applyExactReplace to chat/shared

* refactor: extract editableFlowJson module shared with global mode

* fix(global): preserve flow schema and groups across draft and deploy

* feat: extract inline scripts from flow reads and patches in global mode

* refactor: add findAndReplace helper for match-validated text patches

* refactor: extract getInlineRunnableContent helper for app file tools

* refactor: extract assertNotGeneratedAppFile guard for /wmill.d.ts

* feat: gate global ai mode behind localStorage flag for dev rollout

* chore: bump svelte to ^5.55.5 in raw app template (sync with main)

* fix: isolate global ai draft rollout

* fix: preserve global ai deploy metadata

* fix: harden global ai draft tools

* chore: remove global ai plan doc

* fix: align raw app prompt guidance

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
---
 cli/src/guidance/skills.gen.ts                |  274 +-
 .../components/copilot/CustomAIPrompts.svelte |    5 +-
 .../copilot/chat/AIChatInput.svelte           |    2 +
 .../copilot/chat/AIChatManager.svelte.ts      |   71 +-
 .../chat/CreatedResourceActionDrawers.svelte  |   17 +
 .../copilot/chat/ToolMessageActions.svelte    |   18 +-
 .../lib/components/copilot/chat/app/core.ts   |   46 +-
 .../lib/components/copilot/chat/flow/core.ts  |  463 +---
 .../copilot/chat/flow/editableFlowJson.ts     |  412 +++
 .../copilot/chat/flow/inlineScriptsUtils.ts   |    4 +-
 .../copilot/chat/global/core.test.ts          |  148 +
 .../components/copilot/chat/global/core.ts    | 2381 +++++++++++++++++
 .../chat/global/deployRequests.test.ts        |  165 ++
 .../copilot/chat/global/deployRequests.ts     |  101 +
 .../copilot/chat/global/draftStore.svelte.ts  |  192 ++
 .../copilot/chat/global/draftStore.test.ts    |   56 +
 .../components/copilot/chat/global/gate.ts    |   26 +
 .../src/lib/components/copilot/chat/shared.ts |   57 +-
 .../copilot/chat/workspaceToolsZod.gen.ts     |   21 +
 .../components/raw_apps}/templates.ts         |   37 +
 .../components/settings/AIPromptsModal.svelte |    8 +-
 .../(root)/(logged)/apps_raw/add/+page.svelte |    6 +-
 .../(root)/(logged)/global_drafts/+page.js    |    5 +
 .../(logged)/global_drafts/+page.svelte       |   98 +
 system_prompts/auto-generated/index.d.ts      |    2 +
 system_prompts/auto-generated/index.ts        |   10 +
 system_prompts/auto-generated/prompts.ts      |  383 +++
 .../auto-generated/skills/raw-app/SKILL.md    |  274 +-
 system_prompts/base/raw-app-cli.md            |  226 ++
 system_prompts/base/raw-app.md                |  276 +-
 system_prompts/generate.py                    |   28 +-
 31 files changed, 4862 insertions(+), 950 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/core.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/core.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/deployRequests.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/draftStore.test.ts
 create mode 100644 frontend/src/lib/components/copilot/chat/global/gate.ts
 rename frontend/src/{routes/(root)/(logged)/apps_raw/add => lib/components/raw_apps}/templates.ts (93%)
 create mode 100644 frontend/src/routes/(root)/(logged)/global_drafts/+page.js
 create mode 100644 frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
 create mode 100644 system_prompts/base/raw-app-cli.md

diff --git a/cli/src/guidance/skills.gen.ts b/cli/src/guidance/skills.gen.ts
index 656f24e5a9..2b0962e09d 100644
--- a/cli/src/guidance/skills.gen.ts
+++ b/cli/src/guidance/skills.gen.ts
@@ -5426,9 +5426,9 @@ name: raw-app
 description: MUST use when creating raw apps.
 ---
 
-# Windmill Raw Apps
+# Windmill Raw Apps — CLI workflow
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+This guide covers raw apps from the terminal: scaffolding via \`wmill app new\`, the on-disk layout, and the file-based conventions the CLI uses to represent backend runnables and data table configuration. The platform shape (how a raw app behaves at runtime — frontend bundling, runnable types, datatable SDK calls) is covered in the companion authoring guide.
 
 ## Creating a Raw App
 
@@ -5497,7 +5497,7 @@ wmill app new
 
 This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
 
-## App Structure
+## On-disk app layout
 
 \`\`\`
 my_app{{RAW_APP_SUFFIX}}/
@@ -5517,11 +5517,7 @@ my_app{{RAW_APP_SUFFIX}}/
     └── *.sql              # SQL files to apply via dev server
 \`\`\`
 
-## Backend Runnables
-
-Backend runnables are server-side scripts that your frontend can call. They live in the \`backend/\` folder.
-
-### Creating a Backend Runnable
+## Backend runnables on disk
 
 Add a code file to the \`backend/\` folder:
 
@@ -5531,7 +5527,7 @@ backend/<id>.<ext>
 
 The runnable ID is the filename without extension. For example, \`get_user.ts\` creates a runnable with ID \`get_user\`.
 
-### Supported Languages
+### Supported languages (extension-driven)
 
 | Language         | Extension    | Example          |
 |------------------|--------------|------------------|
@@ -5553,27 +5549,14 @@ The runnable ID is the filename without extension. For example, \`get_user.ts\`
 | C#               | \`.cs\`        | \`myFunc.cs\`      |
 | Java             | \`.java\`      | \`myFunc.java\`    |
 
-### Example Backend Runnable
-
-**backend/get_user.ts:**
-\`\`\`typescript
-import * as wmill from 'windmill-client';
-
-export async function main(user_id: string) {
-  const sql = wmill.datatable();
-  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
-  return user;
-}
-\`\`\`
-
-After creating, tell the user they can generate lock files by running:
+After creating a runnable, tell the user they can generate lock files by running:
 \`\`\`bash
 wmill generate-metadata
 \`\`\`
 
-### Optional YAML Configuration
+### Optional YAML configuration
 
-Add a \`<id>.yaml\` file to configure fields or static values:
+Add a \`<id>.yaml\` file alongside the code to configure fields or static values:
 
 **backend/get_user.yaml:**
 \`\`\`yaml
@@ -5584,7 +5567,7 @@ fields:
     value: "default_user"
 \`\`\`
 
-### Referencing Existing Scripts
+### Referencing existing scripts
 
 To use an existing Windmill script instead of inline code:
 
@@ -5600,32 +5583,9 @@ type: flow
 path: f/my_folder/my_flow
 \`\`\`
 
-### Calling Backend from Frontend
+## Data tables — \`raw_app.yaml\` config
 
-Import from the auto-generated \`wmill.ts\`:
-
-\`\`\`typescript
-import { backend } from './wmill';
-
-// Call a backend runnable
-const user = await backend.get_user({ user_id: '123' });
-\`\`\`
-
-The \`wmill.ts\` file provides type-safe access to all backend runnables.
-
-## Data Tables
-
-Raw apps can query Windmill datatables (PostgreSQL databases managed by Windmill).
-
-### Critical Rules
-
-1. **ONLY USE WHITELISTED TABLES**: You can ONLY query tables listed in \`raw_app.yaml\` → \`data.tables\`. Tables not in this list are NOT accessible.
-
-2. **ADD TABLES BEFORE USING**: To use a new table, first add it to \`data.tables\` in \`raw_app.yaml\`.
-
-3. **USE CONFIGURED DATATABLE/SCHEMA**: Check the app's \`raw_app.yaml\` for the default datatable and schema.
-
-### Configuration in raw_app.yaml
+The \`data\` block in \`raw_app.yaml\` controls which tables the app can query.
 
 \`\`\`yaml
 data:
@@ -5637,9 +5597,153 @@ data:
 \`\`\`
 
 **Table reference formats:**
-- \`<datatable>\` - All tables in the datatable
-- \`<datatable>/<table>\` - Specific table in public schema
-- \`<datatable>/<schema>:<table>\` - Table in specific schema
+- \`<datatable>\` — All tables in the datatable
+- \`<datatable>/<table>\` — Specific table in public schema
+- \`<datatable>/<schema>:<table>\` — Table in specific schema
+
+## SQL Migrations (sql_to_apply/)
+
+The \`sql_to_apply/\` folder is for creating/modifying database tables during development.
+
+### Workflow
+
+1. Create \`.sql\` files in \`sql_to_apply/\`
+2. Run \`wmill app dev\` — the dev server watches this folder
+3. When SQL files change, a modal appears in the browser to confirm execution
+4. After creating tables, **add them to \`data.tables\`** in \`raw_app.yaml\`
+
+### Example migration
+
+**sql_to_apply/001_create_users.sql:**
+\`\`\`sql
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    name TEXT,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+\`\`\`
+
+After applying, add to \`raw_app.yaml\`:
+\`\`\`yaml
+data:
+  tables:
+    - main/users
+\`\`\`
+
+### Migration best practices
+
+- **Use idempotent SQL**: \`CREATE TABLE IF NOT EXISTS\`, etc.
+- **Number files**: \`001_\`, \`002_\` for ordering
+- **Always whitelist tables** after creation
+- This folder is NOT synced — it's for local development only
+
+## CLI Commands
+
+\`wmill app new\` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+
+For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+
+| Command | Description |
+|---------|-------------|
+| \`wmill app dev\` | Start dev server with live reload (see the \`preview\` skill for the full open-the-app-in-the-IDE-pane procedure). |
+| \`wmill app generate-agents\` | Refresh AGENTS.md and DATATABLES.md |
+| \`wmill generate-metadata\` | Generate lock files for backend runnables |
+| \`wmill sync push\` | Deploy app to Windmill |
+| \`wmill sync pull\` | Pull latest from Windmill |
+
+
+
+# Windmill Raw Apps
+
+Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+
+## App shape
+
+A raw app has three logical parts:
+
+- **Frontend** — bundled with esbuild from \`index.tsx\` as the entrypoint. Files include the entrypoint, components (\`App.tsx\`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
+
+## Frontend
+
+### Entrypoint
+
+\`index.tsx\` is the bundling entrypoint. It typically renders a top-level \`App\` component. The bundler is esbuild.
+
+### Generated bindings (\`wmill.d.ts\` / \`wmill.ts\`)
+
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
+
+### Calling backend runnables
+
+Import the generated bindings and call the runnable like a function:
+
+\`\`\`typescript
+import { backend } from './wmill';
+
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
+\`\`\`
+
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through \`backend.<key>(args)\` for everything server-side.
+
+## Backend runnables
+
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
+
+| Type | What it is |
+|---|---|
+| \`inline\` | Custom code stored on the app itself. Most common for app-specific logic. |
+| \`script\` | Reference to an existing workspace script by path. |
+| \`flow\` | Reference to an existing workspace flow by path. |
+| \`hubscript\` | Reference to a hub script by path. |
+
+### Inline runnables
+
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a \`main\` function as its entrypoint.
+
+**TypeScript example** (\`backend/get_user.ts\`):
+
+\`\`\`typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();
+  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
+  return user;
+}
+\`\`\`
+
+**Python example** (\`backend/get_user.py\`):
+
+\`\`\`python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
+\`\`\`
+
+### Path runnables (script / flow / hubscript)
+
+When \`type\` is \`script\`, \`flow\`, or \`hubscript\`, the runnable just stores a \`path\` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
+
+### Static inputs
+
+\`staticInputs\` is an optional \`Record<string, any>\` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
+
+## Data Tables
+
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the \`wmill\` client; the frontend never queries them directly.
+
+### Critical rules
+
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's \`data.tables\` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in \`data.tables\` first.
+3. **Use the configured datatable/schema**: the app's \`data\` config sets the default datatable and schema; reference them consistently across runnables.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -5680,65 +5784,13 @@ def main(user_id: str):
     return user
 \`\`\`
 
-## SQL Migrations (sql_to_apply/)
-
-The \`sql_to_apply/\` folder is for creating/modifying database tables during development.
-
-### Workflow
-
-1. Create \`.sql\` files in \`sql_to_apply/\`
-2. Run \`wmill app dev\` - the dev server watches this folder
-3. When SQL files change, a modal appears in the browser to confirm execution
-4. After creating tables, **add them to \`data.tables\`** in \`raw_app.yaml\`
-
-### Example Migration
-
-**sql_to_apply/001_create_users.sql:**
-\`\`\`sql
-CREATE TABLE IF NOT EXISTS users (
-    id SERIAL PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    name TEXT,
-    created_at TIMESTAMP DEFAULT NOW()
-);
-\`\`\`
-
-After applying, add to \`raw_app.yaml\`:
-\`\`\`yaml
-data:
-  tables:
-    - main/users
-\`\`\`
-
-### Migration Best Practices
-
-- **Use idempotent SQL**: \`CREATE TABLE IF NOT EXISTS\`, etc.
-- **Number files**: \`001_\`, \`002_\` for ordering
-- **Always whitelist tables** after creation
-- This folder is NOT synced - it's for local development only
-
-## CLI Commands
-
-\`wmill app new\` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
-
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
-
-| Command | Description |
-|---------|-------------|
-| \`wmill app dev\` | Start dev server with live reload (see the \`preview\` skill for the full open-the-app-in-the-IDE-pane procedure). |
-| \`wmill app generate-agents\` | Refresh AGENTS.md and DATATABLES.md |
-| \`wmill generate-metadata\` | Generate lock files for backend runnables |
-| \`wmill sync push\` | Deploy app to Windmill |
-| \`wmill sync pull\` | Pull latest from Windmill |
-
 ## Best Practices
 
-1. **Check DATATABLES.md** for existing tables before creating new ones
-2. **Use parameterized queries** - never concatenate user input into SQL
-3. **Keep runnables focused** - one function per file
-4. **Use descriptive IDs** - \`get_user.ts\` not \`a.ts\`
-5. **Always whitelist tables** - add to \`data.tables\` before querying
-6. **Generate locks** - tell the user to run \`wmill generate-metadata\` after adding/modifying backend runnables
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — \`get_user\`, not \`a\`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in \`data.tables\` first.
 `,
   "triggers": `---
 name: triggers
diff --git a/frontend/src/lib/components/copilot/CustomAIPrompts.svelte b/frontend/src/lib/components/copilot/CustomAIPrompts.svelte
index eb4685a4d1..4c7cfbe47b 100644
--- a/frontend/src/lib/components/copilot/CustomAIPrompts.svelte
+++ b/frontend/src/lib/components/copilot/CustomAIPrompts.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-	import { AIMode } from './chat/AIChatManager.svelte'
+	import { AIMode, getVisibleAIModes } from './chat/AIChatManager.svelte'
 	import ToggleButtonGroup from '../common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '../common/toggleButton-v2/ToggleButton.svelte'
 	import Label from '../Label.svelte'
@@ -18,6 +18,7 @@
 	} = $props()
 
 	let selectedAiMode = $state<AIMode>(AIMode.ASK)
+	let visibleModes = $derived(getVisibleAIModes())
 </script>
 
 <div class="flex flex-col gap-2">
@@ -29,7 +30,7 @@
 		<Label label="AI Mode">
 			<ToggleButtonGroup bind:selected={selectedAiMode}>
 				{#snippet children({ item })}
-					{#each Object.values(AIMode) as mode}
+					{#each visibleModes as mode (mode)}
 						<div class="relative">
 							<ToggleButton
 								value={mode}
diff --git a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
index 1a4169f677..833649e9b6 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
+++ b/frontend/src/lib/components/copilot/chat/AIChatInput.svelte
@@ -69,6 +69,8 @@
 				return 'Navigate Windmill UI...'
 			case AIMode.API:
 				return 'Make API calls...'
+			case AIMode.GLOBAL:
+				return 'Work across workspace items...'
 			case AIMode.ASK:
 				return 'Ask questions about Windmill...'
 			default:
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 0d3ca62fd0..a4b873795b 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -60,6 +60,8 @@ import { runChatLoop } from './chatLoop'
 import type { ReviewChangesOpts } from './monaco-adapter'
 import { getCurrentModel, tryGetCurrentModel, getCombinedCustomPrompt } from '$lib/aiStore'
 import type { WorkspaceMutationTarget } from './workspaceTools'
+import { globalTools, prepareGlobalSystemMessage, prepareGlobalUserMessage } from './global/core'
+import { isGlobalAiEnabled } from './global/gate'
 
 // If the estimated token usage is greater than the model context window - the threshold, we delete the oldest message
 const MAX_TOKENS_THRESHOLD_PERCENTAGE = 0.05
@@ -71,9 +73,24 @@ export enum AIMode {
 	APP = 'app',
 	NAVIGATOR = 'navigator',
 	API = 'API',
+	GLOBAL = 'global',
 	ASK = 'ask'
 }
 
+const ALL_AI_MODES = Object.values(AIMode)
+
+export function isAIMode(mode: unknown): mode is AIMode {
+	return ALL_AI_MODES.includes(mode as AIMode)
+}
+
+export function isAIModeVisible(mode: AIMode): boolean {
+	return mode !== AIMode.GLOBAL || isGlobalAiEnabled()
+}
+
+export function getVisibleAIModes(): AIMode[] {
+	return ALL_AI_MODES.filter(isAIModeVisible)
+}
+
 function isWorkspacePath(path: string | undefined): path is string {
 	return path?.startsWith('f/') === true || path?.startsWith('u/') === true
 }
@@ -133,7 +150,9 @@ class AIChatManager {
 		app: this.appAiChatHelpers !== undefined,
 		navigator: true,
 		ask: true,
-		API: true
+		API: true,
+		// Dev-only gate. See `./global/gate.ts` for how to enable.
+		global: isAIModeVisible(AIMode.GLOBAL)
 	})
 
 	open = $derived(chatState.size > 0)
@@ -235,7 +254,8 @@ class AIChatManager {
 		return {
 			kind: 'script',
 			path: workspacePath,
-			deployed: workspacePath !== undefined && this.scriptEditorOptions?.lastDeployedCode !== undefined
+			deployed:
+				workspacePath !== undefined && this.scriptEditorOptions?.lastDeployedCode !== undefined
 		}
 	}
 
@@ -260,6 +280,7 @@ class AIChatManager {
 			workflowAsCode?: boolean
 		}
 	) {
+		if (!isAIModeVisible(mode)) return
 		if (mode === AIMode.SCRIPT && !tryGetCurrentModel()) return
 		this.mode = mode
 		this.pendingPrompt = pendingPrompt ?? ''
@@ -329,6 +350,11 @@ class AIChatManager {
 			this.systemMessage = prepareApiSystemMessage(customPrompt)
 			this.tools = [...this.apiTools]
 			this.helpers = {}
+		} else if (mode === AIMode.GLOBAL) {
+			const customPrompt = getCombinedCustomPrompt(mode)
+			this.systemMessage = prepareGlobalSystemMessage(customPrompt)
+			this.tools = [...globalTools]
+			this.helpers = {}
 		} else if (mode === AIMode.APP) {
 			const customPrompt = getCombinedCustomPrompt(mode)
 			this.systemMessage = prepareAppSystemMessage(customPrompt)
@@ -345,14 +371,24 @@ class AIChatManager {
 			function: {
 				name: 'change_mode',
 				description:
-					'Change the AI mode to the one specified. Script mode is used to create scripts. Flow mode is used to create flows. Navigator mode is used to navigate the application and help the user find what they are looking for. API mode is used to make API calls to the Windmill backend.',
+					'Change the AI mode to the one specified. Script mode is used to create scripts. Flow mode is used to create flows.' +
+					(isGlobalAiEnabled()
+						? ' Global mode is used to inspect workspace scripts and flows and create draft changes.'
+						: '') +
+					' Navigator mode is used to navigate the application and help the user find what they are looking for. API mode is used to make API calls to the Windmill backend.',
 				parameters: {
 					type: 'object',
 					properties: {
 						mode: {
 							type: 'string',
 							description: 'The mode to change to',
-							enum: ['script', 'flow', 'navigator', 'API']
+							enum: [
+								'script',
+								'flow',
+								...(isGlobalAiEnabled() ? ['global'] : []),
+								'navigator',
+								'API'
+							]
 						},
 						pendingPrompt: {
 							type: 'string',
@@ -365,8 +401,11 @@ class AIChatManager {
 			}
 		},
 		fn: async ({ args, toolId, toolCallbacks }) => {
+			if (!isAIMode(args.mode) || !isAIModeVisible(args.mode)) {
+				throw new Error(`AI mode "${args.mode}" is not enabled`)
+			}
 			toolCallbacks.setToolStatus(toolId, { content: 'Switching to ' + args.mode + ' mode...' })
-			this.changeMode(args.mode as AIMode, args.pendingPrompt, {
+			this.changeMode(args.mode, args.pendingPrompt, {
 				closeScriptSettings: true
 			})
 			toolCallbacks.setToolStatus(toolId, { content: 'Switched to ' + args.mode + ' mode' })
@@ -498,6 +537,8 @@ class AIChatManager {
 						)
 					} else if (this.mode === AIMode.NAVIGATOR) {
 						return prepareNavigatorUserMessage(pendingPrompt)
+					} else if (this.mode === AIMode.GLOBAL) {
+						return prepareGlobalUserMessage(pendingPrompt)
 					}
 					return undefined
 				},
@@ -617,17 +658,14 @@ class AIChatManager {
 			isPreprocessor?: boolean
 		} = {}
 	) => {
-		if (options.mode) {
-			this.changeMode(options.mode, undefined, {
-				lang: options.lang,
-				isPreprocessor: options.isPreprocessor
-			})
-		} else {
-			this.changeMode(this.mode, undefined, {
-				lang: options.lang,
-				isPreprocessor: options.isPreprocessor
-			})
+		const requestedMode = options.mode ?? this.mode
+		if (!isAIModeVisible(requestedMode)) {
+			return
 		}
+		this.changeMode(requestedMode, undefined, {
+			lang: options.lang,
+			isPreprocessor: options.isPreprocessor
+		})
 		if (options.instructions) {
 			this.instructions = options.instructions
 		}
@@ -716,6 +754,9 @@ class AIChatManager {
 				case AIMode.API:
 					userMessage = prepareApiUserMessage(oldInstructions)
 					break
+				case AIMode.GLOBAL:
+					userMessage = prepareGlobalUserMessage(oldInstructions)
+					break
 				case AIMode.APP:
 					userMessage = prepareAppUserMessage(
 						oldInstructions,
diff --git a/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte b/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
index 59c018c39e..7d3b8a950c 100644
--- a/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
+++ b/frontend/src/lib/components/copilot/chat/CreatedResourceActionDrawers.svelte
@@ -4,6 +4,8 @@
 	import { Drawer } from '$lib/components/common'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import { Loader2 } from 'lucide-svelte'
+	import ResourceEditorDrawer from '$lib/components/ResourceEditorDrawer.svelte'
+	import VariableEditor from '$lib/components/VariableEditor.svelte'
 	import { registerToolDisplayActionHandler } from './createdResourceActions.svelte'
 	import type { CreatedResourceTriggerKind, ToolDisplayAction } from './shared'
 
@@ -36,6 +38,8 @@
 	let editor: EditorHandle | undefined = $state(undefined)
 	let activeDrawer: ActiveDrawerState | undefined = $state(undefined)
 	let nextActiveDrawerId = 0
+	let resourceEditorDrawer: ResourceEditorDrawer | undefined = $state(undefined)
+	let variableEditor: VariableEditor | undefined = $state(undefined)
 
 	const drawerConfigs: Record<DrawerKey, DrawerConfig> = {
 		schedule: {
@@ -120,6 +124,16 @@
 			return
 		}
 
+		if (action.resource === 'resource') {
+			await resourceEditorDrawer?.initEdit(action.path)
+			return
+		}
+
+		if (action.resource === 'variable') {
+			await variableEditor?.editVariable(action.path)
+			return
+		}
+
 		const key = action.resource === 'schedule' ? 'schedule' : action.triggerKind
 		if (!key) {
 			throw new Error('Missing trigger kind')
@@ -172,3 +186,6 @@
 		{/if}
 	</DrawerContent>
 </Drawer>
+
+<ResourceEditorDrawer bind:this={resourceEditorDrawer} />
+<VariableEditor bind:this={variableEditor} />
diff --git a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
index 6770498ffd..00eff03b89 100644
--- a/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
+++ b/frontend/src/lib/components/copilot/chat/ToolMessageActions.svelte
@@ -1,6 +1,15 @@
 <script lang="ts">
 	import { Button } from '$lib/components/common'
-	import { Calendar, Database, Route, SquarePen, Unplug, Webhook } from 'lucide-svelte'
+	import {
+		Calendar,
+		Database,
+		KeyRound,
+		Package,
+		Route,
+		SquarePen,
+		Unplug,
+		Webhook
+	} from 'lucide-svelte'
 	import AwsIcon from '$lib/components/icons/AwsIcon.svelte'
 	import AzureIcon from '$lib/components/icons/AzureIcon.svelte'
 	import GoogleCloudIcon from '$lib/components/icons/GoogleCloudIcon.svelte'
@@ -14,7 +23,7 @@
 		actions: ToolDisplayAction[]
 	}
 
-	type ActionCardKey = 'schedule' | CreatedResourceTriggerKind
+	type ActionCardKey = 'schedule' | 'resource' | 'variable' | CreatedResourceTriggerKind
 	type ActionCardConfig = {
 		title: string
 		icon: any
@@ -25,6 +34,8 @@
 
 	const actionCardConfigs: Record<ActionCardKey, ActionCardConfig> = {
 		schedule: { title: 'Schedule', icon: Calendar },
+		resource: { title: 'Resource', icon: Package },
+		variable: { title: 'Variable', icon: KeyRound },
 		http: { title: 'HTTP trigger', icon: Route },
 		websocket: { title: 'WebSocket trigger', icon: Unplug },
 		postgres: { title: 'Postgres trigger', icon: Database },
@@ -37,7 +48,8 @@
 	}
 
 	function getActionCardConfig(action: ToolDisplayAction): ActionCardConfig {
-		const key = action.resource === 'schedule' ? 'schedule' : action.triggerKind
+		const key: ActionCardKey | undefined =
+			action.resource === 'trigger' ? action.triggerKind : action.resource
 		return key
 			? actionCardConfigs[key]
 			: { title: action.label.replace(/^Open\s+/i, ''), icon: Webhook }
diff --git a/frontend/src/lib/components/copilot/chat/app/core.ts b/frontend/src/lib/components/copilot/chat/app/core.ts
index 4cd0110a91..cbfdcc5616 100644
--- a/frontend/src/lib/components/copilot/chat/app/core.ts
+++ b/frontend/src/lib/components/copilot/chat/app/core.ts
@@ -8,6 +8,7 @@ import {
 	createToolDef,
 	createSearchWorkspaceTool,
 	createGetRunnableDetailsTool,
+	findAndReplace,
 	type Tool
 } from '../shared'
 import { aiChatManager } from '../AIChatManager.svelte'
@@ -162,31 +163,6 @@ const memo = <T>(factory: () => T): (() => T) => {
 	return () => (cached ??= factory())
 }
 
-function countExactMatches(content: string, search: string): number {
-	if (search.length === 0) {
-		return 0
-	}
-
-	let count = 0
-	let index = 0
-
-	while ((index = content.indexOf(search, index)) !== -1) {
-		count += 1
-		index += search.length
-	}
-
-	return count
-}
-
-function replaceFirstExactMatch(content: string, search: string, replace: string): string {
-	const index = content.indexOf(search)
-	if (index === -1) {
-		return content
-	}
-
-	return content.slice(0, index) + replace + content.slice(index + search.length)
-}
-
 type AppPatchTarget =
 	| { type: 'frontend'; path: string }
 	| { type: 'backend'; path: string; key: string; extension: 'ts' | 'py' }
@@ -658,19 +634,13 @@ export const getAppTools = memo((): Tool<AppAIChatHelpers>[] => [
 				currentContent = backendRunnable.inlineScript.content ?? ''
 			}
 
-			const matchCount = countExactMatches(currentContent, oldString)
-			if (matchCount === 0) {
-				throw new Error('old_string was not found in the current file content.')
-			}
-			if (!replaceAll && matchCount !== 1) {
-				throw new Error(
-					`old_string matched ${matchCount} locations. Make it more specific or set replace_all to true.`
-				)
-			}
-
-			const updatedContent = replaceAll
-				? currentContent.split(oldString).join(newString)
-				: replaceFirstExactMatch(currentContent, oldString, newString)
+			const updatedContent = findAndReplace(
+				currentContent,
+				oldString,
+				newString,
+				replaceAll,
+				'current file content'
+			)
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: `Patching '${target.path}'...`
diff --git a/frontend/src/lib/components/copilot/chat/flow/core.ts b/frontend/src/lib/components/copilot/chat/flow/core.ts
index 0c1750b563..c54c652247 100644
--- a/frontend/src/lib/components/copilot/chat/flow/core.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/core.ts
@@ -19,6 +19,7 @@ import {
 import {
 	createSearchHubScriptsTool,
 	createToolDef,
+	findAndReplace,
 	type Tool,
 	executeTestRun,
 	buildSchemaForTool,
@@ -37,233 +38,17 @@ import type { ExtendedOpenFlow } from '$lib/components/flows/types'
 import { findModuleInFlow, findModuleInModules } from '$lib/components/flows/flowTree'
 import { createInlineScriptSession, type InlineScriptSession } from './inlineScriptsUtils'
 import { validateFlowGroups, type FlowGroup, type FlowJsonUpdateResult } from './helperUtils'
-import { flowModuleSchema, flowModulesSchema } from './openFlowZod.gen'
+import { flowModuleSchema } from './openFlowZod.gen'
 import { collectAllFlowModuleIdsFromModules } from '$lib/components/flows/flowTree'
+import {
+	buildEditableFlowJson as buildEditableFlowJsonBase,
+	validateEditableFlowJson,
+	validateFlowModules,
+	validateFlowSchema,
+	type EditableFlowJson
+} from './editableFlowJson'
 import { FLOW_CHAT_SPECIAL_MODULES, getFlowPrompt } from '$system_prompts'
 
-/**
- * Navigate to a schema at a given path, handling arrays, objects, unions, and wrappers.
- * Uses Zod 4 internal structure.
- * @param schema The Zod schema to navigate
- * @param path The path to navigate
- * @param data Optional actual data to help resolve discriminated unions
- */
-function getSchemaAtPath(
-	schema: z.ZodType,
-	path: (string | number)[],
-	data?: any
-): z.ZodType | null {
-	let current: z.ZodType = schema
-	let currentData = data
-
-	for (let i = 0; i < path.length; i++) {
-		const segment = path[i]
-
-		if (!current || !(current as any)._def) return null
-
-		let type = (current as any)._def.type
-
-		// Unwrap optional/nullable/default/catch
-		while (['optional', 'nullable', 'default', 'catch'].includes(type)) {
-			current = (current as any)._def.innerType
-			if (!current || !(current as any)._def) return null
-			type = (current as any)._def.type
-		}
-
-		// Handle arrays
-		if (type === 'array') {
-			if (typeof segment === 'number') {
-				current = (current as any)._def.element
-				if (currentData && Array.isArray(currentData)) {
-					currentData = currentData[segment]
-				}
-				continue
-			}
-			// If segment is not a number, continue into element type
-			current = (current as any)._def.element
-			i--
-			continue
-		}
-
-		// Handle objects
-		if (type === 'object') {
-			const shape = (current as any)._def.shape
-			const key = String(segment)
-			if (shape && key in shape) {
-				current = shape[key]
-				if (currentData && typeof currentData === 'object') {
-					currentData = currentData[key]
-				}
-				continue
-			}
-			return null
-		}
-
-		// Handle discriminated unions (shows as 'union' in Zod 4)
-		if (type === 'union') {
-			const options = (current as any)._def.options
-			if (options) {
-				// If we have data, try to find the correct union option based on discriminator
-				if (currentData && typeof currentData === 'object') {
-					// Check for common discriminator fields
-					const typeValue = currentData.type
-					if (typeValue) {
-						// Find option that matches this type
-						for (const option of options) {
-							const optionShape = (option as any)._def?.shape
-							const optionType = optionShape?.type?._def?.values?.[0]
-							if (optionType === typeValue) {
-								const remainingPath = path.slice(i)
-								const result = getSchemaAtPath(option, remainingPath, currentData)
-								if (result) return result
-							}
-						}
-					}
-				}
-
-				// Fallback: try to find a matching schema in any of the options
-				for (const option of options) {
-					const remainingPath = path.slice(i)
-					const result = getSchemaAtPath(option, remainingPath, currentData)
-					if (result) return result
-				}
-			}
-			return null
-		}
-
-		// Handle record - any string key accesses the value type
-		if (type === 'record') {
-			current = (current as any)._def.valueType
-			if (!current) return null
-			if (currentData && typeof currentData === 'object') {
-				currentData = currentData[segment]
-			}
-			continue
-		}
-
-		return null
-	}
-
-	return current
-}
-
-/**
- * Format a JSON Schema object into a concise human-readable string for error messages.
- * Prioritizes structural information (object shapes, enums) over descriptions.
- */
-function formatJsonSchemaForError(jsonSchema: any): string {
-	// For objects, show structure (more actionable than description)
-	if (jsonSchema.type === 'object' && jsonSchema.properties) {
-		const props = Object.entries(jsonSchema.properties)
-			.slice(0, 5) // Limit to 5 properties
-			.map(([k, v]: [string, any]) => {
-				// Include enum values for string properties if available
-				if (v.enum) {
-					return `${k}: ${v.enum.map((e: any) => JSON.stringify(e)).join('|')}`
-				}
-				return `${k}: ${v.type || 'any'}`
-			})
-			.join(', ')
-		const moreProps =
-			Object.keys(jsonSchema.properties).length > 5
-				? `, ... (${Object.keys(jsonSchema.properties).length - 5} more)`
-				: ''
-		const required = jsonSchema.required?.length
-			? ` (required: ${jsonSchema.required.join(', ')})`
-			: ''
-		return `{ ${props}${moreProps} }${required}`
-	}
-
-	if (jsonSchema.const !== undefined) {
-		return JSON.stringify(jsonSchema.const)
-	}
-
-	if (jsonSchema.enum) {
-		return `one of: ${jsonSchema.enum.map((v: any) => JSON.stringify(v)).join(', ')}`
-	}
-
-	if (jsonSchema.oneOf) {
-		return jsonSchema.oneOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
-	}
-
-	if (jsonSchema.anyOf) {
-		return jsonSchema.anyOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
-	}
-
-	// Fall back to description for non-structural types
-	if (jsonSchema.description) {
-		return jsonSchema.description
-	}
-
-	return jsonSchema.type || JSON.stringify(jsonSchema)
-}
-
-/**
- * Extract a human-readable description of what a schema expects.
- * For objects, prefers showing the actual structure over descriptions.
- * For simpler types, uses description if available.
- */
-function getExpectedFormat(schema: z.ZodType): string | null {
-	if (!schema || !(schema as any)._def) return null
-
-	let current = schema
-
-	// Unwrap optional/nullable to get inner type
-	while ((current as any)._def.type === 'optional' || (current as any)._def.type === 'nullable') {
-		current = (current as any)._def.innerType
-		if (!current || !(current as any)._def) break
-	}
-
-	// Try JSON Schema representation first for objects (more actionable than descriptions)
-	try {
-		const jsonSchema = z.toJSONSchema(schema)
-		// Skip if it's just a schema with no useful info
-		if (
-			Object.keys(jsonSchema).length <= 1 ||
-			(Object.keys(jsonSchema).length === 1 && jsonSchema.$schema)
-		) {
-			return null
-		}
-		const formatted = formatJsonSchemaForError(jsonSchema)
-		if (formatted && formatted !== 'unknown' && !formatted.startsWith('{')) {
-			return formatted
-		}
-		// For objects, only return if it has meaningful properties
-		if (formatted && formatted.startsWith('{') && formatted !== '{ }') {
-			return formatted
-		}
-	} catch {
-		// Ignore errors from toJSONSchema
-	}
-
-	return null
-}
-
-function countExactMatches(content: string, search: string): number {
-	if (search.length === 0) {
-		return 0
-	}
-
-	let count = 0
-	let index = 0
-
-	while ((index = content.indexOf(search, index)) !== -1) {
-		count++
-		index += search.length
-	}
-
-	return count
-}
-
-function replaceFirstExactMatch(content: string, search: string, replace: string): string {
-	const index = content.indexOf(search)
-	if (index === -1) {
-		return content
-	}
-
-	return content.slice(0, index) + replace + content.slice(index + search.length)
-}
-
 type FlowJsonUpdate = {
 	modules?: FlowModule[]
 	schema?: Record<string, any> | null
@@ -272,220 +57,35 @@ type FlowJsonUpdate = {
 	groups?: FlowGroup[] | null
 }
 
-type EditableFlowJson = {
-	modules: FlowModule[]
-	schema: Record<string, any> | null
-	preprocessor_module: FlowModule | null
-	failure_module: FlowModule | null
-	groups: FlowGroup[] | null
-}
-
 function formatEmptyInlineScriptWarning({
 	emptyInlineScriptModuleIds
 }: FlowJsonUpdateResult): string {
 	if (emptyInlineScriptModuleIds.length === 0) {
 		return ''
 	}
-
 	const moduleList = emptyInlineScriptModuleIds.map((id) => `'${id}'`).join(', ')
 	return ` Warning: inline scripts ${moduleList} are empty for now. Use set_module_code to fill them in.`
 }
 
-function validateFlowModules(rawModules: unknown): FlowModule[] {
-	if (!Array.isArray(rawModules)) {
-		throw new Error('Flow modules must be an array')
-	}
-
-	const parsedModules = rawModules as FlowModule[]
-	const result = flowModulesSchema.safeParse(parsedModules)
-	if (!result.success) {
-		const errors = result.error.issues.slice(0, 5).map((e) => {
-			const path = e.path
-			// Try to find module id for better context
-			const moduleIndex = typeof path[0] === 'number' ? path[0] : undefined
-			const moduleId = moduleIndex !== undefined ? parsedModules[moduleIndex]?.id : undefined
-			const fieldPath = path.slice(1).join('.')
-
-			let message = e.message
-			if (e.code === 'invalid_type') {
-				// Zod 4 message already contains "expected X, received Y"
-				// Try to extract expected format from schema, passing actual data
-				// to help resolve discriminated unions correctly
-				const targetSchema = getSchemaAtPath(
-					flowModulesSchema,
-					path as (string | number)[],
-					parsedModules
-				)
-				if (targetSchema) {
-					const expectedFormat = getExpectedFormat(targetSchema)
-					if (expectedFormat) {
-						message += `\n    Expected format: ${expectedFormat}`
-					}
-				}
-			}
-
-			if (moduleId) {
-				return `Module "${moduleId}" -> ${fieldPath}: ${message}`
-			}
-			return `${path.join('.')}: ${message}`
-		})
-
-		throw new Error(`Invalid flow modules:\n${errors.join('\n')}`)
-	}
-
-	const ids = collectAllFlowModuleIdsFromModules(parsedModules)
-	if (ids.length !== new Set(ids).size) {
-		throw new Error('Duplicate module IDs found in flow')
-	}
-
-	const reservedIds = ids.filter(
-		(id) => id === SPECIAL_MODULE_IDS.PREPROCESSOR || id === SPECIAL_MODULE_IDS.FAILURE
-	)
-	if (reservedIds.length > 0) {
-		throw new Error(
-			'Special modules must be provided via preprocessor_module and failure_module, not inside modules'
-		)
-	}
-
-	return parsedModules
-}
-
-function validateFlowSchema(rawSchema: unknown): Record<string, any> | null {
-	if (rawSchema == null) {
-		return null
-	}
-
-	if (typeof rawSchema !== 'object' || Array.isArray(rawSchema)) {
-		throw new Error('Flow schema must be an object or null')
-	}
-
-	return rawSchema as Record<string, any>
-}
-
-function validateOptionalFlowModule(rawModule: unknown, fieldName: string): FlowModule | null {
-	if (rawModule == null) {
-		return null
-	}
-
-	const result = flowModuleSchema.safeParse(rawModule)
-	if (!result.success) {
-		const error = result.error.issues[0]
-		throw new Error(`Invalid ${fieldName}: ${error?.message ?? 'unknown error'}`)
-	}
-
-	return result.data
-}
-
-function validateEditableFlowJson(rawFlow: unknown): EditableFlowJson {
-	if (!rawFlow || typeof rawFlow !== 'object' || Array.isArray(rawFlow)) {
-		throw new Error('Flow JSON must be an object')
-	}
-
-	const flow = rawFlow as Record<string, unknown>
-	const modules = validateFlowModules(flow.modules)
-	const schema = validateFlowSchema(flow.schema)
-	const preprocessorModule = validateOptionalFlowModule(
-		flow.preprocessor_module,
-		'preprocessor_module'
-	)
-	const failureModule = validateOptionalFlowModule(flow.failure_module, 'failure_module')
-	const groupModuleIds = new Set(collectAllFlowModuleIdsFromModules(modules))
-	const groups = validateFlowGroups(flow.groups, groupModuleIds)
-
-	if (preprocessorModule) {
-		if (preprocessorModule.id !== SPECIAL_MODULE_IDS.PREPROCESSOR) {
-			throw new Error(
-				`Invalid preprocessor_module: id must be "${SPECIAL_MODULE_IDS.PREPROCESSOR}"`
-			)
-		}
-		if (
-			preprocessorModule.value.type !== 'rawscript' &&
-			preprocessorModule.value.type !== 'script'
-		) {
-			throw new Error(
-				'Invalid preprocessor_module: only "rawscript" and "script" modules are supported'
-			)
-		}
-	}
-	if (failureModule) {
-		if (failureModule.id !== SPECIAL_MODULE_IDS.FAILURE) {
-			throw new Error(`Invalid failure_module: id must be "${SPECIAL_MODULE_IDS.FAILURE}"`)
-		}
-		if (failureModule.value.type !== 'rawscript' && failureModule.value.type !== 'script') {
-			throw new Error('Invalid failure_module: only "rawscript" and "script" modules are supported')
-		}
-	}
-
-	const ids = new Set(collectAllFlowModuleIdsFromModules(modules))
-	if (preprocessorModule) {
-		if (ids.has(preprocessorModule.id)) {
-			throw new Error(`Duplicate module ID found in preprocessor_module: ${preprocessorModule.id}`)
-		}
-		ids.add(preprocessorModule.id)
-	}
-	if (failureModule && ids.has(failureModule.id)) {
-		throw new Error(`Duplicate module ID found in failure_module: ${failureModule.id}`)
-	}
-
-	return {
-		modules,
-		schema,
-		preprocessor_module: preprocessorModule,
-		failure_module: failureModule,
-		groups
-	}
-}
-
+/**
+ * Build the agent-facing compact view of a flow, with editor-only post-processing
+ * (insert `[#START]` / `[#END]` markers around code pieces selected as context).
+ * Delegates to the shared `buildEditableFlowJson` for the rest.
+ */
 function buildEditableFlowJson(
 	flow: ExtendedOpenFlow,
 	inlineScriptSession?: InlineScriptSession,
 	selectedContext: ContextElement[] = []
 ): EditableFlowJson {
+	const json = buildEditableFlowJsonBase(
+		{ value: flow.value, schema: flow.schema },
+		inlineScriptSession
+	)
 	const codePieces = selectedContext.filter((c) => c.type === 'flow_module_code_piece')
-	const optimizedModules = inlineScriptSession
-		? inlineScriptSession.extractAndReplaceInlineScripts(flow.value.modules)
-		: flow.value.modules
-	const modules = applyCodePiecesToFlowModules(codePieces, optimizedModules)
-
-	let preprocessorModule = flow.value.preprocessor_module
-	if (
-		preprocessorModule?.value?.type === 'rawscript' &&
-		preprocessorModule.value.content &&
-		inlineScriptSession
-	) {
-		inlineScriptSession.set(preprocessorModule.id, preprocessorModule.value.content)
-		preprocessorModule = {
-			...preprocessorModule,
-			value: {
-				...preprocessorModule.value,
-				content: `inline_script.${preprocessorModule.id}`
-			}
-		}
-	}
-
-	let failureModule = flow.value.failure_module
-	if (
-		failureModule?.value?.type === 'rawscript' &&
-		failureModule.value.content &&
-		inlineScriptSession
-	) {
-		inlineScriptSession.set(failureModule.id, failureModule.value.content)
-		failureModule = {
-			...failureModule,
-			value: {
-				...failureModule.value,
-				content: `inline_script.${failureModule.id}`
-			}
-		}
-	}
-
-	return {
-		modules,
-		schema: flow.schema ?? null,
-		preprocessor_module: preprocessorModule ?? null,
-		failure_module: failureModule ?? null,
-		groups: flow.value.groups ?? null
+	if (codePieces.length === 0) {
+		return json
 	}
+	return { ...json, modules: applyCodePiecesToFlowModules(codePieces, json.modules) }
 }
 
 /**
@@ -1006,25 +606,18 @@ export const flowTools: Tool<FlowAIChatHelpers>[] = [
 			// then copy extracted inline scripts back into the helper session before applying the patch.
 			const inlineScriptSession = createInlineScriptSession()
 			const currentFlowJson = JSON.stringify(buildEditableFlowJson(flow, inlineScriptSession))
-			const matchCount = countExactMatches(currentFlowJson, oldString)
-
-			if (matchCount === 0) {
-				throw new Error('old_string was not found in the current flow JSON.')
-			}
-
-			if (!replaceAll && matchCount !== 1) {
-				throw new Error(
-					`old_string matched ${matchCount} locations. Make it more specific or set replace_all to true.`
-				)
-			}
 
 			toolCallbacks.setToolStatus(toolId, {
 				content: 'Applying JSON patch...'
 			})
 
-			const updatedFlowJson = replaceAll
-				? currentFlowJson.split(oldString).join(newString)
-				: replaceFirstExactMatch(currentFlowJson, oldString, newString)
+			const updatedFlowJson = findAndReplace(
+				currentFlowJson,
+				oldString,
+				newString,
+				replaceAll,
+				'current flow JSON'
+			)
 
 			let parsedFlow: EditableFlowJson
 			try {
diff --git a/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts b/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
new file mode 100644
index 0000000000..a4b0ea72d5
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/flow/editableFlowJson.ts
@@ -0,0 +1,412 @@
+import { z } from 'zod'
+import type { FlowModule, FlowValue } from '$lib/gen'
+import { collectAllFlowModuleIdsFromModules } from '$lib/components/flows/flowTree'
+import { SPECIAL_MODULE_IDS } from '../shared'
+import type { InlineScriptSession } from './inlineScriptsUtils'
+import { validateFlowGroups, type FlowGroup } from './helperUtils'
+import { flowModuleSchema, flowModulesSchema } from './openFlowZod.gen'
+
+/**
+ * Compact, agent-friendly representation of a flow.
+ *
+ * Inline rawscript content is replaced with `inline_script.<moduleId>` placeholders
+ * by `buildEditableFlowJson` so flows stay short in tool I/O. Use the matching
+ * InlineScriptSession to recover the actual content.
+ */
+export type EditableFlowJson = {
+	modules: FlowModule[]
+	schema: Record<string, any> | null
+	preprocessor_module: FlowModule | null
+	failure_module: FlowModule | null
+	groups: FlowGroup[] | null
+}
+
+/** Optional input to the rich-error path of `validateEditableFlowJson`. */
+type SchemaErrorContext = {
+	/** Custom modules schema to validate against (defaults to flowModulesSchema). */
+	modulesSchema?: z.ZodTypeAny
+}
+
+/**
+ * Navigate to a schema at a given path, handling arrays, objects, unions, and wrappers.
+ * Uses Zod 4 internal structure.
+ */
+function getSchemaAtPath(
+	schema: z.ZodType,
+	path: (string | number)[],
+	data?: any
+): z.ZodType | null {
+	let current: z.ZodType = schema
+	let currentData = data
+
+	for (let i = 0; i < path.length; i++) {
+		const segment = path[i]
+
+		if (!current || !(current as any)._def) return null
+
+		let type = (current as any)._def.type
+
+		// Unwrap optional/nullable/default/catch
+		while (['optional', 'nullable', 'default', 'catch'].includes(type)) {
+			current = (current as any)._def.innerType
+			if (!current || !(current as any)._def) return null
+			type = (current as any)._def.type
+		}
+
+		if (type === 'array') {
+			if (typeof segment === 'number') {
+				current = (current as any)._def.element
+				if (currentData && Array.isArray(currentData)) {
+					currentData = currentData[segment]
+				}
+				continue
+			}
+			current = (current as any)._def.element
+			i--
+			continue
+		}
+
+		if (type === 'object') {
+			const shape = (current as any)._def.shape
+			const key = String(segment)
+			if (shape && key in shape) {
+				current = shape[key]
+				if (currentData && typeof currentData === 'object') {
+					currentData = currentData[key]
+				}
+				continue
+			}
+			return null
+		}
+
+		if (type === 'union') {
+			const options = (current as any)._def.options
+			if (options) {
+				if (currentData && typeof currentData === 'object') {
+					const typeValue = currentData.type
+					if (typeValue) {
+						for (const option of options) {
+							const optionShape = (option as any)._def?.shape
+							const optionType = optionShape?.type?._def?.values?.[0]
+							if (optionType === typeValue) {
+								const remainingPath = path.slice(i)
+								const result = getSchemaAtPath(option, remainingPath, currentData)
+								if (result) return result
+							}
+						}
+					}
+				}
+				for (const option of options) {
+					const remainingPath = path.slice(i)
+					const result = getSchemaAtPath(option, remainingPath, currentData)
+					if (result) return result
+				}
+			}
+			return null
+		}
+
+		if (type === 'record') {
+			current = (current as any)._def.valueType
+			if (!current) return null
+			if (currentData && typeof currentData === 'object') {
+				currentData = currentData[segment]
+			}
+			continue
+		}
+
+		return null
+	}
+
+	return current
+}
+
+function formatJsonSchemaForError(jsonSchema: any): string {
+	if (jsonSchema.type === 'object' && jsonSchema.properties) {
+		const props = Object.entries(jsonSchema.properties)
+			.slice(0, 5)
+			.map(([k, v]: [string, any]) => {
+				if (v.enum) {
+					return `${k}: ${v.enum.map((e: any) => JSON.stringify(e)).join('|')}`
+				}
+				return `${k}: ${v.type || 'any'}`
+			})
+			.join(', ')
+		const moreProps =
+			Object.keys(jsonSchema.properties).length > 5
+				? `, ... (${Object.keys(jsonSchema.properties).length - 5} more)`
+				: ''
+		const required = jsonSchema.required?.length
+			? ` (required: ${jsonSchema.required.join(', ')})`
+			: ''
+		return `{ ${props}${moreProps} }${required}`
+	}
+
+	if (jsonSchema.const !== undefined) return JSON.stringify(jsonSchema.const)
+	if (jsonSchema.enum) {
+		return `one of: ${jsonSchema.enum.map((v: any) => JSON.stringify(v)).join(', ')}`
+	}
+	if (jsonSchema.oneOf) return jsonSchema.oneOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
+	if (jsonSchema.anyOf) return jsonSchema.anyOf.map((s: any) => formatJsonSchemaForError(s)).join(' | ')
+	if (jsonSchema.description) return jsonSchema.description
+	return jsonSchema.type || JSON.stringify(jsonSchema)
+}
+
+function getExpectedFormat(schema: z.ZodType): string | null {
+	if (!schema || !(schema as any)._def) return null
+
+	let current = schema
+	while ((current as any)._def.type === 'optional' || (current as any)._def.type === 'nullable') {
+		current = (current as any)._def.innerType
+		if (!current || !(current as any)._def) break
+	}
+
+	try {
+		const jsonSchema = z.toJSONSchema(schema)
+		if (
+			Object.keys(jsonSchema).length <= 1 ||
+			(Object.keys(jsonSchema).length === 1 && jsonSchema.$schema)
+		) {
+			return null
+		}
+		const formatted = formatJsonSchemaForError(jsonSchema)
+		if (formatted && formatted !== 'unknown' && !formatted.startsWith('{')) return formatted
+		if (formatted && formatted.startsWith('{') && formatted !== '{ }') return formatted
+	} catch {
+		// Ignore errors from toJSONSchema
+	}
+	return null
+}
+
+export function validateFlowModules(rawModules: unknown, ctx: SchemaErrorContext = {}): FlowModule[] {
+	if (!Array.isArray(rawModules)) {
+		throw new Error('Flow modules must be an array')
+	}
+
+	const parsedModules = rawModules as FlowModule[]
+	const modulesSchema = ctx.modulesSchema ?? flowModulesSchema
+	const result = modulesSchema.safeParse(parsedModules)
+	if (!result.success) {
+		const errors = result.error.issues.slice(0, 5).map((e) => {
+			const path = e.path
+			const moduleIndex = typeof path[0] === 'number' ? path[0] : undefined
+			const moduleId = moduleIndex !== undefined ? parsedModules[moduleIndex]?.id : undefined
+			const fieldPath = path.slice(1).join('.')
+
+			let message = e.message
+			if (e.code === 'invalid_type') {
+				const targetSchema = getSchemaAtPath(
+					modulesSchema,
+					path as (string | number)[],
+					parsedModules
+				)
+				if (targetSchema) {
+					const expectedFormat = getExpectedFormat(targetSchema)
+					if (expectedFormat) {
+						message += `\n    Expected format: ${expectedFormat}`
+					}
+				}
+			}
+
+			if (moduleId) {
+				return `Module "${moduleId}" -> ${fieldPath}: ${message}`
+			}
+			return `${path.join('.')}: ${message}`
+		})
+
+		throw new Error(`Invalid flow modules:\n${errors.join('\n')}`)
+	}
+
+	const ids = collectAllFlowModuleIdsFromModules(parsedModules)
+	if (ids.length !== new Set(ids).size) {
+		throw new Error('Duplicate module IDs found in flow')
+	}
+
+	const reservedIds = ids.filter(
+		(id) => id === SPECIAL_MODULE_IDS.PREPROCESSOR || id === SPECIAL_MODULE_IDS.FAILURE
+	)
+	if (reservedIds.length > 0) {
+		throw new Error(
+			'Special modules must be provided via preprocessor_module and failure_module, not inside modules'
+		)
+	}
+
+	return parsedModules
+}
+
+export function validateFlowSchema(rawSchema: unknown): Record<string, any> | null {
+	if (rawSchema == null) return null
+	if (typeof rawSchema !== 'object' || Array.isArray(rawSchema)) {
+		throw new Error('Flow schema must be an object or null')
+	}
+	return rawSchema as Record<string, any>
+}
+
+function validateOptionalFlowModule(rawModule: unknown, fieldName: string): FlowModule | null {
+	if (rawModule == null) return null
+
+	const result = flowModuleSchema.safeParse(rawModule)
+	if (!result.success) {
+		const error = result.error.issues[0]
+		throw new Error(`Invalid ${fieldName}: ${error?.message ?? 'unknown error'}`)
+	}
+	return result.data
+}
+
+/**
+ * Parse and validate a raw object as an `EditableFlowJson`. Validates module
+ * shape, schema shape, optional special modules (with their reserved ids),
+ * groups, and that no module ids collide.
+ */
+export function validateEditableFlowJson(
+	rawFlow: unknown,
+	ctx: SchemaErrorContext = {}
+): EditableFlowJson {
+	if (!rawFlow || typeof rawFlow !== 'object' || Array.isArray(rawFlow)) {
+		throw new Error('Flow JSON must be an object')
+	}
+
+	const flow = rawFlow as Record<string, unknown>
+	const modules = validateFlowModules(flow.modules, ctx)
+	const schema = validateFlowSchema(flow.schema)
+	const preprocessorModule = validateOptionalFlowModule(
+		flow.preprocessor_module,
+		'preprocessor_module'
+	)
+	const failureModule = validateOptionalFlowModule(flow.failure_module, 'failure_module')
+	const groupModuleIds = new Set(collectAllFlowModuleIdsFromModules(modules))
+	const groups = validateFlowGroups(flow.groups, groupModuleIds)
+
+	if (preprocessorModule) {
+		if (preprocessorModule.id !== SPECIAL_MODULE_IDS.PREPROCESSOR) {
+			throw new Error(
+				`Invalid preprocessor_module: id must be "${SPECIAL_MODULE_IDS.PREPROCESSOR}"`
+			)
+		}
+		if (
+			preprocessorModule.value.type !== 'rawscript' &&
+			preprocessorModule.value.type !== 'script'
+		) {
+			throw new Error(
+				'Invalid preprocessor_module: only "rawscript" and "script" modules are supported'
+			)
+		}
+	}
+	if (failureModule) {
+		if (failureModule.id !== SPECIAL_MODULE_IDS.FAILURE) {
+			throw new Error(`Invalid failure_module: id must be "${SPECIAL_MODULE_IDS.FAILURE}"`)
+		}
+		if (failureModule.value.type !== 'rawscript' && failureModule.value.type !== 'script') {
+			throw new Error('Invalid failure_module: only "rawscript" and "script" modules are supported')
+		}
+	}
+
+	const ids = new Set(collectAllFlowModuleIdsFromModules(modules))
+	if (preprocessorModule) {
+		if (ids.has(preprocessorModule.id)) {
+			throw new Error(`Duplicate module ID found in preprocessor_module: ${preprocessorModule.id}`)
+		}
+		ids.add(preprocessorModule.id)
+	}
+	if (failureModule && ids.has(failureModule.id)) {
+		throw new Error(`Duplicate module ID found in failure_module: ${failureModule.id}`)
+	}
+
+	return {
+		modules,
+		schema,
+		preprocessor_module: preprocessorModule,
+		failure_module: failureModule,
+		groups
+	}
+}
+
+/**
+ * Build the agent-facing compact view of a flow. When an `InlineScriptSession`
+ * is provided, every rawscript module's `content` is moved into the session
+ * and replaced with the placeholder `inline_script.<moduleId>` (preprocessor
+ * and failure modules included).
+ */
+export function buildEditableFlowJson(
+	flow: { value: FlowValue; schema?: Record<string, any> | null | undefined },
+	inlineScriptSession?: InlineScriptSession
+): EditableFlowJson {
+	const modules = inlineScriptSession
+		? inlineScriptSession.extractAndReplaceInlineScripts(flow.value.modules)
+		: flow.value.modules
+
+	let preprocessorModule = flow.value.preprocessor_module
+	if (
+		preprocessorModule?.value?.type === 'rawscript' &&
+		typeof preprocessorModule.value.content === 'string' &&
+		inlineScriptSession
+	) {
+		inlineScriptSession.set(preprocessorModule.id, preprocessorModule.value.content)
+		preprocessorModule = {
+			...preprocessorModule,
+			value: {
+				...preprocessorModule.value,
+				content: `inline_script.${preprocessorModule.id}`
+			}
+		}
+	}
+
+	let failureModule = flow.value.failure_module
+	if (
+		failureModule?.value?.type === 'rawscript' &&
+		typeof failureModule.value.content === 'string' &&
+		inlineScriptSession
+	) {
+		inlineScriptSession.set(failureModule.id, failureModule.value.content)
+		failureModule = {
+			...failureModule,
+			value: {
+				...failureModule.value,
+				content: `inline_script.${failureModule.id}`
+			}
+		}
+	}
+
+	return {
+		modules,
+		schema: flow.schema ?? null,
+		preprocessor_module: preprocessorModule ?? null,
+		failure_module: failureModule ?? null,
+		groups: flow.value.groups ?? null
+	}
+}
+
+function restoreSpecialRawscriptModule(
+	module: FlowModule | null,
+	session: InlineScriptSession
+): FlowModule | null {
+	if (!module || module.value.type !== 'rawscript' || !module.value.content) return module
+	const match = module.value.content.match(/^inline_script\.(.+)$/)
+	if (!match) return module
+	const content = session.get(match[1])
+	if (content === undefined) return module
+	return { ...module, value: { ...module.value, content } }
+}
+
+/**
+ * Inverse of `buildEditableFlowJson`. Replaces `inline_script.<moduleId>`
+ * placeholders in `editable.modules` and the special modules with the content
+ * stored in `session`. Other fields on the original FlowValue (`same_worker`,
+ * `concurrent_limit`, etc.) are preserved.
+ *
+ * Pair with `buildEditableFlowJson` for round-trip patches: extract → patch
+ * the compact view → restore.
+ */
+export function applyEditableFlowJsonToFlow(
+	originalValue: FlowValue,
+	editable: EditableFlowJson,
+	session: InlineScriptSession
+): FlowValue {
+	return {
+		...originalValue,
+		modules: session.restoreInlineScriptReferences(editable.modules),
+		preprocessor_module:
+			restoreSpecialRawscriptModule(editable.preprocessor_module, session) ?? undefined,
+		failure_module: restoreSpecialRawscriptModule(editable.failure_module, session) ?? undefined,
+		groups: editable.groups ?? undefined
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts b/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
index 4180b7e36b..e63965e52a 100644
--- a/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
+++ b/frontend/src/lib/components/copilot/chat/flow/inlineScriptsUtils.ts
@@ -62,7 +62,7 @@ function extractAndReplaceInlineScripts(
 	return modules.map((module) => {
 		const newModule = { ...module }
 
-		if (newModule.value.type === 'rawscript' && newModule.value.content) {
+		if (newModule.value.type === 'rawscript' && typeof newModule.value.content === 'string') {
 			session.set(module.id, newModule.value.content)
 			newModule.value = {
 				...newModule.value,
@@ -113,7 +113,7 @@ function extractAndReplaceInlineScripts(
 							'type' in tool.value &&
 							tool.value.type === 'rawscript' &&
 							'content' in tool.value &&
-							tool.value.content
+							typeof tool.value.content === 'string'
 						) {
 							session.set(tool.id, tool.value.content as string)
 							return {
diff --git a/frontend/src/lib/components/copilot/chat/global/core.test.ts b/frontend/src/lib/components/copilot/chat/global/core.test.ts
new file mode 100644
index 0000000000..2664c1495d
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/core.test.ts
@@ -0,0 +1,148 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('monaco-editor', () => ({
+	editor: {},
+	languages: {},
+	KeyCode: {},
+	Uri: {
+		parse: (value: string) => ({ toString: () => value })
+	},
+	MarkerSeverity: {
+		Error: 8,
+		Warning: 4,
+		Info: 2,
+		Hint: 1
+	}
+}))
+
+vi.mock('@codingame/monaco-vscode-standalone-typescript-language-features', () => ({
+	getTypeScriptWorker: async () => async () => ({}),
+	typescriptVersion: 'test'
+}))
+
+vi.mock('@codingame/monaco-vscode-languages-service-override', () => ({
+	default: () => ({})
+}))
+
+vi.mock('$lib/components/vscode', () => ({}))
+
+vi.mock('$lib/gen', async () => {
+	const actual = await vi.importActual<any>('$lib/gen')
+
+	function wrapService<T extends object>(target: T, overrides: Record<string, unknown>): T {
+		return new Proxy(target, {
+			get(source, property, receiver) {
+				if (typeof property === 'string' && property in overrides) {
+					return overrides[property]
+				}
+				return Reflect.get(source, property, receiver)
+			}
+		})
+	}
+
+	return {
+		...actual,
+		FlowService: wrapService(actual.FlowService, {
+			existsFlowByPath: vi.fn(async () => false)
+		}),
+		VariableService: wrapService(actual.VariableService, {
+			existsVariable: vi.fn(async () => false)
+		})
+	}
+})
+
+import { globalTools } from './core'
+import { globalDraftStore } from './draftStore.svelte'
+import type { Tool, ToolCallbacks } from '../shared'
+
+const WORKSPACE = 'global-core-test'
+
+const toolCallbacks: ToolCallbacks = {
+	setToolStatus: vi.fn(),
+	removeToolStatus: vi.fn()
+}
+
+function getGlobalTool(name: string): Tool<{}> {
+	const tool = globalTools.find((candidate) => candidate.def.function.name === name)
+	if (!tool) {
+		throw new Error(`Missing global tool "${name}"`)
+	}
+	return tool
+}
+
+async function callGlobalTool(name: string, args: Record<string, unknown>): Promise<string> {
+	return getGlobalTool(name).fn({
+		args,
+		workspace: WORKSPACE,
+		helpers: {},
+		toolCallbacks,
+		toolId: `test-${name}`
+	})
+}
+
+describe('global AI tools', () => {
+	beforeEach(() => {
+		globalDraftStore.clearDrafts(WORKSPACE)
+		vi.clearAllMocks()
+	})
+
+	it('redacts variable draft values when reading workspace items', async () => {
+		await callGlobalTool('write_variable', {
+			path: 'f/secrets/api_key',
+			value: 'super-secret-token',
+			is_secret: true,
+			description: 'API key'
+		})
+
+		const raw = await callGlobalTool('read_workspace_item', {
+			type: 'variable',
+			path: 'f/secrets/api_key'
+		})
+		const item = JSON.parse(raw)
+
+		expect(raw).not.toContain('super-secret-token')
+		expect(item).toEqual({
+			type: 'variable',
+			path: 'f/secrets/api_key',
+			summary: 'API key',
+			isDraft: true
+		})
+	})
+
+	it('fills an empty rawscript module through set_flow_module_code', async () => {
+		await callGlobalTool('write_flow', {
+			path: 'f/flows/empty-module',
+			summary: 'Flow with empty module',
+			value: JSON.stringify({
+				modules: [
+					{
+						id: 'empty_step',
+						value: {
+							type: 'rawscript',
+							language: 'bun',
+							content: '',
+							input_transforms: {}
+						}
+					}
+				]
+			})
+		})
+
+		const code = 'export async function main() {\n\treturn 42\n}'
+
+		await expect(
+			callGlobalTool('set_flow_module_code', {
+				path: 'f/flows/empty-module',
+				module_id: 'empty_step',
+				code
+			})
+		).resolves.toContain('Updated AI draft flow')
+
+		await expect(
+			callGlobalTool('read_flow_module_code', {
+				path: 'f/flows/empty-module',
+				module_id: 'empty_step'
+			})
+		).resolves.toBe(code)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/core.ts b/frontend/src/lib/components/copilot/chat/global/core.ts
new file mode 100644
index 0000000000..de18426a3c
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/core.ts
@@ -0,0 +1,2381 @@
+import {
+	AppService,
+	AzureTriggerService,
+	FlowService,
+	GcpTriggerService,
+	HttpTriggerService,
+	KafkaTriggerService,
+	MqttTriggerService,
+	NatsTriggerService,
+	PostgresTriggerService,
+	ResourceService,
+	ScheduleService,
+	ScriptService,
+	SqsTriggerService,
+	VariableService,
+	WebsocketTriggerService
+} from '$lib/gen'
+import { $ScriptLang } from '$lib/gen/schemas.gen'
+import type {
+	AppWithLastVersion,
+	Flow,
+	FlowValue,
+	ListableApp,
+	ListableResource,
+	ListableVariable,
+	Schedule,
+	Script,
+	ScriptLang
+} from '$lib/gen/types.gen'
+import { updateRawAppPolicy } from '$lib/components/raw_apps/rawAppPolicy'
+import {
+	FRAMEWORK_TEMPLATES,
+	STARTER_RUNNABLE,
+	STARTER_RUNNABLE_KEY,
+	type FrameworkKey
+} from '$lib/components/raw_apps/templates'
+import {
+	applyEditableFlowJsonToFlow,
+	buildEditableFlowJson,
+	validateEditableFlowJson
+} from '../flow/editableFlowJson'
+import { createInlineScriptSession } from '../flow/inlineScriptsUtils'
+import {
+	getFlowPrompt,
+	getRawAppPrompt,
+	getResourcePrompt,
+	getScriptPrompt
+} from '$system_prompts'
+import type {
+	ChatCompletionSystemMessageParam,
+	ChatCompletionUserMessageParam
+} from 'openai/resources/chat/completions.mjs'
+import { z } from 'zod'
+import {
+	createToolDef,
+	findAndReplace,
+	type CreatedResourceTriggerKind,
+	type Tool,
+	type ToolCallbacks,
+	type ToolDisplayAction
+} from '../shared'
+import { flowModuleSchema, flowModulesSchema } from '../flow/openFlowZod.gen'
+import {
+	resourceRequestSchema,
+	scheduleRequestSchema,
+	triggerRequestSchemas,
+	variableRequestSchema
+} from '../workspaceToolsZod.gen'
+import {
+	getWorkspaceItemKey,
+	globalDraftStore,
+	TRIGGER_KINDS,
+	type AppDraftValue,
+	type FlowDraftValue,
+	type TriggerKind,
+	type WorkspaceItem,
+	type WorkspaceItemType
+} from './draftStore.svelte'
+import { buildFlowDeployRequestBody, buildScriptDeployRequestBody } from './deployRequests'
+
+const ITEM_TYPES = [
+	'script',
+	'flow',
+	'schedule',
+	'trigger',
+	'resource',
+	'variable',
+	'app'
+] as const satisfies readonly WorkspaceItemType[]
+const INSTRUCTION_SUBJECTS = [
+	'script',
+	'flow',
+	'resource',
+	'app'
+] as const satisfies readonly WorkspaceItemType[]
+const MAX_LIST_LIMIT = 100
+
+const itemTypeSchema = z.enum(ITEM_TYPES)
+const instructionSubjectSchema = z.enum(INSTRUCTION_SUBJECTS)
+const triggerKindSchema = z.enum(TRIGGER_KINDS)
+const scriptLangSchema = z.enum($ScriptLang.enum)
+
+const getInstructionsSchema = z.object({
+	subject: instructionSubjectSchema.describe(
+		"The workspace item type to get authoring instructions for (script, flow, resource, app). Schedules, triggers, and variables don't need instructions — their tool schemas describe everything."
+	),
+	language: scriptLangSchema
+		.optional()
+		.describe(
+			'Required when subject is script. Use the existing script language when modifying, or the requested target language when creating.'
+		)
+})
+
+const listWorkspaceItemsSchema = z.object({
+	types: z
+		.array(itemTypeSchema)
+		.optional()
+		.describe(
+			'Optional item types to list. Defaults to scripts and flows. Pass schedule or trigger explicitly when needed (listing triggers spans 9 kinds and is heavier).'
+		),
+	query: z.string().optional().describe('Optional case-insensitive path or summary search string.'),
+	path_prefix: z
+		.string()
+		.optional()
+		.describe('Optional path prefix filter, such as f/ or u/user/.'),
+	limit: z
+		.number()
+		.int()
+		.min(1)
+		.max(MAX_LIST_LIMIT)
+		.optional()
+		.describe('Maximum number of items to return. Defaults to 50 and is capped at 100.')
+})
+
+const readWorkspaceItemSchema = z.object({
+	type: itemTypeSchema,
+	path: z.string().describe('Workspace path of the item to read.'),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Identifies which trigger service to call.')
+})
+
+const writeScriptSchema = z.object({
+	path: z
+		.string()
+		.describe('Workspace path of the script, e.g. f/folder/name or u/user/name.'),
+	summary: z.string().optional().describe('Short human-readable summary.'),
+	language: scriptLangSchema.describe('Script language.'),
+	content: z.string().describe('Full script source code.')
+})
+
+const flowValueSchema = z
+	.looseObject({
+		modules: flowModulesSchema.describe('Sequential flow modules.'),
+		preprocessor_module: flowModuleSchema
+			.nullable()
+			.optional()
+			.describe(
+				"Optional preprocessor module with id 'preprocessor'. Runs before normal modules; cannot reference results.*."
+			),
+		failure_module: flowModuleSchema
+			.nullable()
+			.optional()
+			.describe("Optional failure handler module with id 'failure'.")
+	})
+	.describe('OpenFlow value: modules plus optional preprocessor_module and failure_module.')
+
+const readFlowModuleCodeSchema = z.object({
+	path: z.string().describe('Workspace path of the flow.'),
+	module_id: z
+		.string()
+		.describe(
+			'Module id whose inline rawscript content to read. Must reference a module whose value.type is "rawscript".'
+		)
+})
+
+const setFlowModuleCodeSchema = z.object({
+	path: z.string().describe('Workspace path of the flow.'),
+	module_id: z
+		.string()
+		.describe(
+			'Module id whose inline rawscript content to overwrite. Must reference a module whose value.type is "rawscript". Use patch_flow_json for structural changes.'
+		),
+	code: z.string().describe('New script source. Replaces the module\'s value.content entirely.')
+})
+
+// `value` is taken as a JSON string rather than a typed object because the
+// underlying flowValueSchema is recursive (modules can contain modules), which
+// makes z.toJSONSchema emit $defs/$ref. Gemini's tools API rejects those
+// keywords ("Unknown name $ref/$defs"). The string is parsed and validated
+// against flowValueSchema inside the handler. Same trick as set_flow_json in
+// chat/flow/core.ts (see comment on its schema).
+const writeFlowSchema = z.object({
+	path: z
+		.string()
+		.describe('Workspace path of the flow, e.g. f/folder/name or u/user/name.'),
+	summary: z.string().optional().describe('Short human-readable summary.'),
+	value: z
+		.string()
+		.describe(
+			'JSON string of the OpenFlow value object: { modules, preprocessor_module?, failure_module? }. Pass it as a JSON-encoded string, not a nested object.'
+		)
+})
+
+const writeScheduleSchema = scheduleRequestSchema
+
+const writeTriggerSchema = z.object({
+	kind: triggerKindSchema.describe('Trigger kind. Determines which fields are valid in config.'),
+	config: z
+		.union([
+			triggerRequestSchemas.http,
+			triggerRequestSchemas.websocket,
+			triggerRequestSchemas.kafka,
+			triggerRequestSchemas.nats,
+			triggerRequestSchemas.postgres,
+			triggerRequestSchemas.mqtt,
+			triggerRequestSchemas.sqs,
+			triggerRequestSchemas.gcp,
+			triggerRequestSchemas.azure
+		])
+		.describe(
+			'Full trigger configuration. Must include path, script_path, is_flow plus the kind-specific fields.'
+		)
+})
+
+const writeResourceSchema = resourceRequestSchema
+
+const writeVariableSchema = variableRequestSchema
+
+const searchResourceTypesSchema = z.object({
+	query: z.string().describe('Substring to match against resource type names.'),
+	limit: z
+		.number()
+		.int()
+		.min(1)
+		.max(20)
+		.optional()
+		.describe('Max number of resource types to return. Defaults to 5.')
+})
+
+const deleteWorkspaceItemSchema = z.object({
+	type: itemTypeSchema,
+	path: z.string().describe('Workspace path of the item to delete.'),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Identifies which trigger service to call.')
+})
+
+const deployWorkspaceItemSchema = z.object({
+	type: itemTypeSchema,
+	path: z.string().describe('Workspace path of the draft to deploy.'),
+	trigger_kind: triggerKindSchema
+		.optional()
+		.describe('Required when type is trigger. Must match the draft trigger kind.'),
+	deployment_message: z
+		.string()
+		.optional()
+		.describe('Optional deployment message recorded with the change.')
+})
+
+const editScriptSchema = z.object({
+	path: z.string().describe('Workspace path of the script to edit.'),
+	old_string: z.string().min(1).describe('Exact text to find in the script source.'),
+	new_string: z.string().describe('Replacement text.'),
+	replace_all: z
+		.boolean()
+		.optional()
+		.default(false)
+		.describe(
+			'When true, replace every exact match. When false, old_string must match exactly once.'
+		)
+})
+
+const patchFlowJsonSchema = z.object({
+	path: z.string().describe('Workspace path of the flow to edit.'),
+	old_string: z
+		.string()
+		.min(1)
+		.describe('Exact text to find in the flow value, serialized as compact JSON (no indent).'),
+	new_string: z.string().describe('Replacement JSON text.'),
+	replace_all: z
+		.boolean()
+		.optional()
+		.default(false)
+		.describe(
+			'When true, replace every exact match. When false, old_string must match exactly once.'
+		)
+})
+
+// ============= App tools (raw apps) =============
+
+const backendRunnableSchema = z
+	.object({
+		name: z.string().describe('Short summary/description of what the runnable does.'),
+		type: z
+			.enum(['inline', 'script', 'flow', 'hubscript'])
+			.describe(
+				'Runnable kind: "inline" for custom code stored on the app; "script"/"flow" for a workspace runnable; "hubscript" for a hub script.'
+			),
+		staticInputs: z
+			.record(z.string(), z.any())
+			.optional()
+			.describe(
+				'Static inputs that are not overridable by the frontend caller. Useful for workspace/hub scripts to pre-fill arguments.'
+			),
+		inlineScript: z
+			.object({
+				language: z.enum(['bun', 'python3']).describe('Inline script language.'),
+				content: z.string().describe('Inline script source. Must export a main function.')
+			})
+			.optional()
+			.describe('Required when type is "inline".'),
+		path: z
+			.string()
+			.optional()
+			.describe(
+				'Required when type is "script", "flow", or "hubscript". Workspace path of the runnable.'
+			)
+	})
+	.describe(
+		'Backend runnable shape: same as in app mode. Inline runnables carry their script content; path runnables reference an existing workspace/hub item.'
+	)
+
+const readAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app, e.g. f/folder/name.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path like /index.tsx, or backend inline runnable path like backend/<key>/main.ts (or main.py).'
+		)
+})
+
+const writeAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path (must start with /). Use write_app_runnable to set inline backend script content.'
+		),
+	content: z.string().describe('Full file content.')
+})
+
+const deleteAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path to remove from the draft. Use delete_app_runnable for backend runnables.'
+		)
+})
+
+const patchAppFileSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	file_path: z
+		.string()
+		.describe(
+			'Frontend file path like /index.tsx, or backend inline runnable path like backend/<key>/main.ts.'
+		),
+	old_string: z.string().min(1).describe('Exact text to find.'),
+	new_string: z.string().describe('Replacement text.'),
+	replace_all: z
+		.boolean()
+		.optional()
+		.default(false)
+		.describe(
+			'When true, replace every exact match. When false, old_string must match exactly once.'
+		)
+})
+
+const writeAppRunnableSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	key: z
+		.string()
+		.describe(
+			'Unique key for the backend runnable (called from frontend as backend.<key>()). Becomes the file id at backend/<key>/main.{ts|py}.'
+		),
+	runnable: backendRunnableSchema
+})
+
+const deleteAppRunnableSchema = z.object({
+	path: z.string().describe('Workspace path of the app.'),
+	key: z.string().describe('Key of the backend runnable to remove.')
+})
+
+const FRAMEWORK_KEYS = ['react19', 'react18', 'svelte5', 'vue'] as const satisfies readonly FrameworkKey[]
+
+const initAppSchema = z.object({
+	path: z
+		.string()
+		.describe(
+			'Workspace path for the new app, e.g. f/folder/my_app or u/username/my_app. Errors if an app already exists at this path or a draft is already in flight.'
+		),
+	summary: z.string().optional().describe('Short human-readable summary of the app.'),
+	framework: z
+		.enum(FRAMEWORK_KEYS)
+		.describe(
+			'Frontend framework template. Confirm with the user before calling — never default silently. react19 is recommended for new apps.'
+		),
+	data: z
+		.object({
+			datatable: z.string().optional().describe('Default datatable name (e.g. "main").'),
+			schema: z.string().optional().describe('Default schema (PostgreSQL schema, optional).'),
+			tables: z
+				.array(z.string())
+				.optional()
+				.describe(
+					'Initially-whitelisted tables, in the format "<datatable>/<table>" or "<datatable>/<schema>:<table>".'
+				)
+		})
+		.optional()
+		.describe('Optional datatable configuration. Omit unless the user asked to wire one up.')
+})
+
+const GLOBAL_SYSTEM_PROMPT = `You are Windmill's global workspace assistant.
+
+You can inspect workspace scripts, flows, schedules, triggers, resources, variables, and apps, then create draft changes in the frontend AI draft store.
+
+Important rules:
+- write_{script,flow,schedule,trigger,resource,variable} create or overwrite drafts. They do not save, deploy, or mutate workspace items.
+- edit_script and patch_flow_json apply small exact-text edits and save the result as a draft. Prefer them for localized changes; use write_* for large rewrites.
+- For flows specifically: read_workspace_item and patch_flow_json work on a COMPACT view where rawscript module bodies are replaced with the placeholder "inline_script.<moduleId>". Use read_flow_module_code / set_flow_module_code to inspect or overwrite an inline script body; use patch_flow_json for structural edits.
+- deploy_workspace_item persists a draft to the workspace via the real backend create/update API and removes the draft. Requires user confirmation. Only call after the user has reviewed the draft and explicitly asked to deploy.
+- delete_workspace_item permanently removes a workspace item (and any matching draft). Irreversible. Requires user confirmation. Only call when the user has explicitly asked to delete.
+- Use list_workspace_items before broad reads.
+- Use read_workspace_item before overwriting an existing item, unless the user already provided the complete current item. For triggers, pass trigger_kind.
+- Variable values are NEVER returned by read_workspace_item or list_workspace_items — only metadata (path, description, is_secret). The model cannot read secret values, by design.
+- For resources that need secrets, write a Variable first (with is_secret: true), then in the resource value reference it as "$var:path/to/variable". When deploying both, deploy the variable before the resource.
+- Use search_resource_types before write_resource to discover the resource_type name and the JSON Schema its value must match.
+- Use get_instructions before writing a script, flow, resource, or app. For scripts, pass the target language; when modifying, use the language from the item you read.
+- Schedules, triggers, and variables do not need get_instructions — their tool schemas describe every field.
+- A workspace item is { type, path, summary?, language?, triggerKind?, value, isDraft }. For scripts, value is the source code string. For flows, value is { value: <OpenFlow value>, schema, groups } so the inputs schema and groups round-trip through deploy. For schedules/triggers/resources/variables, value is the full request body for that type. For apps, value is { files, runnables, data?, policy?, custom_path? } with frontend file contents and backend runnable definitions.
+- Apps (raw apps): use list_workspace_items with types: ['app'] to find them, read_workspace_item with type 'app' for a metadata summary (file paths + runnable list, no contents), then read_app_file to read individual files. Edit with write_app_file / patch_app_file / delete_app_file for frontend files and write_app_runnable / delete_app_runnable for backend runnables. Frontend file paths start with "/" (e.g. /index.tsx). Backend inline runnables are addressed as "backend/<key>/main.{ts|py}". /wmill.d.ts is generated and cannot be written.
+- To create a new raw app, use init_app. Before calling it, confirm framework (react19 / react18 / svelte5 / vue), path, and summary with the user — do not silently default to react19, even though it is the recommended choice.
+- Apps cannot be deployed from chat. The app editor bundles JS/CSS before save; tell the user to open the app editor to deploy app drafts.
+- Keep context targeted. Do not read unrelated items.
+- Be explicit with the user when you create or update a draft.`
+
+const DEFAULT_LIST_TYPES = ['script', 'flow'] as const satisfies readonly WorkspaceItemType[]
+
+function getRequestedTypes(types: WorkspaceItemType[] | undefined): WorkspaceItemType[] {
+	return types && types.length > 0 ? types : [...DEFAULT_LIST_TYPES]
+}
+
+function itemMatches(
+	item: Pick<WorkspaceItem, 'path' | 'summary'>,
+	query: string | undefined
+): boolean {
+	const normalized = query?.trim().toLowerCase()
+	if (!normalized) return true
+	return (
+		item.path.toLowerCase().includes(normalized) ||
+		(item.summary?.toLowerCase().includes(normalized) ?? false)
+	)
+}
+
+function scriptToItem(script: Script, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'script',
+		path: script.path,
+		summary: script.summary,
+		language: script.language,
+		value: includeValue ? script.content : undefined,
+		isDraft: false
+	}
+}
+
+function flowToItem(flow: Flow, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'flow',
+		path: flow.path,
+		summary: flow.summary,
+		value: includeValue
+			? { value: flow.value, schema: flow.schema, groups: flow.value.groups ?? null }
+			: undefined,
+		isDraft: false
+	}
+}
+
+/**
+ * Turn a flow workspace item into the compact response we send to the model:
+ * rawscript content is replaced with `inline_script.<moduleId>` placeholders.
+ * The model retrieves real content via `read_flow_module_code` and edits it via
+ * `set_flow_module_code`. `patch_flow_json` operates on this compact view too,
+ * so structural edits never have to traverse inline script bodies.
+ */
+function serializeWorkspaceItemForRead(item: WorkspaceItem): unknown {
+	if (item.type === 'variable') {
+		return {
+			type: 'variable',
+			path: item.path,
+			summary: item.summary,
+			isDraft: item.isDraft
+		}
+	}
+
+	if (item.type !== 'flow' || !item.value) return item
+	const flowDraft = item.value as FlowDraftValue
+	const session = createInlineScriptSession()
+	const editable = buildEditableFlowJson(flowDraft, session)
+	return {
+		type: 'flow',
+		path: item.path,
+		summary: item.summary,
+		value: editable,
+		isDraft: item.isDraft
+	}
+}
+
+function scheduleToItem(schedule: Schedule, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'schedule',
+		path: schedule.path,
+		summary: schedule.summary ?? undefined,
+		value: includeValue ? (schedule as unknown as WorkspaceItem['value']) : undefined,
+		isDraft: false
+	}
+}
+
+function resourceToItem(resource: ListableResource, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'resource',
+		path: resource.path,
+		summary: resource.description,
+		value: includeValue ? (resource as unknown as WorkspaceItem['value']) : undefined,
+		isDraft: false
+	}
+}
+
+function variableToItem(variable: ListableVariable): WorkspaceItem {
+	// Variables NEVER expose value (secret risk). Returns metadata only.
+	return {
+		type: 'variable',
+		path: variable.path,
+		summary: variable.description,
+		isDraft: false
+	}
+}
+
+// ============= App helpers =============
+
+type BackendRunnableInput = z.infer<typeof backendRunnableSchema>
+
+type PersistedRunnable = {
+	name: string
+	type: 'inline' | 'path' | 'runnableByName' | 'runnableByPath'
+	runType?: 'script' | 'flow' | 'hubscript'
+	path?: string
+	inlineScript?: { language: string; content: string }
+	fields?: Record<string, any>
+	schema?: any
+	[key: string]: any
+}
+
+function convertPersistedToBackendRunnable(
+	persisted: PersistedRunnable | undefined,
+	key: string
+): BackendRunnableInput | undefined {
+	if (!persisted) return undefined
+
+	const out: BackendRunnableInput = {
+		name: persisted.name ?? key,
+		type: 'inline'
+	}
+
+	if (persisted.type === 'inline' || persisted.type === 'runnableByName') {
+		out.type = 'inline'
+		if (persisted.inlineScript) {
+			let language = persisted.inlineScript.language
+			if (language === 'nativets' || language === 'deno') language = 'bun'
+			out.inlineScript = {
+				language: language as 'bun' | 'python3',
+				content: persisted.inlineScript.content ?? ''
+			}
+		}
+	} else if (persisted.type === 'path' || persisted.type === 'runnableByPath') {
+		if (persisted.runType === 'flow') out.type = 'flow'
+		else if (persisted.runType === 'hubscript') out.type = 'hubscript'
+		else out.type = 'script'
+		out.path = persisted.path
+	}
+
+	if (persisted.fields) {
+		const staticInputs: Record<string, any> = {}
+		for (const [k, v] of Object.entries(persisted.fields)) {
+			if (v && typeof v === 'object' && (v as any).type === 'static') {
+				staticInputs[k] = (v as any).value
+			}
+		}
+		if (Object.keys(staticInputs).length > 0) out.staticInputs = staticInputs
+	}
+
+	return out
+}
+
+function buildPersistedRunnable(
+	input: BackendRunnableInput,
+	existing: PersistedRunnable | undefined
+): PersistedRunnable {
+	const fields = input.staticInputs
+		? Object.fromEntries(
+				Object.entries(input.staticInputs).map(([k, v]) => [
+					k,
+					{ type: 'static', value: v, fieldType: 'object' }
+				])
+			)
+		: existing?.fields ?? {}
+
+	if (input.type === 'inline') {
+		if (!input.inlineScript) {
+			throw new Error('inlineScript is required when runnable type is "inline".')
+		}
+		return {
+			...(existing ?? {}),
+			name: input.name,
+			type: 'inline',
+			inlineScript: {
+				content: input.inlineScript.content,
+				language: input.inlineScript.language
+			},
+			fields
+		}
+	}
+
+	if (!input.path) {
+		throw new Error('path is required when runnable type is "script", "flow", or "hubscript".')
+	}
+	return {
+		...(existing ?? {}),
+		name: input.name,
+		type: 'path',
+		runType: input.type,
+		path: input.path,
+		fields,
+		schema: existing?.schema ?? {}
+	}
+}
+
+type AppFrontendFileMetadata = {
+	path: string
+	size: number
+}
+
+type AppBackendRunnableMetadata = {
+	key: string
+	name: string
+	type: BackendRunnableInput['type']
+	path?: string
+	language?: 'bun' | 'python3'
+	contentSize?: number
+	staticInputKeys?: string[]
+}
+
+type AppMetadata = {
+	frontend: AppFrontendFileMetadata[]
+	backend: AppBackendRunnableMetadata[]
+	data?: any
+}
+
+function summarizeAppValue(value: AppDraftValue): AppMetadata {
+	const frontend: AppFrontendFileMetadata[] = Object.entries(value.files).map(([path, content]) => ({
+		path,
+		size: typeof content === 'string' ? content.length : 0
+	}))
+	const backend: AppBackendRunnableMetadata[] = Object.entries(value.runnables).map(
+		([key, runnable]) => {
+			const converted = convertPersistedToBackendRunnable(runnable as PersistedRunnable, key)
+			const staticInputKeys = converted?.staticInputs
+				? Object.keys(converted.staticInputs)
+				: undefined
+			return {
+				key,
+				name: converted?.name ?? key,
+				type: converted?.type ?? 'inline',
+				...(converted?.path && { path: converted.path }),
+				...(converted?.inlineScript && {
+					language: converted.inlineScript.language,
+					contentSize: converted.inlineScript.content.length
+				}),
+				...(staticInputKeys && staticInputKeys.length > 0 && { staticInputKeys })
+			}
+		}
+	)
+	return {
+		frontend,
+		backend,
+		...(value.data && { data: value.data })
+	}
+}
+
+function appToItem(app: ListableApp | AppWithLastVersion, includeValue: boolean): WorkspaceItem {
+	return {
+		type: 'app',
+		path: app.path,
+		summary: app.summary,
+		value: includeValue ? ((app as AppWithLastVersion).value as AppDraftValue) : undefined,
+		isDraft: false
+	}
+}
+
+const GENERATED_APP_FILE_PATHS = new Set(['/wmill.d.ts'])
+
+function assertNotGeneratedAppFile(filePath: string): void {
+	if (GENERATED_APP_FILE_PATHS.has(filePath)) {
+		throw new Error(
+			`"${filePath}" is generated automatically from backend runnables and cannot be modified directly.`
+		)
+	}
+}
+
+type AppFileTarget =
+	| { kind: 'frontend'; filePath: string }
+	| { kind: 'backend'; filePath: string; key: string; extension: 'ts' | 'py' }
+
+function resolveAppFileTarget(rawPath: string): AppFileTarget {
+	const trimmed = rawPath.trim()
+	const backendMatch = trimmed.match(/^backend\/([^/]+)\/main\.(ts|py)$/)
+	if (backendMatch) {
+		return {
+			kind: 'backend',
+			filePath: trimmed,
+			key: backendMatch[1],
+			extension: backendMatch[2] as 'ts' | 'py'
+		}
+	}
+	return {
+		kind: 'frontend',
+		filePath: trimmed.startsWith('/') ? trimmed : `/${trimmed}`
+	}
+}
+
+function getInlineScriptExtension(runnable: PersistedRunnable | undefined): 'ts' | 'py' {
+	return runnable?.inlineScript?.language === 'python3' ? 'py' : 'ts'
+}
+
+/**
+ * Resolve a backend file target to its inline script body, validating that the
+ * runnable exists, is inline, and matches the requested file extension. Throws
+ * with a clear message otherwise.
+ */
+function getInlineRunnableContent(
+	value: AppDraftValue,
+	target: { kind: 'backend'; filePath: string; key: string; extension: 'ts' | 'py' },
+	appPath: string
+): { content: string; runnable: PersistedRunnable } {
+	const runnable = value.runnables[target.key] as PersistedRunnable | undefined
+	if (!runnable) {
+		throw new Error(`Backend runnable "${target.key}" not found in app "${appPath}".`)
+	}
+	if (runnable.type !== 'inline' && runnable.type !== 'runnableByName') {
+		throw new Error(
+			`Runnable "${target.key}" is not inline. Use read_workspace_item on the referenced ${runnable.runType ?? 'item'} instead.`
+		)
+	}
+	const expected = getInlineScriptExtension(runnable)
+	if (target.extension !== expected) {
+		throw new Error(
+			`Runnable "${target.key}" language is ${expected}. Use backend/${target.key}/main.${expected}.`
+		)
+	}
+	return { content: runnable.inlineScript?.content ?? '', runnable }
+}
+
+async function loadAppDraftValue(path: string, workspace: string): Promise<AppDraftValue> {
+	const draft = globalDraftStore.getDraft(workspace, 'app', path)
+	if (draft && draft.value && typeof draft.value === 'object' && 'files' in draft.value) {
+		return draft.value as AppDraftValue
+	}
+
+	const app = await AppService.getAppByPath({ workspace, path })
+	const value = (app.value ?? {}) as Partial<AppDraftValue>
+	return {
+		summary: app.summary,
+		files: { ...(value.files ?? {}) },
+		runnables: { ...(value.runnables ?? {}) },
+		data: value.data,
+		policy: app.policy as any,
+		custom_path: app.custom_path
+	}
+}
+
+function saveAppDraft(workspace: string, path: string, value: AppDraftValue): WorkspaceItem {
+	return globalDraftStore.setDraft(workspace, {
+		type: 'app',
+		path,
+		summary: value.summary,
+		value,
+		isDraft: true
+	})
+}
+
+type TriggerLike = { path: string; summary?: string | null }
+
+function triggerToItem(
+	kind: TriggerKind,
+	trigger: TriggerLike,
+	includeValue: boolean
+): WorkspaceItem {
+	return {
+		type: 'trigger',
+		triggerKind: kind,
+		path: trigger.path,
+		summary: trigger.summary ?? undefined,
+		value: includeValue ? (trigger as unknown as WorkspaceItem['value']) : undefined,
+		isDraft: false
+	}
+}
+
+type TriggerService = {
+	exists(args: { workspace: string; path: string }): Promise<boolean>
+	get(args: { workspace: string; path: string }): Promise<TriggerLike>
+	list(args: {
+		workspace: string
+		pathStart?: string
+		perPage?: number
+	}): Promise<TriggerLike[]>
+	create(args: { workspace: string; requestBody: any }): Promise<string>
+	update(args: { workspace: string; path: string; requestBody: any }): Promise<string>
+	delete(args: { workspace: string; path: string }): Promise<string>
+}
+
+const triggerServices: Record<TriggerKind, TriggerService> = {
+	http: {
+		exists: (a) => HttpTriggerService.existsHttpTrigger(a),
+		get: (a) => HttpTriggerService.getHttpTrigger(a),
+		list: (a) => HttpTriggerService.listHttpTriggers(a),
+		create: (a) => HttpTriggerService.createHttpTrigger(a),
+		update: (a) => HttpTriggerService.updateHttpTrigger(a),
+		delete: (a) => HttpTriggerService.deleteHttpTrigger(a)
+	},
+	websocket: {
+		exists: (a) => WebsocketTriggerService.existsWebsocketTrigger(a),
+		get: (a) => WebsocketTriggerService.getWebsocketTrigger(a),
+		list: (a) => WebsocketTriggerService.listWebsocketTriggers(a),
+		create: (a) => WebsocketTriggerService.createWebsocketTrigger(a),
+		update: (a) => WebsocketTriggerService.updateWebsocketTrigger(a),
+		delete: (a) => WebsocketTriggerService.deleteWebsocketTrigger(a)
+	},
+	kafka: {
+		exists: (a) => KafkaTriggerService.existsKafkaTrigger(a),
+		get: (a) => KafkaTriggerService.getKafkaTrigger(a),
+		list: (a) => KafkaTriggerService.listKafkaTriggers(a),
+		create: (a) => KafkaTriggerService.createKafkaTrigger(a),
+		update: (a) => KafkaTriggerService.updateKafkaTrigger(a),
+		delete: (a) => KafkaTriggerService.deleteKafkaTrigger(a)
+	},
+	nats: {
+		exists: (a) => NatsTriggerService.existsNatsTrigger(a),
+		get: (a) => NatsTriggerService.getNatsTrigger(a),
+		list: (a) => NatsTriggerService.listNatsTriggers(a),
+		create: (a) => NatsTriggerService.createNatsTrigger(a),
+		update: (a) => NatsTriggerService.updateNatsTrigger(a),
+		delete: (a) => NatsTriggerService.deleteNatsTrigger(a)
+	},
+	postgres: {
+		exists: (a) => PostgresTriggerService.existsPostgresTrigger(a),
+		get: (a) => PostgresTriggerService.getPostgresTrigger(a),
+		list: (a) => PostgresTriggerService.listPostgresTriggers(a),
+		create: (a) => PostgresTriggerService.createPostgresTrigger(a),
+		update: (a) => PostgresTriggerService.updatePostgresTrigger(a),
+		delete: (a) => PostgresTriggerService.deletePostgresTrigger(a)
+	},
+	mqtt: {
+		exists: (a) => MqttTriggerService.existsMqttTrigger(a),
+		get: (a) => MqttTriggerService.getMqttTrigger(a),
+		list: (a) => MqttTriggerService.listMqttTriggers(a),
+		create: (a) => MqttTriggerService.createMqttTrigger(a),
+		update: (a) => MqttTriggerService.updateMqttTrigger(a),
+		delete: (a) => MqttTriggerService.deleteMqttTrigger(a)
+	},
+	sqs: {
+		exists: (a) => SqsTriggerService.existsSqsTrigger(a),
+		get: (a) => SqsTriggerService.getSqsTrigger(a),
+		list: (a) => SqsTriggerService.listSqsTriggers(a),
+		create: (a) => SqsTriggerService.createSqsTrigger(a),
+		update: (a) => SqsTriggerService.updateSqsTrigger(a),
+		delete: (a) => SqsTriggerService.deleteSqsTrigger(a)
+	},
+	gcp: {
+		exists: (a) => GcpTriggerService.existsGcpTrigger(a),
+		get: (a) => GcpTriggerService.getGcpTrigger(a),
+		list: (a) => GcpTriggerService.listGcpTriggers(a),
+		create: (a) => GcpTriggerService.createGcpTrigger(a),
+		update: (a) => GcpTriggerService.updateGcpTrigger(a),
+		delete: (a) => GcpTriggerService.deleteGcpTrigger(a)
+	},
+	azure: {
+		exists: (a) => AzureTriggerService.existsAzureTrigger(a),
+		get: (a) => AzureTriggerService.getAzureTrigger(a),
+		list: (a) => AzureTriggerService.listAzureTriggers(a),
+		create: (a) => AzureTriggerService.createAzureTrigger(a),
+		update: (a) => AzureTriggerService.updateAzureTrigger(a),
+		delete: (a) => AzureTriggerService.deleteAzureTrigger(a)
+	}
+}
+
+async function workspaceItemExists(
+	type: WorkspaceItemType,
+	path: string,
+	workspace: string,
+	triggerKind?: TriggerKind
+): Promise<boolean> {
+	switch (type) {
+		case 'script':
+			return ScriptService.existsScriptByPath({ workspace, path })
+		case 'flow':
+			return FlowService.existsFlowByPath({ workspace, path })
+		case 'schedule':
+			return ScheduleService.existsSchedule({ workspace, path })
+		case 'trigger':
+			if (!triggerKind) return false
+			return triggerServices[triggerKind].exists({ workspace, path })
+		case 'resource':
+			return ResourceService.existsResource({ workspace, path })
+		case 'variable':
+			return VariableService.existsVariable({ workspace, path })
+		case 'app':
+			return AppService.existsApp({ workspace, path })
+	}
+}
+
+async function readWorkspaceItem(
+	type: WorkspaceItemType,
+	path: string,
+	workspace: string,
+	triggerKind?: TriggerKind
+): Promise<WorkspaceItem> {
+	switch (type) {
+		case 'script':
+			return scriptToItem(await ScriptService.getScriptByPath({ workspace, path }), true)
+		case 'flow':
+			return flowToItem(await FlowService.getFlowByPath({ workspace, path }), true)
+		case 'schedule':
+			return scheduleToItem(await ScheduleService.getSchedule({ workspace, path }), true)
+		case 'trigger':
+			if (!triggerKind) {
+				throw new Error('trigger_kind is required when type is trigger.')
+			}
+			return triggerToItem(
+				triggerKind,
+				await triggerServices[triggerKind].get({ workspace, path }),
+				true
+			)
+		case 'resource':
+			return resourceToItem(
+				await ResourceService.getResource({ workspace, path }) as ListableResource,
+				true
+			)
+		case 'variable':
+			// Never expose the value, even when read directly. Pass decryptSecret=false
+			// to avoid materializing secret values server-side.
+			return variableToItem(
+				await VariableService.getVariable({ workspace, path, decryptSecret: false })
+			)
+		case 'app': {
+			// Returns lightweight metadata only — file/runnable contents come via read_app_file.
+			const app = await AppService.getAppByPath({ workspace, path })
+			const value = (app.value ?? {}) as Partial<AppDraftValue>
+			const metadata = summarizeAppValue({
+				summary: app.summary,
+				files: value.files ?? {},
+				runnables: value.runnables ?? {},
+				data: value.data
+			})
+			return {
+				type: 'app',
+				path: app.path,
+				summary: app.summary,
+				value: metadata as unknown as AppDraftValue,
+				isDraft: false
+			}
+		}
+	}
+}
+
+async function listWorkspaceItems(
+	types: WorkspaceItemType[],
+	workspace: string,
+	pathPrefix: string | undefined,
+	perPage: number
+): Promise<WorkspaceItem[]> {
+	const items: WorkspaceItem[] = []
+
+	if (types.includes('script')) {
+		const scripts = await ScriptService.listScripts({
+			workspace,
+			pathStart: pathPrefix,
+			perPage,
+			includeDraftOnly: true,
+			withoutDescription: true
+		})
+		for (const script of scripts) items.push(scriptToItem(script, false))
+	}
+
+	if (types.includes('flow')) {
+		const flows = await FlowService.listFlows({
+			workspace,
+			pathStart: pathPrefix,
+			perPage,
+			includeDraftOnly: true,
+			withoutDescription: true
+		})
+		for (const flow of flows) items.push(flowToItem(flow, false))
+	}
+
+	if (types.includes('schedule')) {
+		const schedules = await ScheduleService.listSchedules({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const schedule of schedules) items.push(scheduleToItem(schedule, false))
+	}
+
+	if (types.includes('trigger')) {
+		for (const kind of TRIGGER_KINDS) {
+			const triggers = await triggerServices[kind].list({
+				workspace,
+				pathStart: pathPrefix,
+				perPage
+			})
+			for (const trigger of triggers) items.push(triggerToItem(kind, trigger, false))
+		}
+	}
+
+	if (types.includes('resource')) {
+		const resources = await ResourceService.listResource({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const resource of resources) items.push(resourceToItem(resource, false))
+	}
+
+	if (types.includes('variable')) {
+		const variables = await VariableService.listVariable({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const variable of variables) items.push(variableToItem(variable))
+	}
+
+	if (types.includes('app')) {
+		const apps = await AppService.listApps({
+			workspace,
+			pathStart: pathPrefix,
+			perPage
+		})
+		for (const app of apps) items.push(appToItem(app, false))
+	}
+
+	return items
+}
+
+function getScriptInstructions(language: ScriptLang | undefined): string {
+	const selected = language ?? 'bun'
+	const note = language
+		? ''
+		: `\n- No script language was provided. Default to \`bun\` only for new TypeScript scripts; if the user requested another language or you read an existing script, call get_instructions again with that language.`
+
+	return `# Global draft script instructions
+
+- Global mode writes complete draft payloads only; it does not save, deploy, run, or generate metadata.
+- A script draft is a workspace item: \`{ type: 'script', path, summary?, language, value, isDraft }\` where \`value\` is the source code string.
+- Use workspace paths such as \`f/folder/name\` or \`u/username/name\`. Preserve the current path/language when modifying unless the user asked to change them.
+- Use \`edit_script\` for small localized changes (provide \`old_string\`/\`new_string\`); use \`write_script\` for full rewrites.${note}
+
+# Windmill script authoring reference (${selected})
+
+${getScriptPrompt(selected)}`
+}
+
+function getFlowInstructions(): string {
+	return `# Global draft flow instructions
+
+- Global mode writes complete draft payloads only; it does not save, deploy, run, scaffold local files, or generate metadata.
+- A flow draft is a workspace item: \`{ type: 'flow', path, summary?, value, isDraft }\` where \`value\` is \`{ value: <OpenFlow value object>, schema, groups }\`. The inputs schema and groups are kept alongside the OpenFlow value so deploy round-trips them.
+- \`value.modules\` contains normal sequential modules. Use top-level \`value.preprocessor_module\` and \`value.failure_module\` for special modules; do not put \`preprocessor\` or \`failure\` in \`value.modules\`.
+- Every module needs a stable unique \`id\` and a useful \`summary\` when the schema supports it.
+- Prefer path/script/flow modules when composing existing workspace logic. Use rawscript modules only when new inline code is needed.
+- When writing rawscript module code, call \`get_instructions\` with \`subject: "script"\` and the rawscript language first.
+
+## Compact view: how rawscript bodies surface in tool I/O
+
+- \`read_workspace_item\` and \`patch_flow_json\` operate on a **compact view** of the flow: every rawscript module's \`value.content\` is replaced with the placeholder \`"inline_script.<moduleId>"\` so inline script bodies don't bloat tool I/O. Schema, groups, preprocessor_module and failure_module are all shown in this view.
+- Inline rawscript content is **not** part of the JSON \`patch_flow_json\` sees. Edits to inline bodies happen via dedicated tools:
+  - \`read_flow_module_code(path, module_id)\` — returns the raw inline script content for one module.
+  - \`set_flow_module_code(path, module_id, code)\` — overwrites that module's inline script content; saves to the AI draft.
+- Use \`patch_flow_json\` for *structural* edits: module ids, paths, input_transforms, branch arrangement, summaries, preprocessor/failure swaps, schema/groups. Use \`set_flow_module_code\` for changes inside a specific rawscript body.
+- \`write_flow\` is for full overwrites / create-from-scratch. Its \`value\` argument is the **non-compact** OpenFlow value (rawscript content is the actual code, not a placeholder).
+
+# Windmill flow authoring reference
+
+${getFlowPrompt()}`
+}
+
+type InstructionSubject = (typeof INSTRUCTION_SUBJECTS)[number]
+
+function getAppInstructions(): string {
+	return `# Global draft app instructions
+
+- Global mode edits raw app drafts only; it does not save, deploy, or bundle.
+- App drafts are addressed by workspace path (e.g. \`f/folder/my_app\`). The first write tool snapshots the workspace app onto the draft, and subsequent writes accumulate.
+- To create a new app, use \`init_app\` with a path, optional summary, and a framework (\`react19\` / \`react18\` / \`svelte5\` / \`vue\`). Confirm framework + path + summary with the user before calling — do not silently default to \`react19\` even though it is the recommended choice. \`init_app\` errors if an app already exists at the path or a draft is already in flight; in that case, edit the existing one rather than re-initializing.
+- \`init_app\` seeds a starter inline runnable named \`a\` (bun, \`main(x: string) => string\`) so the React/Svelte demo button works on first render. Replace or remove it once you start building real backend runnables.
+- Frontend file paths start with \`/\` (e.g. \`/index.tsx\`, \`/App.tsx\`, \`/styles.css\`). Use \`write_app_file\` / \`patch_app_file\` / \`delete_app_file\`.
+- Backend inline runnables are addressed as \`backend/<key>/main.{ts|py}\` from the file tools, but you create or update them via \`write_app_runnable\` / \`delete_app_runnable\` (which take the runnable shape directly: \`{ name, type, inlineScript?, path?, staticInputs? }\`).
+- \`/wmill.d.ts\` (or \`wmill.ts\`) is generated automatically from the backend runnables — never write it directly.
+- Inline runnables only support \`bun\` or \`python3\` in chat. Path runnables (\`script\`/\`flow\`/\`hubscript\`) reference an existing item.
+- Apps cannot be deployed from chat. The app editor bundles JS/CSS before save; tell the user to open the app editor to deploy app drafts.
+- Use \`read_workspace_item\` with \`type: 'app'\` for a metadata summary (file paths and runnable list, no contents). Use \`read_app_file\` to read an individual file.
+- Note: the authoring reference below mentions the CLI on-disk layout (\`backend/<id>.<ext>\`, \`raw_app.yaml\`, \`sql_to_apply/\`). That layout is only relevant for the terminal workflow — in chat, apps are addressed via the tool surface above.
+
+# Windmill raw app authoring reference
+
+${getRawAppPrompt()}`
+}
+
+function getResourceInstructions(): string {
+	return `# Global draft resource & variable instructions
+
+- Global mode writes complete draft payloads only; it does not save, deploy, run, scaffold local files, or generate metadata.
+- A resource draft is a workspace item: \`{ type: 'resource', path, summary?, value, isDraft }\`. \`value\` is a CreateResource body: \`{ path, value, description?, resource_type, labels? }\` where the inner \`value\` is the resource type's data shape.
+- A variable draft is a workspace item: \`{ type: 'variable', path, summary?, value, isDraft }\`. \`value\` is a CreateVariable body: \`{ path, value, is_secret, description, account?, is_oauth?, expires_at?, labels? }\`.
+- For secret fields in a resource value, do NOT inline the raw secret. Create a Variable first with \`is_secret: true\`, then in the resource value reference it as \`"$var:path/to/variable"\`.
+- Reference formats inside resource values: \`$var:g/all/name\` (global), \`$var:u/user/name\` (user), \`$var:f/folder/name\` (folder). Reference another resource with \`$res:path/to/resource\`.
+- When deploying drafts that depend on each other (e.g., a resource and the variables it references), deploy the variables first.
+- Use \`search_resource_types\` to discover valid \`resource_type\` names and their JSON Schemas. Match the resource value to that schema.
+- For OAuth resources, the \`is_oauth: true\` flag is managed by Windmill's OAuth flow; global mode generally creates manual resources, not OAuth ones.
+
+# Windmill resource & variable reference
+
+${getResourcePrompt()}`
+}
+
+function getInstructions(subject: InstructionSubject, language?: ScriptLang): string {
+	switch (subject) {
+		case 'script':
+			return getScriptInstructions(language)
+		case 'flow':
+			return getFlowInstructions()
+		case 'resource':
+			return getResourceInstructions()
+		case 'app':
+			return getAppInstructions()
+	}
+}
+
+export const globalTools: Tool<{}>[] = [
+	{
+		def: createToolDef(
+			getInstructionsSchema,
+			'get_instructions',
+			'Get Windmill authoring instructions for scripts, flows, resources, or apps. For scripts, pass the target language.'
+		),
+		fn: async ({ args, toolId, toolCallbacks }) => {
+			const parsed = getInstructionsSchema.parse(args)
+			const label =
+				parsed.subject === 'script' && parsed.language
+					? `${parsed.subject} (${parsed.language})`
+					: parsed.subject
+			toolCallbacks.setToolStatus(toolId, { content: `Loaded ${label} instructions` })
+			return getInstructions(parsed.subject, parsed.language)
+		}
+	},
+	{
+		def: createToolDef(
+			listWorkspaceItemsSchema,
+			'list_workspace_items',
+			'List workspace items (scripts, flows, schedules, triggers, resources, variables, apps) and AI drafts. Returns metadata only (no value). Defaults to scripts and flows.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = listWorkspaceItemsSchema.parse(args)
+			const types = getRequestedTypes(parsed.types)
+			const limit = parsed.limit ?? 50
+			toolCallbacks.setToolStatus(toolId, { content: 'Listing workspace items...' })
+
+			const byKey = new Map<string, WorkspaceItem>()
+			const workspaceItems = await listWorkspaceItems(
+				types,
+				workspace,
+				parsed.path_prefix,
+				Math.min(limit, MAX_LIST_LIMIT)
+			)
+			for (const item of workspaceItems) {
+				byKey.set(getWorkspaceItemKey(item.type, item.path, item.triggerKind), item)
+			}
+
+			for (const draft of globalDraftStore.listDrafts(workspace)) {
+				if (!types.includes(draft.type)) continue
+				byKey.set(getWorkspaceItemKey(draft.type, draft.path, draft.triggerKind), {
+					...draft,
+					value: undefined
+				})
+			}
+
+			const results = Array.from(byKey.values())
+				.filter((item) => itemMatches(item, parsed.query))
+				.slice(0, limit)
+
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Listed ${results.length} workspace item(s)`
+			})
+			return JSON.stringify(results, null, 2)
+		}
+	},
+	{
+		def: createToolDef(
+			readWorkspaceItemSchema,
+			'read_workspace_item',
+			'Read one workspace item or AI draft by type and path. Returns the full workspace item including value.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = readWorkspaceItemSchema.parse(args)
+			if (parsed.type === 'trigger' && !parsed.trigger_kind) {
+				const message = 'trigger_kind is required when type is trigger.'
+				toolCallbacks.setToolStatus(toolId, { content: message, error: message })
+				return JSON.stringify({ success: false, error: message })
+			}
+			const draft = globalDraftStore.getDraft(
+				workspace,
+				parsed.type,
+				parsed.path,
+				parsed.trigger_kind
+			)
+			if (draft) {
+				toolCallbacks.setToolStatus(toolId, {
+					content: `Read AI draft ${parsed.type} "${parsed.path}"`
+				})
+				return JSON.stringify(serializeWorkspaceItemForRead(draft), null, 2)
+			}
+
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Reading ${parsed.type} "${parsed.path}"...`
+			})
+			const item = await readWorkspaceItem(
+				parsed.type,
+				parsed.path,
+				workspace,
+				parsed.trigger_kind
+			)
+			toolCallbacks.setToolStatus(toolId, { content: `Read ${parsed.type} "${parsed.path}"` })
+			return JSON.stringify(serializeWorkspaceItemForRead(item), null, 2)
+		}
+	},
+	{
+		def: createToolDef(
+			writeScriptSchema,
+			'write_script',
+			'Create or overwrite an AI draft script. Does not save or deploy. Read the existing script first when overwriting.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeScriptSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'script',
+					path: parsed.path,
+					summary: parsed.summary,
+					language: parsed.language,
+					value: parsed.content,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeFlowSchema,
+			'write_flow',
+			'Create or overwrite an AI draft flow. Does not save or deploy. Read the existing flow first when overwriting. value must be a JSON-encoded string of the OpenFlow value object.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeFlowSchema.parse(ctx.args)
+			let value: unknown
+			try {
+				value = JSON.parse(parsed.value)
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error)
+				throw new Error(`Invalid JSON for value: ${message}`)
+			}
+			const validated = flowValueSchema.safeParse(value)
+			if (!validated.success) {
+				throw new Error(
+					`Invalid flow value: ${validated.error.issues
+						.slice(0, 5)
+						.map((i) => `${i.path.join('.')}: ${i.message}`)
+						.join('; ')}`
+				)
+			}
+			return writeDraft(
+				{
+					type: 'flow',
+					path: parsed.path,
+					summary: parsed.summary,
+					value: { value: validated.data as FlowValue, schema: null, groups: null },
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeScheduleSchema,
+			'write_schedule',
+			'Create or overwrite an AI draft schedule. Does not save or deploy. Provide script_path and is_flow to point to the runnable.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeScheduleSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'schedule',
+					path: parsed.path,
+					summary: parsed.summary ?? undefined,
+					value: parsed,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeTriggerSchema,
+			'write_trigger',
+			'Create or overwrite an AI draft trigger. Does not save or deploy. Provide kind plus the kind-specific config (including path, script_path, is_flow).',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeTriggerSchema.parse(ctx.args)
+			const config = parsed.config as { path: string; summary?: string | null }
+			return writeDraft(
+				{
+					type: 'trigger',
+					triggerKind: parsed.kind,
+					path: config.path,
+					summary: config.summary ?? undefined,
+					value: parsed.config,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			editScriptSchema,
+			'edit_script',
+			'Find/replace exact text in a script. Edits the existing draft if one exists, otherwise reads the workspace script and saves the result as a new draft.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = editScriptSchema.parse(ctx.args)
+			return editScript(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			patchFlowJsonSchema,
+			'patch_flow_json',
+			'Find/replace exact text in a flow value (compact JSON). Edits the existing draft if one exists, otherwise reads the workspace flow and saves the result as a new draft. Use write_flow for larger structural rewrites.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = patchFlowJsonSchema.parse(ctx.args)
+			return patchFlowJson(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deployWorkspaceItemSchema,
+			'deploy_workspace_item',
+			'Persist an AI draft to the workspace by calling the real backend create/update API. This MUTATES the workspace. Requires user confirmation.',
+			{ strict: false }
+		),
+		showDetails: true,
+		showFade: true,
+		requiresConfirmation: true,
+		confirmationMessage: 'Deploy AI draft to workspace',
+		fn: async (ctx) => {
+			const parsed = deployWorkspaceItemSchema.parse(ctx.args)
+			return deployDraft(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deleteWorkspaceItemSchema,
+			'delete_workspace_item',
+			'Permanently delete a workspace item by path. This MUTATES the workspace and is irreversible. Also clears any matching AI draft. Requires user confirmation.'
+		),
+		showDetails: true,
+		showFade: true,
+		requiresConfirmation: true,
+		confirmationMessage: 'Delete workspace item',
+		fn: async (ctx) => {
+			const parsed = deleteWorkspaceItemSchema.parse(ctx.args)
+			return deleteWorkspaceItem(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			writeResourceSchema,
+			'write_resource',
+			'Create or overwrite an AI draft resource. Does not save or deploy. Reference secret values via $var:path/to/variable; create the variable separately with write_variable.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeResourceSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'resource',
+					path: parsed.path,
+					summary: parsed.description,
+					value: parsed,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			writeVariableSchema,
+			'write_variable',
+			'Create or overwrite an AI draft variable. Does not save or deploy. Use is_secret: true for secret values. After deploy, reference from a resource as $var:path/to/variable.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeVariableSchema.parse(ctx.args)
+			return writeDraft(
+				{
+					type: 'variable',
+					path: parsed.path,
+					summary: parsed.description,
+					value: parsed,
+					isDraft: true
+				},
+				ctx
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			searchResourceTypesSchema,
+			'search_resource_types',
+			'Search for resource types in the workspace by substring. Returns names, descriptions, and JSON Schemas — use this before write_resource to know what shape value should have.'
+		),
+		fn: async ({ args, workspace, toolId, toolCallbacks }) => {
+			const parsed = searchResourceTypesSchema.parse(args)
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Searching resource types for "${parsed.query}"...`
+			})
+			const results = await ResourceService.queryResourceTypes({
+				workspace,
+				text: parsed.query,
+				limit: parsed.limit ?? 5
+			})
+			toolCallbacks.setToolStatus(toolId, {
+				content: `Found ${results.length} resource type(s) for "${parsed.query}"`
+			})
+			return JSON.stringify(
+				results.map((rt) => ({
+					name: rt.name,
+					schema: rt.schema
+				})),
+				null,
+				2
+			)
+		}
+	},
+	{
+		def: createToolDef(
+			readFlowModuleCodeSchema,
+			'read_flow_module_code',
+			'Read the inline rawscript content of one flow module by id. Reads from the AI draft when one exists, otherwise from the workspace flow. Use this instead of patch_flow_json when you only need to inspect an inline script body.'
+		),
+		fn: async (ctx) => {
+			const parsed = readFlowModuleCodeSchema.parse(ctx.args)
+			return readFlowModuleCode(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			setFlowModuleCodeSchema,
+			'set_flow_module_code',
+			'Overwrite the inline rawscript content of one flow module by id. Saves to the AI draft only — does not deploy. Use this for inline script body changes; structural changes (module ids, paths, input_transforms, branches) go through patch_flow_json.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = setFlowModuleCodeSchema.parse(ctx.args)
+			return setFlowModuleCode(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			initAppSchema,
+			'init_app',
+			'Initialize a new raw app draft from a framework template. Errors if an app already exists at the path or a draft is already in flight. Confirm framework, path, and summary with the user before calling — do not silently default to react19.',
+			{ strict: false }
+		),
+		showDetails: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = initAppSchema.parse(ctx.args)
+			return initApp(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			readAppFileSchema,
+			'read_app_file',
+			'Read one frontend file or inline backend runnable script from a raw app. Use file_path "/foo.tsx" for frontend files and "backend/<key>/main.{ts|py}" for inline runnables. Prefers the AI draft when one exists.'
+		),
+		fn: async (ctx) => {
+			const parsed = readAppFileSchema.parse(ctx.args)
+			return readAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			writeAppFileSchema,
+			'write_app_file',
+			'Create or overwrite a frontend file in an app draft. Saves to the AI draft only — does not deploy. First write snapshots the workspace app onto the draft.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeAppFileSchema.parse(ctx.args)
+			return writeAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deleteAppFileSchema,
+			'delete_app_file',
+			'Remove a frontend file from an app draft. Saves to the AI draft only — does not deploy.'
+		),
+		fn: async (ctx) => {
+			const parsed = deleteAppFileSchema.parse(ctx.args)
+			return deleteAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			patchAppFileSchema,
+			'patch_app_file',
+			'Find/replace exact text in a frontend file or inline backend runnable script. Saves the result to the AI draft.'
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = patchAppFileSchema.parse(ctx.args)
+			return patchAppFile(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			writeAppRunnableSchema,
+			'write_app_runnable',
+			'Create or overwrite a backend runnable in an app draft. Saves to the AI draft only — does not deploy. Re-derives the app policy after the change.',
+			{ strict: false }
+		),
+		showDetails: true,
+		streamArguments: true,
+		showFade: true,
+		fn: async (ctx) => {
+			const parsed = writeAppRunnableSchema.parse(ctx.args)
+			return writeAppRunnable(parsed, ctx)
+		}
+	},
+	{
+		def: createToolDef(
+			deleteAppRunnableSchema,
+			'delete_app_runnable',
+			'Remove a backend runnable from an app draft. Saves to the AI draft only — does not deploy. Re-derives the app policy after the change.'
+		),
+		fn: async (ctx) => {
+			const parsed = deleteAppRunnableSchema.parse(ctx.args)
+			return deleteAppRunnable(parsed, ctx)
+		}
+	}
+]
+
+type WriteDraftCtx = {
+	workspace: string
+	toolId: string
+	toolCallbacks: ToolCallbacks
+}
+
+async function loadScriptForEdit(
+	path: string,
+	workspace: string
+): Promise<{ content: string; language: ScriptLang; summary?: string }> {
+	const draft = globalDraftStore.getDraft(workspace, 'script', path)
+	if (draft) {
+		if (typeof draft.value !== 'string' || !draft.language) {
+			throw new Error(`Draft script "${path}" is missing content or language.`)
+		}
+		return { content: draft.value, language: draft.language, summary: draft.summary }
+	}
+	const script = await ScriptService.getScriptByPath({ workspace, path })
+	return { content: script.content, language: script.language, summary: script.summary }
+}
+
+async function editScript(
+	args: { path: string; old_string: string; new_string: string; replace_all: boolean },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { path, old_string: oldString, new_string: newString, replace_all: replaceAll } = args
+	ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: `Editing script "${path}"...` })
+
+	const base = await loadScriptForEdit(path, ctx.workspace)
+	const updated = findAndReplace(base.content, oldString, newString, replaceAll, 'script source')
+	return writeDraft(
+		{
+			type: 'script',
+			path,
+			summary: base.summary,
+			language: base.language,
+			value: updated,
+			isDraft: true
+		},
+		ctx
+	)
+}
+
+async function loadFlowDraftValue(
+	path: string,
+	workspace: string
+): Promise<{ flow: FlowDraftValue; summary?: string }> {
+	const draft = globalDraftStore.getDraft(workspace, 'flow', path)
+	if (draft) {
+		if (draft.value === undefined || typeof draft.value === 'string') {
+			throw new Error(`Draft flow "${path}" has no value.`)
+		}
+		return { flow: draft.value as FlowDraftValue, summary: draft.summary }
+	}
+	const flow = await FlowService.getFlowByPath({ workspace, path })
+	return {
+		flow: { value: flow.value, schema: flow.schema, groups: flow.value.groups ?? null },
+		summary: flow.summary
+	}
+}
+
+async function patchFlowJson(
+	args: { path: string; old_string: string; new_string: string; replace_all: boolean },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { path, old_string: oldString, new_string: newString, replace_all: replaceAll } = args
+	ctx.toolCallbacks.setToolStatus(ctx.toolId, { content: `Patching flow "${path}"...` })
+
+	// Operate on the compact (placeholders-for-rawscript) view so inline script
+	// bodies don't appear in the JSON the model sees or patches. Real script
+	// content is preserved through the patch via the InlineScriptSession; the
+	// model uses set_flow_module_code to change inline script bodies.
+	const base = await loadFlowDraftValue(path, ctx.workspace)
+	const session = createInlineScriptSession()
+	const editable = buildEditableFlowJson(base.flow, session)
+	const currentJson = JSON.stringify(editable)
+	const updatedJson = findAndReplace(
+		currentJson,
+		oldString,
+		newString,
+		replaceAll,
+		'compact flow JSON'
+	)
+	let parsedValue: unknown
+	try {
+		parsedValue = JSON.parse(updatedJson)
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error)
+		throw new Error(`Invalid JSON after replacement: ${message}`)
+	}
+
+	const patchedEditable = validateEditableFlowJson(parsedValue)
+	const newFlowValue = applyEditableFlowJsonToFlow(base.flow.value, patchedEditable, session)
+
+	return writeDraft(
+		{
+			type: 'flow',
+			path,
+			summary: base.summary,
+			value: {
+				...base.flow,
+				value: newFlowValue,
+				schema: patchedEditable.schema,
+				groups: patchedEditable.groups
+			},
+			isDraft: true
+		},
+		ctx
+	)
+}
+
+async function readFlowModuleCode(
+	args: { path: string; module_id: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Reading inline script for module "${args.module_id}" from flow "${args.path}"...`
+	})
+	const base = await loadFlowDraftValue(args.path, workspace)
+	const session = createInlineScriptSession()
+	buildEditableFlowJson(base.flow, session)
+	const content = session.get(args.module_id)
+	if (content === undefined) {
+		throw new Error(
+			`Module "${args.module_id}" is not an inline rawscript in flow "${args.path}". (Path runnables, branches, and loops have no inline script content; use patch_flow_json to inspect them.)`
+		)
+	}
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Read inline script for "${args.module_id}"`
+	})
+	return content
+}
+
+async function setFlowModuleCode(
+	args: { path: string; module_id: string; code: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Updating inline script for module "${args.module_id}" in flow "${args.path}"...`
+	})
+	const base = await loadFlowDraftValue(args.path, workspace)
+	const session = createInlineScriptSession()
+	const editable = buildEditableFlowJson(base.flow, session)
+	if (!session.has(args.module_id)) {
+		throw new Error(
+			`Module "${args.module_id}" is not an inline rawscript in flow "${args.path}". Use patch_flow_json or write_flow for structural changes.`
+		)
+	}
+	session.set(args.module_id, args.code)
+	const newFlowValue = applyEditableFlowJsonToFlow(base.flow.value, editable, session)
+	return writeDraft(
+		{
+			type: 'flow',
+			path: args.path,
+			summary: base.summary,
+			value: { ...base.flow, value: newFlowValue },
+			isDraft: true
+		},
+		ctx
+	)
+}
+
+async function initApp(
+	args: {
+		path: string
+		summary?: string
+		framework: FrameworkKey
+		data?: { datatable?: string; schema?: string; tables?: string[] }
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, summary, framework, data } = args
+
+	if (globalDraftStore.getDraft(workspace, 'app', path)) {
+		throw new Error(
+			`An AI draft for app "${path}" already exists. Use write_app_file / write_app_runnable to modify it, or delete the existing draft first.`
+		)
+	}
+	if (await AppService.existsApp({ workspace, path })) {
+		throw new Error(
+			`An app already exists at "${path}". Use read_workspace_item + write_app_file / write_app_runnable to modify it.`
+		)
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Initializing app draft "${path}" with ${framework} template...`
+	})
+
+	const template = FRAMEWORK_TEMPLATES[framework]
+	const value: AppDraftValue = {
+		summary,
+		files: { ...template },
+		runnables: { [STARTER_RUNNABLE_KEY]: { ...STARTER_RUNNABLE } },
+		...(data && {
+			data: {
+				tables: data.tables ?? [],
+				datatable: data.datatable,
+				schema: data.schema
+			}
+		})
+	}
+	await recomputeAppPolicy(value)
+	const stored = saveAppDraft(workspace, path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Initialized app draft "${path}" (${framework})`,
+		result: 'Draft initialized'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Initialized AI draft app "${path}" from the ${framework} template with a starter runnable "${STARTER_RUNNABLE_KEY}". Use write_app_file / write_app_runnable to evolve the draft.`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function readAppFile(
+	args: { path: string; file_path: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const target = resolveAppFileTarget(args.file_path)
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Reading ${target.filePath} from app "${args.path}"...`
+	})
+
+	const value = await loadAppDraftValue(args.path, workspace)
+
+	if (target.kind === 'frontend') {
+		const content = value.files[target.filePath]
+		if (content === undefined) {
+			throw new Error(`Frontend file "${target.filePath}" not found in app "${args.path}".`)
+		}
+		toolCallbacks.setToolStatus(toolId, { content: `Read ${target.filePath}` })
+		return content
+	}
+
+	const { content } = getInlineRunnableContent(value, target, args.path)
+	toolCallbacks.setToolStatus(toolId, { content: `Read ${target.filePath}` })
+	return content
+}
+
+async function writeAppFile(
+	args: { path: string; file_path: string; content: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const target = resolveAppFileTarget(args.file_path)
+	if (target.kind !== 'frontend') {
+		throw new Error(
+			`write_app_file only writes frontend files. Use write_app_runnable to set inline backend script content.`
+		)
+	}
+	assertNotGeneratedAppFile(target.filePath)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Writing ${target.filePath} to app "${args.path}"...`
+	})
+
+	const value = await loadAppDraftValue(args.path, workspace)
+	value.files = { ...value.files, [target.filePath]: args.content }
+	const stored = saveAppDraft(workspace, args.path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Updated ${target.filePath} in app "${args.path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Updated AI draft app "${args.path}" with frontend file "${target.filePath}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function deleteAppFile(
+	args: { path: string; file_path: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const target = resolveAppFileTarget(args.file_path)
+	if (target.kind !== 'frontend') {
+		throw new Error(
+			`delete_app_file only deletes frontend files. Use delete_app_runnable for backend runnables.`
+		)
+	}
+	assertNotGeneratedAppFile(target.filePath)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deleting ${target.filePath} from app "${args.path}"...`
+	})
+
+	const value = await loadAppDraftValue(args.path, workspace)
+	if (!(target.filePath in value.files)) {
+		throw new Error(`Frontend file "${target.filePath}" not found in app "${args.path}".`)
+	}
+	const { [target.filePath]: _removed, ...remaining } = value.files
+	value.files = remaining
+	const stored = saveAppDraft(workspace, args.path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Removed ${target.filePath} from app "${args.path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Removed "${target.filePath}" from AI draft app "${args.path}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function patchAppFile(
+	args: {
+		path: string
+		file_path: string
+		old_string: string
+		new_string: string
+		replace_all: boolean
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, file_path: filePath, old_string: oldString, new_string: newString, replace_all: replaceAll } = args
+	const target = resolveAppFileTarget(filePath)
+	if (target.kind === 'frontend') {
+		assertNotGeneratedAppFile(target.filePath)
+	}
+
+	toolCallbacks.setToolStatus(toolId, { content: `Patching ${target.filePath} in app "${path}"...` })
+
+	const value = await loadAppDraftValue(path, workspace)
+	let currentContent: string
+	let runnable: PersistedRunnable | undefined
+
+	if (target.kind === 'frontend') {
+		const existing = value.files[target.filePath]
+		if (existing === undefined) {
+			throw new Error(`Frontend file "${target.filePath}" not found in app "${path}".`)
+		}
+		currentContent = existing
+	} else {
+		const resolved = getInlineRunnableContent(value, target, path)
+		currentContent = resolved.content
+		runnable = resolved.runnable
+	}
+
+	const updated = findAndReplace(
+		currentContent,
+		oldString,
+		newString,
+		replaceAll,
+		`${target.filePath} content`
+	)
+
+	if (target.kind === 'frontend') {
+		value.files = { ...value.files, [target.filePath]: updated }
+	} else {
+		value.runnables = {
+			...value.runnables,
+			[target.key]: {
+				...runnable!,
+				inlineScript: {
+					language: runnable!.inlineScript?.language ?? (target.extension === 'py' ? 'python3' : 'bun'),
+					content: updated
+				}
+			}
+		}
+	}
+
+	const stored = saveAppDraft(workspace, path, value)
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Patched ${target.filePath} in app "${path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Patched "${target.filePath}" in AI draft app "${path}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function recomputeAppPolicy(value: AppDraftValue): Promise<void> {
+	value.policy = (await updateRawAppPolicy(
+		value.runnables as any,
+		value.policy as any
+	)) as any
+}
+
+async function writeAppRunnable(
+	args: { path: string; key: string; runnable: BackendRunnableInput },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, key, runnable: input } = args
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Writing runnable "${key}" to app "${path}"...`
+	})
+
+	const value = await loadAppDraftValue(path, workspace)
+	const existing = value.runnables[key] as PersistedRunnable | undefined
+	const persisted = buildPersistedRunnable(input, existing)
+	value.runnables = { ...value.runnables, [key]: persisted }
+	await recomputeAppPolicy(value)
+	const stored = saveAppDraft(workspace, path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Updated runnable "${key}" in app "${path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Updated AI draft app "${path}" with runnable "${key}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+async function deleteAppRunnable(
+	args: { path: string; key: string },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { path, key } = args
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Removing runnable "${key}" from app "${path}"...`
+	})
+
+	const value = await loadAppDraftValue(path, workspace)
+	if (!(key in value.runnables)) {
+		throw new Error(`Backend runnable "${key}" not found in app "${path}".`)
+	}
+	const { [key]: _removed, ...remaining } = value.runnables
+	value.runnables = remaining
+	await recomputeAppPolicy(value)
+	const stored = saveAppDraft(workspace, path, value)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Removed runnable "${key}" from app "${path}"`,
+		result: 'Draft updated'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Removed runnable "${key}" from AI draft app "${path}".`,
+			item: stored
+		},
+		null,
+		2
+	)
+}
+
+const triggerLabels: Record<TriggerKind, string> = {
+	http: 'HTTP trigger',
+	websocket: 'WebSocket trigger',
+	kafka: 'Kafka trigger',
+	nats: 'NATS trigger',
+	postgres: 'Postgres trigger',
+	mqtt: 'MQTT trigger',
+	sqs: 'SQS trigger',
+	gcp: 'GCP Pub/Sub trigger',
+	azure: 'Azure Event Grid trigger'
+}
+
+function createOpenScheduleAction(
+	path: string,
+	targetKind: 'script' | 'flow'
+): ToolDisplayAction {
+	return {
+		id: `open-deployed-schedule:${path}`,
+		type: 'open_created_resource',
+		label: 'Open schedule',
+		resource: 'schedule',
+		path,
+		targetKind
+	}
+}
+
+function createOpenTriggerAction(
+	kind: TriggerKind,
+	path: string,
+	targetKind: 'script' | 'flow'
+): ToolDisplayAction {
+	return {
+		id: `open-deployed-trigger:${kind}:${path}`,
+		type: 'open_created_resource',
+		label: `Open ${triggerLabels[kind]}`,
+		resource: 'trigger',
+		triggerKind: kind as CreatedResourceTriggerKind,
+		path,
+		targetKind
+	}
+}
+
+function createOpenResourceAction(path: string): ToolDisplayAction {
+	return {
+		id: `open-deployed-resource:${path}`,
+		type: 'open_created_resource',
+		label: 'Open resource',
+		resource: 'resource',
+		path
+	}
+}
+
+function createOpenVariableAction(path: string): ToolDisplayAction {
+	return {
+		id: `open-deployed-variable:${path}`,
+		type: 'open_created_resource',
+		label: 'Open variable',
+		resource: 'variable',
+		path
+	}
+}
+
+async function deployDraft(
+	args: {
+		type: WorkspaceItemType
+		path: string
+		trigger_kind?: TriggerKind
+		deployment_message?: string
+	},
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { type, path, trigger_kind: triggerKind, deployment_message: deploymentMessage } = args
+
+	if (type === 'app') {
+		throw new Error(
+			'Apps cannot be deployed from chat. Open the app editor to deploy (the editor bundles JS/CSS before save).'
+		)
+	}
+
+	if (type === 'trigger' && !triggerKind) {
+		throw new Error('trigger_kind is required when deploying a trigger.')
+	}
+
+	const draft = globalDraftStore.getDraft(workspace, type, path, triggerKind)
+	if (!draft) {
+		throw new Error(`No AI draft found for ${type} "${path}".`)
+	}
+	if (draft.value === undefined) {
+		throw new Error(`Draft ${type} "${path}" has no value to deploy.`)
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deploying ${type} "${path}"...`
+	})
+
+	let actions: ToolDisplayAction[] | undefined
+
+	switch (type) {
+		case 'script': {
+			const existing = (await ScriptService.existsScriptByPath({ workspace, path }))
+				? await ScriptService.getScriptByPath({ workspace, path })
+				: undefined
+			await ScriptService.createScript({
+				workspace,
+				requestBody: buildScriptDeployRequestBody(path, draft, existing, deploymentMessage)
+			})
+			break
+		}
+		case 'flow': {
+			const flowDraft = draft.value as FlowDraftValue
+			const existing = (await FlowService.existsFlowByPath({ workspace, path }))
+				? await FlowService.getFlowByPath({ workspace, path })
+				: undefined
+			const requestBody = buildFlowDeployRequestBody(
+				path,
+				draft.summary,
+				flowDraft,
+				existing,
+				deploymentMessage
+			)
+			if (existing) {
+				await FlowService.updateFlow({ workspace, path, requestBody })
+			} else {
+				await FlowService.createFlow({ workspace, requestBody })
+			}
+			break
+		}
+		case 'schedule': {
+			const requestBody = draft.value as any
+			if (await ScheduleService.existsSchedule({ workspace, path })) {
+				await ScheduleService.updateSchedule({ workspace, path, requestBody })
+			} else {
+				await ScheduleService.createSchedule({ workspace, requestBody })
+			}
+			actions = [createOpenScheduleAction(path, requestBody.is_flow ? 'flow' : 'script')]
+			break
+		}
+		case 'trigger': {
+			const service = triggerServices[triggerKind!]
+			const requestBody = draft.value as { is_flow?: boolean }
+			if (await service.exists({ workspace, path })) {
+				await service.update({ workspace, path, requestBody })
+			} else {
+				await service.create({ workspace, requestBody })
+			}
+			actions = [
+				createOpenTriggerAction(triggerKind!, path, requestBody.is_flow ? 'flow' : 'script')
+			]
+			break
+		}
+		case 'resource': {
+			const requestBody = draft.value as any
+			if (await ResourceService.existsResource({ workspace, path })) {
+				await ResourceService.updateResource({ workspace, path, requestBody })
+			} else {
+				await ResourceService.createResource({ workspace, requestBody })
+			}
+			actions = [createOpenResourceAction(path)]
+			break
+		}
+		case 'variable': {
+			const requestBody = draft.value as any
+			if (await VariableService.existsVariable({ workspace, path })) {
+				await VariableService.updateVariable({ workspace, path, requestBody })
+			} else {
+				await VariableService.createVariable({ workspace, requestBody })
+			}
+			actions = [createOpenVariableAction(path)]
+			break
+		}
+	}
+
+	globalDraftStore.deleteDraft(workspace, type, path, triggerKind)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deployed ${type} "${path}"`,
+		result: 'Deployed',
+		actions
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Deployed AI draft ${type} "${path}" to the workspace. Draft removed from the AI draft store.`,
+			type,
+			path,
+			triggerKind
+		},
+		null,
+		2
+	)
+}
+
+async function deleteWorkspaceItem(
+	args: { type: WorkspaceItemType; path: string; trigger_kind?: TriggerKind },
+	ctx: WriteDraftCtx
+): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	const { type, path, trigger_kind: triggerKind } = args
+
+	if (type === 'trigger' && !triggerKind) {
+		throw new Error('trigger_kind is required when deleting a trigger.')
+	}
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deleting ${type} "${path}"...`
+	})
+
+	switch (type) {
+		case 'script':
+			await ScriptService.deleteScriptByPath({ workspace, path })
+			break
+		case 'flow':
+			await FlowService.deleteFlowByPath({ workspace, path })
+			break
+		case 'schedule':
+			await ScheduleService.deleteSchedule({ workspace, path })
+			break
+		case 'trigger':
+			await triggerServices[triggerKind!].delete({ workspace, path })
+			break
+		case 'resource':
+			await ResourceService.deleteResource({ workspace, path })
+			break
+		case 'variable':
+			await VariableService.deleteVariable({ workspace, path })
+			break
+		case 'app':
+			await AppService.deleteApp({ workspace, path })
+			break
+	}
+
+	globalDraftStore.deleteDraft(workspace, type, path, triggerKind)
+
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Deleted ${type} "${path}"`,
+		result: 'Deleted'
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `Deleted ${type} "${path}" from the workspace. Any matching AI draft was also cleared.`,
+			type,
+			path,
+			triggerKind
+		},
+		null,
+		2
+	)
+}
+
+async function writeDraft(item: WorkspaceItem, ctx: WriteDraftCtx): Promise<string> {
+	const { workspace, toolId, toolCallbacks } = ctx
+	toolCallbacks.setToolStatus(toolId, {
+		content: `Writing draft ${item.type} "${item.path}"...`
+	})
+
+	const exists =
+		globalDraftStore.getDraft(workspace, item.type, item.path, item.triggerKind) !== undefined ||
+		(await workspaceItemExists(item.type, item.path, workspace, item.triggerKind))
+
+	const stored = globalDraftStore.setDraft(workspace, item)
+
+	const verb = exists ? 'Updated' : 'Created'
+	toolCallbacks.setToolStatus(toolId, {
+		content: `${verb} AI draft ${item.type} "${item.path}"`,
+		result: `Draft ${verb.toLowerCase()}`
+	})
+	return JSON.stringify(
+		{
+			success: true,
+			message: `${verb} AI draft ${item.type} "${item.path}". The workspace was not saved or deployed.`,
+			item: stored.type === 'variable' ? serializeWorkspaceItemForRead(stored) : stored
+		},
+		null,
+		2
+	)
+}
+
+export function prepareGlobalSystemMessage(
+	customPrompt?: string
+): ChatCompletionSystemMessageParam {
+	let content = GLOBAL_SYSTEM_PROMPT
+	if (customPrompt?.trim()) {
+		content = `${content}\n\nUSER GIVEN INSTRUCTIONS:\n${customPrompt.trim()}`
+	}
+
+	return {
+		role: 'system',
+		content
+	}
+}
+
+export function prepareGlobalUserMessage(instructions: string): ChatCompletionUserMessageParam {
+	return {
+		role: 'user',
+		content: instructions
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts b/frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts
new file mode 100644
index 0000000000..f79bbd2a4e
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/deployRequests.test.ts
@@ -0,0 +1,165 @@
+import { describe, expect, it } from 'vitest'
+import type { Flow, NewScript, Script } from '$lib/gen/types.gen'
+import { buildFlowDeployRequestBody, buildScriptDeployRequestBody } from './deployRequests'
+import type { WorkspaceItem } from './draftStore.svelte'
+
+describe('global AI deploy request builders', () => {
+	it('preserves existing script metadata while replacing draft-controlled fields', () => {
+		const existing = {
+			hash: 'parent-hash',
+			path: 'f/demo/script',
+			summary: 'existing summary',
+			description: 'existing description',
+			content: 'old content',
+			schema: { properties: { name: { type: 'string' } } },
+			is_template: true,
+			language: 'bun',
+			kind: 'script',
+			tag: 'node',
+			envs: ['ENV_A'],
+			concurrent_limit: 3,
+			concurrency_time_window_s: 60,
+			concurrency_key: 'key',
+			debounce_key: 'debounce',
+			debounce_delay_s: 5,
+			debounce_args_to_accumulate: ['ids'],
+			max_total_debouncing_time: 120,
+			max_total_debounces_amount: 4,
+			cache_ttl: 30,
+			cache_ignore_s3_path: true,
+			dedicated_worker: true,
+			ws_error_handler_muted: true,
+			priority: 9,
+			restart_unless_cancelled: true,
+			timeout: 300,
+			delete_after_secs: 600,
+			visible_to_runner_only: true,
+			auto_kind: 'script',
+			codebase: 'repo',
+			has_preprocessor: true,
+			on_behalf_of_email: 'deployer@example.com',
+			assets: [{ path: 's3://bucket/key', kind: 's3object' }],
+			modules: { 'helper.ts': { content: 'export const helper = 1', language: 'bun' } },
+			labels: ['prod'],
+			lock: 'stale lock'
+		} as unknown as Script & Partial<NewScript>
+		const draft: WorkspaceItem = {
+			type: 'script',
+			path: 'f/demo/script',
+			summary: 'draft summary',
+			language: 'bun',
+			value: 'new content',
+			isDraft: true
+		}
+
+		const requestBody = buildScriptDeployRequestBody('f/demo/script', draft, existing, 'ai deploy')
+
+		expect(requestBody).toMatchObject({
+			path: 'f/demo/script',
+			parent_hash: 'parent-hash',
+			summary: 'draft summary',
+			description: 'existing description',
+			content: 'new content',
+			schema: existing.schema,
+			tag: 'node',
+			envs: ['ENV_A'],
+			concurrent_limit: 3,
+			concurrency_time_window_s: 60,
+			concurrency_key: 'key',
+			debounce_key: 'debounce',
+			debounce_delay_s: 5,
+			debounce_args_to_accumulate: ['ids'],
+			max_total_debouncing_time: 120,
+			max_total_debounces_amount: 4,
+			cache_ttl: 30,
+			cache_ignore_s3_path: true,
+			dedicated_worker: true,
+			ws_error_handler_muted: true,
+			priority: 9,
+			restart_unless_cancelled: true,
+			timeout: 300,
+			delete_after_secs: 600,
+			visible_to_runner_only: true,
+			auto_kind: 'script',
+			codebase: 'repo',
+			has_preprocessor: true,
+			on_behalf_of_email: 'deployer@example.com',
+			preserve_on_behalf_of: true,
+			assets: existing.assets,
+			modules: existing.modules,
+			labels: ['prod'],
+			deployment_message: 'ai deploy'
+		})
+		expect(requestBody.lock).toBeUndefined()
+	})
+
+	it('preserves existing flow metadata and uses draft value/schema overrides', () => {
+		const existing = {
+			path: 'f/demo/flow',
+			summary: 'existing summary',
+			description: 'existing description',
+			value: { modules: [] },
+			schema: { required: ['name'] },
+			tag: 'python',
+			ws_error_handler_muted: true,
+			priority: 7,
+			dedicated_worker: true,
+			timeout: 60,
+			visible_to_runner_only: true,
+			on_behalf_of_email: 'deployer@example.com',
+			labels: ['critical']
+		} as unknown as Flow
+		const draftValue = {
+			value: { modules: [{ id: 'step', value: { type: 'identity' } }] },
+			schema: { properties: { name: { type: 'string' } } },
+			groups: [{ start_id: 'step', end_id: 'step', summary: 'Group' }]
+		}
+
+		const requestBody = buildFlowDeployRequestBody(
+			'f/demo/flow',
+			undefined,
+			draftValue as any,
+			existing,
+			'ai deploy'
+		)
+
+		expect(requestBody).toMatchObject({
+			path: 'f/demo/flow',
+			summary: 'existing summary',
+			description: 'existing description',
+			schema: draftValue.schema,
+			tag: 'python',
+			ws_error_handler_muted: true,
+			priority: 7,
+			dedicated_worker: true,
+			timeout: 60,
+			visible_to_runner_only: true,
+			on_behalf_of_email: 'deployer@example.com',
+			preserve_on_behalf_of: true,
+			labels: ['critical'],
+			deployment_message: 'ai deploy'
+		})
+		expect(requestBody.value.modules).toHaveLength(1)
+		expect(requestBody.value.groups).toEqual(draftValue.groups)
+	})
+
+	it('falls back to existing flow schema when the draft has no schema', () => {
+		const existing = {
+			path: 'f/demo/flow',
+			summary: 'existing summary',
+			value: { modules: [] },
+			schema: { properties: { existing: { type: 'boolean' } } }
+		} as unknown as Flow
+
+		const requestBody = buildFlowDeployRequestBody(
+			'f/demo/flow',
+			'draft summary',
+			{ value: { modules: [] }, schema: null, groups: null },
+			existing,
+			undefined
+		)
+
+		expect(requestBody.summary).toBe('draft summary')
+		expect(requestBody.schema).toBe(existing.schema)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/deployRequests.ts b/frontend/src/lib/components/copilot/chat/global/deployRequests.ts
new file mode 100644
index 0000000000..c9b2630c51
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/deployRequests.ts
@@ -0,0 +1,101 @@
+import type { Flow, NewScript, OpenFlowWPath, Script } from '$lib/gen/types.gen'
+import type { FlowDraftValue, WorkspaceItem } from './draftStore.svelte'
+
+type ScriptWithDeployMetadata = Script & Partial<Pick<NewScript, 'assets' | 'cache_ignore_s3_path'>>
+
+export type FlowDeployRequestBody = OpenFlowWPath & {
+	deployment_message?: string
+}
+
+function preserveOnBehalfOf(email: string | undefined): true | undefined {
+	return email ? true : undefined
+}
+
+export function buildScriptDeployRequestBody(
+	path: string,
+	draft: WorkspaceItem,
+	existing: Script | undefined,
+	deploymentMessage: string | undefined
+): NewScript {
+	if (typeof draft.value !== 'string' || !draft.language) {
+		throw new Error(`Draft script "${path}" is missing content or language.`)
+	}
+
+	const existingWithMetadata = existing as ScriptWithDeployMetadata | undefined
+
+	return {
+		path,
+		summary: draft.summary ?? existing?.summary ?? '',
+		description: existing?.description ?? '',
+		content: draft.value,
+		parent_hash: existing?.hash,
+		schema: existing?.schema,
+		is_template: existing?.is_template,
+		language: draft.language,
+		kind: existing?.kind,
+		tag: existing?.tag,
+		envs: existing?.envs,
+		concurrent_limit: existing?.concurrent_limit,
+		concurrency_time_window_s: existing?.concurrency_time_window_s,
+		debounce_key: existing?.debounce_key,
+		debounce_delay_s: existing?.debounce_delay_s,
+		debounce_args_to_accumulate: existing?.debounce_args_to_accumulate,
+		max_total_debouncing_time: existing?.max_total_debouncing_time,
+		max_total_debounces_amount: existing?.max_total_debounces_amount,
+		cache_ttl: existing?.cache_ttl,
+		cache_ignore_s3_path: existingWithMetadata?.cache_ignore_s3_path,
+		dedicated_worker: existing?.dedicated_worker,
+		ws_error_handler_muted: existing?.ws_error_handler_muted,
+		priority: existing?.priority,
+		restart_unless_cancelled: existing?.restart_unless_cancelled,
+		timeout: existing?.timeout,
+		delete_after_secs: existing?.delete_after_secs,
+		deployment_message: deploymentMessage,
+		concurrency_key: existing?.concurrency_key,
+		visible_to_runner_only: existing?.visible_to_runner_only,
+		auto_kind: existing?.auto_kind,
+		codebase: existing?.codebase,
+		has_preprocessor: existing?.has_preprocessor,
+		on_behalf_of_email: existing?.on_behalf_of_email,
+		preserve_on_behalf_of: preserveOnBehalfOf(existing?.on_behalf_of_email),
+		assets: existingWithMetadata?.assets,
+		modules: existing?.modules,
+		labels: existing?.labels
+	}
+}
+
+function flowValueWithDraftGroups(flowDraft: FlowDraftValue): FlowDraftValue['value'] {
+	if (flowDraft.groups === undefined) {
+		return flowDraft.value
+	}
+	return {
+		...flowDraft.value,
+		groups: flowDraft.groups ?? undefined
+	}
+}
+
+export function buildFlowDeployRequestBody(
+	path: string,
+	draftSummary: string | undefined,
+	flowDraft: FlowDraftValue,
+	existing: Flow | undefined,
+	deploymentMessage: string | undefined
+): FlowDeployRequestBody {
+	return {
+		path,
+		summary: draftSummary ?? existing?.summary ?? '',
+		description: existing?.description ?? '',
+		value: flowValueWithDraftGroups(flowDraft),
+		schema: flowDraft.schema ?? existing?.schema ?? {},
+		tag: existing?.tag,
+		ws_error_handler_muted: existing?.ws_error_handler_muted,
+		priority: existing?.priority,
+		dedicated_worker: existing?.dedicated_worker,
+		timeout: existing?.timeout,
+		visible_to_runner_only: existing?.visible_to_runner_only,
+		on_behalf_of_email: existing?.on_behalf_of_email,
+		preserve_on_behalf_of: preserveOnBehalfOf(existing?.on_behalf_of_email),
+		labels: existing?.labels,
+		deployment_message: deploymentMessage
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts b/frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts
new file mode 100644
index 0000000000..c0fb8985f5
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/draftStore.svelte.ts
@@ -0,0 +1,192 @@
+import type {
+	AzureTriggerData,
+	CreateResource,
+	CreateVariable,
+	FlowValue,
+	GcpTriggerData,
+	NewHttpTrigger,
+	NewKafkaTrigger,
+	NewMqttTrigger,
+	NewNatsTrigger,
+	NewPostgresTrigger,
+	NewSchedule,
+	NewSqsTrigger,
+	NewWebsocketTrigger,
+	Policy,
+	ScriptLang
+} from '$lib/gen/types.gen'
+
+/**
+ * Flow draft value. Mirrors what the backend's create/update flow API expects
+ * — the OpenFlow value, plus the inputs schema and (optional) groups.
+ *
+ * Schema and groups are split out from FlowValue intentionally so that
+ * deploy_workspace_item can preserve them through the draft → workspace
+ * round-trip; an earlier version dropped them on every deploy.
+ */
+export type FlowDraftValue = {
+	value: FlowValue
+	schema?: Record<string, any> | null
+	groups?: NonNullable<FlowValue['groups']> | null
+}
+
+export const TRIGGER_KINDS = [
+	'http',
+	'websocket',
+	'kafka',
+	'nats',
+	'postgres',
+	'mqtt',
+	'sqs',
+	'gcp',
+	'azure'
+] as const
+
+export type TriggerKind = (typeof TRIGGER_KINDS)[number]
+
+export type TriggerRequestBody =
+	| NewHttpTrigger
+	| NewWebsocketTrigger
+	| NewKafkaTrigger
+	| NewNatsTrigger
+	| NewPostgresTrigger
+	| NewMqttTrigger
+	| NewSqsTrigger
+	| GcpTriggerData
+	| AzureTriggerData
+
+export type WorkspaceItemType =
+	| 'script'
+	| 'flow'
+	| 'schedule'
+	| 'trigger'
+	| 'resource'
+	| 'variable'
+	| 'app'
+
+export type AppDraftValue = {
+	summary?: string
+	files: Record<string, string>
+	runnables: Record<string, any>
+	data?: any
+	policy?: Policy
+	custom_path?: string
+}
+
+export type WorkspaceItem = {
+	type: WorkspaceItemType
+	path: string
+	summary?: string
+	language?: ScriptLang
+	triggerKind?: TriggerKind
+	value?:
+		| string
+		| FlowDraftValue
+		| NewSchedule
+		| TriggerRequestBody
+		| CreateResource
+		| CreateVariable
+		| AppDraftValue
+	isDraft: boolean
+}
+
+export function getWorkspaceItemKey(
+	type: WorkspaceItemType,
+	path: string,
+	triggerKind?: TriggerKind
+): string {
+	if (type === 'trigger') {
+		return `trigger:${triggerKind ?? ''}:${path}`
+	}
+	return `${type}:${path}`
+}
+
+function clone<T>(value: T): T {
+	return structuredClone($state.snapshot(value)) as T
+}
+
+class GlobalDraftStore {
+	private drafts = $state<Record<string, Record<string, WorkspaceItem>>>({})
+
+	private getWorkspaceDrafts(workspace: string): Record<string, WorkspaceItem> {
+		return this.drafts[workspace] ?? {}
+	}
+
+	private ensureWorkspaceDrafts(workspace: string): Record<string, WorkspaceItem> {
+		if (!this.drafts[workspace]) {
+			this.drafts[workspace] = {}
+		}
+		return this.drafts[workspace]
+	}
+
+	listDrafts(workspace: string): WorkspaceItem[] {
+		return Object.values(this.getWorkspaceDrafts(workspace)).map(clone)
+	}
+
+	getDraft(
+		workspace: string,
+		type: WorkspaceItemType,
+		path: string,
+		triggerKind?: TriggerKind
+	): WorkspaceItem | undefined {
+		const draft = this.getWorkspaceDrafts(workspace)[getWorkspaceItemKey(type, path, triggerKind)]
+		return draft ? clone(draft) : undefined
+	}
+
+	setDraft(workspace: string, item: WorkspaceItem): WorkspaceItem {
+		const stored: WorkspaceItem = { ...clone(item), isDraft: true }
+		this.ensureWorkspaceDrafts(workspace)[
+			getWorkspaceItemKey(item.type, item.path, item.triggerKind)
+		] = stored
+		return clone(stored)
+	}
+
+	deleteDraft(
+		workspace: string,
+		type: WorkspaceItemType,
+		path: string,
+		triggerKind?: TriggerKind
+	): void {
+		const drafts = this.drafts[workspace]
+		if (!drafts) return
+
+		delete drafts[getWorkspaceItemKey(type, path, triggerKind)]
+		if (Object.keys(drafts).length === 0) {
+			delete this.drafts[workspace]
+		}
+	}
+
+	clearDrafts(workspace: string): void {
+		delete this.drafts[workspace]
+	}
+
+	getScriptDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'script', path)
+	}
+
+	getFlowDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'flow', path)
+	}
+
+	getScheduleDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'schedule', path)
+	}
+
+	getTriggerDraft(workspace: string, kind: TriggerKind, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'trigger', path, kind)
+	}
+
+	getResourceDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'resource', path)
+	}
+
+	getVariableDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'variable', path)
+	}
+
+	getAppDraft(workspace: string, path: string): WorkspaceItem | undefined {
+		return this.getDraft(workspace, 'app', path)
+	}
+}
+
+export const globalDraftStore = new GlobalDraftStore()
diff --git a/frontend/src/lib/components/copilot/chat/global/draftStore.test.ts b/frontend/src/lib/components/copilot/chat/global/draftStore.test.ts
new file mode 100644
index 0000000000..a05126a568
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/draftStore.test.ts
@@ -0,0 +1,56 @@
+import { beforeEach, describe, expect, it } from 'vitest'
+import { globalDraftStore } from './draftStore.svelte'
+
+const WORKSPACE_A = 'draft-store-test-a'
+const WORKSPACE_B = 'draft-store-test-b'
+
+function clearTestDrafts() {
+	globalDraftStore.clearDrafts(WORKSPACE_A)
+	globalDraftStore.clearDrafts(WORKSPACE_B)
+}
+
+describe('globalDraftStore', () => {
+	beforeEach(clearTestDrafts)
+
+	it('lists and reads drafts only from the requested workspace', () => {
+		globalDraftStore.setDraft(WORKSPACE_A, {
+			type: 'script',
+			path: 'f/shared/path',
+			language: 'bun',
+			value: 'export async function main() {}',
+			isDraft: true
+		})
+
+		expect(globalDraftStore.getDraft(WORKSPACE_A, 'script', 'f/shared/path')?.value).toBe(
+			'export async function main() {}'
+		)
+		expect(globalDraftStore.getDraft(WORKSPACE_B, 'script', 'f/shared/path')).toBeUndefined()
+		expect(globalDraftStore.listDrafts(WORKSPACE_A)).toHaveLength(1)
+		expect(globalDraftStore.listDrafts(WORKSPACE_B)).toHaveLength(0)
+	})
+
+	it('deletes and clears drafts only from the requested workspace', () => {
+		globalDraftStore.setDraft(WORKSPACE_A, {
+			type: 'flow',
+			path: 'f/shared/path',
+			value: { value: { modules: [] }, schema: null, groups: null },
+			isDraft: true
+		})
+		globalDraftStore.setDraft(WORKSPACE_B, {
+			type: 'flow',
+			path: 'f/shared/path',
+			value: { value: { modules: [] }, schema: { workspace: WORKSPACE_B }, groups: null },
+			isDraft: true
+		})
+
+		globalDraftStore.deleteDraft(WORKSPACE_A, 'flow', 'f/shared/path')
+
+		expect(globalDraftStore.getDraft(WORKSPACE_A, 'flow', 'f/shared/path')).toBeUndefined()
+		expect(globalDraftStore.getDraft(WORKSPACE_B, 'flow', 'f/shared/path')).toBeDefined()
+
+		globalDraftStore.clearDrafts(WORKSPACE_B)
+
+		expect(globalDraftStore.listDrafts(WORKSPACE_A)).toHaveLength(0)
+		expect(globalDraftStore.listDrafts(WORKSPACE_B)).toHaveLength(0)
+	})
+})
diff --git a/frontend/src/lib/components/copilot/chat/global/gate.ts b/frontend/src/lib/components/copilot/chat/global/gate.ts
new file mode 100644
index 0000000000..664f06ff39
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/global/gate.ts
@@ -0,0 +1,26 @@
+/**
+ * Dev-only gate for the Global AI chat mode.
+ *
+ * While the mode is being iterated on, it should not be visible to regular
+ * users. Developers/QA enable it in their browser with:
+ *
+ *     localStorage.setItem('wm_dev_global_ai', '1')
+ *
+ * and reload the page. To disable, remove the key or set it to anything else.
+ *
+ * When the mode is ready to ship to everyone, replace every call to
+ * `isGlobalAiEnabled()` with `true` and delete this file. The references are
+ * intentionally narrow (chat mode visibility, custom prompt settings, the
+ * `change_mode` tool enum, and the `/global_drafts` dev route) so the rip-out
+ * is a small grep.
+ */
+const STORAGE_KEY = 'wm_dev_global_ai'
+
+export function isGlobalAiEnabled(): boolean {
+	if (typeof localStorage === 'undefined') return false
+	try {
+		return localStorage.getItem(STORAGE_KEY) === '1'
+	} catch {
+		return false
+	}
+}
diff --git a/frontend/src/lib/components/copilot/chat/shared.ts b/frontend/src/lib/components/copilot/chat/shared.ts
index 59eba6a834..d29f9fc0ee 100644
--- a/frontend/src/lib/components/copilot/chat/shared.ts
+++ b/frontend/src/lib/components/copilot/chat/shared.ts
@@ -239,6 +239,59 @@ export interface ContextStringResult {
 	hasFlowModule: boolean
 }
 
+/** Count exact occurrences of `search` in `content`. */
+export function countExactMatches(content: string, search: string): number {
+	if (search.length === 0) return 0
+	let count = 0
+	let index = 0
+	while ((index = content.indexOf(search, index)) !== -1) {
+		count++
+		index += search.length
+	}
+	return count
+}
+
+/**
+ * Replace exact occurrences of `oldString` with `newString` in `content`.
+ * When `replaceAll` is false, only the first match is replaced. Returns the
+ * original string unchanged when no match is found.
+ */
+export function applyExactReplace(
+	content: string,
+	oldString: string,
+	newString: string,
+	replaceAll: boolean
+): string {
+	if (replaceAll) return content.split(oldString).join(newString)
+	const index = content.indexOf(oldString)
+	if (index === -1) return content
+	return content.slice(0, index) + newString + content.slice(index + oldString.length)
+}
+
+/**
+ * Match-count-validated exact text replacement. Throws when `oldString` is
+ * missing, and (unless `replaceAll`) when it appears more than once.
+ * `contextLabel` flows into the error message ("not found in the <label>.").
+ */
+export function findAndReplace(
+	content: string,
+	oldString: string,
+	newString: string,
+	replaceAll: boolean,
+	contextLabel: string
+): string {
+	const matchCount = countExactMatches(content, oldString)
+	if (matchCount === 0) {
+		throw new Error(`old_string was not found in the ${contextLabel}.`)
+	}
+	if (!replaceAll && matchCount !== 1) {
+		throw new Error(
+			`old_string matched ${matchCount} locations. Make it more specific or set replace_all to true.`
+		)
+	}
+	return applyExactReplace(content, oldString, newString, replaceAll)
+}
+
 export const extractAllModules = (modules: FlowModule[]): FlowModule[] => {
 	return modules.flatMap((m) => {
 		if (m.value.type === 'forloopflow' || m.value.type === 'whileloopflow') {
@@ -424,9 +477,9 @@ export type CreatedResourceAction = {
 	id: string
 	type: 'open_created_resource'
 	label: string
-	resource: 'schedule' | 'trigger'
+	resource: 'schedule' | 'trigger' | 'resource' | 'variable'
 	path: string
-	targetKind: 'script' | 'flow'
+	targetKind?: 'script' | 'flow'
 	triggerKind?: CreatedResourceTriggerKind
 }
 
diff --git a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
index 8d8cce2482..d989412bb1 100644
--- a/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
+++ b/frontend/src/lib/components/copilot/chat/workspaceToolsZod.gen.ts
@@ -397,6 +397,27 @@ export const azureTriggerRequestSchema = z.object({
 	"labels": z.array(z.string()).optional()
 }).describe("Data for creating or updating an Azure Event Grid trigger.")
 
+export const variableRequestSchema = z.object({
+	"path": z.string().describe("The path to the variable"),
+	"value": z.string().describe("The value of the variable"),
+	"is_secret": z.boolean().describe("Whether the variable is a secret"),
+	"description": z.string().describe("The description of the variable"),
+	"account": z.number().int().describe("The account identifier").optional(),
+	"is_oauth": z.boolean().describe("Whether the variable is an OAuth variable").optional(),
+	"expires_at": z.string().datetime({ offset: true }).describe("The expiration date of the variable").optional(),
+	"labels": z.array(z.string()).optional(),
+	"ws_specific": z.boolean().optional()
+})
+
+export const resourceRequestSchema = z.object({
+	"path": z.string().describe("The path to the resource"),
+	"value": z.any(),
+	"description": z.string().describe("The description of the resource").optional(),
+	"resource_type": z.string().describe("The resource_type associated with the resource"),
+	"labels": z.array(z.string()).optional(),
+	"ws_specific": z.boolean().optional()
+})
+
 export const triggerRequestSchemas = {
 	http: httpTriggerRequestSchema,
 	websocket: websocketTriggerRequestSchema,
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts b/frontend/src/lib/components/raw_apps/templates.ts
similarity index 93%
rename from frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
rename to frontend/src/lib/components/raw_apps/templates.ts
index eaac0f108f..335ae4d8e8 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/add/templates.ts
+++ b/frontend/src/lib/components/raw_apps/templates.ts
@@ -154,6 +154,43 @@ export const vueTemplate = {
 }`
 }
 
+export const FRAMEWORK_TEMPLATES = {
+	react19: react19Template,
+	react18: react18Template,
+	svelte5: svelte5Template,
+	vue: vueTemplate
+}
+
+export type FrameworkKey = keyof typeof FRAMEWORK_TEMPLATES
+
+export const STARTER_RUNNABLE_KEY = 'a'
+
+// Matches the starter runnable that the apps_raw/add page seeds, so the
+// React/Svelte demo button (`backend.a({ x: 42 })`) works on first render.
+export const STARTER_RUNNABLE = {
+	name: 'a',
+	fields: {},
+	type: 'inline',
+	inlineScript: {
+		content:
+			'// import * as wmill from "windmill-client"\n\nexport async function main(x: string) {\n  return x\n}\n',
+		language: 'bun',
+		schema: {
+			$schema: 'https://json-schema.org/draft/2020-12/schema',
+			properties: {
+				x: {
+					default: null,
+					description: '',
+					originalType: 'string',
+					type: 'string'
+				}
+			},
+			required: ['x'],
+			type: 'object'
+		}
+	}
+}
+
 export const appVueRouter = `
 <template>
   <div class="container">
diff --git a/frontend/src/lib/components/settings/AIPromptsModal.svelte b/frontend/src/lib/components/settings/AIPromptsModal.svelte
index b9c126d19c..a6630b89b1 100644
--- a/frontend/src/lib/components/settings/AIPromptsModal.svelte
+++ b/frontend/src/lib/components/settings/AIPromptsModal.svelte
@@ -3,7 +3,7 @@
 	import Button from '../common/button/Button.svelte'
 	import Label from '../Label.svelte'
 	import TextInput from '../text_input/TextInput.svelte'
-	import { AIMode } from '../copilot/chat/AIChatManager.svelte'
+	import { AIMode, getVisibleAIModes } from '../copilot/chat/AIChatManager.svelte'
 
 	const MAX_CUSTOM_PROMPT_LENGTH = 5000
 
@@ -31,6 +31,7 @@
 		[AIMode.APP]: 'Enter custom instructions for UI and app development',
 		[AIMode.NAVIGATOR]: 'Enter custom instructions for navigation and guidance',
 		[AIMode.API]: 'Enter custom instructions for API interactions and integrations',
+		[AIMode.GLOBAL]: 'Enter custom instructions for workspace-wide draft assistance',
 		[AIMode.ASK]: 'Enter custom instructions for general questions and assistance'
 	}
 
@@ -40,9 +41,12 @@
 		[AIMode.APP]: 'App Mode',
 		[AIMode.NAVIGATOR]: 'Navigator Mode',
 		[AIMode.API]: 'API Mode',
+		[AIMode.GLOBAL]: 'Global Mode',
 		[AIMode.ASK]: 'Ask Mode'
 	}
 
+	let visibleModes = $derived(getVisibleAIModes())
+
 	function handleSave() {
 		onSave?.()
 		open = false
@@ -75,7 +79,7 @@
 				{/if}
 			</div>
 
-			{#each Object.values(AIMode) as mode}
+			{#each visibleModes as mode (mode)}
 				<div class="flex flex-col gap-2 pb-4 last:border-b-0">
 					<Label label={modeLabels[mode]} for={`custom-prompt-${mode}`}>
 						<TextInput
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte
index f33fb36922..31100d3b07 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/add/+page.svelte
@@ -12,7 +12,11 @@
 	import RawAppEditor from '$lib/components/raw_apps/RawAppEditor.svelte'
 	import Modal from '$lib/components/common/modal/Modal.svelte'
 	import FileEditorIcon from '$lib/components/raw_apps/FileEditorIcon.svelte'
-	import { react18Template, react19Template, svelte5Template } from './templates'
+	import {
+		react18Template,
+		react19Template,
+		svelte5Template
+	} from '$lib/components/raw_apps/templates'
 	import type { Runnable } from '$lib/components/raw_apps/rawAppPolicy'
 	import { type RawAppData, DEFAULT_DATA } from '$lib/components/raw_apps/dataTableRefUtils'
 	import {
diff --git a/frontend/src/routes/(root)/(logged)/global_drafts/+page.js b/frontend/src/routes/(root)/(logged)/global_drafts/+page.js
new file mode 100644
index 0000000000..d62178ddb3
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/global_drafts/+page.js
@@ -0,0 +1,5 @@
+export function load() {
+	return {
+		stuff: { title: 'Global AI drafts' }
+	}
+}
diff --git a/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte b/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
new file mode 100644
index 0000000000..4b7f8e8d0c
--- /dev/null
+++ b/frontend/src/routes/(root)/(logged)/global_drafts/+page.svelte
@@ -0,0 +1,98 @@
+<script lang="ts">
+	import { Button } from '$lib/components/common'
+	import {
+		globalDraftStore,
+		type WorkspaceItem
+	} from '$lib/components/copilot/chat/global/draftStore.svelte'
+	import { isGlobalAiEnabled } from '$lib/components/copilot/chat/global/gate'
+	import { goto } from '$lib/navigation'
+	import { workspaceStore } from '$lib/stores'
+	import { Trash2 } from 'lucide-svelte'
+	import { onMount } from 'svelte'
+
+	let enabled = $state(false)
+
+	onMount(() => {
+		// Dev-only route. Bounce to home when the global mode gate is closed.
+		enabled = isGlobalAiEnabled()
+		if (!enabled) {
+			goto('/')
+		}
+	})
+
+	let drafts = $derived($workspaceStore ? globalDraftStore.listDrafts($workspaceStore) : [])
+
+	function draftKey(item: WorkspaceItem): string {
+		return `${item.type}:${item.triggerKind ?? '-'}:${item.path}`
+	}
+
+	function deleteDraft(item: WorkspaceItem) {
+		if (!$workspaceStore) return
+		globalDraftStore.deleteDraft($workspaceStore, item.type, item.path, item.triggerKind)
+	}
+
+	function clearAll() {
+		if (!$workspaceStore) return
+		globalDraftStore.clearDrafts($workspaceStore)
+	}
+</script>
+
+{#if enabled}
+	<div class="p-6 max-w-5xl mx-auto">
+		<div class="flex items-center justify-between mb-6">
+			<div>
+				<h1 class="text-2xl font-semibold">Global AI drafts</h1>
+				<p class="text-sm text-tertiary">
+					Dev-only inspector for the in-memory global draft store.
+				</p>
+			</div>
+			<Button
+				variant="default"
+				startIcon={{ icon: Trash2 }}
+				disabled={drafts.length === 0}
+				onclick={clearAll}
+			>
+				Clear all
+			</Button>
+		</div>
+
+		{#if drafts.length === 0}
+			<p class="text-sm text-tertiary">No drafts.</p>
+		{:else}
+			<ul class="space-y-4">
+				{#each drafts as draft (draftKey(draft))}
+					<li class="border rounded p-4">
+						<div class="flex items-start justify-between gap-2 mb-2">
+							<div>
+								<div class="font-mono text-sm">
+									<span class="font-semibold">{draft.type}</span>
+									{#if draft.triggerKind}
+										<span class="text-tertiary">({draft.triggerKind})</span>
+									{/if}
+									<span class="text-tertiary">·</span>
+									<span>{draft.path}</span>
+								</div>
+								{#if draft.summary}
+									<div class="text-sm text-tertiary mt-1">{draft.summary}</div>
+								{/if}
+								{#if draft.language}
+									<div class="text-xs text-tertiary mt-1">language: {draft.language}</div>
+								{/if}
+							</div>
+							<Button
+								variant="default"
+								startIcon={{ icon: Trash2 }}
+								iconOnly
+								onclick={() => deleteDraft(draft)}
+							/>
+						</div>
+						<pre
+							class="text-xs bg-surface-secondary p-3 rounded overflow-auto max-h-96 whitespace-pre-wrap"
+							>{JSON.stringify(draft.value, null, 2)}</pre
+						>
+					</li>
+				{/each}
+			</ul>
+		{/if}
+	</div>
+{/if}
diff --git a/system_prompts/auto-generated/index.d.ts b/system_prompts/auto-generated/index.d.ts
index 2ff02ece06..6018d7ef92 100644
--- a/system_prompts/auto-generated/index.d.ts
+++ b/system_prompts/auto-generated/index.d.ts
@@ -1,5 +1,7 @@
 export * from './prompts';
 export declare function getScriptPrompt(language: string): string;
 export declare function getFlowPrompt(): string;
+export declare function getResourcePrompt(): string;
+export declare function getRawAppPrompt(): string;
 export declare function getDatatableSdkReference(): string;
 export declare function getWorkflowAsCodePrompt(language?: string): string;
diff --git a/system_prompts/auto-generated/index.ts b/system_prompts/auto-generated/index.ts
index 1d880184a7..bbd90e1066 100644
--- a/system_prompts/auto-generated/index.ts
+++ b/system_prompts/auto-generated/index.ts
@@ -44,6 +44,16 @@ export function getFlowPrompt(): string {
   ].filter(Boolean).join('\n\n');
 }
 
+// Helper for resource & variable authoring
+export function getResourcePrompt(): string {
+  return prompts.RESOURCES_BASE;
+}
+
+// Helper for raw app authoring (chat consumers)
+export function getRawAppPrompt(): string {
+  return prompts.RAW_APP_BASE;
+}
+
 // Helper to get datatable SDK reference for app mode
 export function getDatatableSdkReference(): string {
   return [
diff --git a/system_prompts/auto-generated/prompts.ts b/system_prompts/auto-generated/prompts.ts
index 8a9da7c4e5..f1c00d5763 100644
--- a/system_prompts/auto-generated/prompts.ts
+++ b/system_prompts/auto-generated/prompts.ts
@@ -324,6 +324,389 @@ Reference a specific resource using \`$res:\` prefix:
 \`\`\`
 `;
 
+export const RESOURCES_BASE = `# Windmill Resources
+
+Resources store credentials and configuration for external services.
+
+## File Format
+
+Resource files use the pattern: \`{path}.resource.json\`
+
+Example: \`f/databases/postgres_prod.resource.json\`
+
+## Resource Structure
+
+\`\`\`json
+{
+  "value": {
+    "host": "db.example.com",
+    "port": 5432,
+    "user": "admin",
+    "password": "$var:g/all/db_password",
+    "dbname": "production"
+  },
+  "description": "Production PostgreSQL database",
+  "resource_type": "postgresql"
+}
+\`\`\`
+
+## Required Fields
+
+- \`value\` - Object containing the resource configuration
+- \`resource_type\` - Name of the resource type (e.g., "postgresql", "slack")
+
+## Variable References
+
+Reference variables in resource values:
+
+\`\`\`json
+{
+  "value": {
+    "api_key": "$var:g/all/api_key",
+    "secret": "$var:u/admin/secret"
+  }
+}
+\`\`\`
+
+**Reference formats:**
+- \`$var:g/all/name\` - Global variable
+- \`$var:u/username/name\` - User variable
+- \`$var:f/folder/name\` - Folder variable
+
+## Resource References
+
+Reference other resources:
+
+\`\`\`json
+{
+  "value": {
+    "database": "$res:f/databases/postgres"
+  }
+}
+\`\`\`
+
+## Common Resource Types
+
+### PostgreSQL
+\`\`\`json
+{
+  "resource_type": "postgresql",
+  "value": {
+    "host": "localhost",
+    "port": 5432,
+    "user": "postgres",
+    "password": "$var:g/all/pg_password",
+    "dbname": "windmill",
+    "sslmode": "prefer"
+  }
+}
+\`\`\`
+
+### MySQL
+\`\`\`json
+{
+  "resource_type": "mysql",
+  "value": {
+    "host": "localhost",
+    "port": 3306,
+    "user": "root",
+    "password": "$var:g/all/mysql_password",
+    "database": "myapp"
+  }
+}
+\`\`\`
+
+### Slack
+\`\`\`json
+{
+  "resource_type": "slack",
+  "value": {
+    "token": "$var:g/all/slack_token"
+  }
+}
+\`\`\`
+
+### AWS S3
+\`\`\`json
+{
+  "resource_type": "s3",
+  "value": {
+    "bucket": "my-bucket",
+    "region": "us-east-1",
+    "accessKeyId": "$var:g/all/aws_access_key",
+    "secretAccessKey": "$var:g/all/aws_secret_key"
+  }
+}
+\`\`\`
+
+### HTTP/API
+\`\`\`json
+{
+  "resource_type": "http",
+  "value": {
+    "baseUrl": "https://api.example.com",
+    "headers": {
+      "Authorization": "Bearer $var:g/all/api_token"
+    }
+  }
+}
+\`\`\`
+
+### Kafka
+\`\`\`json
+{
+  "resource_type": "kafka",
+  "value": {
+    "brokers": "broker1:9092,broker2:9092",
+    "sasl_mechanism": "PLAIN",
+    "security_protocol": "SASL_SSL",
+    "username": "$var:g/all/kafka_user",
+    "password": "$var:g/all/kafka_password"
+  }
+}
+\`\`\`
+
+### NATS
+\`\`\`json
+{
+  "resource_type": "nats",
+  "value": {
+    "servers": ["nats://localhost:4222"],
+    "user": "$var:g/all/nats_user",
+    "password": "$var:g/all/nats_password"
+  }
+}
+\`\`\`
+
+### MQTT
+\`\`\`json
+{
+  "resource_type": "mqtt",
+  "value": {
+    "host": "mqtt.example.com",
+    "port": 8883,
+    "username": "$var:g/all/mqtt_user",
+    "password": "$var:g/all/mqtt_password",
+    "tls": true
+  }
+}
+\`\`\`
+
+## Custom Resource Types
+
+Create custom resource types with JSON Schema:
+
+\`\`\`json
+{
+  "name": "custom_api",
+  "schema": {
+    "type": "object",
+    "properties": {
+      "base_url": {"type": "string", "format": "uri"},
+      "api_key": {"type": "string"},
+      "timeout": {"type": "integer", "default": 30}
+    },
+    "required": ["base_url", "api_key"]
+  },
+  "description": "Custom API connection"
+}
+\`\`\`
+
+Save as: \`custom_api.resource-type.json\`
+
+## OAuth Resources
+
+OAuth resources are managed through the Windmill UI and marked:
+
+\`\`\`json
+{
+  "is_oauth": true,
+  "account": 123
+}
+\`\`\`
+
+OAuth tokens are automatically refreshed by Windmill.
+
+## Using Resources in Scripts
+
+### TypeScript (Bun/Deno)
+\`\`\`typescript
+export async function main(db: RT.Postgresql) {
+  // db contains the resource values
+  const { host, port, user, password, dbname } = db;
+}
+\`\`\`
+
+### Python
+\`\`\`python
+class postgresql(TypedDict):
+    host: str
+    port: int
+    user: str
+    password: str
+    dbname: str
+
+def main(db: postgresql):
+    # db contains the resource values
+    pass
+\`\`\`
+
+## CLI Commands
+
+\`\`\`bash
+# List resources
+wmill resource list
+
+# List resource types with schemas
+wmill resource-type list --schema
+
+# Get specific resource type schema
+wmill resource-type get postgresql
+
+# Push resources (tell the user to run this, do NOT run it yourself)
+wmill sync push
+\`\`\`
+`;
+
+export const RAW_APP_BASE = `# Windmill Raw Apps
+
+Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+
+## App shape
+
+A raw app has three logical parts:
+
+- **Frontend** — bundled with esbuild from \`index.tsx\` as the entrypoint. Files include the entrypoint, components (\`App.tsx\`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
+
+## Frontend
+
+### Entrypoint
+
+\`index.tsx\` is the bundling entrypoint. It typically renders a top-level \`App\` component. The bundler is esbuild.
+
+### Generated bindings (\`wmill.d.ts\` / \`wmill.ts\`)
+
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
+
+### Calling backend runnables
+
+Import the generated bindings and call the runnable like a function:
+
+\`\`\`typescript
+import { backend } from './wmill';
+
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
+\`\`\`
+
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through \`backend.<key>(args)\` for everything server-side.
+
+## Backend runnables
+
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
+
+| Type | What it is |
+|---|---|
+| \`inline\` | Custom code stored on the app itself. Most common for app-specific logic. |
+| \`script\` | Reference to an existing workspace script by path. |
+| \`flow\` | Reference to an existing workspace flow by path. |
+| \`hubscript\` | Reference to a hub script by path. |
+
+### Inline runnables
+
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a \`main\` function as its entrypoint.
+
+**TypeScript example** (\`backend/get_user.ts\`):
+
+\`\`\`typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();
+  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
+  return user;
+}
+\`\`\`
+
+**Python example** (\`backend/get_user.py\`):
+
+\`\`\`python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
+\`\`\`
+
+### Path runnables (script / flow / hubscript)
+
+When \`type\` is \`script\`, \`flow\`, or \`hubscript\`, the runnable just stores a \`path\` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
+
+### Static inputs
+
+\`staticInputs\` is an optional \`Record<string, any>\` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
+
+## Data Tables
+
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the \`wmill\` client; the frontend never queries them directly.
+
+### Critical rules
+
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's \`data.tables\` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in \`data.tables\` first.
+3. **Use the configured datatable/schema**: the app's \`data\` config sets the default datatable and schema; reference them consistently across runnables.
+
+### Querying in TypeScript (Bun/Deno)
+
+\`\`\`typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();  // Or: wmill.datatable('other_datatable')
+
+  // Parameterized queries (safe from SQL injection)
+  const user = await sql\`SELECT * FROM users WHERE id = \${user_id}\`.fetchOne();
+  const users = await sql\`SELECT * FROM users WHERE active = \${true}\`.fetch();
+
+  // Insert/Update
+  await sql\`INSERT INTO users (name, email) VALUES (\${name}, \${email})\`;
+  await sql\`UPDATE users SET name = \${newName} WHERE id = \${user_id}\`;
+
+  return user;
+}
+\`\`\`
+
+### Querying in Python
+
+\`\`\`python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()  # Or: wmill.datatable('other_datatable')
+
+    # Use $1, $2, etc. for parameters
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    users = db.query('SELECT * FROM users WHERE active = $1', True).fetch()
+
+    # Insert/Update
+    db.query('INSERT INTO users (name, email) VALUES ($1, $2)', name, email)
+    db.query('UPDATE users SET name = $1 WHERE id = $2', new_name, user_id)
+
+    return user
+\`\`\`
+
+## Best Practices
+
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — \`get_user\`, not \`a\`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in \`data.tables\` first.
+`;
+
 export const WORKFLOW_AS_CODE_BASE = `# Windmill Workflow-as-Code Writing Guide
 
 ## Scope
diff --git a/system_prompts/auto-generated/skills/raw-app/SKILL.md b/system_prompts/auto-generated/skills/raw-app/SKILL.md
index 5ac3a69cff..937a18e1c9 100644
--- a/system_prompts/auto-generated/skills/raw-app/SKILL.md
+++ b/system_prompts/auto-generated/skills/raw-app/SKILL.md
@@ -3,9 +3,9 @@ name: raw-app
 description: MUST use when creating raw apps.
 ---
 
-# Windmill Raw Apps
+# Windmill Raw Apps — CLI workflow
 
-Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+This guide covers raw apps from the terminal: scaffolding via `wmill app new`, the on-disk layout, and the file-based conventions the CLI uses to represent backend runnables and data table configuration. The platform shape (how a raw app behaves at runtime — frontend bundling, runnable types, datatable SDK calls) is covered in the companion authoring guide.
 
 ## Creating a Raw App
 
@@ -74,7 +74,7 @@ wmill app new
 
 This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
 
-## App Structure
+## On-disk app layout
 
 ```
 my_app__raw_app/
@@ -94,11 +94,7 @@ my_app__raw_app/
     └── *.sql              # SQL files to apply via dev server
 ```
 
-## Backend Runnables
-
-Backend runnables are server-side scripts that your frontend can call. They live in the `backend/` folder.
-
-### Creating a Backend Runnable
+## Backend runnables on disk
 
 Add a code file to the `backend/` folder:
 
@@ -108,7 +104,7 @@ backend/<id>.<ext>
 
 The runnable ID is the filename without extension. For example, `get_user.ts` creates a runnable with ID `get_user`.
 
-### Supported Languages
+### Supported languages (extension-driven)
 
 | Language         | Extension    | Example          |
 |------------------|--------------|------------------|
@@ -130,27 +126,14 @@ The runnable ID is the filename without extension. For example, `get_user.ts` cr
 | C#               | `.cs`        | `myFunc.cs`      |
 | Java             | `.java`      | `myFunc.java`    |
 
-### Example Backend Runnable
-
-**backend/get_user.ts:**
-```typescript
-import * as wmill from 'windmill-client';
-
-export async function main(user_id: string) {
-  const sql = wmill.datatable();
-  const user = await sql`SELECT * FROM users WHERE id = ${user_id}`.fetchOne();
-  return user;
-}
-```
-
-After creating, tell the user they can generate lock files by running:
+After creating a runnable, tell the user they can generate lock files by running:
 ```bash
 wmill generate-metadata
 ```
 
-### Optional YAML Configuration
+### Optional YAML configuration
 
-Add a `<id>.yaml` file to configure fields or static values:
+Add a `<id>.yaml` file alongside the code to configure fields or static values:
 
 **backend/get_user.yaml:**
 ```yaml
@@ -161,7 +144,7 @@ fields:
     value: "default_user"
 ```
 
-### Referencing Existing Scripts
+### Referencing existing scripts
 
 To use an existing Windmill script instead of inline code:
 
@@ -177,32 +160,9 @@ type: flow
 path: f/my_folder/my_flow
 ```
 
-### Calling Backend from Frontend
+## Data tables — `raw_app.yaml` config
 
-Import from the auto-generated `wmill.ts`:
-
-```typescript
-import { backend } from './wmill';
-
-// Call a backend runnable
-const user = await backend.get_user({ user_id: '123' });
-```
-
-The `wmill.ts` file provides type-safe access to all backend runnables.
-
-## Data Tables
-
-Raw apps can query Windmill datatables (PostgreSQL databases managed by Windmill).
-
-### Critical Rules
-
-1. **ONLY USE WHITELISTED TABLES**: You can ONLY query tables listed in `raw_app.yaml` → `data.tables`. Tables not in this list are NOT accessible.
-
-2. **ADD TABLES BEFORE USING**: To use a new table, first add it to `data.tables` in `raw_app.yaml`.
-
-3. **USE CONFIGURED DATATABLE/SCHEMA**: Check the app's `raw_app.yaml` for the default datatable and schema.
-
-### Configuration in raw_app.yaml
+The `data` block in `raw_app.yaml` controls which tables the app can query.
 
 ```yaml
 data:
@@ -214,9 +174,153 @@ data:
 ```
 
 **Table reference formats:**
-- `<datatable>` - All tables in the datatable
-- `<datatable>/<table>` - Specific table in public schema
-- `<datatable>/<schema>:<table>` - Table in specific schema
+- `<datatable>` — All tables in the datatable
+- `<datatable>/<table>` — Specific table in public schema
+- `<datatable>/<schema>:<table>` — Table in specific schema
+
+## SQL Migrations (sql_to_apply/)
+
+The `sql_to_apply/` folder is for creating/modifying database tables during development.
+
+### Workflow
+
+1. Create `.sql` files in `sql_to_apply/`
+2. Run `wmill app dev` — the dev server watches this folder
+3. When SQL files change, a modal appears in the browser to confirm execution
+4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
+
+### Example migration
+
+**sql_to_apply/001_create_users.sql:**
+```sql
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    name TEXT,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+```
+
+After applying, add to `raw_app.yaml`:
+```yaml
+data:
+  tables:
+    - main/users
+```
+
+### Migration best practices
+
+- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
+- **Number files**: `001_`, `002_` for ordering
+- **Always whitelist tables** after creation
+- This folder is NOT synced — it's for local development only
+
+## CLI Commands
+
+`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+
+For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+
+| Command | Description |
+|---------|-------------|
+| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
+| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
+| `wmill generate-metadata` | Generate lock files for backend runnables |
+| `wmill sync push` | Deploy app to Windmill |
+| `wmill sync pull` | Pull latest from Windmill |
+
+
+
+# Windmill Raw Apps
+
+Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
+
+## App shape
+
+A raw app has three logical parts:
+
+- **Frontend** — bundled with esbuild from `index.tsx` as the entrypoint. Files include the entrypoint, components (`App.tsx`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
+
+## Frontend
+
+### Entrypoint
+
+`index.tsx` is the bundling entrypoint. It typically renders a top-level `App` component. The bundler is esbuild.
+
+### Generated bindings (`wmill.d.ts` / `wmill.ts`)
+
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
+
+### Calling backend runnables
+
+Import the generated bindings and call the runnable like a function:
+
+```typescript
+import { backend } from './wmill';
+
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
+```
+
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through `backend.<key>(args)` for everything server-side.
+
+## Backend runnables
+
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
+
+| Type | What it is |
+|---|---|
+| `inline` | Custom code stored on the app itself. Most common for app-specific logic. |
+| `script` | Reference to an existing workspace script by path. |
+| `flow` | Reference to an existing workspace flow by path. |
+| `hubscript` | Reference to a hub script by path. |
+
+### Inline runnables
+
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a `main` function as its entrypoint.
+
+**TypeScript example** (`backend/get_user.ts`):
+
+```typescript
+import * as wmill from 'windmill-client';
+
+export async function main(user_id: string) {
+  const sql = wmill.datatable();
+  const user = await sql`SELECT * FROM users WHERE id = ${user_id}`.fetchOne();
+  return user;
+}
+```
+
+**Python example** (`backend/get_user.py`):
+
+```python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
+```
+
+### Path runnables (script / flow / hubscript)
+
+When `type` is `script`, `flow`, or `hubscript`, the runnable just stores a `path` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
+
+### Static inputs
+
+`staticInputs` is an optional `Record<string, any>` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
+
+## Data Tables
+
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the `wmill` client; the frontend never queries them directly.
+
+### Critical rules
+
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's `data.tables` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in `data.tables` first.
+3. **Use the configured datatable/schema**: the app's `data` config sets the default datatable and schema; reference them consistently across runnables.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -257,62 +361,10 @@ def main(user_id: str):
     return user
 ```
 
-## SQL Migrations (sql_to_apply/)
-
-The `sql_to_apply/` folder is for creating/modifying database tables during development.
-
-### Workflow
-
-1. Create `.sql` files in `sql_to_apply/`
-2. Run `wmill app dev` - the dev server watches this folder
-3. When SQL files change, a modal appears in the browser to confirm execution
-4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
-
-### Example Migration
-
-**sql_to_apply/001_create_users.sql:**
-```sql
-CREATE TABLE IF NOT EXISTS users (
-    id SERIAL PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    name TEXT,
-    created_at TIMESTAMP DEFAULT NOW()
-);
-```
-
-After applying, add to `raw_app.yaml`:
-```yaml
-data:
-  tables:
-    - main/users
-```
-
-### Migration Best Practices
-
-- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
-- **Number files**: `001_`, `002_` for ordering
-- **Always whitelist tables** after creation
-- This folder is NOT synced - it's for local development only
-
-## CLI Commands
-
-`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
-
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
-
-| Command | Description |
-|---------|-------------|
-| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
-| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
-| `wmill generate-metadata` | Generate lock files for backend runnables |
-| `wmill sync push` | Deploy app to Windmill |
-| `wmill sync pull` | Pull latest from Windmill |
-
 ## Best Practices
 
-1. **Check DATATABLES.md** for existing tables before creating new ones
-2. **Use parameterized queries** - never concatenate user input into SQL
-3. **Keep runnables focused** - one function per file
-4. **Use descriptive IDs** - `get_user.ts` not `a.ts`
-5. **Always whitelist tables** - add to `data.tables` before querying
-6. **Generate locks** - tell the user to run `wmill generate-metadata` after adding/modifying backend runnables
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — `get_user`, not `a`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in `data.tables` first.
diff --git a/system_prompts/base/raw-app-cli.md b/system_prompts/base/raw-app-cli.md
new file mode 100644
index 0000000000..e7e8fe9881
--- /dev/null
+++ b/system_prompts/base/raw-app-cli.md
@@ -0,0 +1,226 @@
+# Windmill Raw Apps — CLI workflow
+
+This guide covers raw apps from the terminal: scaffolding via `wmill app new`, the on-disk layout, and the file-based conventions the CLI uses to represent backend runnables and data table configuration. The platform shape (how a raw app behaves at runtime — frontend bundling, runnable types, datatable SDK calls) is covered in the companion authoring guide.
+
+## Creating a Raw App
+
+**You — the AI agent — create the app yourself by running `wmill app new` with the right flags. Do NOT tell the user to "run `wmill app new` and follow the prompts" or wait for them to do it.** The bare `wmill app new` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
+
+### Step 1 — Gather the three required values by asking the user
+
+You need three things to run the command:
+
+1. **summary** — a short description of the app
+2. **path** — the windmill path, e.g. `f/folder/my_app` or `u/username/my_app`
+3. **framework** — one of `react19` (recommended), `react18`, `svelte5`, `vue`
+
+If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+
+Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+
+- For `framework` — multiple-choice with the four allowed values; mark `react19` as `(Recommended)` and put it first.
+- For `summary` and `path` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+
+Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+
+### Step 2 — Run the command yourself
+
+Once you have summary + path + framework, run it:
+
+```bash
+wmill app new \
+  --summary "Customer dashboard" \
+  --path f/sales/dashboard \
+  --framework react19
+```
+
+That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of `--summary`/`--path`/`--framework` puts the command in non-interactive mode.
+
+### Optional flags
+
+Layer these in only when the user asked for them:
+
+| Flag | When to add it |
+|---|---|
+| `--datatable <name>` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
+| `--schema <name>` | Together with `--datatable`. Creates the schema with `CREATE SCHEMA IF NOT EXISTS` if it doesn't already exist. |
+| `--overwrite` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
+| `--no-open-in-desktop` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
+
+### Step 3 — Offer the visual preview
+
+After `wmill app new` and any initial edits to `App.tsx` / `index.tsx`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a `launch.json` entry when an embedded preview tool is in play) the user should consent to.
+
+For apps the preview command runs from the app folder (`cd <app_path>__raw_app && wmill app dev …`); the `preview` skill picks the proxy vs direct branch based on whether the runtime exposes a tool that can embed a localhost URL. If the user already asked to see/preview/visualize the app in their original request, skip the offer and just invoke the skill.
+
+### Anti-patterns to avoid
+
+- ❌ Running `wmill app new` with no flags (the prompt will hang).
+- ❌ Telling the user to "run `wmill app new` and follow the prompts" — that's a step backwards from what you can do directly.
+- ❌ Inventing a path/summary/framework instead of asking the user.
+- ❌ Defaulting to `react19` because the user didn't say — even sensible defaults must be confirmed.
+- ❌ Passing `--overwrite` automatically when the directory exists — confirm with the user first.
+
+### Interactive (only when a human is at the terminal)
+
+```bash
+wmill app new
+```
+
+This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
+
+## On-disk app layout
+
+```
+my_app__raw_app/
+├── AGENTS.md              # AI agent instructions (auto-generated)
+├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
+├── raw_app.yaml           # App configuration (summary, path, data settings)
+├── index.tsx              # Frontend entry point
+├── App.tsx                # Main React/Svelte/Vue component
+├── index.css              # Styles
+├── package.json           # Frontend dependencies
+├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
+├── backend/               # Backend runnables (server-side scripts)
+│   ├── <id>.<ext>         # Code file (e.g., get_user.ts)
+│   ├── <id>.yaml          # Optional: config for fields, or to reference existing scripts
+│   └── <id>.lock          # Lock file (run 'wmill generate-metadata' to create/update)
+└── sql_to_apply/          # SQL migrations (dev only, not synced)
+    └── *.sql              # SQL files to apply via dev server
+```
+
+## Backend runnables on disk
+
+Add a code file to the `backend/` folder:
+
+```
+backend/<id>.<ext>
+```
+
+The runnable ID is the filename without extension. For example, `get_user.ts` creates a runnable with ID `get_user`.
+
+### Supported languages (extension-driven)
+
+| Language         | Extension    | Example          |
+|------------------|--------------|------------------|
+| TypeScript       | `.ts`        | `myFunc.ts`      |
+| TypeScript (Bun) | `.bun.ts`    | `myFunc.bun.ts`  |
+| TypeScript (Deno)| `.deno.ts`   | `myFunc.deno.ts` |
+| Python           | `.py`        | `myFunc.py`      |
+| Go               | `.go`        | `myFunc.go`      |
+| Bash             | `.sh`        | `myFunc.sh`      |
+| PowerShell       | `.ps1`       | `myFunc.ps1`     |
+| PostgreSQL       | `.pg.sql`    | `myFunc.pg.sql`  |
+| MySQL            | `.my.sql`    | `myFunc.my.sql`  |
+| BigQuery         | `.bq.sql`    | `myFunc.bq.sql`  |
+| Snowflake        | `.sf.sql`    | `myFunc.sf.sql`  |
+| MS SQL           | `.ms.sql`    | `myFunc.ms.sql`  |
+| GraphQL          | `.gql`       | `myFunc.gql`     |
+| PHP              | `.php`       | `myFunc.php`     |
+| Rust             | `.rs`        | `myFunc.rs`      |
+| C#               | `.cs`        | `myFunc.cs`      |
+| Java             | `.java`      | `myFunc.java`    |
+
+After creating a runnable, tell the user they can generate lock files by running:
+```bash
+wmill generate-metadata
+```
+
+### Optional YAML configuration
+
+Add a `<id>.yaml` file alongside the code to configure fields or static values:
+
+**backend/get_user.yaml:**
+```yaml
+type: inline
+fields:
+  user_id:
+    type: static
+    value: "default_user"
+```
+
+### Referencing existing scripts
+
+To use an existing Windmill script instead of inline code:
+
+**backend/existing_script.yaml:**
+```yaml
+type: script
+path: f/my_folder/existing_script
+```
+
+For flows:
+```yaml
+type: flow
+path: f/my_folder/my_flow
+```
+
+## Data tables — `raw_app.yaml` config
+
+The `data` block in `raw_app.yaml` controls which tables the app can query.
+
+```yaml
+data:
+  datatable: main           # Default datatable
+  schema: app_schema        # Default schema (optional)
+  tables:
+    - main/users            # Table in public schema
+    - main/app_schema:items # Table in specific schema
+```
+
+**Table reference formats:**
+- `<datatable>` — All tables in the datatable
+- `<datatable>/<table>` — Specific table in public schema
+- `<datatable>/<schema>:<table>` — Table in specific schema
+
+## SQL Migrations (sql_to_apply/)
+
+The `sql_to_apply/` folder is for creating/modifying database tables during development.
+
+### Workflow
+
+1. Create `.sql` files in `sql_to_apply/`
+2. Run `wmill app dev` — the dev server watches this folder
+3. When SQL files change, a modal appears in the browser to confirm execution
+4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
+
+### Example migration
+
+**sql_to_apply/001_create_users.sql:**
+```sql
+CREATE TABLE IF NOT EXISTS users (
+    id SERIAL PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    name TEXT,
+    created_at TIMESTAMP DEFAULT NOW()
+);
+```
+
+After applying, add to `raw_app.yaml`:
+```yaml
+data:
+  tables:
+    - main/users
+```
+
+### Migration best practices
+
+- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
+- **Number files**: `001_`, `002_` for ordering
+- **Always whitelist tables** after creation
+- This folder is NOT synced — it's for local development only
+
+## CLI Commands
+
+`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+
+For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+
+| Command | Description |
+|---------|-------------|
+| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
+| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
+| `wmill generate-metadata` | Generate lock files for backend runnables |
+| `wmill sync push` | Deploy app to Windmill |
+| `wmill sync pull` | Pull latest from Windmill |
+
diff --git a/system_prompts/base/raw-app.md b/system_prompts/base/raw-app.md
index 4114c55a60..04103e434b 100644
--- a/system_prompts/base/raw-app.md
+++ b/system_prompts/base/raw-app.md
@@ -2,132 +2,54 @@
 
 Raw apps let you build custom frontends with React, Svelte, or Vue that connect to Windmill backend runnables and datatables.
 
-## Creating a Raw App
+## App shape
 
-**You — the AI agent — create the app yourself by running `wmill app new` with the right flags. Do NOT tell the user to "run `wmill app new` and follow the prompts" or wait for them to do it.** The bare `wmill app new` is an interactive wizard that hangs waiting for stdin in any non-TTY context (which includes you). Always pass flags.
+A raw app has three logical parts:
 
-### Step 1 — Gather the three required values by asking the user
+- **Frontend** — bundled with esbuild from `index.tsx` as the entrypoint. Files include the entrypoint, components (`App.tsx`), styles, etc.
+- **Backend runnables** — server-side scripts the frontend calls, each addressed by a unique key.
+- **Data** — optional whitelisted datatables (managed PostgreSQL) that the backend runnables can query. The frontend never queries the database directly; backend runnables are the only bridge.
 
-You need three things to run the command:
+## Frontend
 
-1. **summary** — a short description of the app
-2. **path** — the windmill path, e.g. `f/folder/my_app` or `u/username/my_app`
-3. **framework** — one of `react19` (recommended), `react18`, `svelte5`, `vue`
+### Entrypoint
 
-If the user's request did not supply *every* one of these explicitly, ask. Do not guess values, do not invent paths, do not pick a framework on the user's behalf, do not "just use react19 because it's the default".
+`index.tsx` is the bundling entrypoint. It typically renders a top-level `App` component. The bundler is esbuild.
 
-Use whichever interactive question facility your runtime provides — a structured multi-choice tool if available, otherwise plain chat — and group all missing fields into a single round-trip so the user answers them at once:
+### Generated bindings (`wmill.d.ts` / `wmill.ts`)
 
-- For `framework` — multiple-choice with the four allowed values; mark `react19` as `(Recommended)` and put it first.
-- For `summary` and `path` — provide one or two example values as multiple-choice options (the user can pick "Other" to type a free-form answer).
+The frontend imports a generated module that mirrors the backend runnables. **Never write to it directly** — it gets regenerated whenever backend runnables change. Modifying it by hand will be overwritten.
 
-Only proceed once you have concrete values for all three. If the user replies with something ambiguous, ask again rather than guessing.
+### Calling backend runnables
 
-### Step 2 — Run the command yourself
+Import the generated bindings and call the runnable like a function:
 
-Once you have summary + path + framework, run it:
+```typescript
+import { backend } from './wmill';
 
-```bash
-wmill app new \
-  --summary "Customer dashboard" \
-  --path f/sales/dashboard \
-  --framework react19
+// Call a backend runnable
+const user = await backend.get_user({ user_id: '123' });
 ```
 
-That's the minimum. The datatable wizard and the "Open in Claude Desktop?" prompt are skipped silently because passing any of `--summary`/`--path`/`--framework` puts the command in non-interactive mode.
+The frontend cannot reach datatables, workspace items, or external services on its own — it goes through `backend.<key>(args)` for everything server-side.
 
-### Optional flags
+## Backend runnables
 
-Layer these in only when the user asked for them:
+Each runnable has a unique key (used to call it from the frontend) and one of four types:
 
-| Flag | When to add it |
+| Type | What it is |
 |---|---|
-| `--datatable <name>` | The user wants this app wired to a specific Windmill datatable. Without it, the app is created with no datatable. |
-| `--schema <name>` | Together with `--datatable`. Creates the schema with `CREATE SCHEMA IF NOT EXISTS` if it doesn't already exist. |
-| `--overwrite` | The target directory already exists and the user said it's OK to replace. Without it, non-interactive mode aborts with an error so you don't clobber existing work. |
-| `--no-open-in-desktop` | Already implied in non-interactive mode; only needed if you're somehow running interactively. |
+| `inline` | Custom code stored on the app itself. Most common for app-specific logic. |
+| `script` | Reference to an existing workspace script by path. |
+| `flow` | Reference to an existing workspace flow by path. |
+| `hubscript` | Reference to a hub script by path. |
 
-### Step 3 — Offer the visual preview
+### Inline runnables
 
-After `wmill app new` and any initial edits to `App.tsx` / `index.tsx`, **offer** to open the visual preview as a one-sentence next step (e.g. "Want me to open the visual preview?"). Don't auto-open — opening the dev page has side effects (browser window, possibly a `launch.json` entry when an embedded preview tool is in play) the user should consent to.
+Inline runnables carry their own source code. For file-based raw apps, the runnable language is determined by the backend file extension. The script must expose a `main` function as its entrypoint.
 
-For apps the preview command runs from the app folder (`cd <app_path>__raw_app && wmill app dev …`); the `preview` skill picks the proxy vs direct branch based on whether the runtime exposes a tool that can embed a localhost URL. If the user already asked to see/preview/visualize the app in their original request, skip the offer and just invoke the skill.
+**TypeScript example** (`backend/get_user.ts`):
 
-### Anti-patterns to avoid
-
-- ❌ Running `wmill app new` with no flags (the prompt will hang).
-- ❌ Telling the user to "run `wmill app new` and follow the prompts" — that's a step backwards from what you can do directly.
-- ❌ Inventing a path/summary/framework instead of asking the user.
-- ❌ Defaulting to `react19` because the user didn't say — even sensible defaults must be confirmed.
-- ❌ Passing `--overwrite` automatically when the directory exists — confirm with the user first.
-
-### Interactive (only when a human is at the terminal)
-
-```bash
-wmill app new
-```
-
-This is the wizard. It only works when run by a human in a real terminal. Don't call it this way from an agent.
-
-## App Structure
-
-```
-my_app__raw_app/
-├── AGENTS.md              # AI agent instructions (auto-generated)
-├── DATATABLES.md          # Database schemas (run 'wmill app generate-agents' to refresh)
-├── raw_app.yaml           # App configuration (summary, path, data settings)
-├── index.tsx              # Frontend entry point
-├── App.tsx                # Main React/Svelte/Vue component
-├── index.css              # Styles
-├── package.json           # Frontend dependencies
-├── wmill.ts               # Auto-generated backend type definitions (DO NOT EDIT)
-├── backend/               # Backend runnables (server-side scripts)
-│   ├── <id>.<ext>         # Code file (e.g., get_user.ts)
-│   ├── <id>.yaml          # Optional: config for fields, or to reference existing scripts
-│   └── <id>.lock          # Lock file (run 'wmill generate-metadata' to create/update)
-└── sql_to_apply/          # SQL migrations (dev only, not synced)
-    └── *.sql              # SQL files to apply via dev server
-```
-
-## Backend Runnables
-
-Backend runnables are server-side scripts that your frontend can call. They live in the `backend/` folder.
-
-### Creating a Backend Runnable
-
-Add a code file to the `backend/` folder:
-
-```
-backend/<id>.<ext>
-```
-
-The runnable ID is the filename without extension. For example, `get_user.ts` creates a runnable with ID `get_user`.
-
-### Supported Languages
-
-| Language         | Extension    | Example          |
-|------------------|--------------|------------------|
-| TypeScript       | `.ts`        | `myFunc.ts`      |
-| TypeScript (Bun) | `.bun.ts`    | `myFunc.bun.ts`  |
-| TypeScript (Deno)| `.deno.ts`   | `myFunc.deno.ts` |
-| Python           | `.py`        | `myFunc.py`      |
-| Go               | `.go`        | `myFunc.go`      |
-| Bash             | `.sh`        | `myFunc.sh`      |
-| PowerShell       | `.ps1`       | `myFunc.ps1`     |
-| PostgreSQL       | `.pg.sql`    | `myFunc.pg.sql`  |
-| MySQL            | `.my.sql`    | `myFunc.my.sql`  |
-| BigQuery         | `.bq.sql`    | `myFunc.bq.sql`  |
-| Snowflake        | `.sf.sql`    | `myFunc.sf.sql`  |
-| MS SQL           | `.ms.sql`    | `myFunc.ms.sql`  |
-| GraphQL          | `.gql`       | `myFunc.gql`     |
-| PHP              | `.php`       | `myFunc.php`     |
-| Rust             | `.rs`        | `myFunc.rs`      |
-| C#               | `.cs`        | `myFunc.cs`      |
-| Java             | `.java`      | `myFunc.java`    |
-
-### Example Backend Runnable
-
-**backend/get_user.ts:**
 ```typescript
 import * as wmill from 'windmill-client';
 
@@ -138,80 +60,34 @@ export async function main(user_id: string) {
 }
 ```
 
-After creating, tell the user they can generate lock files by running:
-```bash
-wmill generate-metadata
+**Python example** (`backend/get_user.py`):
+
+```python
+import wmill
+
+def main(user_id: str):
+    db = wmill.datatable()
+    user = db.query('SELECT * FROM users WHERE id = $1', user_id).fetch_one()
+    return user
 ```
 
-### Optional YAML Configuration
+### Path runnables (script / flow / hubscript)
 
-Add a `<id>.yaml` file to configure fields or static values:
+When `type` is `script`, `flow`, or `hubscript`, the runnable just stores a `path` to an existing workspace or hub item — no inline code. The referenced item's input/output schema becomes the runnable's surface.
 
-**backend/get_user.yaml:**
-```yaml
-type: inline
-fields:
-  user_id:
-    type: static
-    value: "default_user"
-```
+### Static inputs
 
-### Referencing Existing Scripts
-
-To use an existing Windmill script instead of inline code:
-
-**backend/existing_script.yaml:**
-```yaml
-type: script
-path: f/my_folder/existing_script
-```
-
-For flows:
-```yaml
-type: flow
-path: f/my_folder/my_flow
-```
-
-### Calling Backend from Frontend
-
-Import from the auto-generated `wmill.ts`:
-
-```typescript
-import { backend } from './wmill';
-
-// Call a backend runnable
-const user = await backend.get_user({ user_id: '123' });
-```
-
-The `wmill.ts` file provides type-safe access to all backend runnables.
+`staticInputs` is an optional `Record<string, any>` for arguments not overridable from the frontend. Useful with path runnables to pre-fill some args while leaving the rest to the frontend caller.
 
 ## Data Tables
 
-Raw apps can query Windmill datatables (PostgreSQL databases managed by Windmill).
+Data tables are PostgreSQL databases managed by Windmill. Backend runnables query them via the `wmill` client; the frontend never queries them directly.
 
-### Critical Rules
+### Critical rules
 
-1. **ONLY USE WHITELISTED TABLES**: You can ONLY query tables listed in `raw_app.yaml` → `data.tables`. Tables not in this list are NOT accessible.
-
-2. **ADD TABLES BEFORE USING**: To use a new table, first add it to `data.tables` in `raw_app.yaml`.
-
-3. **USE CONFIGURED DATATABLE/SCHEMA**: Check the app's `raw_app.yaml` for the default datatable and schema.
-
-### Configuration in raw_app.yaml
-
-```yaml
-data:
-  datatable: main           # Default datatable
-  schema: app_schema        # Default schema (optional)
-  tables:
-    - main/users            # Table in public schema
-    - main/app_schema:items # Table in specific schema
-```
-
-**Table reference formats:**
-- `<datatable>` - All tables in the datatable
-- `<datatable>/<table>` - Specific table in public schema
-- `<datatable>/<schema>:<table>` - Table in specific schema
+1. **Whitelisted tables only**: a runnable can only query tables listed in the app's `data.tables` config. Tables not in this list are not accessible.
+2. **Add tables before using**: queries against unlisted tables fail at runtime. When you introduce a new table, register it in `data.tables` first.
+3. **Use the configured datatable/schema**: the app's `data` config sets the default datatable and schema; reference them consistently across runnables.
 
 ### Querying in TypeScript (Bun/Deno)
 
@@ -252,62 +128,10 @@ def main(user_id: str):
     return user
 ```
 
-## SQL Migrations (sql_to_apply/)
-
-The `sql_to_apply/` folder is for creating/modifying database tables during development.
-
-### Workflow
-
-1. Create `.sql` files in `sql_to_apply/`
-2. Run `wmill app dev` - the dev server watches this folder
-3. When SQL files change, a modal appears in the browser to confirm execution
-4. After creating tables, **add them to `data.tables`** in `raw_app.yaml`
-
-### Example Migration
-
-**sql_to_apply/001_create_users.sql:**
-```sql
-CREATE TABLE IF NOT EXISTS users (
-    id SERIAL PRIMARY KEY,
-    email TEXT NOT NULL UNIQUE,
-    name TEXT,
-    created_at TIMESTAMP DEFAULT NOW()
-);
-```
-
-After applying, add to `raw_app.yaml`:
-```yaml
-data:
-  tables:
-    - main/users
-```
-
-### Migration Best Practices
-
-- **Use idempotent SQL**: `CREATE TABLE IF NOT EXISTS`, etc.
-- **Number files**: `001_`, `002_` for ordering
-- **Always whitelist tables** after creation
-- This folder is NOT synced - it's for local development only
-
-## CLI Commands
-
-`wmill app new` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
-
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
-
-| Command | Description |
-|---------|-------------|
-| `wmill app dev` | Start dev server with live reload (see the `preview` skill for the full open-the-app-in-the-IDE-pane procedure). |
-| `wmill app generate-agents` | Refresh AGENTS.md and DATATABLES.md |
-| `wmill generate-metadata` | Generate lock files for backend runnables |
-| `wmill sync push` | Deploy app to Windmill |
-| `wmill sync pull` | Pull latest from Windmill |
-
 ## Best Practices
 
-1. **Check DATATABLES.md** for existing tables before creating new ones
-2. **Use parameterized queries** - never concatenate user input into SQL
-3. **Keep runnables focused** - one function per file
-4. **Use descriptive IDs** - `get_user.ts` not `a.ts`
-5. **Always whitelist tables** - add to `data.tables` before querying
-6. **Generate locks** - tell the user to run `wmill generate-metadata` after adding/modifying backend runnables
+1. **Check existing tables** before creating new ones — reuse beats schema growth.
+2. **Use parameterized queries** — never concatenate user input into SQL.
+3. **Keep runnables focused** — one function per runnable; small surface area.
+4. **Use descriptive keys** — `get_user`, not `a`.
+5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in `data.tables` first.
diff --git a/system_prompts/generate.py b/system_prompts/generate.py
index f291995b88..87f0b63576 100644
--- a/system_prompts/generate.py
+++ b/system_prompts/generate.py
@@ -680,6 +680,8 @@ WORKSPACE_TOOL_ZOD_SCHEMAS = [
     ('NewSqsTrigger', 'sqsTriggerRequestSchema'),
     ('GcpTriggerData', 'gcpTriggerRequestSchema'),
     ('AzureTriggerData', 'azureTriggerRequestSchema'),
+    ('CreateVariable', 'variableRequestSchema'),
+    ('CreateResource', 'resourceRequestSchema'),
 ]
 
 WORKSPACE_TOOL_TRIGGER_SCHEMAS = [
@@ -1486,11 +1488,17 @@ def generate_skills(
     # Ensure skills directory exists
     OUTPUT_SKILLS_DIR.mkdir(parents=True, exist_ok=True)
 
-    # Read base files for additional skills
+    # Read base files for additional skills.
+    # Note: raw-app.md is the chat-relevant authoring guide. The CLI workflow
+    # (wmill app new wizard, on-disk layout, sql_to_apply/, CLI commands) lives
+    # in raw-app-cli.md. Concatenated here for the skill so CLI users see CLI
+    # guidance first, then the platform shape.
     base_dir = SCRIPT_DIR / "base"
+    raw_app_cli_md = read_markdown_file(base_dir / "raw-app-cli.md")
+    raw_app_authoring_md = read_markdown_file(base_dir / "raw-app.md")
     base_content = {
         'flow': f"{flow_cli}\n\n{flow_base}\n\n{openflow_content}",
-        'raw_app': read_markdown_file(base_dir / "raw-app.md"),
+        'raw_app': f"{raw_app_cli_md}\n\n{raw_app_authoring_md}",
         'triggers': read_markdown_file(base_dir / "triggers.md"),
         'schedules': read_markdown_file(base_dir / "schedules.md"),
         'resources': read_markdown_file(base_dir / "resources.md"),
@@ -1856,6 +1864,8 @@ def main():
 
     script_base = read_markdown_file(base_dir / "script-base.md")
     flow_base = read_markdown_file(base_dir / "flow-base.md")
+    resources_base = read_markdown_file(base_dir / "resources.md")
+    raw_app_base = read_markdown_file(base_dir / "raw-app.md")
     workflow_as_code_base = read_markdown_file(base_dir / "workflow-as-code.md")
     flow_cli = read_markdown_file(base_dir / "flow-cli.md")
     flow_chat_special_modules = read_markdown_file(base_dir / "flow-chat-special-modules.md")
@@ -1913,6 +1923,8 @@ def main():
         # Base prompts
         'SCRIPT_BASE': script_base,
         'FLOW_BASE': flow_base,
+        'RESOURCES_BASE': resources_base,
+        'RAW_APP_BASE': raw_app_base,
         'WORKFLOW_AS_CODE_BASE': workflow_as_code_base,
         'FLOW_CHAT_SPECIAL_MODULES': flow_chat_special_modules,
 
@@ -2001,6 +2013,16 @@ export function getFlowPrompt(): string {
   ].filter(Boolean).join('\\n\\n');
 }
 
+// Helper for resource & variable authoring
+export function getResourcePrompt(): string {
+  return prompts.RESOURCES_BASE;
+}
+
+// Helper for raw app authoring (chat consumers)
+export function getRawAppPrompt(): string {
+  return prompts.RAW_APP_BASE;
+}
+
 // Helper to get datatable SDK reference for app mode
 export function getDatatableSdkReference(): string {
   return [
@@ -2037,6 +2059,8 @@ export function getWorkflowAsCodePrompt(language?: string): string {
     index_dts_content = """export * from './prompts';
 export declare function getScriptPrompt(language: string): string;
 export declare function getFlowPrompt(): string;
+export declare function getResourcePrompt(): string;
+export declare function getRawAppPrompt(): string;
 export declare function getDatatableSdkReference(): string;
 export declare function getWorkflowAsCodePrompt(language?: string): string;
 """

From 07a4cb687206cbafaf8244d03148397ca3e4600c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 12 May 2026 10:42:05 +0000
Subject: [PATCH 44/50] branch download UI on shouldDownloadViaClient instead
 of onclick interception (#9118)

* fix(frontend): branch download UI on shouldDownloadViaClient instead of intercepting in onclick

When OpenAPI.TOKEN is set, several download links rendered an `<a href>`
to the API and relied on an `onclick` handler to call `e.preventDefault()`
and route the request through `downloadViaClient`. This is fragile in
embedded contexts (e.g. the whitelabel React SDK) where Svelte's hydrated
event listener may not intercept the click in time, so the browser
follows the unauthenticated `href` straight to the API.

Mirror the drawer pattern already used in `LogViewer` and
`FlowStatusViewerInner`: render a `<button>` calling `downloadViaClient`
when `shouldDownloadViaClient()` is true, and fall back to the plain
`<a href download>` otherwise. Affects the LogViewer top bar, the large-
result download in DisplayResult, the inline S3 link in ObjectViewer,
the CSV link in ParqetCsvTableRenderer, and FileDownload.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(frontend): treat custom HEADERS / basic auth as token equivalents in shouldDownloadViaClient

Customers wiring the SDK with cookie-bypass auth via custom request
headers (e.g. `OpenAPI.HEADERS = getAuthHeaders()` returning a Bearer
header) had `shouldDownloadViaClient()` return false because it only
checked `OpenAPI.TOKEN`. The plain `<a href download>` branch then
followed the link without those headers, so authenticated downloads
silently degraded to the cookie path (or failed when there is no cookie).

Widen the check to any non-cookie auth: TOKEN, HEADERS, or USERNAME
(basic auth). Route `downloadViaClient` through the generated client's
`getHeaders` so all configured auth schemes are applied consistently
instead of hand-building an Authorization header for TOKEN only.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../src/lib/components/DisplayResult.svelte   | 23 ++++++-----
 frontend/src/lib/components/LogViewer.svelte  | 28 +++++++-------
 .../components/ParqetCsvTableRenderer.svelte  | 28 +++++++++-----
 .../common/fileDownload/FileDownload.svelte   | 38 +++++++++----------
 .../propertyPicker/ObjectViewer.svelte        | 32 ++++++++++------
 frontend/src/lib/utils/downloadFile.ts        | 23 +++++------
 6 files changed, 92 insertions(+), 80 deletions(-)

diff --git a/frontend/src/lib/components/DisplayResult.svelte b/frontend/src/lib/components/DisplayResult.svelte
index ff4196443d..8ac06662d8 100644
--- a/frontend/src/lib/components/DisplayResult.svelte
+++ b/frontend/src/lib/components/DisplayResult.svelte
@@ -187,11 +187,6 @@
 			: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`
 	)
 	let resultDownloadName = $derived(`${filename ?? 'result'}.json`)
-	async function onResultDownload(e: MouseEvent) {
-		if (!resultApiPath || !shouldDownloadViaClient()) return
-		e.preventDefault()
-		await downloadViaClient(resultApiPath, resultDownloadName)
-	}
 
 	function checkIfS3(result: any, keys: string[]) {
 		return keys.includes('s3') && typeof result.s3 === 'string'
@@ -1020,13 +1015,17 @@
 					{:else}
 						{#if largeObject}
 							<div class="text-xs text-emphasis"
-								><a
-									download={resultDownloadName}
-									href={resultDownloadHref}
-									onclick={onResultDownload}
-								>
-									Download {filename ? '' : 'as JSON'}
-								</a>
+								>{#if resultApiPath && shouldDownloadViaClient()}
+									<button
+										onclick={() => downloadViaClient(resultApiPath!, resultDownloadName)}
+									>
+										Download {filename ? '' : 'as JSON'}
+									</button>
+								{:else}
+									<a download={resultDownloadName} href={resultDownloadHref}>
+										Download {filename ? '' : 'as JSON'}
+									</a>
+								{/if}
 								{#if download_as_csv}
 									<DownloadCsv
 										getContent={() => convertJsonToCsv(result)}
diff --git a/frontend/src/lib/components/LogViewer.svelte b/frontend/src/lib/components/LogViewer.svelte
index 9d7b71b6e3..39089dec8b 100644
--- a/frontend/src/lib/components/LogViewer.svelte
+++ b/frontend/src/lib/components/LogViewer.svelte
@@ -208,11 +208,6 @@
 	let logsApiPath = $derived(`/w/${$workspaceStore}/jobs_u/get_logs/${jobId}`)
 	let downloadHref = $derived(withExternalDomain(`${base}/api${logsApiPath}`))
 	let downloadName = $derived(`windmill_logs_${jobId}.txt`)
-	async function onDownloadClick(e: MouseEvent) {
-		if (!shouldDownloadViaClient()) return
-		e.preventDefault()
-		await downloadViaClient(logsApiPath, downloadName)
-	}
 	let truncatedContent = $derived(truncateContent(content, loadedFromObjectStore, LOG_LIMIT))
 	let prefixInfo = $derived(findPrefixInfo(truncatedContent))
 	let downloadStartUrl = $derived(findStartUrl(truncatedContent, prefixInfo))
@@ -357,14 +352,21 @@
 				<div class="flex gap-2 justify-end flex-1">
 					{#if jobId && download}
 						<div class="flex items-center">
-							<a
-								class="text-primary pb-0.5"
-								target="_blank"
-								href={downloadHref}
-								download={downloadName}
-								onclick={onDownloadClick}
-								><Download size="14" />
-							</a>
+							{#if shouldDownloadViaClient()}
+								<button
+									class="text-primary pb-0.5"
+									onclick={() => downloadViaClient(logsApiPath, downloadName)}
+									><Download size="14" />
+								</button>
+							{:else}
+								<a
+									class="text-primary pb-0.5"
+									target="_blank"
+									href={downloadHref}
+									download={downloadName}
+									><Download size="14" />
+								</a>
+							{/if}
 						</div>
 					{/if}
 					<button onclick={logViewer.openDrawer}><Expand size="12" /></button>
diff --git a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
index 91cc107791..fd08eb64be 100644
--- a/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
+++ b/frontend/src/lib/components/ParqetCsvTableRenderer.svelte
@@ -203,16 +203,24 @@
 	{#if !disable_download && !s3resource.endsWith('.csv')}
 		{@const csvApiPath = `/w/${workspaceId}/job_helpers/download_s3_parquet_file_as_csv?file_key=${encodeURIComponent(s3resource)}${storage ? `&storage=${storage}` : ''}`}
 		{@const csvName = (s3resource.split('/').pop() ?? 'download') + '.csv'}
-		<a
-			target="_blank"
-			href="{base}/api{csvApiPath}"
-			class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
-			onclick={async (e) => {
-				if (!shouldDownloadViaClient()) return
-				e.preventDefault()
-				await downloadViaClient(csvApiPath, csvName)
-			}}><div class="flex flex-row-reverse gap-2 items-center"><Download size={12} /> CSV</div></a
-		>
+		{#if shouldDownloadViaClient()}
+			<button
+				class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
+				onclick={() => downloadViaClient(csvApiPath, csvName)}
+				><div class="flex flex-row-reverse gap-2 items-center"
+					><Download size={12} /> CSV</div
+				></button
+			>
+		{:else}
+			<a
+				target="_blank"
+				href="{base}/api{csvApiPath}"
+				class="text-secondary w-full text-right underline text-2xs whitespace-nowrap"
+				><div class="flex flex-row-reverse gap-2 items-center"
+					><Download size={12} /> CSV</div
+				></a
+			>
+		{/if}
 	{/if}
 
 	{#if nbRows != undefined}
diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index 0cb48eb7e1..8d6529764b 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -26,26 +26,26 @@
 	)
 	let href = $derived(`${base}/api${apiPath}`)
 
-	async function onclick(e: MouseEvent) {
-		if (!shouldDownloadViaClient()) return
-		e.preventDefault()
-		await downloadViaClient(apiPath, filename)
-	}
+	const sharedClass = `relative center-center flex w-full text-center font-normal text-primary text-sm
+border border-dashed border-gray-400 hover:border-blue-500
+focus-within:border-blue-500 hover:bg-blue-50 dark:hover:bg-frost-900 focus-within:bg-blue-50
+duration-200 rounded-lg p-1 gap-2`
 </script>
 
 {#if s3object && s3object?.s3}
-	<a
-		class="relative center-center flex w-full text-center font-normal text-primary text-sm
-border border-dashed border-gray-400 hover:border-blue-500
-focus-within:border-blue-500 hover:bg-blue-50 dark:hover:bg-frost-900 focus-within:bg-blue-50
-duration-200 rounded-lg p-1 gap-2"
-		{href}
-		download={filename}
-		{onclick}
-	>
-		<Download />
-		<span>
-			{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
-		</span>
-	</a>
+	{#if shouldDownloadViaClient()}
+		<button class={sharedClass} onclick={() => downloadViaClient(apiPath, filename)}>
+			<Download />
+			<span>
+				{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
+			</span>
+		</button>
+	{:else}
+		<a class={sharedClass} {href} download={filename}>
+			<Download />
+			<span>
+				{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
+			</span>
+		</a>
+	{/if}
 {/if}
diff --git a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
index d954618518..9746991d6b 100644
--- a/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
+++ b/frontend/src/lib/components/propertyPicker/ObjectViewer.svelte
@@ -410,18 +410,26 @@
 						{#if getTypeAsString(jsonFiltered) === 's3object'}
 							{@const s3DownloadApiPath = `/w/${$workspaceStore}/job_helpers/download_s3_file?file_key=${encodeURIComponent(jsonFiltered?.s3 ?? '')}${jsonFiltered?.storage ? `&storage=${jsonFiltered.storage}` : ''}`}
 							{@const s3DownloadName = jsonFiltered?.s3.split('/').pop() ?? 'unnamed_download.file'}
-							<a
-								class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
-								href={`/api${s3DownloadApiPath}`}
-								download={s3DownloadName}
-								onclick={async (e) => {
-									if (!shouldDownloadViaClient()) return
-									e.preventDefault()
-									await downloadViaClient(s3DownloadApiPath, s3DownloadName)
-								}}
-							>
-								<span class="flex items-center gap-1"><Download size={12} />download</span>
-							</a>
+							{#if shouldDownloadViaClient()}
+								<button
+									class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
+									onclick={() => downloadViaClient(s3DownloadApiPath, s3DownloadName)}
+								>
+									<span class="flex items-center gap-1"
+										><Download size={12} />download</span
+									>
+								</button>
+							{:else}
+								<a
+									class="text-secondary underline font-semibold text-2xs whitespace-nowrap ml-1 w-fit"
+									href={`/api${s3DownloadApiPath}`}
+									download={s3DownloadName}
+								>
+									<span class="flex items-center gap-1"
+										><Download size={12} />download</span
+									>
+								</a>
+							{/if}
 							<button
 								class="text-secondary underline text-2xs whitespace-nowrap ml-1"
 								onclick={() => {
diff --git a/frontend/src/lib/utils/downloadFile.ts b/frontend/src/lib/utils/downloadFile.ts
index 40f3d8df12..fe37ee5f2c 100644
--- a/frontend/src/lib/utils/downloadFile.ts
+++ b/frontend/src/lib/utils/downloadFile.ts
@@ -1,32 +1,27 @@
 import { OpenAPI } from '$lib/gen'
+import { getHeaders } from '$lib/gen/core/request'
 import { sendUserToast } from '$lib/toast'
 
-async function resolveToken(): Promise<string | undefined> {
-	const t = OpenAPI.TOKEN
-	if (!t) return undefined
-	return typeof t === 'string' ? t : await t({} as any)
-}
-
 /**
- * When OpenAPI.TOKEN is set we cannot rely on a plain `<a href>` browser navigation
- * because the browser does not attach the Authorization header. In that case fetch
- * the file via the OpenAPI client (which uses OpenAPI.BASE and the Bearer token) and
- * trigger a download from a blob URL. Otherwise let the default link behavior happen.
+ * When OpenAPI is configured to authenticate via headers (TOKEN, basic auth,
+ * or arbitrary HEADERS) we cannot rely on a plain `<a href>` browser
+ * navigation because the browser does not attach those headers. In that case
+ * fetch the file via the OpenAPI client (which carries the configured auth)
+ * and trigger a download from a blob URL. Cookie-only auth still works with
+ * a plain link.
  *
  * `apiPath` should be the path relative to OpenAPI.BASE, starting with `/`
  * (e.g. `/w/foo/job_helpers/download_s3_file?file_key=...`).
  */
 export function shouldDownloadViaClient(): boolean {
-	return Boolean(OpenAPI.TOKEN)
+	return Boolean(OpenAPI.TOKEN || OpenAPI.HEADERS || OpenAPI.USERNAME)
 }
 
 export async function downloadViaClient(apiPath: string, filename: string): Promise<void> {
-	const token = await resolveToken()
 	const url = `${OpenAPI.BASE}${apiPath}`
-	const headers: Record<string, string> = {}
-	if (token) headers['Authorization'] = `Bearer ${token}`
 	let response: Response
 	try {
+		const headers = await getHeaders(OpenAPI, { method: 'GET', url: apiPath })
 		response = await fetch(url, { headers, credentials: OpenAPI.CREDENTIALS })
 	} catch (e) {
 		sendUserToast(`Download failed: ${e}`, true)

From 0bb77a9bd60af117f0c59bc87d7b38f9ccedb60e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 12 May 2026 11:48:42 +0000
Subject: [PATCH 45/50] route result and args downloads through
 downloadViaClient (#9122)

* fix(frontend): route result and args downloads through downloadViaClient

* refactor(frontend): reuse argsApiPath in WINDMILL_TOO_BIG branch
---
 .../components/DisplayResultControlBar.svelte | 40 ++++++++---
 frontend/src/lib/components/JobArgs.svelte    | 68 ++++++++++++-------
 2 files changed, 73 insertions(+), 35 deletions(-)

diff --git a/frontend/src/lib/components/DisplayResultControlBar.svelte b/frontend/src/lib/components/DisplayResultControlBar.svelte
index 95d0a3414e..d45ca3f92d 100644
--- a/frontend/src/lib/components/DisplayResultControlBar.svelte
+++ b/frontend/src/lib/components/DisplayResultControlBar.svelte
@@ -3,6 +3,7 @@
 	import { Download, InfoIcon, ClipboardCopy, Expand } from 'lucide-svelte'
 	import Popover from './Popover.svelte'
 	import { copyToClipboard } from '$lib/utils'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 	import type { DisplayResultUi } from './custom_ui'
 	import { createEventDispatcher } from 'svelte'
 
@@ -37,21 +38,38 @@
 			return 'error stringifying object: ' + e.toString()
 		}
 	}
+
+	let resultApiPath = $derived(
+		workspaceId && jobId
+			? nodeId
+				? `/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
+				: `/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
+			: undefined
+	)
+	let downloadName = $derived(`${filename ?? 'result'}.json`)
 </script>
 
 <div class={twMerge('flex flex-row gap-2.5 z-10 text-primary -mt-1 items-center')}>
 	{#if customUi?.disableDownload !== true}
-		<a
-			download="{filename ?? 'result'}.json"
-			class="text-current"
-			href={workspaceId && jobId
-				? nodeId
-					? `${base}/api/w/${workspaceId}/jobs/result_by_id/${jobId}/${nodeId}`
-					: `${base}/api/w/${workspaceId}/jobs_u/completed/get_result/${jobId}`
-				: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
-		>
-			<Download size={14} />
-		</a>
+		{#if resultApiPath && shouldDownloadViaClient()}
+			<button
+				class="text-current"
+				onclick={() => downloadViaClient(resultApiPath!, downloadName)}
+				aria-label="Download result"
+			>
+				<Download size={14} />
+			</button>
+		{:else}
+			<a
+				download={downloadName}
+				class="text-current"
+				href={resultApiPath
+					? `${base}/api${resultApiPath}`
+					: `data:text/json;charset=utf-8,${encodeURIComponent(toJsonStr(result))}`}
+			>
+				<Download size={14} />
+			</a>
+		{/if}
 	{/if}
 	{#if disableTooltips !== true}
 		<Popover documentationLink="https://www.windmill.dev/docs/core_concepts/rich_display_rendering">
diff --git a/frontend/src/lib/components/JobArgs.svelte b/frontend/src/lib/components/JobArgs.svelte
index 68ca3c078f..77c94de11e 100644
--- a/frontend/src/lib/components/JobArgs.svelte
+++ b/frontend/src/lib/components/JobArgs.svelte
@@ -13,6 +13,7 @@
 	import HighlightTheme from './HighlightTheme.svelte'
 	import { deepEqual } from 'fast-equals'
 	import { isWindmillTooBigObject } from './job_args'
+	import { downloadViaClient, shouldDownloadViaClient } from '$lib/utils/downloadFile'
 
 	interface Props {
 		id?: string | undefined
@@ -27,6 +28,10 @@
 	let runLocally: Drawer | undefined = $state()
 	let jsonStr = $state('')
 
+	const argsDownloadName = 'windmill-args.json'
+	let argsApiPath = $derived(id && workspace ? `/w/${workspace}/jobs_u/get_args/${id}` : undefined)
+	let argsDataHref = $derived(`data:text/json;charset=utf-8,${encodeURIComponent(jsonStr)}`)
+
 	function pythonCode() {
 		return `
 if __name__ == "__main__":
@@ -60,10 +65,12 @@ ${Object.entries(args)
 {#if args && typeof args === 'object' && deepEqual( Object.keys(args ?? {}), ['reason'] ) && args['reason'] == 'PREPROCESSOR_ARGS_ARE_DISCARDED'}
 	Preprocessor args are discarded
 {:else if id && workspace && args && typeof args === 'object' && deepEqual( Object.keys(args ?? {}), ['reason'] ) && args['reason'] == 'WINDMILL_TOO_BIG'}
-	The args are too big in size to be able to fetch alongside job. Please <a
-		href="/api/w/{workspace}/jobs_u/get_args/{id}"
-		target="_blank">download the JSON file to view them</a
-	>.
+	The args are too big in size to be able to fetch alongside job. Please {#if shouldDownloadViaClient()}<button
+			class="text-blue-500 hover:underline"
+			onclick={() => downloadViaClient(argsApiPath!, argsDownloadName)}
+			>download the JSON file to view them</button
+		>{:else}<a href="/api{argsApiPath}" target="_blank">download the JSON file to view them</a
+		>{/if}.
 {:else}
 	<div class="relative">
 		<DataTable size="sm" containerClass="bg-surface-tertiary">
@@ -120,17 +127,26 @@ ${Object.entries(args)
 <Drawer bind:this={jsonViewer} size="900px">
 	<DrawerContent title="Expanded Args" on:close={jsonViewer.closeDrawer}>
 		{#snippet actions()}
-			<Button
-				download="windmill-args.json"
-				href={id && workspace
-					? `/api/w/${workspace}/jobs_u/get_args/${id}`
-					: `data:text/json;charset=utf-8,${encodeURIComponent(jsonStr)}`}
-				startIcon={{ icon: Download }}
-				size="xs"
-				color="light"
-			>
-				Download
-			</Button>
+			{#if argsApiPath && shouldDownloadViaClient()}
+				<Button
+					on:click={() => downloadViaClient(argsApiPath!, argsDownloadName)}
+					startIcon={{ icon: Download }}
+					size="xs"
+					color="light"
+				>
+					Download
+				</Button>
+			{:else}
+				<Button
+					download={argsDownloadName}
+					href={argsApiPath ? `/api${argsApiPath}` : argsDataHref}
+					startIcon={{ icon: Download }}
+					size="xs"
+					color="light"
+				>
+					Download
+				</Button>
+			{/if}
 			<Button
 				on:click={() => runLocally?.openDrawer()}
 				color="light"
@@ -150,15 +166,19 @@ ${Object.entries(args)
 		{/snippet}
 		{#if jsonStr.length > 100000 || (id && workspace && args && isWindmillTooBigObject(args))}
 			<div class="text-sm mb-2 text-primary">
-				<a
-					download="windmill-args.json"
-					href={id && workspace
-						? `/api/w/${workspace}/jobs_u/get_args/${id}`
-						: `data:text/json;charset=utf-8,${encodeURIComponent(jsonStr)}`}
-				>
-					JSON is too large to be displayed in full.
-				</a></div
-			>
+				{#if argsApiPath && shouldDownloadViaClient()}
+					<button
+						class="underline"
+						onclick={() => downloadViaClient(argsApiPath!, argsDownloadName)}
+					>
+						JSON is too large to be displayed in full.
+					</button>
+				{:else}
+					<a download={argsDownloadName} href={argsApiPath ? `/api${argsApiPath}` : argsDataHref}>
+						JSON is too large to be displayed in full.
+					</a>
+				{/if}
+			</div>
 		{:else}
 			<Highlight language={json} code={jsonStr.replace(/\\n/g, '\n')} />
 		{/if}

From cab0000f3a5e9a0b201a85da1a01b1f82df8a316 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 12 May 2026 12:07:45 +0000
Subject: [PATCH 46/50] fix: preserve explicit nulls for typed fields in bulk
 instance config (#9123)

Setting a typed instance setting (e.g. `object_store_cache_config`) to
`null` via `PUT /api/settings/instance_config` was silently ignored:
`Json<InstanceConfig>` deserialized null to `None`, and `to_settings_map`
then dropped it via `skip_serializing_if = "Option::is_none"`, so
`diff_global_settings` (Merge mode) never saw the deletion.

Add `#[serde(remote = "Self")]` to `GlobalSettings` plus a manual
`Deserialize` impl that captures top-level explicit nulls into `extra`,
which already round-trips correctly via flatten. The handler stays
fully typed.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../windmill-common/src/instance_config.rs    | 139 ++++++++++++++++++
 1 file changed, 139 insertions(+)

diff --git a/backend/windmill-common/src/instance_config.rs b/backend/windmill-common/src/instance_config.rs
index e9a9731f74..e19182be30 100644
--- a/backend/windmill-common/src/instance_config.rs
+++ b/backend/windmill-common/src/instance_config.rs
@@ -200,7 +200,15 @@ fn opaque_json_schema(_: &mut schemars::gen::SchemaGenerator) -> schemars::schem
 
 /// Typed global settings with schema validation.
 /// Known settings have explicit fields; unknown settings pass through via `extra`.
+///
+/// `#[serde(remote = "Self")]` turns the derived (de)serializers into inherent
+/// associated functions so we can wrap them with the manual `Deserialize` impl
+/// below. The wrapper preserves explicit `null` values (which the typed
+/// `Option<T>` fields would otherwise silently drop on round-trip through
+/// `to_settings_map`) by stashing them in `extra`, where they survive
+/// re-serialization and reach `diff_global_settings` as proper deletes.
 #[derive(Deserialize, Serialize, Clone, Debug, Default)]
+#[serde(remote = "Self")]
 #[cfg_attr(feature = "instance_config_schema", derive(schemars::JsonSchema))]
 pub struct GlobalSettings {
     // Numeric settings
@@ -373,6 +381,42 @@ pub struct GlobalSettings {
     pub extra: BTreeMap<String, serde_json::Value>,
 }
 
+impl Serialize for GlobalSettings {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        Self::serialize(self, serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for GlobalSettings {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        // Capture top-level keys explicitly set to `null` so they survive the
+        // `to_settings_map` round-trip — typed `Option<T>` fields all use
+        // `skip_serializing_if = "Option::is_none"`, which would otherwise
+        // silently drop the null. We stash the null entries in `extra`, which
+        // serializes them back out as `null` for `diff_global_settings` to
+        // route to deletes.
+        let mut value = serde_json::Value::deserialize(deserializer)?;
+        let null_keys: Vec<String> = value
+            .as_object()
+            .map(|m| {
+                m.iter()
+                    .filter_map(|(k, v)| v.is_null().then(|| k.clone()))
+                    .collect()
+            })
+            .unwrap_or_default();
+        if let Some(obj) = value.as_object_mut() {
+            for k in &null_keys {
+                obj.remove(k);
+            }
+        }
+        let mut s = Self::deserialize(value).map_err(serde::de::Error::custom)?;
+        for k in null_keys {
+            s.extra.insert(k, serde_json::Value::Null);
+        }
+        Ok(s)
+    }
+}
+
 impl GlobalSettings {
     /// Convert to a flat `BTreeMap` suitable for DB sync.
     pub fn to_settings_map(&self) -> BTreeMap<String, serde_json::Value> {
@@ -1930,6 +1974,101 @@ mod tests {
     // to_settings_map edge cases
     // -----------------------------------------------------------------------
 
+    /// Regression test for bulk-endpoint deletion of typed settings.
+    ///
+    /// A naive `#[derive(Deserialize)]` would route
+    /// `{"object_store_cache_config": null}` to the typed `Option<...>` field
+    /// as `None`, and `skip_serializing_if = "Option::is_none"` would then
+    /// strip it from `to_settings_map`, so `diff_global_settings` (Merge mode)
+    /// would never see the deletion. The manual `Deserialize` impl on
+    /// `GlobalSettings` captures explicit top-level nulls into `extra` so they
+    /// survive the round-trip and reach `diff_global_settings` as proper
+    /// deletes.
+    #[test]
+    fn explicit_null_on_typed_field_survives_round_trip() {
+        let json = serde_json::json!({
+            "object_store_cache_config": null,
+            "secret_backend": null,
+            "smtp_settings": null,
+            "base_url": "https://x",
+        });
+        let settings: GlobalSettings =
+            serde_json::from_value(json).expect("null should deserialize");
+        assert!(settings.object_store_cache_config.is_none());
+        assert!(settings.secret_backend.is_none());
+        assert!(settings.smtp_settings.is_none());
+        assert_eq!(settings.base_url.as_deref(), Some("https://x"));
+        let map = settings.to_settings_map();
+        assert_eq!(map["object_store_cache_config"], serde_json::Value::Null);
+        assert_eq!(map["secret_backend"], serde_json::Value::Null);
+        assert_eq!(map["smtp_settings"], serde_json::Value::Null);
+        assert_eq!(map["base_url"], serde_json::json!("https://x"));
+    }
+
+    /// Absent keys remain absent — critical so a PUT that only sets a single
+    /// field doesn't accidentally delete every other setting in Merge mode.
+    #[test]
+    fn absent_typed_fields_do_not_appear_in_map() {
+        let settings: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"base_url": "https://x"})).unwrap();
+        let map = settings.to_settings_map();
+        assert!(!map.contains_key("object_store_cache_config"));
+        assert!(!map.contains_key("smtp_settings"));
+        assert_eq!(map.get("base_url"), Some(&serde_json::json!("https://x")));
+    }
+
+    /// End-to-end: deserialize → `to_settings_map` → diff in Merge mode with
+    /// an explicit null produces a delete (the scenario that silently failed
+    /// before the manual `Deserialize` impl).
+    #[test]
+    fn deserialize_then_diff_deletes_typed_null() {
+        let mut current = BTreeMap::new();
+        current.insert(
+            "object_store_cache_config".to_string(),
+            serde_json::json!({"type": "S3", "bucket": "b"}),
+        );
+        let desired: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"object_store_cache_config": null})).unwrap();
+        let desired_map = desired.to_settings_map();
+        let diff = diff_global_settings(&current, &desired_map, ApplyMode::Merge);
+        assert!(diff.upserts.is_empty());
+        assert_eq!(diff.deletes, vec!["object_store_cache_config".to_string()]);
+    }
+
+    /// Nested nulls inside a typed sub-struct are not promoted to top-level
+    /// deletes — only the top-level key matters, mirroring the per-key API.
+    #[test]
+    fn nested_null_inside_typed_field_is_not_treated_as_top_level_null() {
+        let settings: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"smtp_settings": {"smtp_host": null}}))
+                .unwrap();
+        let map = settings.to_settings_map();
+        assert!(
+            map["smtp_settings"].is_object(),
+            "smtp_settings should be an object, not null"
+        );
+    }
+
+    /// Unknown/extra keys with explicit null still flow through `extra` — this
+    /// was already correct before the manual impl; guard against regression.
+    #[test]
+    fn explicit_null_on_extra_field_survives_round_trip() {
+        let settings: GlobalSettings =
+            serde_json::from_value(serde_json::json!({"unknown_legacy_setting": null})).unwrap();
+        let map = settings.to_settings_map();
+        assert_eq!(map["unknown_legacy_setting"], serde_json::Value::Null);
+    }
+
+    /// Top-level non-object input must reject with a deserialize error rather
+    /// than silently producing defaults. Matches the previous derive behavior.
+    #[test]
+    fn non_object_top_level_input_errors() {
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!(null)).is_err());
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!("s")).is_err());
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!(42)).is_err());
+        assert!(serde_json::from_value::<GlobalSettings>(serde_json::json!([])).is_err());
+    }
+
     #[test]
     fn to_settings_map_empty_defaults() {
         let settings = GlobalSettings::default();

From c6346aabe0a1770e9e4c11a4da23d3fa081b9e6b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 12 May 2026 12:32:07 +0000
Subject: [PATCH 47/50] chore(main): release 1.700.2 (#9117)

* chore(main): release 1.700.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |   8 +
 backend/Cargo.lock                            | 160 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 .../parsers/windmill-parser-wasm/Cargo.lock   |  48 +++---
 .../parsers/windmill-parser-wasm/Cargo.toml   |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/main.ts                               |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   2 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 17 files changed, 128 insertions(+), 120 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13a1cdc370..e297309df2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## [1.700.2](https://github.com/windmill-labs/windmill/compare/v1.700.1...v1.700.2) (2026-05-12)
+
+
+### Bug Fixes
+
+* preserve explicit nulls for typed fields in bulk instance config ([#9123](https://github.com/windmill-labs/windmill/issues/9123)) ([cab0000](https://github.com/windmill-labs/windmill/commit/cab0000f3a5e9a0b201a85da1a01b1f82df8a316))
+* preserve negative integers in Bedrock tool schema conversion ([#9116](https://github.com/windmill-labs/windmill/issues/9116)) ([01e21c7](https://github.com/windmill-labs/windmill/commit/01e21c7f913eaf7dffc3d6a31501418ff2104c8b))
+
 ## [1.700.1](https://github.com/windmill-labs/windmill/compare/v1.700.0...v1.700.1) (2026-05-11)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 56d42da02b..7a6433e5af 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -13788,7 +13788,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -13869,7 +13869,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-ai"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "async-trait",
  "aws-config",
@@ -13899,7 +13899,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -13912,7 +13912,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -14055,7 +14055,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14078,7 +14078,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14091,7 +14091,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14117,7 +14117,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -14127,7 +14127,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14144,7 +14144,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "base64 0.22.1",
@@ -14166,7 +14166,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14189,7 +14189,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14205,7 +14205,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14226,7 +14226,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14247,7 +14247,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14261,7 +14261,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -14293,7 +14293,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14318,7 +14318,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "flate2",
@@ -14336,7 +14336,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14358,7 +14358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14378,7 +14378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14408,7 +14408,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14436,7 +14436,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "lazy_static",
  "serde",
@@ -14448,7 +14448,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "argon2",
  "axum 0.8.9",
@@ -14473,7 +14473,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14487,7 +14487,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "axum 0.8.9",
  "chrono",
@@ -14520,7 +14520,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -14534,7 +14534,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "axum 0.8.9",
@@ -14553,7 +14553,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -14654,7 +14654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -14673,7 +14673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "regex",
  "serde",
@@ -14688,7 +14688,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -14712,7 +14712,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -14729,7 +14729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -14745,7 +14745,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14766,7 +14766,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -14797,7 +14797,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "arc-swap",
@@ -14822,7 +14822,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -14856,7 +14856,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "futures",
@@ -14874,7 +14874,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -14883,7 +14883,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14895,7 +14895,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -14907,7 +14907,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -14919,7 +14919,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -14931,7 +14931,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -14943,7 +14943,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -14954,7 +14954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -14965,7 +14965,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -14977,7 +14977,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -14988,7 +14988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15010,7 +15010,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15022,7 +15022,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15036,7 +15036,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15053,7 +15053,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15066,7 +15066,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15078,7 +15078,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15096,7 +15096,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -15112,7 +15112,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -15128,7 +15128,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15139,7 +15139,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15176,7 +15176,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "const_format",
@@ -15214,7 +15214,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -15225,7 +15225,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15255,7 +15255,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15279,7 +15279,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15312,7 +15312,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-azure"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15345,7 +15345,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15365,7 +15365,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15399,7 +15399,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15435,7 +15435,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15458,7 +15458,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15482,7 +15482,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15506,7 +15506,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15541,7 +15541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15569,7 +15569,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15592,7 +15592,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "bitflags 2.11.1",
@@ -15611,7 +15611,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -15724,7 +15724,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "bytes",
  "futures",
@@ -16558,9 +16558,9 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.7"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 104fc6e136..0babfe3810 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.700.1"
+version = "1.700.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -87,7 +87,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.700.1"
+version = "1.700.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.lock b/backend/parsers/windmill-parser-wasm/Cargo.lock
index 43780b0703..954303108f 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.lock
+++ b/backend/parsers/windmill-parser-wasm/Cargo.lock
@@ -6183,7 +6183,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill-common"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "aho-corasick",
  "anyhow",
@@ -6263,7 +6263,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -6275,7 +6275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "convert_case",
  "serde",
@@ -6284,7 +6284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6296,7 +6296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6308,7 +6308,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -6320,7 +6320,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6332,7 +6332,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6344,7 +6344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -6355,7 +6355,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6366,7 +6366,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -6378,7 +6378,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6389,7 +6389,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -6411,7 +6411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -6423,7 +6423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6437,7 +6437,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "convert_case",
@@ -6454,7 +6454,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6467,7 +6467,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6479,7 +6479,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -6497,7 +6497,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -6513,7 +6513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -6529,7 +6529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wasm"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "getrandom 0.2.17",
@@ -6561,7 +6561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -6572,7 +6572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.700.1"
+version = "1.700.2"
 dependencies = [
  "anyhow",
  "bitflags",
diff --git a/backend/parsers/windmill-parser-wasm/Cargo.toml b/backend/parsers/windmill-parser-wasm/Cargo.toml
index e470ae9e38..0131c16089 100644
--- a/backend/parsers/windmill-parser-wasm/Cargo.toml
+++ b/backend/parsers/windmill-parser-wasm/Cargo.toml
@@ -12,7 +12,7 @@ resolver = "2"
 members = ["."]
 
 [workspace.package]
-version = "1.700.1"
+version = "1.700.2"
 edition = "2021"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index b1e8ceabdb..258e268f88 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.700.1
+  version: 1.700.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index ea5a58f71b..22cc1f75eb 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.700.1";
+export const VERSION = "v1.700.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 8980331c31..a755c16901 100755
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -79,7 +79,7 @@ export {
   token,
 };
 
-export const VERSION = "1.700.1";
+export const VERSION = "1.700.2";
 
 // Re-exported from constants.ts to maintain backwards compatibility
 export { WM_FORK_PREFIX } from "./core/constants.ts";
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 8123f93c57..2483fa4d97 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.700.1",
+	"version": "1.700.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.700.1",
+			"version": "1.700.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 8da5968bb0..32bdc019f0 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.700.1",
+	"version": "1.700.2",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 73496b676f..9425a21af9 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,7 +4,7 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.700.1"
+wmill = ">=1.700.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index be157a3961..7769f50a1c 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: '3.0.3'
 
 info:
-  version: 1.700.1
+  version: 1.700.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 8dfc135d48..586ece80a7 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.700.1'
+    ModuleVersion     = '1.700.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 5d9917d249..1699abaebf 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.700.1"
+version = "1.700.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index cffc69e164..251f481322 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.700.1",
+  "version": "1.700.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./sqlUtils.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index caad8ab8ad..53005f6120 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.700.1",
+  "version": "1.700.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "sideEffects": false,
diff --git a/version.txt b/version.txt
index e52350d307..cfabbb8494 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.700.1
+1.700.2

From a305a74e732c52d39e54c27899de165b9073ded7 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Tue, 12 May 2026 15:44:00 +0200
Subject: [PATCH 48/50] refactor: require ai evals proxy backend (#9119)

---
 ai_evals/README.md                            |  18 ++-
 .../adapters/frontend/backendPreview.test.ts  |   2 -
 ai_evals/adapters/frontend/backendPreview.ts  |   9 +-
 ai_evals/adapters/frontend/benchmarkRunner.ts |  18 ++-
 .../frontend/core/app/appEvalRunner.ts        |  17 ++-
 .../adapters/frontend/core/app/fileHelpers.ts |  37 ++++++-
 .../frontend/core/flow/flowEvalRunner.ts      |  13 +--
 .../frontend/core/script/scriptEvalRunner.ts  |   9 +-
 .../frontend/core/shared/baseEvalRunner.ts    |  76 ++++++-------
 .../core/shared/providerConfig.test.ts        |  26 -----
 .../frontend/core/shared/providerConfig.ts    |  73 ++----------
 .../adapters/frontend/core/shared/types.ts    |   8 +-
 ai_evals/adapters/frontend/runtime.ts         |   5 -
 .../adapters/frontend/windmillBackend.test.ts | 104 ++++++++++++++++++
 ai_evals/adapters/frontend/windmillBackend.ts |  31 ++++--
 ai_evals/cli/index.ts                         |  25 +----
 ai_evals/core/backendValidation.ts            |   2 -
 ai_evals/core/frontendTransport.test.ts       |  64 -----------
 ai_evals/core/frontendTransport.ts            |  49 ---------
 ai_evals/core/results.ts                      |   6 -
 ai_evals/core/types.ts                        |   2 -
 ai_evals/core/windmillBackendSettings.test.ts |  63 +++++++++++
 ai_evals/core/windmillBackendSettings.ts      |  22 ----
 ai_evals/modes/app.ts                         |  14 +--
 ai_evals/modes/flow.ts                        |  16 +--
 ai_evals/modes/frontendCommon.ts              |  10 +-
 ai_evals/modes/script.ts                      |  16 +--
 27 files changed, 328 insertions(+), 407 deletions(-)
 create mode 100644 ai_evals/adapters/frontend/windmillBackend.test.ts
 delete mode 100644 ai_evals/core/frontendTransport.test.ts
 delete mode 100644 ai_evals/core/frontendTransport.ts
 create mode 100644 ai_evals/core/windmillBackendSettings.test.ts

diff --git a/ai_evals/README.md b/ai_evals/README.md
index 267451aabf..2e1f3210f8 100644
--- a/ai_evals/README.md
+++ b/ai_evals/README.md
@@ -55,7 +55,7 @@ bun run cli -- run flow flow-test4-order-processing-loop --model opus
 bun run cli -- run flow flow-test0-sum-two-numbers --models haiku,opus,4o
 bun run cli -- run flow flow-test0-sum-two-numbers --runs 3 --verbose
 bun run cli -- run flow --record
-GEMINI_API_KEY=... bun run cli -- run app app-test1-counter-create --model gemini-pro --transport proxy
+GEMINI_API_KEY=... bun run cli -- run app app-test1-counter-create --model gemini-pro
 WMILL_AI_EVAL_BACKEND_URL=http://127.0.0.1:8000 bun run cli -- run flow --backend-validation preview
 bun run cli -- run cli bun-hello-script
 ```
@@ -72,7 +72,6 @@ Public CLI surface:
 - `--output <path>`: custom result JSON path
 - `--model <alias>`: choose the model under test
 - `--models <a,b,c>`: run the same cases sequentially against several model aliases
-- `--transport <mode>`: frontend request transport (`direct` by default, `proxy` to exercise `/api/w/{workspace}/ai/proxy`)
 - `--verbose`: stream assistant output for frontend runs
 - `--record`: append a compact tracked summary line to `ai_evals/history/<mode>.jsonl` for full-suite runs only
 - `--backend-validation <mode>`: optional backend smoke validation (`off` or `preview`) for `script` and `flow` evals
@@ -145,26 +144,23 @@ If `--backend-validation preview` is enabled:
 - `script` evals run a real backend script preview in an isolated temp workspace
 - `flow` evals run a real backend flow preview only for cases that define `runtime.backendPreview`
 - `flow` cases with `initial.workspace` fixtures seed those scripts and flows into the preview workspace before preview
-- when `WMILL_AI_EVAL_BACKEND_WORKSPACE` is set, `ai_evals` treats that workspace as a dedicated test workspace, clears managed eval assets under `f/evals/*` before each preview run, and then reseeds the current case fixtures
+- when `WMILL_AI_EVAL_BACKEND_WORKSPACE` is set, `ai_evals` creates or reuses that workspace as a dedicated test workspace, clears managed eval assets under `f/evals/*` before each preview run, and then reseeds the current case fixtures
 
-Supported backend validation env vars:
+Supported backend env vars:
 
 - `WMILL_AI_EVAL_BACKEND_VALIDATION=preview`
 - `WMILL_AI_EVAL_BACKEND_URL=http://127.0.0.1:8000`
 - `WMILL_AI_EVAL_BACKEND_EMAIL=admin@windmill.dev`
 - `WMILL_AI_EVAL_BACKEND_PASSWORD=changeme`
 - `WMILL_AI_EVAL_BACKEND_WORKSPACE=integration-tests` to reuse an existing workspace on CE installs with low workspace limits
-- `WMILL_AI_EVAL_KEEP_WORKSPACES=1`
-- `WMILL_AI_EVAL_WORKSPACE_PREFIX=ai-evals`
 
-Frontend proxy transport uses the same backend auth/workspace env vars.
+Frontend modes require a reachable Windmill backend and send model requests through the workspace AI proxy at `/api/w/{workspace}/ai/proxy`. At startup, `ai_evals` checks the resolved backend URL and fails early with setup guidance if the backend cannot be reached or login fails.
 
-When `--transport proxy` is set:
+For frontend modes:
 
-- `ai_evals` creates or reuses a backend workspace
+- `ai_evals` creates a temporary backend workspace, or creates/reuses `WMILL_AI_EVAL_BACKEND_WORKSPACE` when it is set
 - it upserts a provider resource under `f/evals/ai/<provider>`
 - frontend requests go through `/api/w/{workspace}/ai/proxy`
-- result JSON and history records include `transport` so direct vs proxy runs stay distinguishable
 
 ## Results And Artifacts
 
@@ -182,7 +178,7 @@ If `--record` is used, the CLI also appends one compact JSON line to:
 
 Each recorded line contains:
 
-- run metadata (`createdAt`, `gitSha`, `mode`, `runModel`, `transport`, `judgeModel`)
+- run metadata (`createdAt`, `gitSha`, `mode`, `runModel`, `judgeModel`)
 - suite totals (`caseCount`, `attemptCount`, `passedAttempts`, `passRate`, `averageDurationMs`, `averageJudgeScore`)
 - average token usage (`averageTokenUsagePerAttempt`)
 - per-case metrics under `cases[]` (`averageDurationMs`, `averageJudgeScore`, `averageTokenUsagePerAttempt`, pass rate)
diff --git a/ai_evals/adapters/frontend/backendPreview.test.ts b/ai_evals/adapters/frontend/backendPreview.test.ts
index 2f12c9a896..d4de361333 100644
--- a/ai_evals/adapters/frontend/backendPreview.test.ts
+++ b/ai_evals/adapters/frontend/backendPreview.test.ts
@@ -210,8 +210,6 @@ function buildSettings(
 		baseUrl: 'http://backend.test/default',
 		email: 'admin@windmill.dev',
 		password: 'changeme',
-		keepWorkspaces: true,
-		workspacePrefix: 'ai-evals',
 		pollIntervalMs: 1,
 		maxWaitMs: 50,
 		...overrides
diff --git a/ai_evals/adapters/frontend/backendPreview.ts b/ai_evals/adapters/frontend/backendPreview.ts
index e1be934564..57e1cfdf2a 100644
--- a/ai_evals/adapters/frontend/backendPreview.ts
+++ b/ai_evals/adapters/frontend/backendPreview.ts
@@ -24,6 +24,7 @@ export interface CompletedPreviewJob {
 const tokenCache = new Map<string, Promise<string>>()
 const sharedWorkspaceQueue = new Map<string, Promise<void>>()
 const managedSharedWorkspacePrefixes = ['f/evals/']
+const DEFAULT_WORKSPACE_PREFIX = 'ai-evals'
 
 export class BackendPreviewClient {
 	constructor(private readonly settings: BackendValidationSettings) {}
@@ -35,7 +36,7 @@ export class BackendPreviewClient {
 	): Promise<T> {
 		const workspaceId =
 			this.settings.workspaceOverride ??
-			buildWorkspaceId(this.settings.workspacePrefix, caseId, attempt)
+			buildWorkspaceId(caseId, attempt)
 
 		const run = async () => {
 			await this.ensureWorkspace(workspaceId)
@@ -46,7 +47,7 @@ export class BackendPreviewClient {
 			try {
 				return await body(workspaceId)
 			} finally {
-				if (!this.settings.keepWorkspaces && !this.settings.workspaceOverride) {
+				if (!this.settings.workspaceOverride) {
 					await this.deleteWorkspace(workspaceId).catch(() => undefined)
 				}
 			}
@@ -440,14 +441,14 @@ async function withSharedWorkspaceLock<T>(workspaceId: string, body: () => Promi
 	}
 }
 
-function buildWorkspaceId(prefix: string, caseId: string, attempt: number): string {
+function buildWorkspaceId(caseId: string, attempt: number): string {
 	const caseSlug = caseId
 		.toLowerCase()
 		.replace(/[^a-z0-9-]+/g, '-')
 		.replace(/^-+|-+$/g, '')
 		.slice(0, 30)
 	const suffix = randomUUID().slice(0, 8)
-	return `${prefix}-${caseSlug || 'case'}-a${attempt}-${suffix}`
+	return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || 'case'}-a${attempt}-${suffix}`
 }
 
 function extractFolderName(path: string): string | null {
diff --git a/ai_evals/adapters/frontend/benchmarkRunner.ts b/ai_evals/adapters/frontend/benchmarkRunner.ts
index 474d434803..50a0d10c3c 100644
--- a/ai_evals/adapters/frontend/benchmarkRunner.ts
+++ b/ai_evals/adapters/frontend/benchmarkRunner.ts
@@ -1,6 +1,5 @@
 import { loadSelectedCases } from "../../core/cases";
 import { resolveBackendValidationSettings } from "../../core/backendValidation";
-import { resolveFrontendEvalTransportSettings } from "../../core/frontendTransport";
 import {
   formatRunModelLabel,
   getFrontendEvalModel,
@@ -9,6 +8,7 @@ import {
 import { buildRunResult } from "../../core/results";
 import { runSuite } from "../../core/runSuite";
 import type { BenchmarkRunResult, ModeRunner } from "../../core/types";
+import { resolveWindmillBackendSettings } from "../../core/windmillBackendSettings";
 import { emitFrontendBenchmarkProgress } from "./progress";
 import { createAppModeRunner } from "../../modes/app";
 import { createFlowModeRunner } from "../../modes/flow";
@@ -36,17 +36,14 @@ export async function runFrontendBenchmarkFromEnv(): Promise<BenchmarkRunResult>
     evalMode: mode,
     requestedMode: process.env.WMILL_FRONTEND_AI_EVAL_BACKEND_VALIDATION,
   });
-  const transportSettings = resolveFrontendEvalTransportSettings({
-    evalMode: mode,
-    requestedTransport: process.env.WMILL_FRONTEND_AI_EVAL_TRANSPORT,
-  });
+  const backendSettings = resolveWindmillBackendSettings();
 
   const selectedCases = await loadSelectedCases(mode, caseIds);
   const modeRunner = getModeRunner(
     mode,
     getFrontendEvalModel(model),
     backendValidation,
-    transportSettings,
+    backendSettings,
   );
   const runModel = formatRunModelLabel(mode, model);
   const caseResults = await runSuite({
@@ -66,7 +63,6 @@ export async function runFrontendBenchmarkFromEnv(): Promise<BenchmarkRunResult>
     mode,
     runs,
     runModel,
-    transport: transportSettings.transport,
     judgeModel: DEFAULT_JUDGE_MODEL,
     caseResults,
   });
@@ -76,18 +72,18 @@ function getModeRunner(
   mode: FrontendBenchmarkMode,
   model: ReturnType<typeof getFrontendEvalModel>,
   backendValidation: ReturnType<typeof resolveBackendValidationSettings>,
-  transportSettings: ReturnType<typeof resolveFrontendEvalTransportSettings>,
+  backendSettings: ReturnType<typeof resolveWindmillBackendSettings>,
 ): ModeRunner<any, any, any> {
   switch (mode) {
     case "flow":
-      return createFlowModeRunner(model, backendValidation, transportSettings);
+      return createFlowModeRunner(model, backendValidation, backendSettings);
     case "app":
-      return createAppModeRunner(model, transportSettings);
+      return createAppModeRunner(model, backendSettings);
     case "script":
       return createScriptModeRunner(
         model,
         backendValidation,
-        transportSettings,
+        backendSettings,
       );
   }
 }
diff --git a/ai_evals/adapters/frontend/core/app/appEvalRunner.ts b/ai_evals/adapters/frontend/core/app/appEvalRunner.ts
index 55d1e6ab9a..16543b28de 100644
--- a/ai_evals/adapters/frontend/core/app/appEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/app/appEvalRunner.ts
@@ -12,7 +12,7 @@ import {
   prepareAppUserMessage,
 } from "../../../../../frontend/src/lib/components/copilot/chat/app/core";
 import type { Tool as ProductionTool } from "../../../../../frontend/src/lib/components/copilot/chat/shared";
-import { createAppFileHelpers } from "./fileHelpers";
+import { createAppFileHelpers, type AppEvalChatHelpers } from "./fileHelpers";
 import { runEval } from "../shared";
 import type { AIProvider } from "$lib/gen/types.gen";
 import type {
@@ -22,7 +22,6 @@ import type {
 } from "../../../../core/types";
 import type { TokenUsage } from "../shared/types";
 import type { AppFilesState } from "../../../../core/validators";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 import {
   createAppBackendRunnableContextElement,
@@ -49,8 +48,7 @@ export interface AppEvalOptions {
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
+  backend: WindmillBackendSettings;
   workspaceRoot?: string;
   runContext?: ModeRunContext;
 }
@@ -58,7 +56,7 @@ export interface AppEvalOptions {
 export async function runAppEval(
   userPrompt: string,
   apiKey: string,
-  options?: AppEvalOptions,
+  options: AppEvalOptions,
 ): Promise<AppEvalResult> {
   const workspaceRoot =
     options?.workspaceRoot ??
@@ -101,10 +99,9 @@ export async function runAppEval(
         model,
         workspace: workspaceRoot,
         provider: options?.provider,
-        transport: options?.transport,
-        backend: options?.backend,
-        proxyCaseId: options?.runContext?.caseId,
-        proxyAttempt: options?.runContext?.attempt,
+        backend: options.backend,
+        caseId: options?.runContext?.caseId,
+        attempt: options?.runContext?.attempt,
       },
     });
 
@@ -124,7 +121,7 @@ export async function runAppEval(
 
 async function buildAdditionalContext(
   appContext: EvalCaseRuntimeAppContextSpec | undefined,
-  helpers: AppAIChatHelpers,
+  helpers: AppEvalChatHelpers,
 ): Promise<ContextElement[]> {
   const entries = appContext?.additional ?? [];
   if (entries.length === 0) {
diff --git a/ai_evals/adapters/frontend/core/app/fileHelpers.ts b/ai_evals/adapters/frontend/core/app/fileHelpers.ts
index e82ddf4672..15721a49ed 100644
--- a/ai_evals/adapters/frontend/core/app/fileHelpers.ts
+++ b/ai_evals/adapters/frontend/core/app/fileHelpers.ts
@@ -2,6 +2,7 @@ import { mkdir, rm, writeFile } from 'fs/promises'
 import { dirname, join } from 'path'
 import type {
 	AppAIChatHelpers,
+	AppDatatableMetadata,
 	AppFiles,
 	BackendRunnable,
 	DataTableSchema,
@@ -10,6 +11,10 @@ import type {
 } from '../../../../../frontend/src/lib/components/copilot/chat/app/core'
 import { buildAppWmillTypes, collectAppDiagnostics } from '../../../../core/appDiagnostics'
 
+export interface AppEvalChatHelpers extends AppAIChatHelpers {
+	getDatatables: () => Promise<DataTableSchema[]>
+}
+
 async function writeFrontendFile(
 	workspaceRoot: string | undefined,
 	path: string,
@@ -92,7 +97,7 @@ export async function createAppFileHelpers(
 	initialDatatables: DataTableSchema[] = [],
 	workspaceRoot?: string
 ): Promise<{
-	helpers: AppAIChatHelpers
+	helpers: AppEvalChatHelpers
 	getFiles: () => AppFiles
 	getEvalState: () => {
 		frontend: Record<string, string>
@@ -137,7 +142,7 @@ export async function createAppFileHelpers(
 	}
 	await persistDatatables(workspaceRoot, datatables)
 
-	const helpers: AppAIChatHelpers = {
+	const helpers: AppEvalChatHelpers = {
 		listFrontendFiles: () => [
 			...Object.keys(frontend).filter((path) => path !== '/wmill.d.ts'),
 			'/wmill.d.ts'
@@ -211,6 +216,34 @@ export async function createAppFileHelpers(
 		},
 		lint,
 		getDatatables: async () => structuredClone(datatables),
+		listDatatableTables: async () =>
+			datatables.map(
+				(datatable): AppDatatableMetadata => {
+					const schemas = Object.fromEntries(
+						Object.entries(datatable.schemas).map(([schemaName, tables]) => [
+							schemaName,
+							Object.keys(tables)
+						])
+					)
+					return {
+						datatable_name: datatable.datatable_name,
+						schemas,
+						tableCount: Object.values(schemas).reduce(
+							(sum, tableNames) => sum + tableNames.length,
+							0
+						),
+						error: datatable.error
+					}
+				}
+			),
+		getDatatableTableSchema: async (
+			datatableName: string,
+			schemaName: string,
+			tableName: string
+		) => {
+			const datatable = datatables.find((entry) => entry.datatable_name === datatableName)
+			return structuredClone(datatable?.schemas?.[schemaName]?.[tableName] ?? {})
+		},
 		getAvailableDatatableNames: () => datatables.map((datatable) => datatable.datatable_name),
 		execDatatableSql: async (
 			datatableName: string,
diff --git a/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts b/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts
index 1b448bdea4..0cd25f5787 100644
--- a/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/flow/flowEvalRunner.ts
@@ -18,7 +18,6 @@ import {
 import { runEval } from "../shared";
 import type { ModeRunContext } from "../../../../core/types";
 import type { TokenUsage, ToolCallDetail } from "../shared/types";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 
 export interface FlowFixture {
@@ -48,8 +47,7 @@ export interface FlowEvalOptions {
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
+  backend: WindmillBackendSettings;
   workspaceRoot?: string;
   runContext?: ModeRunContext;
 }
@@ -57,7 +55,7 @@ export interface FlowEvalOptions {
 export async function runFlowEval(
   userPrompt: string,
   apiKey: string,
-  options?: FlowEvalOptions,
+  options: FlowEvalOptions,
 ): Promise<FlowEvalResult> {
   const workspaceRoot =
     options?.workspaceRoot ??
@@ -100,10 +98,9 @@ export async function runFlowEval(
         model,
         workspace: workspaceRoot,
         provider: options?.provider,
-        transport: options?.transport,
-        backend: options?.backend,
-        proxyCaseId: options?.runContext?.caseId,
-        proxyAttempt: options?.runContext?.attempt,
+        backend: options.backend,
+        caseId: options?.runContext?.caseId,
+        attempt: options?.runContext?.attempt,
       },
     });
 
diff --git a/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts b/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts
index 30aa2c81e7..95ce6555e6 100644
--- a/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/script/scriptEvalRunner.ts
@@ -14,7 +14,6 @@ import { createScriptFileHelpers, type ScriptEvalState } from "./fileHelpers";
 import { runEval } from "../shared";
 import type { ModeRunContext } from "../../../../core/types";
 import type { TokenUsage, ToolCallDetail } from "../shared/types";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 
 export interface ScriptEvalResult {
@@ -33,8 +32,7 @@ export interface ScriptEvalOptions {
   model?: string;
   maxIterations?: number;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
+  backend: WindmillBackendSettings;
   workspaceRoot?: string;
   runContext?: ModeRunContext;
 }
@@ -98,10 +96,9 @@ export async function runScriptEval(
         model,
         workspace: workspaceRoot,
         provider: modelProvider.provider,
-        transport: options.transport,
         backend: options.backend,
-        proxyCaseId: options.runContext?.caseId,
-        proxyAttempt: options.runContext?.attempt,
+        caseId: options.runContext?.caseId,
+        attempt: options.runContext?.attempt,
       },
     });
 
diff --git a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
index 5b1f2e948e..7fd43ccb87 100644
--- a/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
+++ b/ai_evals/adapters/frontend/core/shared/baseEvalRunner.ts
@@ -40,8 +40,8 @@ export interface RunEvalParams<THelpers, TOutput> {
   apiKey: string;
   /** Function to get the current output state */
   getOutput: () => TOutput;
-  /** Optional configuration */
-  options?: EvalRunnerOptions;
+  /** Model and Windmill backend configuration */
+  options: EvalRunnerOptions;
   onAssistantMessageStart?: () => void;
   onAssistantToken?: (token: string) => void;
   onAssistantMessageEnd?: () => void;
@@ -70,10 +70,10 @@ export async function runEval<THelpers, TOutput>(
   } = params;
   let shouldEmitMessageStart = true;
 
-  const model = options?.model ?? "gpt-4o";
-  const maxIterations = options?.maxIterations ?? 20;
-  const workspace = options?.workspace ?? "test-workspace";
-  const provider = toFrontendEvalProvider(options?.provider);
+  const model = options.model ?? "gpt-4o";
+  const maxIterations = options.maxIterations ?? 20;
+  const workspace = options.workspace ?? "test-workspace";
+  const provider = toFrontendEvalProvider(options.provider);
 
   const modelProvider = resolveEvalModelProvider(model, provider);
 
@@ -203,45 +203,31 @@ export async function runEval<THelpers, TOutput>(
     }
   };
 
-  if (options?.transport === "proxy") {
-    const backendSettings = options.backend;
-    if (!backendSettings) {
-      throw new Error("Missing backend settings for proxy transport");
-    }
-
-    const backendClient = new WindmillBackendClient(backendSettings);
-    return await backendClient.withWorkspace(
-      options.proxyCaseId ?? "eval",
-      options.proxyAttempt ?? 1,
-      async (proxyWorkspaceId) => {
-        const resourcePath = buildProxyResourcePath(modelProvider.provider);
-        await backendClient.upsertResource({
-          workspaceId: proxyWorkspaceId,
-          path: resourcePath,
-          resourceType: modelProvider.provider,
-          value: { api_key: apiKey },
-        });
-        const token = await backendClient.getToken();
-        const clients = createEvalClients({
-          provider: modelProvider.provider,
-          apiKey,
-          transport: "proxy",
-          proxy: {
-            baseURL: `${backendSettings.baseUrl}/api/w/${encodeURIComponent(proxyWorkspaceId)}/ai/proxy`,
-            bearerToken: token,
-            resourcePath,
-          },
-        }) as unknown as ChatClients;
-        return await executeChatLoop(clients);
-      },
-    );
-  }
-
-  const clients = createEvalClients({
-    provider: modelProvider.provider,
-    apiKey,
-  }) as unknown as ChatClients;
-  return await executeChatLoop(clients);
+  const backendSettings = options.backend;
+  const backendClient = new WindmillBackendClient(backendSettings);
+  return await backendClient.withWorkspace(
+    options.caseId ?? "eval",
+    options.attempt ?? 1,
+    async (proxyWorkspaceId) => {
+      const resourcePath = buildProxyResourcePath(modelProvider.provider);
+      await backendClient.upsertResource({
+        workspaceId: proxyWorkspaceId,
+        path: resourcePath,
+        resourceType: modelProvider.provider,
+        value: { api_key: apiKey },
+      });
+      const token = await backendClient.getToken();
+      const clients = createEvalClients({
+        provider: modelProvider.provider,
+        proxy: {
+          baseURL: `${backendSettings.baseUrl}/api/w/${encodeURIComponent(proxyWorkspaceId)}/ai/proxy`,
+          bearerToken: token,
+          resourcePath,
+        },
+      }) as unknown as ChatClients;
+      return await executeChatLoop(clients);
+    },
+  );
 }
 
 function toFrontendEvalProvider(
diff --git a/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts b/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts
index e504ced376..77d9154da3 100644
--- a/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts
+++ b/ai_evals/adapters/frontend/core/shared/providerConfig.test.ts
@@ -2,35 +2,9 @@ import { describe, expect, it } from "bun:test";
 import {
   buildProxyHeaders,
   buildProxyResourcePath,
-  buildOpenAICompatibleClientOptions,
   resolveEvalModelProvider,
 } from "./providerConfig";
 
-describe("buildOpenAICompatibleClientOptions", () => {
-  it("adds Gemini's OpenAI-compatible base URL and client header", () => {
-    const options = buildOpenAICompatibleClientOptions(
-      "googleai",
-      "gemini-test-key",
-    );
-
-    expect(options).toMatchObject({
-      apiKey: "gemini-test-key",
-      baseURL: "https://generativelanguage.googleapis.com/v1beta/openai/",
-      defaultHeaders: {
-        "x-goog-api-client": "windmill-ai-evals/1.0",
-      },
-    });
-  });
-
-  it("keeps the default OpenAI-compatible config for OpenAI", () => {
-    expect(
-      buildOpenAICompatibleClientOptions("openai", "openai-test-key"),
-    ).toEqual({
-      apiKey: "openai-test-key",
-    });
-  });
-});
-
 describe("proxy helpers", () => {
   it("builds provider-scoped proxy resource paths", () => {
     expect(buildProxyResourcePath("googleai")).toBe("f/evals/ai/googleai");
diff --git a/ai_evals/adapters/frontend/core/shared/providerConfig.ts b/ai_evals/adapters/frontend/core/shared/providerConfig.ts
index 62ba221a40..15372049fe 100644
--- a/ai_evals/adapters/frontend/core/shared/providerConfig.ts
+++ b/ai_evals/adapters/frontend/core/shared/providerConfig.ts
@@ -1,7 +1,6 @@
 import Anthropic from "@anthropic-ai/sdk";
 import OpenAI from "openai";
 import type { FrontendEvalModelConfig } from "../../../../core/models";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 
 export type FrontendEvalProvider = FrontendEvalModelConfig["provider"];
 
@@ -15,15 +14,12 @@ export interface ResolvedEvalModelProvider {
   model: string;
 }
 
-export interface EvalProxyClientConfig {
+export interface WindmillAiProxyClientConfig {
   baseURL: string;
   bearerToken: string;
   resourcePath: string;
 }
 
-const GEMINI_OPENAI_BASE_URL =
-  "https://generativelanguage.googleapis.com/v1beta/openai/";
-const GEMINI_GOOG_API_CLIENT = "windmill-ai-evals/1.0";
 const EVAL_PROXY_RESOURCE_PREFIX = "f/evals/ai";
 
 export function buildProxyHeaders(
@@ -40,25 +36,8 @@ export function buildProxyResourcePath(provider: FrontendEvalProvider): string {
   return `${EVAL_PROXY_RESOURCE_PREFIX}/${provider}`;
 }
 
-export function buildOpenAICompatibleClientOptions(
-  provider: Exclude<FrontendEvalProvider, "anthropic">,
-  apiKey: string,
-): ConstructorParameters<typeof OpenAI>[0] {
-  if (provider === "googleai") {
-    return {
-      apiKey,
-      baseURL: GEMINI_OPENAI_BASE_URL,
-      defaultHeaders: {
-        "x-goog-api-client": GEMINI_GOOG_API_CLIENT,
-      },
-    };
-  }
-
-  return { apiKey };
-}
-
 function buildProxyOpenAIClientOptions(
-  proxy: EvalProxyClientConfig,
+  proxy: WindmillAiProxyClientConfig,
 ): ConstructorParameters<typeof OpenAI>[0] {
   return {
     apiKey: "unused",
@@ -69,52 +48,24 @@ function buildProxyOpenAIClientOptions(
 
 export function createEvalClients(input: {
   provider: FrontendEvalProvider;
-  apiKey: string;
-  transport?: FrontendEvalTransport;
-  proxy?: EvalProxyClientConfig;
+  proxy: WindmillAiProxyClientConfig;
 }): EvalClients {
-  const transport = input.transport ?? "direct";
-
   if (input.provider === "anthropic") {
-    if (transport === "proxy") {
-      if (!input.proxy) {
-        throw new Error(
-          "Missing proxy client configuration for proxy transport",
-        );
-      }
-      return {
-        openai: new OpenAI({ apiKey: "unused" }),
-        anthropic: new Anthropic({
-          apiKey: "unused",
-          baseURL: input.proxy.baseURL,
-          defaultHeaders: buildProxyHeaders(
-            input.proxy.bearerToken,
-            input.proxy.resourcePath,
-          ),
-        }),
-      };
-    }
-
     return {
       openai: new OpenAI({ apiKey: "unused" }),
-      anthropic: new Anthropic({ apiKey: input.apiKey }),
-    };
-  }
-
-  if (transport === "proxy") {
-    if (!input.proxy) {
-      throw new Error("Missing proxy client configuration for proxy transport");
-    }
-    return {
-      openai: new OpenAI(buildProxyOpenAIClientOptions(input.proxy)),
-      anthropic: new Anthropic({ apiKey: "unused" }),
+      anthropic: new Anthropic({
+        apiKey: "unused",
+        baseURL: input.proxy.baseURL,
+        defaultHeaders: buildProxyHeaders(
+          input.proxy.bearerToken,
+          input.proxy.resourcePath,
+        ),
+      }),
     };
   }
 
   return {
-    openai: new OpenAI(
-      buildOpenAICompatibleClientOptions(input.provider, input.apiKey),
-    ),
+    openai: new OpenAI(buildProxyOpenAIClientOptions(input.proxy)),
     anthropic: new Anthropic({ apiKey: "unused" }),
   };
 }
diff --git a/ai_evals/adapters/frontend/core/shared/types.ts b/ai_evals/adapters/frontend/core/shared/types.ts
index f2a3f04794..f081fe398a 100644
--- a/ai_evals/adapters/frontend/core/shared/types.ts
+++ b/ai_evals/adapters/frontend/core/shared/types.ts
@@ -1,6 +1,5 @@
 import type { ChatCompletionMessageParam } from "openai/resources/chat/completions.mjs";
 import type { AIProvider } from "$lib/gen/types.gen";
-import type { FrontendEvalTransport } from "../../../../core/frontendTransport";
 import type { WindmillBackendSettings } from "../../../../core/windmillBackendSettings";
 
 export interface TokenUsage {
@@ -15,14 +14,13 @@ export interface ToolCallDetail {
 }
 
 export interface EvalRunnerOptions {
+  backend: WindmillBackendSettings;
   maxIterations?: number;
   model?: string;
   workspace?: string;
   provider?: AIProvider;
-  transport?: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
-  proxyCaseId?: string;
-  proxyAttempt?: number;
+  caseId?: string;
+  attempt?: number;
 }
 
 export interface RawEvalResult<TOutput> {
diff --git a/ai_evals/adapters/frontend/runtime.ts b/ai_evals/adapters/frontend/runtime.ts
index 6a76fceeb0..180c7a2993 100644
--- a/ai_evals/adapters/frontend/runtime.ts
+++ b/ai_evals/adapters/frontend/runtime.ts
@@ -23,7 +23,6 @@ export async function runFrontendBenchmarkAdapter(input: {
   caseIds: string[];
   runs: number;
   model?: string;
-  transport?: string;
   verbose?: boolean;
   backendValidation?: string;
 }): Promise<BenchmarkRunResult> {
@@ -44,10 +43,6 @@ export async function runFrontendBenchmarkAdapter(input: {
     WMILL_FRONTEND_AI_EVAL_BACKEND_VALIDATION: input.backendValidation ?? "",
   };
 
-  if (input.transport) {
-    env.WMILL_FRONTEND_AI_EVAL_TRANSPORT = input.transport;
-  }
-
   try {
     await runVitestBenchmark(
       path.join(FRONTEND_DIR, "node_modules", ".bin", "vitest"),
diff --git a/ai_evals/adapters/frontend/windmillBackend.test.ts b/ai_evals/adapters/frontend/windmillBackend.test.ts
new file mode 100644
index 0000000000..302502c2d9
--- /dev/null
+++ b/ai_evals/adapters/frontend/windmillBackend.test.ts
@@ -0,0 +1,104 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import type { WindmillBackendSettings } from "../../core/windmillBackendSettings";
+import {
+  WindmillBackendClient,
+  assertWindmillBackendReachable,
+} from "./windmillBackend";
+
+const ORIGINAL_FETCH = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = ORIGINAL_FETCH;
+});
+
+describe("assertWindmillBackendReachable", () => {
+  it("logs in to verify backend reachability", async () => {
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    globalThis.fetch = mockFetch(requests, textResponse(200, "token"));
+
+    await expect(
+      assertWindmillBackendReachable(
+        buildSettings({ baseUrl: "http://backend.test/reachable" }),
+      ),
+    ).resolves.toBeUndefined();
+
+    expect(requests.map((entry) => entry.url)).toEqual([
+      "http://backend.test/reachable/api/auth/login",
+    ]);
+  });
+
+  it("adds setup guidance when the backend cannot be initialized", async () => {
+    globalThis.fetch = mockFetch(
+      [],
+      textResponse(401, "invalid password"),
+    );
+
+    await expect(
+      assertWindmillBackendReachable(
+        buildSettings({ baseUrl: "http://backend.test/auth-failure" }),
+      ),
+    ).rejects.toThrow(
+      "Start a Windmill backend at that URL, or set WMILL_AI_EVAL_BACKEND_URL=<url>.",
+    );
+  });
+});
+
+describe("WindmillBackendClient", () => {
+  it("creates or reuses the specified backend workspace without deleting it", async () => {
+    const requests: Array<{ url: string; init?: RequestInit }> = [];
+    globalThis.fetch = mockFetch(
+      requests,
+      textResponse(200, "token"),
+      textResponse(200, "false"),
+      textResponse(200, ""),
+    );
+
+    const client = new WindmillBackendClient(
+      buildSettings({
+        baseUrl: "http://backend.test/shared-workspace",
+        workspaceOverride: "shared-evals",
+      }),
+    );
+
+    await expect(
+      client.withWorkspace("case-a", 1, async (workspaceId) => workspaceId),
+    ).resolves.toBe("shared-evals");
+
+    expect(requests.map((entry) => entry.url)).toEqual([
+      "http://backend.test/shared-workspace/api/auth/login",
+      "http://backend.test/shared-workspace/api/workspaces/exists",
+      "http://backend.test/shared-workspace/api/workspaces/create",
+    ]);
+  });
+});
+
+function buildSettings(
+  overrides: Partial<WindmillBackendSettings> = {},
+): WindmillBackendSettings {
+  return {
+    baseUrl: "http://backend.test/default",
+    email: "admin@windmill.dev",
+    password: "changeme",
+    ...overrides,
+  };
+}
+
+function mockFetch(
+  requests: Array<{ url: string; init?: RequestInit }>,
+  ...responses: Response[]
+): typeof fetch {
+  const queue = [...responses];
+  return async (input, init) => {
+    const url = String(input);
+    requests.push({ url, init });
+    const next = queue.shift();
+    if (!next) {
+      throw new Error(`Unexpected fetch: ${url}`);
+    }
+    return next;
+  };
+}
+
+function textResponse(status: number, body: string): Response {
+  return new Response(body, { status });
+}
diff --git a/ai_evals/adapters/frontend/windmillBackend.ts b/ai_evals/adapters/frontend/windmillBackend.ts
index c8d9537779..2247d8e5d5 100644
--- a/ai_evals/adapters/frontend/windmillBackend.ts
+++ b/ai_evals/adapters/frontend/windmillBackend.ts
@@ -3,6 +3,7 @@ import type { WindmillBackendSettings } from "../../core/windmillBackendSettings
 
 const tokenCache = new Map<string, Promise<string>>();
 const sharedWorkspaceQueue = new Map<string, Promise<void>>();
+const DEFAULT_WORKSPACE_PREFIX = "ai-evals";
 
 export class WindmillBackendClient {
   constructor(private readonly settings: WindmillBackendSettings) {}
@@ -14,7 +15,7 @@ export class WindmillBackendClient {
   ): Promise<T> {
     const workspaceId =
       this.settings.workspaceOverride ??
-      buildWorkspaceId(this.settings.workspacePrefix, caseId, attempt);
+      buildWorkspaceId(caseId, attempt);
 
     const run = async () => {
       await this.ensureWorkspace(workspaceId);
@@ -22,7 +23,7 @@ export class WindmillBackendClient {
       try {
         return await body(workspaceId);
       } finally {
-        if (!this.settings.keepWorkspaces && !this.settings.workspaceOverride) {
+        if (!this.settings.workspaceOverride) {
           await this.deleteWorkspace(workspaceId).catch(() => undefined);
         }
       }
@@ -136,6 +137,24 @@ export class WindmillBackendClient {
   }
 }
 
+export async function assertWindmillBackendReachable(
+  settings: WindmillBackendSettings,
+): Promise<void> {
+  try {
+    await new WindmillBackendClient(settings).getToken();
+  } catch (error) {
+    const details = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      [
+        `Could not initialize the Windmill backend for AI eval proxy at ${settings.baseUrl}.`,
+        "Start a Windmill backend at that URL, or set WMILL_AI_EVAL_BACKEND_URL=<url>.",
+        `Using login ${settings.email}; if authentication failed, set WMILL_AI_EVAL_BACKEND_EMAIL and WMILL_AI_EVAL_BACKEND_PASSWORD.`,
+        `Details: ${details}`,
+      ].join("\n"),
+    );
+  }
+}
+
 async function withSharedWorkspaceLock<T>(
   workspaceId: string,
   body: () => Promise<T>,
@@ -160,18 +179,14 @@ async function withSharedWorkspaceLock<T>(
   }
 }
 
-function buildWorkspaceId(
-  prefix: string,
-  caseId: string,
-  attempt: number,
-): string {
+function buildWorkspaceId(caseId: string, attempt: number): string {
   const caseSlug = caseId
     .toLowerCase()
     .replace(/[^a-z0-9-]+/g, "-")
     .replace(/^-+|-+$/g, "")
     .slice(0, 30);
   const suffix = randomUUID().slice(0, 8);
-  return `${prefix}-${caseSlug || "case"}-a${attempt}-${suffix}`;
+  return `${DEFAULT_WORKSPACE_PREFIX}-${caseSlug || "case"}-a${attempt}-${suffix}`;
 }
 
 async function expectOk(response: Response, context: string): Promise<void> {
diff --git a/ai_evals/cli/index.ts b/ai_evals/cli/index.ts
index 202d826078..259b055ff5 100644
--- a/ai_evals/cli/index.ts
+++ b/ai_evals/cli/index.ts
@@ -27,11 +27,8 @@ import { EVAL_MODES, type EvalMode } from "../core/types";
 import { DEFAULT_JUDGE_MODEL } from "../core/judge";
 import { createCliModeRunner } from "../modes/cli";
 import { runFrontendBenchmarkAdapter } from "../adapters/frontend/runtime";
-import {
-  FRONTEND_EVAL_TRANSPORTS,
-  type FrontendEvalTransport,
-  parseFrontendEvalTransport,
-} from "../core/frontendTransport";
+import { resolveWindmillBackendSettings } from "../core/windmillBackendSettings";
+import { assertWindmillBackendReachable } from "../adapters/frontend/windmillBackend";
 
 async function main() {
   const program = new Command()
@@ -98,10 +95,6 @@ async function main() {
       "--models <names>",
       "comma-separated model aliases to run sequentially",
     )
-    .option(
-      "--transport <mode>",
-      `frontend transport (${FRONTEND_EVAL_TRANSPORTS.join(", ")})`,
-    )
     .option("--verbose", "stream assistant output during frontend runs")
     .option(
       "--record",
@@ -120,7 +113,6 @@ async function main() {
           output?: string;
           model?: string;
           models?: string;
-          transport?: string;
           verbose?: boolean;
           record?: boolean;
           backendValidation?: string;
@@ -133,9 +125,6 @@ async function main() {
           outputPath: options.output,
           model: options.model,
           models: options.models,
-          transport: options.transport
-            ? parseFrontendEvalTransport(options.transport)
-            : undefined,
           verbose: options.verbose ?? false,
           record: options.record ?? false,
           backendValidation: options.backendValidation,
@@ -184,7 +173,6 @@ async function handleRun(input: {
   outputPath?: string;
   model?: string;
   models?: string;
-  transport?: FrontendEvalTransport;
   verbose: boolean;
   record: boolean;
   backendValidation?: string;
@@ -197,11 +185,6 @@ async function handleRun(input: {
   if (input.model && input.models) {
     throw new Error("Use either --model or --models, not both");
   }
-  if (input.mode === "cli" && input.transport === "proxy") {
-    throw new Error(
-      "--transport proxy is only supported for flow, script, and app modes",
-    );
-  }
 
   const selectedCases = await loadSelectedCases(input.mode, input.caseIds);
   const models = resolveRequestedModels(input.mode, input.model, input.models);
@@ -220,6 +203,9 @@ async function handleRun(input: {
       "--backend-validation currently supports only flow and script modes",
     );
   }
+  if (input.mode !== "cli") {
+    await assertWindmillBackendReachable(resolveWindmillBackendSettings());
+  }
 
   const summaries: Array<{
     label: string;
@@ -249,7 +235,6 @@ async function handleRun(input: {
             caseIds: input.caseIds,
             runs: input.runs,
             model: model.id,
-            transport: input.transport,
             verbose: input.verbose,
             backendValidation,
           });
diff --git a/ai_evals/core/backendValidation.ts b/ai_evals/core/backendValidation.ts
index 87094fd23f..1484aee2d4 100644
--- a/ai_evals/core/backendValidation.ts
+++ b/ai_evals/core/backendValidation.ts
@@ -13,9 +13,7 @@ export interface BackendValidationSettings {
   baseUrl: string;
   email: string;
   password: string;
-  keepWorkspaces: boolean;
   workspaceOverride?: string;
-  workspacePrefix: string;
   pollIntervalMs: number;
   maxWaitMs: number;
 }
diff --git a/ai_evals/core/frontendTransport.test.ts b/ai_evals/core/frontendTransport.test.ts
deleted file mode 100644
index 09ebd1b3a7..0000000000
--- a/ai_evals/core/frontendTransport.test.ts
+++ /dev/null
@@ -1,64 +0,0 @@
-import { afterEach, describe, expect, it } from "bun:test";
-import {
-  parseFrontendEvalTransport,
-  resolveFrontendEvalTransportSettings,
-} from "./frontendTransport";
-
-const ORIGINAL_ENV = {
-  WMILL_AI_EVAL_BACKEND_URL: process.env.WMILL_AI_EVAL_BACKEND_URL,
-};
-
-afterEach(() => {
-  if (ORIGINAL_ENV.WMILL_AI_EVAL_BACKEND_URL === undefined) {
-    delete process.env.WMILL_AI_EVAL_BACKEND_URL;
-  } else {
-    process.env.WMILL_AI_EVAL_BACKEND_URL =
-      ORIGINAL_ENV.WMILL_AI_EVAL_BACKEND_URL;
-  }
-});
-
-describe("parseFrontendEvalTransport", () => {
-  it("defaults to direct when unset", () => {
-    expect(parseFrontendEvalTransport(undefined)).toBe("direct");
-  });
-
-  it("accepts proxy explicitly", () => {
-    expect(parseFrontendEvalTransport("proxy")).toBe("proxy");
-  });
-
-  it("rejects unsupported values", () => {
-    expect(() => parseFrontendEvalTransport("worker")).toThrow(
-      "Unsupported frontend eval transport: worker",
-    );
-  });
-});
-
-describe("resolveFrontendEvalTransportSettings", () => {
-  it("includes backend settings for proxy transport", () => {
-    process.env.WMILL_AI_EVAL_BACKEND_URL = "http://127.0.0.1:8000/";
-
-    expect(
-      resolveFrontendEvalTransportSettings({
-        evalMode: "app",
-        requestedTransport: "proxy",
-      }),
-    ).toMatchObject({
-      transport: "proxy",
-      backend: {
-        baseUrl: "http://127.0.0.1:8000",
-      },
-    });
-  });
-
-  it("keeps direct transport for cli runs", () => {
-    expect(
-      resolveFrontendEvalTransportSettings({
-        evalMode: "cli",
-        requestedTransport: "direct",
-      }),
-    ).toEqual({
-      transport: "direct",
-      backend: undefined,
-    });
-  });
-});
diff --git a/ai_evals/core/frontendTransport.ts b/ai_evals/core/frontendTransport.ts
deleted file mode 100644
index fa78505113..0000000000
--- a/ai_evals/core/frontendTransport.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-import type { EvalMode } from "./types";
-import type { WindmillBackendSettings } from "./windmillBackendSettings";
-import { resolveWindmillBackendSettings } from "./windmillBackendSettings";
-
-export const FRONTEND_EVAL_TRANSPORTS = ["direct", "proxy"] as const;
-
-export type FrontendEvalTransport = (typeof FRONTEND_EVAL_TRANSPORTS)[number];
-
-export interface FrontendEvalTransportSettings {
-  transport: FrontendEvalTransport;
-  backend?: WindmillBackendSettings;
-}
-
-export function parseFrontendEvalTransport(
-  value?: string | null,
-): FrontendEvalTransport {
-  const normalized = value?.trim().toLowerCase();
-
-  if (!normalized || normalized === "direct") {
-    return "direct";
-  }
-
-  if (normalized === "proxy") {
-    return "proxy";
-  }
-
-  throw new Error(
-    `Unsupported frontend eval transport: ${value}. Use one of: ${FRONTEND_EVAL_TRANSPORTS.join(", ")}`,
-  );
-}
-
-export function resolveFrontendEvalTransportSettings(input: {
-  evalMode: EvalMode;
-  requestedTransport?: string | null;
-}): FrontendEvalTransportSettings {
-  const transport = parseFrontendEvalTransport(input.requestedTransport);
-
-  if (transport === "proxy" && input.evalMode === "cli") {
-    throw new Error(
-      'Frontend eval transport "proxy" is only supported for flow, script, and app evals',
-    );
-  }
-
-  return {
-    transport,
-    backend:
-      transport === "proxy" ? resolveWindmillBackendSettings() : undefined,
-  };
-}
diff --git a/ai_evals/core/results.ts b/ai_evals/core/results.ts
index c5f6b8749b..e58840f911 100644
--- a/ai_evals/core/results.ts
+++ b/ai_evals/core/results.ts
@@ -74,7 +74,6 @@ export function buildRunResult(input: {
   mode: EvalMode;
   runs: number;
   runModel: string | null;
-  transport?: BenchmarkRunResult["transport"];
   judgeModel: string | null;
   caseResults: BenchmarkCaseResult[];
 }): BenchmarkRunResult {
@@ -116,7 +115,6 @@ export function buildRunResult(input: {
     gitSha: getGitSha(),
     runs: input.runs,
     runModel: input.runModel,
-    transport: input.transport ?? null,
     judgeModel: input.judgeModel,
     caseCount: input.caseResults.length,
     attemptCount,
@@ -142,9 +140,6 @@ export function formatRunSummary(result: BenchmarkRunResult): string {
     `Pass rate: ${formatPercent(result.passRate)} (${result.passedAttempts}/${result.attemptCount})`,
     `Average duration: ${Math.round(result.averageDurationMs)}ms`,
   ];
-  if (result.transport) {
-    lines.splice(1, 0, `Transport: ${result.transport}`);
-  }
 
   const failures = collectFailures(result);
   if (failures.length > 0) {
@@ -251,7 +246,6 @@ function toHistoryRecord(result: BenchmarkRunResult) {
     mode: result.mode,
     runs: result.runs,
     runModel: result.runModel,
-    transport: result.transport,
     judgeModel: result.judgeModel,
     caseCount: result.caseCount,
     attemptCount: result.attemptCount,
diff --git a/ai_evals/core/types.ts b/ai_evals/core/types.ts
index 2d612be21a..dfc6882f84 100644
--- a/ai_evals/core/types.ts
+++ b/ai_evals/core/types.ts
@@ -1,7 +1,6 @@
 export const EVAL_MODES = ["cli", "flow", "script", "app"] as const;
 
 export type EvalMode = (typeof EVAL_MODES)[number];
-export type FrontendEvalTransport = "direct" | "proxy";
 
 export interface EvalCaseRuntimeBackendPreview {
   args?: Record<string, unknown>;
@@ -297,7 +296,6 @@ export interface BenchmarkRunResult {
   gitSha: string | null;
   runs: number;
   runModel: string | null;
-  transport: FrontendEvalTransport | null;
   judgeModel: string | null;
   caseCount: number;
   attemptCount: number;
diff --git a/ai_evals/core/windmillBackendSettings.test.ts b/ai_evals/core/windmillBackendSettings.test.ts
new file mode 100644
index 0000000000..200bc4aa7a
--- /dev/null
+++ b/ai_evals/core/windmillBackendSettings.test.ts
@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, it } from "bun:test";
+import { resolveWindmillBackendSettings } from "./windmillBackendSettings";
+
+const ENV_KEYS = [
+  "WMILL_AI_EVAL_BACKEND_URL",
+  "WINDMILL_URL",
+  "WINDMILL_BASE_URL",
+  "REMOTE",
+  "WMILL_AI_EVAL_BACKEND_EMAIL",
+  "WMILL_AI_EVAL_BACKEND_PASSWORD",
+  "WMILL_AI_EVAL_BACKEND_WORKSPACE",
+] as const;
+
+const ORIGINAL_ENV = Object.fromEntries(
+  ENV_KEYS.map((key) => [key, process.env[key]]),
+) as Record<(typeof ENV_KEYS)[number], string | undefined>;
+
+afterEach(() => {
+  for (const key of ENV_KEYS) {
+    const value = ORIGINAL_ENV[key];
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+});
+
+describe("resolveWindmillBackendSettings", () => {
+  it("uses backend URL/auth defaults and the optional explicit workspace", () => {
+    delete process.env.WMILL_AI_EVAL_BACKEND_URL;
+    delete process.env.WINDMILL_URL;
+    delete process.env.WINDMILL_BASE_URL;
+    delete process.env.REMOTE;
+    process.env.WMILL_AI_EVAL_BACKEND_WORKSPACE = "shared-evals";
+
+    expect(resolveWindmillBackendSettings()).toEqual({
+      baseUrl: "http://127.0.0.1:8000",
+      email: "admin@windmill.dev",
+      password: "changeme",
+      workspaceOverride: "shared-evals",
+    });
+  });
+
+  it("does not expose workspace retention knobs", () => {
+    process.env.WMILL_AI_EVAL_BACKEND_URL = "http://backend.test/";
+
+    const settings = resolveWindmillBackendSettings();
+
+    expect(settings).toEqual({
+      baseUrl: "http://backend.test",
+      email: "admin@windmill.dev",
+      password: "changeme",
+      workspaceOverride: undefined,
+    });
+    expect(Object.keys(settings).sort()).toEqual([
+      "baseUrl",
+      "email",
+      "password",
+      "workspaceOverride",
+    ]);
+  });
+});
diff --git a/ai_evals/core/windmillBackendSettings.ts b/ai_evals/core/windmillBackendSettings.ts
index c3a0a52d47..2388c32b4d 100644
--- a/ai_evals/core/windmillBackendSettings.ts
+++ b/ai_evals/core/windmillBackendSettings.ts
@@ -2,9 +2,7 @@ export interface WindmillBackendSettings {
   baseUrl: string;
   email: string;
   password: string;
-  keepWorkspaces: boolean;
   workspaceOverride?: string;
-  workspacePrefix: string;
 }
 
 export function resolveWindmillBackendSettings(): WindmillBackendSettings {
@@ -18,13 +16,9 @@ export function resolveWindmillBackendSettings(): WindmillBackendSettings {
     ),
     email: process.env.WMILL_AI_EVAL_BACKEND_EMAIL ?? "admin@windmill.dev",
     password: process.env.WMILL_AI_EVAL_BACKEND_PASSWORD ?? "changeme",
-    keepWorkspaces: isTruthy(process.env.WMILL_AI_EVAL_KEEP_WORKSPACES),
     workspaceOverride: sanitizeOptionalWorkspaceId(
       process.env.WMILL_AI_EVAL_BACKEND_WORKSPACE,
     ),
-    workspacePrefix: sanitizeWorkspacePrefix(
-      process.env.WMILL_AI_EVAL_WORKSPACE_PREFIX ?? "ai-evals",
-    ),
   };
 }
 
@@ -43,25 +37,9 @@ function normalizeBaseUrl(value: string): string {
   return value.replace(/\/+$/, "");
 }
 
-function sanitizeWorkspacePrefix(value: string): string {
-  const sanitized = value
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9-]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-  return sanitized.length > 0 ? sanitized : "ai-evals";
-}
-
 function sanitizeOptionalWorkspaceId(
   value: string | undefined,
 ): string | undefined {
   const trimmed = value?.trim();
   return trimmed ? trimmed : undefined;
 }
-
-function isTruthy(value: string | undefined): boolean {
-  if (!value) {
-    return false;
-  }
-  return ["1", "true", "yes", "on"].includes(value.trim().toLowerCase());
-}
diff --git a/ai_evals/modes/app.ts b/ai_evals/modes/app.ts
index 5bca0ad878..af9d7c667b 100644
--- a/ai_evals/modes/app.ts
+++ b/ai_evals/modes/app.ts
@@ -5,15 +5,12 @@ import type { FrontendEvalModelConfig } from "../core/models";
 import { validateAppState, type AppFilesState } from "../core/validators";
 import type { BenchmarkArtifactFile, ModeRunner } from "../core/types";
 import { runAppEval } from "../adapters/frontend/core/app/appEvalRunner";
-import {
-  DEFAULT_FRONTEND_EVAL_MODEL,
-  getFrontendApiKey,
-} from "./frontendCommon";
-import type { FrontendEvalTransportSettings } from "../core/frontendTransport";
+import { getFrontendApiKey } from "./frontendCommon";
+import type { WindmillBackendSettings } from "../core/windmillBackendSettings";
 
 export function createAppModeRunner(
-  modelConfig: FrontendEvalModelConfig = DEFAULT_FRONTEND_EVAL_MODEL,
-  transportSettings?: FrontendEvalTransportSettings,
+  modelConfig: FrontendEvalModelConfig,
+  backendSettings: WindmillBackendSettings,
 ): ModeRunner<AppFilesState, AppFilesState, AppFilesState> {
   return {
     mode: "app",
@@ -37,8 +34,7 @@ export function createAppModeRunner(
           appContext: context.evalCase?.runtime?.appContext,
           provider: modelConfig.provider,
           model: modelConfig.model,
-          transport: transportSettings?.transport,
-          backend: transportSettings?.backend,
+          backend: backendSettings,
           runContext: context,
         },
       );
diff --git a/ai_evals/modes/flow.ts b/ai_evals/modes/flow.ts
index 4e4f6451b9..e40a495573 100644
--- a/ai_evals/modes/flow.ts
+++ b/ai_evals/modes/flow.ts
@@ -7,11 +7,8 @@ import type { BenchmarkArtifactFile, ModeRunner } from "../core/types";
 import { runFlowEval } from "../adapters/frontend/core/flow/flowEvalRunner";
 import type { FlowWorkspaceFixtures } from "../adapters/frontend/core/flow/fileHelpers";
 import { BackendPreviewClient } from "../adapters/frontend/backendPreview";
-import {
-  DEFAULT_FRONTEND_EVAL_MODEL,
-  getFrontendApiKey,
-} from "./frontendCommon";
-import type { FrontendEvalTransportSettings } from "../core/frontendTransport";
+import { getFrontendApiKey } from "./frontendCommon";
+import type { WindmillBackendSettings } from "../core/windmillBackendSettings";
 import {
   normalizeFlowInitialFixture,
   normalizeFlowStateFixture,
@@ -19,9 +16,9 @@ import {
 } from "./flowFixtures";
 
 export function createFlowModeRunner(
-  modelConfig: FrontendEvalModelConfig = DEFAULT_FRONTEND_EVAL_MODEL,
-  backendValidation?: BackendValidationSettings,
-  transportSettings?: FrontendEvalTransportSettings,
+  modelConfig: FrontendEvalModelConfig,
+  backendValidation: BackendValidationSettings | undefined,
+  backendSettings: WindmillBackendSettings,
 ): ModeRunner<FlowInitialFixture, FlowState, FlowState> {
   return {
     mode: "flow",
@@ -49,8 +46,7 @@ export function createFlowModeRunner(
           maxIterations: context.evalCase?.runtime?.maxTurns,
           provider: modelConfig.provider,
           model: modelConfig.model,
-          transport: transportSettings?.transport,
-          backend: transportSettings?.backend,
+          backend: backendSettings,
           runContext: context,
         },
       );
diff --git a/ai_evals/modes/frontendCommon.ts b/ai_evals/modes/frontendCommon.ts
index 2619d21821..f121551d86 100644
--- a/ai_evals/modes/frontendCommon.ts
+++ b/ai_evals/modes/frontendCommon.ts
@@ -1,12 +1,4 @@
-import {
-  getFrontendEvalModel,
-  resolveEvalModel,
-  type FrontendEvalModelConfig,
-} from "../core/models";
-
-export const DEFAULT_FRONTEND_EVAL_MODEL: FrontendEvalModelConfig = getFrontendEvalModel(
-  resolveEvalModel("flow")
-);
+import type { FrontendEvalModelConfig } from "../core/models";
 
 export function getFrontendApiKey(provider: FrontendEvalModelConfig["provider"]): string {
   const envName =
diff --git a/ai_evals/modes/script.ts b/ai_evals/modes/script.ts
index 7671e8220a..0c49b05d7d 100644
--- a/ai_evals/modes/script.ts
+++ b/ai_evals/modes/script.ts
@@ -6,16 +6,13 @@ import type { BenchmarkArtifactFile, ModeRunner } from "../core/types";
 import { BackendPreviewClient } from "../adapters/frontend/backendPreview";
 import { runScriptEval } from "../adapters/frontend/core/script/scriptEvalRunner";
 import type { ScriptEvalState } from "../adapters/frontend/core/script/fileHelpers";
-import {
-  DEFAULT_FRONTEND_EVAL_MODEL,
-  getFrontendApiKey,
-} from "./frontendCommon";
-import type { FrontendEvalTransportSettings } from "../core/frontendTransport";
+import { getFrontendApiKey } from "./frontendCommon";
+import type { WindmillBackendSettings } from "../core/windmillBackendSettings";
 
 export function createScriptModeRunner(
-  modelConfig: FrontendEvalModelConfig = DEFAULT_FRONTEND_EVAL_MODEL,
-  backendValidation?: BackendValidationSettings,
-  transportSettings?: FrontendEvalTransportSettings,
+  modelConfig: FrontendEvalModelConfig,
+  backendValidation: BackendValidationSettings | undefined,
+  backendSettings: WindmillBackendSettings,
 ): ModeRunner<ScriptEvalState, ScriptEvalState, ScriptEvalState> {
   return {
     mode: "script",
@@ -40,8 +37,7 @@ export function createScriptModeRunner(
           maxIterations: context.evalCase?.runtime?.maxTurns,
           provider: modelConfig.provider,
           model: modelConfig.model,
-          transport: transportSettings?.transport,
-          backend: transportSettings?.backend,
+          backend: backendSettings,
           runContext: context,
         },
       );

From 17cf538a2d8724bbc289d9c1c13e4076a4cdfef7 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Tue, 12 May 2026 16:09:31 +0200
Subject: [PATCH 49/50] refactor: move ai providers to windmill-ai (#9120)

---
 backend/Cargo.lock                            |  4 ---
 backend/windmill-ai/src/lib.rs                |  1 +
 .../src}/providers/anthropic.rs               |  8 ++---
 .../src}/providers/bedrock.rs                 | 12 +++----
 .../src}/providers/google_ai.rs               |  4 +--
 backend/windmill-ai/src/providers/mod.rs      | 31 ++++++++++++++++++
 .../src}/providers/openai.rs                  |  8 ++---
 .../src}/providers/openrouter.rs              | 10 +++---
 .../ai => windmill-ai/src}/providers/other.rs |  8 ++---
 backend/windmill-worker/Cargo.toml            |  6 +---
 backend/windmill-worker/src/ai/mod.rs         |  1 -
 .../windmill-worker/src/ai/providers/mod.rs   |  7 ----
 .../windmill-worker/src/ai/query_builder.rs   | 32 ++-----------------
 backend/windmill-worker/src/ai_executor.rs    |  5 +--
 docs/windmill-ai-refactor-plan.md             |  4 +--
 15 files changed, 65 insertions(+), 76 deletions(-)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/providers/anthropic.rs (99%)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/providers/bedrock.rs (97%)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/providers/google_ai.rs (99%)
 create mode 100644 backend/windmill-ai/src/providers/mod.rs
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/providers/openai.rs (99%)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/providers/openrouter.rs (98%)
 rename backend/{windmill-worker/src/ai => windmill-ai/src}/providers/other.rs (99%)
 delete mode 100644 backend/windmill-worker/src/ai/providers/mod.rs

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 7a6433e5af..00e8959f72 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15618,10 +15618,6 @@ dependencies = [
  "async-recursion",
  "async-stream",
  "async-trait",
- "aws-config",
- "aws-credential-types",
- "aws-sdk-bedrockruntime",
- "aws-smithy-types",
  "axum 0.8.9",
  "backon",
  "base64 0.22.1",
diff --git a/backend/windmill-ai/src/lib.rs b/backend/windmill-ai/src/lib.rs
index 945091613b..6b174bf2e6 100644
--- a/backend/windmill-ai/src/lib.rs
+++ b/backend/windmill-ai/src/lib.rs
@@ -5,6 +5,7 @@ pub mod ai_google;
 pub mod ai_providers;
 pub mod ai_types;
 pub mod image_handler;
+pub mod providers;
 pub mod query_builder;
 pub mod sse;
 pub mod types;
diff --git a/backend/windmill-worker/src/ai/providers/anthropic.rs b/backend/windmill-ai/src/providers/anthropic.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/anthropic.rs
rename to backend/windmill-ai/src/providers/anthropic.rs
index 0a3c5df6e4..43cb503d96 100644
--- a/backend/windmill-worker/src/ai/providers/anthropic.rs
+++ b/backend/windmill-ai/src/providers/anthropic.rs
@@ -1,7 +1,4 @@
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-use serde_json::value::RawValue;
-use windmill_ai::{
+use crate::{
     ai_google::parse_data_url,
     ai_providers::AIProvider,
     image_handler::prepare_messages_for_api,
@@ -10,6 +7,9 @@ use windmill_ai::{
     types::*,
     utils::{extract_text_content, should_use_structured_output_tool},
 };
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
 use windmill_common::{client::AuthedClient, error::Error};
 
 /// Anthropic API version for standard API
diff --git a/backend/windmill-worker/src/ai/providers/bedrock.rs b/backend/windmill-ai/src/providers/bedrock.rs
similarity index 97%
rename from backend/windmill-worker/src/ai/providers/bedrock.rs
rename to backend/windmill-ai/src/providers/bedrock.rs
index 8c37433cab..005327c15b 100644
--- a/backend/windmill-worker/src/ai/providers/bedrock.rs
+++ b/backend/windmill-ai/src/providers/bedrock.rs
@@ -1,4 +1,4 @@
-//! AWS Bedrock provider for the AI agent.
+//! AWS Bedrock provider for AI requests.
 //!
 //! Uses shared SDK code from windmill_ai::ai_bedrock for:
 //! - BedrockClient (SDK wrapper with auth)
@@ -6,16 +6,16 @@
 //! - Stream event parsing
 //! - Helper utilities
 
-use std::collections::HashMap;
-use windmill_ai::{
+use crate::{
     image_handler::prepare_messages_for_api,
     query_builder::{ParsedResponse, StreamEventSink},
     types::{OpenAIMessage, StreamingEvent, TokenUsage, ToolDef},
 };
+use std::collections::HashMap;
 use windmill_common::{client::AuthedClient, error::Error};
 
-// Import shared Bedrock helpers for worker-specific orchestration.
-use windmill_ai::ai_bedrock::{
+// Import shared Bedrock helpers for provider orchestration.
+use crate::ai_bedrock::{
     bedrock_model_supports_prompt_caching, bedrock_stream_event_is_block_stop,
     bedrock_stream_event_to_text, bedrock_stream_event_to_tool_delta,
     bedrock_stream_event_to_tool_start, build_tool_config, create_inference_config,
@@ -24,7 +24,7 @@ use windmill_ai::ai_bedrock::{
 };
 
 // ============================================================================
-// Query Builder (Worker-specific orchestration)
+// Query Builder
 // ============================================================================
 
 #[derive(Default)]
diff --git a/backend/windmill-worker/src/ai/providers/google_ai.rs b/backend/windmill-ai/src/providers/google_ai.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/google_ai.rs
rename to backend/windmill-ai/src/providers/google_ai.rs
index 19c50d06de..81f34e7acb 100644
--- a/backend/windmill-worker/src/ai/providers/google_ai.rs
+++ b/backend/windmill-ai/src/providers/google_ai.rs
@@ -1,5 +1,4 @@
-use async_trait::async_trait;
-use windmill_ai::{
+use crate::{
     ai_google::{
         openai_messages_to_gemini, openai_tools_to_gemini, GeminiGenerationConfig,
         GeminiImageContent, GeminiImageRequest, GeminiImageResponse, GeminiInlineData, GeminiPart,
@@ -10,6 +9,7 @@ use windmill_ai::{
     sse::{GeminiSSEParser, SSEParser},
     types::*,
 };
+use async_trait::async_trait;
 use windmill_common::{client::AuthedClient, error::Error};
 
 // ============================================================================
diff --git a/backend/windmill-ai/src/providers/mod.rs b/backend/windmill-ai/src/providers/mod.rs
new file mode 100644
index 0000000000..8f9e2382a8
--- /dev/null
+++ b/backend/windmill-ai/src/providers/mod.rs
@@ -0,0 +1,31 @@
+pub mod anthropic;
+#[cfg(feature = "bedrock")]
+pub mod bedrock;
+pub mod google_ai;
+pub mod openai;
+pub mod openrouter;
+pub mod other;
+
+use crate::{ai_providers::AIProvider, query_builder::QueryBuilder, types::ProviderWithResource};
+
+use self::{
+    anthropic::AnthropicQueryBuilder, google_ai::GoogleAIQueryBuilder, openai::OpenAIQueryBuilder,
+    openrouter::OpenRouterQueryBuilder, other::OtherQueryBuilder,
+};
+
+/// Factory function to create the appropriate query builder for a provider.
+pub fn create_query_builder(provider: &ProviderWithResource) -> Box<dyn QueryBuilder> {
+    match provider.kind {
+        AIProvider::GoogleAI => {
+            Box::new(GoogleAIQueryBuilder::new(provider.get_platform().clone()))
+        }
+        AIProvider::OpenAI => Box::new(OpenAIQueryBuilder::new(provider.kind.clone())),
+        AIProvider::Anthropic => Box::new(AnthropicQueryBuilder::new(
+            provider.kind.clone(),
+            provider.get_platform().clone(),
+            provider.get_enable_1m_context(),
+        )),
+        AIProvider::OpenRouter => Box::new(OpenRouterQueryBuilder::new()),
+        _ => Box::new(OtherQueryBuilder::new(provider.kind.clone())),
+    }
+}
diff --git a/backend/windmill-worker/src/ai/providers/openai.rs b/backend/windmill-ai/src/providers/openai.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/openai.rs
rename to backend/windmill-ai/src/providers/openai.rs
index e0767d5dda..f8928ca940 100644
--- a/backend/windmill-worker/src/ai/providers/openai.rs
+++ b/backend/windmill-ai/src/providers/openai.rs
@@ -1,7 +1,4 @@
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-use serde_json::value::RawValue;
-use windmill_ai::{
+use crate::{
     ai_providers::AIProvider,
     ai_types::OpenAIToolCall,
     image_handler::{prepare_messages_for_api, s3_object_to_content_part},
@@ -10,6 +7,9 @@ use windmill_ai::{
     types::*,
     utils::extract_text_content,
 };
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json::value::RawValue;
 use windmill_common::{client::AuthedClient, error::Error};
 
 // Responses API structures
diff --git a/backend/windmill-worker/src/ai/providers/openrouter.rs b/backend/windmill-ai/src/providers/openrouter.rs
similarity index 98%
rename from backend/windmill-worker/src/ai/providers/openrouter.rs
rename to backend/windmill-ai/src/providers/openrouter.rs
index ede541cd13..aaefbb08ca 100644
--- a/backend/windmill-worker/src/ai/providers/openrouter.rs
+++ b/backend/windmill-ai/src/providers/openrouter.rs
@@ -1,15 +1,15 @@
-use async_trait::async_trait;
-use serde::{Deserialize, Serialize};
-use serde_json;
-use windmill_ai::{
+use crate::{
     ai_providers::AIProvider,
     image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
     types::*,
 };
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+use serde_json;
 use windmill_common::{client::AuthedClient, error::Error};
 
-use crate::ai::providers::other::OtherQueryBuilder;
+use crate::providers::other::OtherQueryBuilder;
 
 // OpenRouter-specific types
 #[derive(Serialize)]
diff --git a/backend/windmill-worker/src/ai/providers/other.rs b/backend/windmill-ai/src/providers/other.rs
similarity index 99%
rename from backend/windmill-worker/src/ai/providers/other.rs
rename to backend/windmill-ai/src/providers/other.rs
index a840517133..08f922a1de 100644
--- a/backend/windmill-worker/src/ai/providers/other.rs
+++ b/backend/windmill-ai/src/providers/other.rs
@@ -1,7 +1,4 @@
-use async_trait::async_trait;
-use serde::Serialize;
-use serde_json;
-use windmill_ai::{
+use crate::{
     ai_providers::AIProvider,
     image_handler::prepare_messages_for_api,
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventSink},
@@ -9,6 +6,9 @@ use windmill_ai::{
     types::*,
     utils::should_use_structured_output_tool,
 };
+use async_trait::async_trait;
+use serde::Serialize;
+use serde_json;
 use windmill_common::{client::AuthedClient, error::Error};
 
 #[derive(Serialize, Debug, Clone)]
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index f1c7fa6c99..5ebcb0b370 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -39,7 +39,7 @@ ruby = ["dep:windmill-parser-ruby"]
 rlang = ["dep:windmill-parser-r"]
 duckdb = ["dep:libloading"]
 quickjs = ["windmill-jseval/quickjs"]
-bedrock = ["windmill-ai/bedrock", "dep:aws-sdk-bedrockruntime", "dep:aws-config", "dep:aws-credential-types", "dep:aws-smithy-types"]
+bedrock = ["windmill-ai/bedrock"]
 
 [dependencies]
 windmill-ai = { workspace = true, default-features = false }
@@ -71,10 +71,6 @@ windmill-parser-sql.workspace = true
 windmill-parser-graphql.workspace = true
 windmill-parser-php = { workspace = true, optional = true }
 windmill-git-sync.workspace = true
-aws-sdk-bedrockruntime = { workspace = true, optional = true }
-aws-config = { workspace = true, optional = true }
-aws-credential-types = { workspace = true, optional = true }
-aws-smithy-types = { workspace = true, optional = true }
 flume.workspace = true
 sqlx.workspace = true
 uuid.workspace = true
diff --git a/backend/windmill-worker/src/ai/mod.rs b/backend/windmill-worker/src/ai/mod.rs
index b004b0ec20..24e877ab13 100644
--- a/backend/windmill-worker/src/ai/mod.rs
+++ b/backend/windmill-worker/src/ai/mod.rs
@@ -1,7 +1,6 @@
 // AI executor module structure
 // This module will contain all AI-related execution logic
 
-pub mod providers;
 pub mod query_builder;
 pub mod tools;
 pub mod utils;
diff --git a/backend/windmill-worker/src/ai/providers/mod.rs b/backend/windmill-worker/src/ai/providers/mod.rs
deleted file mode 100644
index f558c28289..0000000000
--- a/backend/windmill-worker/src/ai/providers/mod.rs
+++ /dev/null
@@ -1,7 +0,0 @@
-pub mod anthropic;
-#[cfg(feature = "bedrock")]
-pub mod bedrock;
-pub mod google_ai;
-pub mod openai;
-pub mod openrouter;
-pub mod other;
diff --git a/backend/windmill-worker/src/ai/query_builder.rs b/backend/windmill-worker/src/ai/query_builder.rs
index 606aa8f9db..fe8a3b9b00 100644
--- a/backend/windmill-worker/src/ai/query_builder.rs
+++ b/backend/windmill-worker/src/ai/query_builder.rs
@@ -1,37 +1,9 @@
 use async_trait::async_trait;
-use windmill_ai::{
-    query_builder::{QueryBuilder, StreamEventSink},
-    types::*,
-};
+use windmill_ai::{query_builder::StreamEventSink, types::*};
 use windmill_common::{error::Error, worker::Connection};
 use windmill_queue::MiniPulledJob;
 
-use crate::{
-    ai::providers::{
-        anthropic::AnthropicQueryBuilder, google_ai::GoogleAIQueryBuilder,
-        openai::OpenAIQueryBuilder, openrouter::OpenRouterQueryBuilder, other::OtherQueryBuilder,
-    },
-    job_logger::append_result_stream,
-};
-
-/// Factory function to create the appropriate query builder for a provider
-pub fn create_query_builder(provider: &ProviderWithResource) -> Box<dyn QueryBuilder> {
-    use windmill_ai::ai_providers::AIProvider;
-
-    match provider.kind {
-        AIProvider::GoogleAI => {
-            Box::new(GoogleAIQueryBuilder::new(provider.get_platform().clone()))
-        }
-        AIProvider::OpenAI => Box::new(OpenAIQueryBuilder::new(provider.kind.clone())),
-        AIProvider::Anthropic => Box::new(AnthropicQueryBuilder::new(
-            provider.kind.clone(),
-            provider.get_platform().clone(),
-            provider.get_enable_1m_context(),
-        )),
-        AIProvider::OpenRouter => Box::new(OpenRouterQueryBuilder::new()),
-        _ => Box::new(OtherQueryBuilder::new(provider.kind.clone())),
-    }
-}
+use crate::job_logger::append_result_stream;
 
 /// Processes streaming events by persisting them to the database.
 /// Implements StreamEventSink so it can be passed to QueryBuilder methods.
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index cdf2995f9c..dae4f277f2 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -23,6 +23,7 @@ use crate::ai::tools::McpClientStub as McpClient;
 use windmill_ai::{
     ai_providers::AIProvider,
     image_handler::upload_image_to_s3,
+    providers::create_query_builder,
     query_builder::{BuildRequestArgs, ParsedResponse},
     types::*,
     utils::{should_use_structured_output_tool, AI_HTTP_HEADERS},
@@ -44,7 +45,7 @@ use windmill_common::{
 use windmill_queue::{cancel_single_job, CanceledBy, MiniPulledJob};
 
 use crate::{
-    ai::query_builder::{create_query_builder, StreamEventProcessor},
+    ai::query_builder::StreamEventProcessor,
     common::{build_args_map, resolve_job_timeout, OccupancyMetrics, StreamNotifier},
     handle_child::{run_future_with_polling_update_job_poller_graceful, GracefulPollOutcome},
 };
@@ -866,7 +867,7 @@ pub async fn run_agent(
                     .get_region()
                     .unwrap_or(windmill_ai::ai_providers::USE_ENV_REGION);
                 // Use Bedrock SDK via dedicated query builder
-                crate::ai::providers::bedrock::BedrockQueryBuilder::default()
+                windmill_ai::providers::bedrock::BedrockQueryBuilder::default()
                     .execute_request(
                         &messages,
                         tool_defs.as_deref(),
diff --git a/docs/windmill-ai-refactor-plan.md b/docs/windmill-ai-refactor-plan.md
index 78b82ddcc6..0e8449d897 100644
--- a/docs/windmill-ai-refactor-plan.md
+++ b/docs/windmill-ai-refactor-plan.md
@@ -142,7 +142,7 @@ Move from `windmill-worker/src/ai/sse.rs` to `windmill-ai/src/sse.rs`:
 
 ---
 
-### Step 5: Move provider implementations to windmill-ai
+### Step 5: Move provider implementations to windmill-ai ✅
 
 Move from `windmill-worker/src/ai/providers/` to `windmill-ai/src/providers/`:
 - `anthropic.rs` — `AnthropicQueryBuilder`
@@ -159,7 +159,7 @@ Move utility functions providers depend on:
 
 ---
 
-### Step 6: Move image_handler to windmill-ai
+### Step 6: Move image_handler to windmill-ai ✅
 
 Move from `windmill-worker/src/ai/image_handler.rs` to `windmill-ai/src/image_handler.rs`:
 - `download_and_encode_s3_image` — no signature change needed

From d0f23cc5238b025208c61e983701894de28536d5 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Tue, 12 May 2026 16:33:21 +0200
Subject: [PATCH 50/50] feat(frontend): unified EditorHeader with file picker
 for flow/script/app editors (#9047)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: add EditableInput component

* feat: add EditorHeader for flow editor with file picker entry point

* feat: WorkspaceItemPicker for editor header navigation

* feat: clickable breadcrumb in EditorHeader, scoped picker keyboard nav

* fix: reload flow on URL change and reset highlight in search mode

* feat: editor header layout polish and trigger removal

* feat: apply EditorHeader to script, app, and raw app editors

* fix: show generated initial path for new apps in EditorHeader

* fix: align EditorHeader new-app path with draft drawer's Path component

* fix: read page.params.path in loadApp to reload on URL change

* fix: remount AppEditor when navigating between apps

* fix: clear app/files on URL change so editor remounts with fresh data

* fix: route picker selections to /apps/edit or /apps_raw/edit based on raw_app

* fix: drop Save button from path popover; defer rename to deploy

* refactor: drop pathPopoverContent snippet, bind newEditedPath directly

* refactor: dedupe editor header plumbing (editPathFor, userPathPrefix, breadcrumb snippet)

* fix: freeze breadcrumb during path edit so popover doesn't drift

* fix: drop spinner from path dependency-check; render nothing when no usages

* fix: swallow 404 in checkFlowOnBehalfOf so renaming a flow doesn't toast

* Revert "fix: swallow 404 in checkFlowOnBehalfOf so renaming a flow doesn't toast"

This reverts commit 82dec462aefe5f166862ee7642c028ce0e58e3e9.

* refactor: drop moveRenameManager dep from EditorHeader; pass onBehalfOfEmail as prop

* refactor: replace breadcrumb-snapshot effect with open/close setter

* refactor: drop unused dirtyPath state from EditorHeader

* fix: surface Path validation error in pen popover

* fix: decouple Path validation error from hideFullPath toggle

* refactor: use InputError for path validation message (slide transition)

* fix: re-derive Path meta from external path changes (sibling sync)

* docs: note Path's meta could be replaced with function-form bindings

* fix: 'Exit & see details' uses deployed path, not live store

* fix: undo/redo shortcut uses shiftKey instead of fragile case-match

* fix: type errors and keep edit pen visible while popover is open

* chore: remove unused meltComponents/Accordion wrapper

* fix: focus search input on picker open via popover openFocus selector

* fix: refocus picker search input on every popover open

* fix: pre-seed picker loaded state from cache so accordion opens at the right place

* fix: breadcrumb and picker track savedPath, not draft-renamed live path

* fix: inject current draft item into picker so breadcrumb scope isn't empty

* docs: add component-level and prop-level docs to EditableInput

* feat: warn that a deploy is needed when path is edited on a saved item

* feat: show same path-change-needs-deploy message in flow/script settings

* fix(flows): persist draft-renamed path through reload and dirty check

* fix: include path in unsaved-changes diff so renames trigger the modal

* feat: nested folders in picker tree and breadcrumb

* fix: per-segment popover state so switching breadcrumbs closes the previous one

* refactor: replace accordion picker with drill-through picker

* refactor(picker): review fixes, drill polish, and breadcrumb collapse

* fix(picker): review fixes — banned bindable, drop sibling-sync, load races, mouse highlight

* fix(picker): smooth-scroll highlighted row into view on open

* fix(picker): second-pass review fixes — load races, cache invalidation, breadcrumb/picker a11y, raw_app routing

* fix(RowIcon): apply size prop to resource_type and fallback divs

* feat(picker): add cross-kind 'All' root; deeper breadcrumb segments open there

* fix(picker,editor): third-pass review — search loading state, pen autofocus, allow empty summary, a11y

* fix(picker,editor): fourth-pass review — own check, flowbuilder arrows, editableinput double-save, customui.path gate, invalidate races

* fix(editor,picker): codex review — fresh URL state per load, granular whitelabel topBar gates

* fix(flows): clear localStorage in auto-reload to break URL-state loop
---
 .../lib/components/BreadcrumbSegment.svelte   |  76 ++
 .../src/lib/components/EditorHeader.svelte    | 247 +++++++
 .../src/lib/components/FlowBuilder.svelte     |  84 +--
 frontend/src/lib/components/InputError.svelte |   2 +-
 .../src/lib/components/LabelsInput.svelte     |  14 +-
 frontend/src/lib/components/Path.svelte       |  10 +-
 .../src/lib/components/ScriptBuilder.svelte   | 116 +--
 .../WorkspaceItemDrillPicker.svelte           | 699 ++++++++++++++++++
 .../components/apps/editor/AppEditor.svelte   |   4 +-
 .../apps/editor/AppEditorHeader.svelte        |  99 ++-
 .../components/common/EditableInput.svelte    | 143 ++++
 .../components/common/button/Button.svelte    |  12 +-
 .../UnsavedConfirmationModal.svelte           |   7 +-
 .../components/common/table/RowIcon.svelte    |  43 +-
 frontend/src/lib/components/flow_builder.ts   |  82 +-
 .../flows/content/FlowSettings.svelte         |   8 +
 .../lib/components/icons/BarsStaggered.svelte |  12 +-
 .../components/meltComponents/Popover.svelte  |   5 +
 .../components/raw_apps/RawAppEditor.svelte   |   2 +-
 .../raw_apps/RawAppEditorHeader.svelte        |  97 ++-
 frontend/src/lib/components/script_builder.ts |   2 +
 .../src/lib/components/workspacePicker.ts     | 151 ++++
 frontend/src/lib/utils.ts                     |  10 +
 .../(logged)/apps/edit/[...path]/+page.svelte |  17 +-
 .../apps_raw/edit/[...path]/+page.svelte      |  21 +-
 .../(root)/(logged)/flows/add/+page.svelte    |   6 +-
 .../flows/edit/[...path]/+page.svelte         |  71 +-
 .../(root)/(logged)/scripts/add/+page.svelte  |  23 +-
 .../scripts/edit/[...path]/+page.svelte       |  42 +-
 29 files changed, 1760 insertions(+), 345 deletions(-)
 create mode 100644 frontend/src/lib/components/BreadcrumbSegment.svelte
 create mode 100644 frontend/src/lib/components/EditorHeader.svelte
 create mode 100644 frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
 create mode 100644 frontend/src/lib/components/common/EditableInput.svelte
 create mode 100644 frontend/src/lib/components/workspacePicker.ts

diff --git a/frontend/src/lib/components/BreadcrumbSegment.svelte b/frontend/src/lib/components/BreadcrumbSegment.svelte
new file mode 100644
index 0000000000..8b18503f75
--- /dev/null
+++ b/frontend/src/lib/components/BreadcrumbSegment.svelte
@@ -0,0 +1,76 @@
+<!--
+@component
+One clickable segment of the editor breadcrumb. The segment opens a popover
+containing a `WorkspaceItemDrillPicker`. Each instance owns its own `isOpen`
+state — switching popovers relies on melt-ui's `closeOnOtherPopoverOpen` to
+close siblings.
+-->
+<script lang="ts">
+	import { ChevronRight } from 'lucide-svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import WorkspaceItemDrillPicker, {
+		type Scope
+	} from '$lib/components/WorkspaceItemDrillPicker.svelte'
+	import type { WorkspaceItem } from '$lib/components/workspacePicker'
+
+	interface Props {
+		label: string
+		withChevron?: boolean
+		extraClass?: string
+		disabled?: boolean
+		/** Where the picker lands when this segment is clicked. */
+		initialScope?: Scope
+		/** Composite key of the row to highlight (e.g. `dir:flow:f/demo`). */
+		initialHighlight?: string
+		/** Mark this segment as the current page (leaf of the breadcrumb). */
+		isCurrent?: boolean
+		currentItem?: WorkspaceItem & { savedPath?: string }
+		onPick: (item: WorkspaceItem) => void
+	}
+
+	let {
+		label,
+		withChevron = false,
+		extraClass = '',
+		disabled = false,
+		initialScope,
+		initialHighlight,
+		isCurrent = false,
+		currentItem,
+		onPick
+	}: Props = $props()
+
+	let isOpen = $state(false)
+
+	const SEGMENT_BASE_CLASS =
+		'font-normal inline-flex items-center px-1 rounded hover:bg-surface-hover hover:text-primary transition-colors'
+
+	function handlePick(item: WorkspaceItem) {
+		isOpen = false
+		onPick(item)
+	}
+</script>
+
+<Popover
+	placement="bottom-start"
+	usePointerDownOutside
+	excludeSelectors=".drawer"
+	disableFocusTrap
+	closeOnOtherPopoverOpen
+	class="{SEGMENT_BASE_CLASS} {extraClass} {disabled ? 'cursor-default' : 'cursor-pointer'}"
+	bind:isOpen
+	openFocus="[data-workspace-picker-search]"
+	triggerAttrs={{
+		'aria-label': label,
+		...(isCurrent ? { 'aria-current': 'page' } : {})
+	}}
+	{disabled}
+>
+	{#snippet trigger()}
+		{#if withChevron}<ChevronRight size={10} class="shrink-0" /><span class="truncate">{label}</span
+			>{:else}{label}{/if}
+	{/snippet}
+	{#snippet content()}
+		<WorkspaceItemDrillPicker {initialScope} {initialHighlight} {currentItem} onPick={handlePick} />
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/EditorHeader.svelte b/frontend/src/lib/components/EditorHeader.svelte
new file mode 100644
index 0000000000..e52210bb06
--- /dev/null
+++ b/frontend/src/lib/components/EditorHeader.svelte
@@ -0,0 +1,247 @@
+<script lang="ts">
+	import { Pencil } from 'lucide-svelte'
+	import { Alert, Button } from '$lib/components/common'
+	import EditableInput from '$lib/components/common/EditableInput.svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
+	import Path from '$lib/components/Path.svelte'
+	import Label from '$lib/components/Label.svelte'
+	import {
+		dirKey,
+		KIND_LABEL_LOWER,
+		kindKey,
+		leafKeyFor,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from '$lib/components/workspacePicker'
+	import BreadcrumbSegment from '$lib/components/BreadcrumbSegment.svelte'
+	import { isOwner } from '$lib/utils'
+	import { userStore, workspaceStore } from '$lib/stores'
+
+	interface Props {
+		summary?: string
+		path?: string
+		/** The item's *saved* path on the server. Used so the picker knows to
+		 * replace the saved entry with a virtual one at the live `path` while
+		 * the user is mid-rename — keeps the breadcrumb and picker tree coherent
+		 * (the breadcrumb shows the user's draft path, and the picker shows the
+		 * item at that same path even though the rename hasn't been deployed). */
+		savedPath?: string
+		/** Kind of the item being edited; used to label the first breadcrumb segment. */
+		kind?: WorkspaceItemKind
+		/** True when editing a raw app — forwarded into the virtual `currentItem`
+		 * so the picker / `editPathFor` can route to `/apps_raw/...`. */
+		raw_app?: boolean
+		onNavigate?: (item: WorkspaceItem) => void
+		/** When set, shows a "redeployed on behalf of" warning in the path-edit
+		 * popover. Parents already know this from their loaded item — no API call. */
+		onBehalfOfEmail?: string | undefined
+		penVisibility?: 'hover' | 'always'
+		/** When false, the summary input becomes read-only. Breadcrumb
+		 * navigation and the pen popover are unaffected. */
+		summaryEditable?: boolean
+		/** When false, the pen popover is hidden so the path can't be edited
+		 * inline. Breadcrumb navigation still works — only the rename UI is
+		 * gated. */
+		pathEditable?: boolean
+	}
+
+	let {
+		summary = $bindable(),
+		path = $bindable(),
+		savedPath,
+		kind = 'flow',
+		raw_app = false,
+		onNavigate,
+		onBehalfOfEmail,
+		penVisibility = 'hover',
+		summaryEditable = true,
+		pathEditable = true
+	}: Props = $props()
+
+	let pathPopoverOpen = $state(false)
+	/** Snapshot of `path` taken when the pen popover opens; cleared on close.
+	 * While set, the breadcrumb derives from it instead of `path` so the pen
+	 * anchor doesn't reflow as the user types in the popover (which would drag
+	 * the popover with it via floating-ui's auto-update). */
+	let snapshotPath = $state<string | undefined>(undefined)
+
+	function setPathPopoverOpen(open: boolean) {
+		pathPopoverOpen = open
+		// Only snapshot when there's a path to freeze. New flows / scripts open
+		// the popover with `path === ''` and rely on `Path.reset()` to seed a
+		// path; if we snapshot the empty value the breadcrumb stays blank for
+		// the whole popover lifetime. Leaving `snapshotPath` undefined lets
+		// `displayPath` track the live seeded path instead.
+		snapshotPath = open && path ? path : undefined
+	}
+
+	// Path segments. e.g. "f/demo/weather_report" → scope "f/demo", slug "weather_report".
+	// `snapshotPath` keeps the breadcrumb frozen while the pen popover is open
+	// so the trigger doesn't drift mid-edit. Outside of that, the breadcrumb
+	// follows the live `path` — coherent with the picker because we inject a
+	// virtual current-item entry at that same live path (see `currentItem`).
+	let displayPath = $derived(snapshotPath ?? path ?? '')
+	/** Breakdown for breadcrumb rendering. Top-level dirs (scopes) come first
+	 * — `f/<folder>` or `u/<user>` — then any number of subfolders, then the
+	 * item name. Each dir entry's `fullPath` is the cumulative path up to
+	 * that level, used to key the picker's `initialOpen` / `initialHighlight`. */
+	let segments = $derived.by(() => {
+		const parts = displayPath.split('/')
+		if (parts.length < 3) return null
+		const scope = parts.slice(0, 2).join('/')
+		const slug = parts.slice(2)
+		const dirs: { name: string; fullPath: string }[] = []
+		// Top-level scope is a dir.
+		dirs.push({ name: scope, fullPath: scope })
+		// Intermediate slug parts (everything except the last one).
+		let acc = scope
+		for (let i = 0; i < slug.length - 1; i++) {
+			acc = `${acc}/${slug[i]}`
+			dirs.push({ name: slug[i], fullPath: acc })
+		}
+		const leaf = { name: slug[slug.length - 1], fullPath: displayPath }
+		return { dirs, leaf }
+	})
+
+	// Treat an empty path as ownable so the pen popover lets a user pick the
+	// path for a brand-new item. `Path.reset()` then synthesizes a default
+	// under their own user/folder scope.
+	let own = $derived(!path || isOwner(path, $userStore, $workspaceStore))
+
+	// Virtual entry for the picker: surfaces the currently-edited item at its
+	// live path (which may differ from `savedPath` mid-rename, so the picker
+	// otherwise has no leaf to expand).
+	let currentItem = $derived<WorkspaceItem & { savedPath?: string }>({
+		path: path ?? '',
+		summary: summary ?? '',
+		kind,
+		raw_app,
+		savedPath
+	})
+
+	function handleSummarySave(newValue: string) {
+		summary = newValue.trim()
+	}
+
+	function handlePickerSelect(item: WorkspaceItem) {
+		onNavigate?.(item)
+	}
+</script>
+
+<div class="inline-block max-w-full align-top group px-2 py-0.5 leading-tight">
+	<!-- Path row -->
+	<div class="flex items-center max-w-full text-2xs text-secondary font-mono">
+		<nav aria-label="Breadcrumb" class="contents">
+			<BreadcrumbSegment
+				label={KIND_LABEL_LOWER[kind]}
+				initialScope={undefined}
+				initialHighlight={kindKey(kind)}
+				isCurrent={!segments}
+				{currentItem}
+				onPick={handlePickerSelect}
+			/>
+			{#if segments}
+				{#each segments.dirs as dir, i (dir.fullPath)}
+					{@const dKey = dirKey('all', dir.fullPath)}
+					<BreadcrumbSegment
+						label={dir.name}
+						withChevron
+						extraClass={i === 0 ? 'gap-0.5 min-w-0 max-w-[40%]' : 'gap-0.5 min-w-0'}
+						initialScope={i === 0
+							? { kind: 'all' }
+							: { kind: 'all', dir: segments.dirs[i - 1].fullPath }}
+						initialHighlight={dKey}
+						{currentItem}
+						onPick={handlePickerSelect}
+					/>
+				{/each}
+				{@const leafKey = leafKeyFor(kind, segments.leaf.fullPath)}
+				{@const leafParent = segments.dirs[segments.dirs.length - 1]?.fullPath}
+				<BreadcrumbSegment
+					label={segments.leaf.name}
+					withChevron
+					extraClass="gap-0.5 min-w-0"
+					initialScope={leafParent ? { kind: 'all', dir: leafParent } : { kind: 'all' }}
+					initialHighlight={leafKey}
+					isCurrent
+					{currentItem}
+					onPick={handlePickerSelect}
+				/>
+			{/if}
+		</nav>
+
+		<!-- Pen → path-edit popover. Skipped entirely when path editing is
+		     disabled so the user doesn't see an inert button. -->
+		{#if pathEditable}
+			<Popover
+				placement="bottom-start"
+				contentClasses="p-4"
+				usePointerDownOutside
+				excludeSelectors=".drawer"
+				disableFocusTrap
+				closeOnOtherPopoverOpen
+				bind:isOpen={() => pathPopoverOpen, setPathPopoverOpen}
+			>
+				{#snippet trigger()}
+					<Button
+						variant="subtle"
+						unifiedSize="xs"
+						iconOnly
+						startIcon={{ icon: Pencil }}
+						title="Edit path"
+						aria-label="Edit path"
+						btnClasses={penVisibility === 'hover' && !pathPopoverOpen
+							? 'opacity-0 transition-opacity group-hover:opacity-100 focus-visible:opacity-100'
+							: ''}
+					/>
+				{/snippet}
+				{#snippet content()}
+					<div class="flex flex-col gap-6 w-[480px]">
+						{#if own}
+							<Path
+								autofocus
+								bind:path
+								initialPath={snapshotPath ?? path ?? ''}
+								namePlaceholder={kind}
+								{kind}
+								hideFullPath
+								size="sm"
+								drawerOffset={4000}
+							/>
+							{#if savedPath && path && path !== savedPath}
+								<Alert
+									type="info"
+									size="xs"
+									title="Deploy the {kind} to make the path change effective."
+								/>
+							{/if}
+							{#if onBehalfOfEmail}
+								<Alert type="info" title="Run on behalf of" size="xs">
+									This flow will be redeployed on behalf of you ({$userStore?.email}) instead of {onBehalfOfEmail}
+								</Alert>
+							{/if}
+						{:else}
+							<Label label="Path">
+								<span class="text-xs font-mono text-secondary">{path}</span>
+								<p class="text-2xs text-tertiary mt-1">Only the owner can change the path</p>
+							</Label>
+						{/if}
+					</div>
+				{/snippet}
+			</Popover>
+		{/if}
+	</div>
+
+	<!-- Summary -->
+	<div class="max-w-full -mt-[2px]" title={summary}>
+		<EditableInput
+			value={summary ?? ''}
+			placeholder="Add a summary..."
+			editable={summaryEditable}
+			size="sm"
+			onSave={handleSummarySave}
+			textClass="text-xs font-semibold text-emphasis leading-tight"
+			class="max-w-full"
+		/>
+	</div>
+</div>
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 6c135a70b5..f2e37bbeda 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -20,6 +20,7 @@
 		readFieldsRecursively,
 		replaceFalseWithUndefined,
 		isMac,
+		userPathPrefix,
 		type Item,
 		type StateStore,
 		type Value
@@ -46,7 +47,6 @@
 	import { GroupEditor, setGroupEditorContext } from './graph/groupEditor.svelte'
 	import { cleanFlow } from './flows/utils.svelte'
 	import {
-		Calendar,
 		Save,
 		DiffIcon,
 		HistoryIcon,
@@ -71,7 +71,7 @@
 	import { resetAllTodos, skipAllTodos } from '$lib/tutorialUtils'
 	import { tutorialsToDo } from '$lib/stores'
 	import { getTutorialIndex } from '$lib/tutorials/config'
-	import SummaryPathDisplay from './SummaryPathDisplay.svelte'
+	import EditorHeader from './EditorHeader.svelte'
 	import type { FlowBuilderWhitelabelCustomUi } from './custom_ui'
 	import FlowYamlEditor from './flows/header/FlowYamlEditor.svelte'
 	import { type TriggerContext, type ScheduleTrigger } from './triggers'
@@ -130,7 +130,8 @@
 		onDetails,
 		onSaveDraftError,
 		onSaveDraftOnlyAtNewPath,
-		onHistoryRestore
+		onHistoryRestore,
+		onNavigate
 	}: FlowBuilderProps = $props()
 
 	let initialPathStore = writable(initialPath)
@@ -147,13 +148,7 @@
 	})
 
 	// used for new flows for captures
-	let fakeInitialPath =
-		'u/' +
-		($userStore?.username?.includes('@')
-			? $userStore!.username.split('@')[0].replace(/[^a-zA-Z0-9_]/g, '')
-			: $userStore?.username) +
-		'/' +
-		generateRandomString(12)
+	let fakeInitialPath = userPathPrefix($userStore?.username) + generateRandomString(12)
 
 	// Used by multiplayer deploy collision warning
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
@@ -203,6 +198,11 @@
 			savedValue: savedFlow,
 			modifiedValue: {
 				...flowStore.val,
+				// `$pathStore` is the live-edited path (the pen popover binds it).
+				// `flowStore.val.path` doesn't track those edits, so without this the
+				// rename wouldn't show up in the diff and the unsaved-changes warning
+				// wouldn't fire when leaving with a pending rename.
+				path: $pathStore,
 				draft_triggers: structuredClone(triggersState.getDraftTriggersSnapshot())
 			}
 		}
@@ -760,16 +760,13 @@
 			return
 		}
 
-		switch (event.key) {
-			case 'Z':
-				if (event.ctrlKey || event.metaKey) {
-					handleRedo()
-					event.preventDefault()
-				}
-				break
+		// Only lowercase single-char keys — named keys like `ArrowDown` must
+		// stay PascalCase to match their switch cases.
+		switch (event.key.length === 1 ? event.key.toLowerCase() : event.key) {
 			case 'z':
 				if (event.ctrlKey || event.metaKey) {
-					handleUndo()
+					if (event.shiftKey) handleRedo()
+					else handleUndo()
 					event.preventDefault()
 				}
 				break
@@ -822,7 +819,10 @@
 		if (savedFlow?.draft_only === false || savedFlow?.draft_only === undefined) {
 			dropdownItems.push({
 				label: 'Exit & see details',
-				onClick: () => onDetails?.({ path: $pathStore })
+				// Use the deployed path, not the live `$pathStore` — the latter
+				// reflects local rename edits that haven't been deployed yet,
+				// which would land the user on a 404 details page.
+				onClick: () => onDetails?.({ path: initialPath })
 			})
 		}
 
@@ -1025,9 +1025,20 @@
 			untrack(() => saveSessionDraft())
 		}
 	})
+	// Sync `$pathStore` from `flowStore.val.path` (which `initFlow` populates
+	// from the loaded flow — including the draft's rename, when there is one).
+	// This effect only tracks `flowStore.val.path`, so popover edits that go
+	// straight to `$pathStore` don't trigger it and aren't overwritten.
+	// Replaces the previous `$pathStore = initialPath` push (added in #2536 for
+	// the VSCode extension), which silently dropped any draft-renamed path
+	// because `initialPath` is the URL, not the loaded path.
 	$effect.pre(() => {
-		initialPath && ($pathStore = initialPath)
+		// `flowStore.val` is typed `OpenFlow` here but `initFlow` actually puts a
+		// `Flow` (with `path`) in it.
+		const p = (flowStore.val as Flow | undefined)?.path
+		if (p) untrack(() => ($pathStore = p))
 	})
+
 	$effect.pre(() => {
 		selectedId && untrack(() => select(selectedId))
 	})
@@ -1150,38 +1161,15 @@
 			<div
 				class="justify-between flex flex-row items-center pl-2 pr-4 space-x-4 scrollbar-hidden overflow-x-auto max-h-12 h-full relative"
 			>
-				<div class="flex w-full gap-8 items-center min-w-0">
-					<SummaryPathDisplay
+				<div class="min-w-0 max-w-full">
+					<EditorHeader
 						bind:summary={flowStore.val.summary}
 						bind:path={$pathStore}
-						kind="flow"
-						editable
+						savedPath={initialPath}
+						onBehalfOfEmail={$savedOnBehalfOfEmail}
+						onNavigate={(item) => onNavigate?.(item)}
 					/>
 				</div>
-
-				<div class="gap-4 flex-row hidden md:flex whitespace-nowrap">
-					{#if triggersState.triggers?.some((t) => t.type === 'schedule')}
-						{@const primaryScheduleIndex = triggersState.triggers.findIndex((t) => t.isPrimary)}
-						{@const scheduleIndex = triggersState.triggers.findIndex((t) => t.type === 'schedule')}
-						<Button
-							btnClasses="hidden lg:inline-flex"
-							startIcon={{ icon: Calendar }}
-							variant="subtle"
-							size="xs"
-							on:click={async () => {
-								select('Trigger')
-								const selected = primaryScheduleIndex ?? scheduleIndex
-								if (selected) {
-									triggersState.selectedTriggerIndex = selected
-								}
-							}}
-						>
-							{triggersState.triggers[primaryScheduleIndex]?.draftConfig?.schedule ??
-								triggersState.triggers[primaryScheduleIndex]?.lightConfig?.schedule ??
-								''}
-						</Button>
-					{/if}
-				</div>
 				<div class="flex flex-row gap-2 items-center">
 					{#if $enterpriseLicense && !newFlow}
 						<Awareness />
diff --git a/frontend/src/lib/components/InputError.svelte b/frontend/src/lib/components/InputError.svelte
index f075521740..a431140afa 100644
--- a/frontend/src/lib/components/InputError.svelte
+++ b/frontend/src/lib/components/InputError.svelte
@@ -2,7 +2,7 @@
 	import { slide } from 'svelte/transition'
 
 	interface Props {
-		error: string
+		error?: string | undefined
 	}
 
 	let { error }: Props = $props()
diff --git a/frontend/src/lib/components/LabelsInput.svelte b/frontend/src/lib/components/LabelsInput.svelte
index e357f62895..933fe38ea1 100644
--- a/frontend/src/lib/components/LabelsInput.svelte
+++ b/frontend/src/lib/components/LabelsInput.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
 	import Badge from './common/badge/Badge.svelte'
+	import Button from './common/button/Button.svelte'
 	import { Plus, Tag, X } from 'lucide-svelte'
 	import { workspaceStore } from '$lib/stores'
 
@@ -155,11 +156,14 @@
 			{/if}
 		</div>
 	{:else}
-		<button
-			class="text-tertiary hover:text-secondary text-2xs flex items-center gap-0.5"
+		<Button
+			variant="subtle"
+			unifiedSize="xs"
+			startIcon={{ icon: Tag }}
+			endIcon={{ icon: Plus, props: { size: 8 } }}
+			btnClasses="!gap-0.5"
+			aria-label="Add label"
 			onclick={startAdding}
-		>
-			<Tag size={12} /><Plus size={8} />
-		</button>
+		/>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/Path.svelte b/frontend/src/lib/components/Path.svelte
index c35b5f1e81..44b76e17e7 100644
--- a/frontend/src/lib/components/Path.svelte
+++ b/frontend/src/lib/components/Path.svelte
@@ -33,12 +33,13 @@
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import { random_adj } from './random_positive_adjetive'
-	import { Folder, Loader2, SearchCode, User } from 'lucide-svelte'
+	import { Folder, SearchCode, User } from 'lucide-svelte'
 	import Tooltip from './Tooltip.svelte'
 	import { tick } from 'svelte'
 	import FolderPicker from './FolderPicker.svelte'
 	import PathNameAutocomplete from './PathNameAutocomplete.svelte'
 	import TextInput from './text_input/TextInput.svelte'
+	import InputError from './InputError.svelte'
 
 	type PathKind =
 		| 'resource'
@@ -537,14 +538,13 @@
 				/>
 				<!-- <span class="font-mono text-sm break-all">{path}</span> -->
 			</div>
-			<div class="text-red-600 dark:text-red-400 text-2xs mt-1.5">{error}</div>
 		</div>
 	{/if}
 
+	<InputError {error} />
+
 	{#if pathUsageInFlowsPromise || pathUsageInAppsPromise || pathUsageInScriptsPromise}
-		{#await Promise.all( [pathUsageInAppsPromise, pathUsageInFlowsPromise, pathUsageInScriptsPromise] )}
-			<Loader2 class="animate-spin" size={16} />
-		{:then [apps, flows, scripts]}
+		{#await Promise.all( [pathUsageInAppsPromise, pathUsageInFlowsPromise, pathUsageInScriptsPromise] ) then [apps, flows, scripts]}
 			{#if (apps && apps.length) || (flows && flows.length) || (scripts && scripts.length)}
 				<p class="text-xs">
 					Used by {localeConcatAnd([
diff --git a/frontend/src/lib/components/ScriptBuilder.svelte b/frontend/src/lib/components/ScriptBuilder.svelte
index ee6fe15738..c25f121ce7 100644
--- a/frontend/src/lib/components/ScriptBuilder.svelte
+++ b/frontend/src/lib/components/ScriptBuilder.svelte
@@ -44,7 +44,7 @@
 	} from '$lib/utils'
 	import Path from './Path.svelte'
 	import ScriptEditor from './ScriptEditor.svelte'
-	import { Alert, Badge, Button, Drawer, SecondsInput, Tab, TabContent, Tabs } from './common'
+	import { Alert, Button, Drawer, SecondsInput, Tab, TabContent, Tabs } from './common'
 	import LanguageIcon from './common/languageIcons/LanguageIcon.svelte'
 	import type { SupportedLanguage, Schema } from '$lib/common'
 	import Tooltip from './Tooltip.svelte'
@@ -52,19 +52,7 @@
 	import ToggleButtonGroup from '$lib/components/common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from '$lib/components/common/toggleButton-v2/ToggleButton.svelte'
 	import ErrorHandlerToggleButton from '$lib/components/details/ErrorHandlerToggleButton.svelte'
-	import {
-		Bug,
-		Calendar,
-		CheckCircle,
-		Code,
-		Pen,
-		Plus,
-		Rocket,
-		Save,
-		Settings,
-		Shuffle,
-		X
-	} from 'lucide-svelte'
+	import { Bug, CheckCircle, Code, Plus, Rocket, Save, Settings, Shuffle, X } from 'lucide-svelte'
 	import { sendUserToast } from '$lib/toast'
 	import { isCloudHosted } from '$lib/cloud'
 	import Awareness from './Awareness.svelte'
@@ -81,7 +69,7 @@
 	import { defaultScriptLanguages, processLangs } from '$lib/scripts'
 	import DefaultScripts from './DefaultScripts.svelte'
 	import { onMount, setContext, untrack } from 'svelte'
-	import Summary from './Summary.svelte'
+	import EditorHeader from './EditorHeader.svelte'
 	import LabelsInput from './LabelsInput.svelte'
 
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
@@ -102,7 +90,6 @@
 	import type { ScriptBuilderProps } from './script_builder'
 	import type { DiffDrawerI } from './diff_drawer'
 	import WorkerTagSelect from './WorkerTagSelect.svelte'
-	import { inputSizeClasses } from './text_input/TextInput.svelte'
 	import type { ButtonType } from './common/button/model'
 	import DebounceLimit from './flows/DebounceLimit.svelte'
 	import { isRuleActive } from '$lib/workspaceProtectionRules.svelte'
@@ -152,6 +139,7 @@
 		onSeeDetails,
 		onSaveDraftError,
 		onSaveDraft,
+		onNavigate,
 		disableAi
 	}: ScriptBuilderProps = $props()
 
@@ -1218,6 +1206,14 @@
 													namePlaceholder="script"
 													kind="script"
 												/>
+												{#if initialPath && script.path && script.path !== initialPath}
+													<Alert
+														type="info"
+														size="xs"
+														title="Deploy the script to make the path change effective."
+														class="mt-2"
+													/>
+												{/if}
 											</Label>
 											<Label label="Description">
 												<MetadataGen
@@ -1968,78 +1964,32 @@
 	<div class="flex flex-col h-screen">
 		<div class="flex h-12 items-center px-4">
 			<div class="flex gap-2 lg:gap-2 w-full items-center">
-				<div class="flex flex-row gap-2 grow max-w-md">
-					<div class="center-center">
-						<button
-							disabled={customUi?.topBar?.settings == false}
-							onclick={async () => {
-								metadataOpen = true
-							}}
-						>
-							<LanguageIcon lang={script.language} size={24} />
-						</button>
-					</div>
-					<Summary
-						disabled={customUi?.topBar?.editableSummary == false}
-						bind:value={script.summary}
-					/>
+				<div class="flex flex-row items-center gap-2 min-w-0 max-w-full">
+					<button
+						disabled={customUi?.topBar?.settings == false}
+						class="shrink-0"
+						onclick={async () => {
+							metadataOpen = true
+						}}
+					>
+						<LanguageIcon lang={script.language} size={24} />
+					</button>
+					{#if customUi?.topBar?.path != false}
+						<EditorHeader
+							bind:summary={script.summary}
+							bind:path={script.path}
+							savedPath={initialPath}
+							kind="script"
+							summaryEditable={customUi?.topBar?.editableSummary != false}
+							pathEditable={customUi?.topBar?.editablePath != false}
+							onNavigate={(item) => onNavigate?.(item)}
+						/>
+					{/if}
 				</div>
 
 				<!-- Separator -->
 				<div class="flex-1"></div>
 
-				<div class="gap-4 flex whitespace-nowrap">
-					{#if triggersState.triggers?.some((t) => t.type === 'schedule')}
-						{@const primarySchedule = triggersState.triggers.findIndex((t) => t.isPrimary)}
-						{@const schedule = triggersState.triggers.findIndex((t) => t.type === 'schedule')}
-
-						<Button
-							btnClasses="hidden lg:inline-flex"
-							startIcon={{ icon: Calendar }}
-							variant="contained"
-							color="light"
-							size="xs"
-							on:click={async () => {
-								metadataOpen = true
-								selectedTab = 'triggers'
-								triggersState.selectedTriggerIndex = primarySchedule ?? schedule
-							}}
-						>
-							{triggersState.triggers[primarySchedule]?.draftConfig?.schedule ??
-								triggersState.triggers[primarySchedule]?.lightConfig?.schedule ??
-								''}
-						</Button>
-					{/if}
-					{#if customUi?.topBar?.path != false}
-						<div class="flex justify-start w-full items-center">
-							{#if customUi?.topBar?.editablePath != false}
-								<button
-									onclick={async () => {
-										metadataOpen = true
-									}}
-								>
-									<Badge
-										color="gray"
-										class="center-center !bg-surface-secondary !text-primary {inputSizeClasses.md}  !w-[70px] rounded-r-none hover:!bg-surface-hover transition-all border border-r-0"
-									>
-										<Pen size={12} class="mr-2 shrink-0" /> Path
-									</Badge>
-								</button>
-							{/if}
-							<input
-								type="text"
-								readonly
-								value={script.path}
-								size={script.path?.length || 50}
-								class="font-mono !text-xs !min-w-[96px] !max-w-[300px] !w-full {inputSizeClasses.md} !my-0 !py-0 !rounded-l-none border border-l-0 !shadow-none"
-								onfocus={({ currentTarget }) => {
-									currentTarget.select()
-								}}
-							/>
-						</div>
-					{/if}
-				</div>
-
 				{#if $enterpriseLicense && initialPath != ''}
 					<Awareness />
 				{/if}
diff --git a/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
new file mode 100644
index 0000000000..abee584afa
--- /dev/null
+++ b/frontend/src/lib/components/WorkspaceItemDrillPicker.svelte
@@ -0,0 +1,699 @@
+<!--
+@component
+Drill-through workspace item picker. One level is shown at a time:
+
+  - **Root** (no scope): All + kinds (Flows / Scripts / Apps). "All" is a
+    cross-kind row — drilling in shows folders/items merged across every kind.
+  - **Kind** (`{ kind }`): top-level scopes for that kind (e.g. `f/demo`, `u/alice`).
+    `kind: 'all'` is the cross-kind variant — folders contain items from
+    every kind, leaves still belong to a real kind.
+  - **Dir** (`{ kind, dir }`): immediate children of `dir` — subdirs + leaves.
+
+Clicking a row drills *down*; the chevron-left in the header walks one level
+*up*. Search is global across all kinds and ignores the current scope.
+-->
+<script lang="ts">
+	import { workspaceStore } from '$lib/stores'
+	import { ChevronLeft, ChevronRight, Folder, Layers, Loader2, User } from 'lucide-svelte'
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+	import RowIcon from '$lib/components/common/table/RowIcon.svelte'
+	import SearchItems from '$lib/components/SearchItems.svelte'
+	import { onMount, untrack } from 'svelte'
+	import {
+		dirKey,
+		getCachedItems,
+		KIND_LABEL,
+		KIND_LABEL_LOWER,
+		kindKey,
+		leafKeyFor,
+		loadKind,
+		type WorkspaceItem,
+		type WorkspaceItemKind
+	} from './workspacePicker'
+
+	type Kind = WorkspaceItemKind
+	type Item = WorkspaceItem
+	/** `'all'` is a virtual cross-kind scope — items still belong to a real
+	 * kind, but folders and the root row group items from every kind. */
+	type ScopeKind = Kind | 'all'
+
+	export type Scope = { kind: ScopeKind; dir?: string } | undefined
+
+	interface Props {
+		onPick: (item: WorkspaceItem) => void
+		kinds?: Kind[]
+		/** Where the picker lands when first opened. `undefined` = root (kinds list). */
+		initialScope?: Scope
+		/** Composite key of the row to highlight (e.g. `dir:flow:f/demo`). */
+		initialHighlight?: string
+		/** Currently-edited item — gets `aria-current` and a no-op click. If
+		 * `savedPath` differs from `path` (draft rename), the saved entry is
+		 * suppressed so only the live one shows. */
+		currentItem?: WorkspaceItem & { savedPath?: string }
+	}
+
+	let {
+		onPick,
+		kinds = ['flow', 'script', 'app'],
+		initialScope,
+		initialHighlight,
+		currentItem
+	}: Props = $props()
+
+	let searchInput: TextInput | undefined = $state()
+	let pickerRoot: HTMLElement | undefined = $state()
+	const instanceId = crypto.randomUUID()
+	const listboxId = `pkr-list-${instanceId}`
+	const idFor = (key: string) => `pkr-${instanceId}-${key.replace(/[^a-zA-Z0-9-]/g, '_')}`
+
+	export function focus() {
+		searchInput?.focus()
+	}
+
+	// Sibling-popover open: melt-ui's `openFocus` runs once during the close→open
+	// transition; the picker may not be mounted yet. Retry after settle.
+	onMount(() => {
+		const t = setTimeout(focus, 50)
+		return () => clearTimeout(t)
+	})
+
+	const leafKey = (it: Item) => leafKeyFor(it.kind, it.path)
+
+	let scope = $state<Scope>(untrack(() => initialScope))
+	let filter = $state('')
+
+	/** Tracks whether the last user action was mouse movement (true) or
+	 * keyboard nav (false). When false, row `mouseenter` events are ignored
+	 * — prevents the cursor from stealing the keyboard-driven highlight as
+	 * rows shift under it during scope changes. Re-enabled on `mousemove`.
+	 * Starts `false` so the synthetic `mouseenter` fired when the popover
+	 * mounts under a stationary cursor doesn't clobber `initialHighlight`. */
+	let mouseActive = $state(false)
+
+	// Seed from cache so kinds already fetched in this session render on the
+	// first frame. Read once at mount: melt-ui mounts a fresh picker per
+	// popover open, so workspace changes are picked up at the next open
+	// without needing this seed to be reactive.
+	let loaded = $state<Partial<Record<Kind, Item[]>>>(
+		(() => {
+			if (!$workspaceStore) return {}
+			const out: Partial<Record<Kind, Item[]>> = {}
+			for (const k of kinds) {
+				const cached = getCachedItems($workspaceStore, k)
+				if (cached) out[k] = cached
+			}
+			return out
+		})()
+	)
+	let loadingKind = $state<Partial<Record<Kind, boolean>>>({})
+
+	async function ensureLoaded(kind: Kind) {
+		if (!$workspaceStore) return
+		if (loaded[kind]) return
+		loadingKind[kind] = true
+		try {
+			const items = await loadKind($workspaceStore, kind)
+			loaded[kind] = items
+		} finally {
+			loadingKind[kind] = false
+		}
+	}
+
+	// Fetch the scope's kind on entry to a non-root level. The `'all'` scope
+	// needs every kind loaded since it merges items across them.
+	$effect(() => {
+		if (!scope) return
+		if (scope.kind === 'all') for (const k of kinds) ensureLoaded(k)
+		else ensureLoaded(scope.kind)
+	})
+
+	// Searching is global → load every kind.
+	$effect(() => {
+		if (filter.trim() !== '') for (const k of kinds) ensureLoaded(k)
+	})
+
+	type DirNode = {
+		fullPath: string
+		name: string
+		isScope: boolean
+		children: DirNode[]
+		leaves: Item[]
+	}
+
+	/** Inject the currently-edited item into a kind's list at its live path,
+	 * dropping the saved entry when a draft rename is in progress. Other kinds
+	 * pass through untouched. */
+	function withCurrent(items: Item[], k: Kind): Item[] {
+		if (!currentItem || currentItem.kind !== k) return items
+		const drafted =
+			currentItem.savedPath && currentItem.savedPath !== currentItem.path
+				? items.filter((it) => it.path !== currentItem.savedPath)
+				: items
+		if (drafted.some((it) => it.path === currentItem.path)) return drafted
+		return [
+			...drafted,
+			{
+				path: currentItem.path,
+				summary: currentItem.summary,
+				kind: k,
+				raw_app: currentItem.raw_app
+			}
+		]
+	}
+
+	function buildTreeFromItems(items: Item[]): DirNode[] {
+		const scopeRoots = new Map<string, DirNode>()
+		for (const it of items) {
+			const parts = it.path.split('/')
+			if (parts.length < 3) continue
+			const scopeFp = parts.slice(0, 2).join('/')
+			let node = scopeRoots.get(scopeFp)
+			if (!node) {
+				node = { fullPath: scopeFp, name: scopeFp, isScope: true, children: [], leaves: [] }
+				scopeRoots.set(scopeFp, node)
+			}
+			const slug = parts.slice(2)
+			let cur = node
+			for (let i = 0; i < slug.length - 1; i++) {
+				const seg = slug[i]
+				const fullPath = cur.fullPath + '/' + seg
+				let next = cur.children.find((c) => c.name === seg)
+				if (!next) {
+					next = { fullPath, name: seg, isScope: false, children: [], leaves: [] }
+					cur.children.push(next)
+				}
+				cur = next
+			}
+			cur.leaves.push(it)
+		}
+		const scopes = Array.from(scopeRoots.values()).sort((a, b) => {
+			const af = a.fullPath.startsWith('f/') ? 0 : 1
+			const bf = b.fullPath.startsWith('f/') ? 0 : 1
+			if (af !== bf) return af - bf
+			return a.fullPath.localeCompare(b.fullPath)
+		})
+		const sortNode = (n: DirNode) => {
+			n.children.sort((a, b) => a.name.localeCompare(b.name))
+			n.leaves.sort((a, b) => a.path.localeCompare(b.path))
+			n.children.forEach(sortNode)
+		}
+		scopes.forEach(sortNode)
+		return scopes
+	}
+
+	/** Per-kind tree deriveds. Each only re-evaluates `buildTreeFromItems`
+	 * when its own `loaded[k]` changes or when the user is mid-rename on
+	 * that kind — typing in a flow's path edit leaves script/app trees
+	 * cached. */
+	function buildIfActive(k: Kind, list: Item[] | undefined): DirNode[] {
+		if (!kinds.includes(k)) return []
+		const items = withCurrent(list ?? [], k)
+		if (items.length === 0) return []
+		return buildTreeFromItems(items)
+	}
+
+	const flowTree = $derived(buildIfActive('flow', loaded.flow))
+	const scriptTree = $derived(buildIfActive('script', loaded.script))
+	const appTree = $derived(buildIfActive('app', loaded.app))
+	/** Cross-kind tree: every loaded item from every active kind, merged into
+	 * one folder hierarchy. Each leaf still carries its real kind, so the row
+	 * icon and `editPathFor` routing still work; folders contain a mix. */
+	const allTree = $derived.by(() => {
+		const merged = kinds.flatMap((k) => withCurrent(loaded[k] ?? [], k))
+		return merged.length === 0 ? [] : buildTreeFromItems(merged)
+	})
+
+	function treeFor(k: ScopeKind): DirNode[] {
+		if (k === 'all') return allTree
+		if (k === 'flow') return flowTree
+		if (k === 'script') return scriptTree
+		return appTree
+	}
+
+	function findDirInList(list: DirNode[], fullPath: string): DirNode | undefined {
+		for (const n of list) {
+			if (n.fullPath === fullPath) return n
+			const sub = findDirInList(n.children, fullPath)
+			if (sub) return sub
+		}
+		return undefined
+	}
+
+	function parentDirPath(p: string): string | undefined {
+		const parts = p.split('/')
+		if (parts.length <= 2) return undefined
+		return parts.slice(0, -1).join('/')
+	}
+
+	type Entry =
+		| { type: 'kind'; key: string; kind: ScopeKind }
+		| { type: 'dir'; key: string; kind: ScopeKind; node: DirNode }
+		| { type: 'leaf'; key: string; item: Item }
+
+	type DisplayItem = Item & { marked?: string }
+	type SearchInput = Item & { _key: string }
+
+	let allItems = $derived<SearchInput[]>(
+		kinds.flatMap((k) =>
+			withCurrent(loaded[k] ?? [], k).map((it) => ({ ...it, _key: `${k}:${it.path}` }))
+		)
+	)
+
+	let searchedItems: DisplayItem[] | undefined = $state(undefined)
+
+	let isSearching = $derived(filter.trim() !== '')
+
+	let searchResultsByKind = $derived.by(() => {
+		const out: Record<Kind, DisplayItem[]> = { flow: [], script: [], app: [] }
+		if (!searchedItems) return out
+		for (const it of searchedItems) out[it.kind].push(it)
+		return out
+	})
+
+	/** Rows currently shown — drives both rendering and keyboard nav. Not used
+	 * while `isSearching` (search renders its own grouped layout). */
+	let entries = $derived.by<Entry[]>(() => {
+		const s = scope
+		if (!s) {
+			const kindEntries = kinds.map((k) => ({
+				type: 'kind' as const,
+				key: kindKey(k),
+				kind: k
+			}))
+			// "All" only makes sense across multiple kinds — with a single kind
+			// it would duplicate that kind's own root row.
+			if (kinds.length <= 1) return kindEntries
+			return [
+				{ type: 'kind' as const, key: kindKey('all'), kind: 'all' as ScopeKind },
+				...kindEntries
+			]
+		}
+		const tree = treeFor(s.kind)
+		if (!s.dir) {
+			return tree.map((node) => ({
+				type: 'dir',
+				key: dirKey(s.kind, node.fullPath),
+				kind: s.kind,
+				node
+			}))
+		}
+		const node = findDirInList(tree, s.dir)
+		if (!node) return []
+		return [
+			...node.children.map(
+				(c): Entry => ({
+					type: 'dir',
+					key: dirKey(s.kind, c.fullPath),
+					kind: s.kind,
+					node: c
+				})
+			),
+			...node.leaves.map((l): Entry => ({ type: 'leaf', key: leafKey(l), item: l }))
+		]
+	})
+
+	let navKeys = $derived.by(() => {
+		if (isSearching) {
+			return kinds.flatMap((k) => searchResultsByKind[k].map((it) => leafKey(it)))
+		}
+		return entries.map((e) => e.key)
+	})
+
+	let highlightedKey = $state<string | undefined>(untrack(() => initialHighlight))
+	let highlightedId = $derived(highlightedKey ? idFor(highlightedKey) : undefined)
+
+	$effect(() => {
+		if (navKeys.length === 0) return
+		if (!highlightedKey || !navKeys.includes(highlightedKey)) {
+			highlightedKey = navKeys[0]
+		}
+	})
+
+	$effect(() => {
+		if (highlightedKey && navKeys.includes(highlightedKey)) {
+			requestAnimationFrame(scrollHighlightIntoView)
+		}
+	})
+
+	function scrollHighlightIntoView() {
+		if (!pickerRoot || !highlightedKey) return
+		const el = pickerRoot.querySelector<HTMLElement>(
+			`[data-nav-key="${CSS.escape(highlightedKey)}"]`
+		)
+		el?.scrollIntoView({ block: 'nearest', behavior: 'smooth' })
+	}
+
+	function moveHighlight(delta: 1 | -1) {
+		if (navKeys.length === 0) return
+		const cur = navKeys.indexOf(highlightedKey ?? '')
+		const next = cur < 0 ? 0 : (cur + delta + navKeys.length) % navKeys.length
+		highlightedKey = navKeys[next]
+		mouseActive = false
+		requestAnimationFrame(scrollHighlightIntoView)
+	}
+
+	function setHoverHighlight(key: string) {
+		// Ignored until the user actually moves the mouse. Prevents the cursor
+		// (parked over a row) from clobbering keyboard-driven selection when
+		// the layout shifts beneath it.
+		if (mouseActive) highlightedKey = key
+	}
+
+	function isCurrent(it: Item): boolean {
+		return !!currentItem && currentItem.kind === it.kind && currentItem.path === it.path
+	}
+
+	function pick(it: Item) {
+		if (isCurrent(it)) return
+		onPick({ path: it.path, summary: it.summary, kind: it.kind, raw_app: it.raw_app })
+	}
+
+	function activate(key: string | undefined) {
+		if (!key) return
+		if (isSearching) {
+			const flat = kinds.flatMap((k) => searchResultsByKind[k])
+			const it = flat.find((x) => leafKey(x) === key)
+			if (it) pick(it)
+			return
+		}
+		const entry = entries.find((e) => e.key === key)
+		if (!entry) return
+		drill(entry)
+	}
+
+	function drill(entry: Entry) {
+		if (entry.type === 'kind') {
+			scope = { kind: entry.kind }
+		} else if (entry.type === 'dir') {
+			scope = { kind: entry.kind, dir: entry.node.fullPath }
+		} else {
+			pick(entry.item)
+		}
+	}
+
+	function goUp() {
+		if (!scope) return
+		// Highlight the row in the parent view that represents the scope we
+		// just left, so the user sees where they came from.
+		if (!scope.dir) {
+			const leaving = kindKey(scope.kind)
+			scope = undefined
+			highlightedKey = leaving
+			return
+		}
+		const leaving = dirKey(scope.kind, scope.dir)
+		const parent = parentDirPath(scope.dir)
+		scope = parent ? { kind: scope.kind, dir: parent } : { kind: scope.kind }
+		highlightedKey = leaving
+	}
+
+	function handleSearchKeydown(e: KeyboardEvent) {
+		if (e.key === 'ArrowDown') {
+			e.preventDefault()
+			e.stopPropagation()
+			moveHighlight(1)
+		} else if (e.key === 'ArrowUp') {
+			e.preventDefault()
+			e.stopPropagation()
+			moveHighlight(-1)
+		} else if (e.key === 'Enter') {
+			e.preventDefault()
+			e.stopPropagation()
+			mouseActive = false
+			activate(highlightedKey)
+		} else if ((e.key === 'ArrowLeft' || e.key === 'Backspace') && filter === '' && scope) {
+			// Walk up the tree. Only when search is empty — otherwise these
+			// keys would hijack cursor movement / character deletion.
+			e.preventDefault()
+			e.stopPropagation()
+			mouseActive = false
+			goUp()
+		} else if (e.key === 'ArrowRight' && filter === '' && !isSearching) {
+			// Drill into the highlighted folder/kind. Leaves are reserved for
+			// Enter (more deliberate, since picking navigates away).
+			const entry = entries.find((en) => en.key === highlightedKey)
+			if (entry && entry.type !== 'leaf') {
+				e.preventDefault()
+				e.stopPropagation()
+				mouseActive = false
+				drill(entry)
+			}
+		}
+	}
+
+	/** Breadcrumb segments for the header — kind name first, then the scope
+	 * (`f/<folder>` or `u/<user>`) as one chunk, then any nested subdirs. */
+	let headerSegments = $derived.by<string[]>(() => {
+		if (!scope) return []
+		const out = [scope.kind === 'all' ? 'all' : KIND_LABEL_LOWER[scope.kind]]
+		if (scope.dir) {
+			const parts = scope.dir.split('/')
+			out.push(parts.slice(0, 2).join('/'))
+			for (let i = 2; i < parts.length; i++) out.push(parts[i])
+		}
+		return out
+	})
+
+	/** Full breadcrumb (used for the hover tooltip). */
+	let headerLabel = $derived(headerSegments.join(' › '))
+
+	/** Number of intermediate segments to hide behind a `…`. The collapsed
+	 * window is segments[2 .. 2 + hiddenCount); we always keep the first
+	 * two (kind, top-level scope) and the deepest segment. Bumped up by an
+	 * effect that measures actual overflow — see below. */
+	let hiddenCount = $state(0)
+
+	/** Breadcrumb shown to the user. Hides intermediate segments first, then
+	 * relies on `truncate-start` for any remaining overflow on the deepest
+	 * segment. Hover reveals the full path via `title`. */
+	let headerLabelDisplay = $derived.by(() => {
+		if (headerSegments.length <= 3 || hiddenCount === 0) return headerLabel
+		return [
+			headerSegments[0],
+			headerSegments[1],
+			'…',
+			...headerSegments.slice(2 + hiddenCount)
+		].join(' › ')
+	})
+
+	let breadcrumbSpan: HTMLElement | undefined = $state()
+	let lastSegmentsKey = ''
+
+	/** Measurement loop: each pass reads `scrollWidth > clientWidth` on the
+	 * truncated span; if overflowing and there's still an intermediate segment
+	 * to drop, increment `hiddenCount`. Mutating `hiddenCount` re-renders and
+	 * re-fires this effect, so the loop self-terminates either when the text
+	 * fits or when only [kind, scope, …, leaf] remain (`truncate-start` then
+	 * polishes any final overflow). When the breadcrumb itself changes (new
+	 * scope), reset to 0 first so a shorter path can re-expand. */
+	$effect(() => {
+		const key = headerSegments.join('|')
+		const segmentsChanged = key !== lastSegmentsKey
+		if (segmentsChanged) {
+			lastSegmentsKey = key
+			if (hiddenCount !== 0) {
+				hiddenCount = 0
+				return
+			}
+		}
+		// Track hiddenCount so each collapse step re-measures.
+		void hiddenCount
+		if (!breadcrumbSpan) return
+		const maxHide = Math.max(0, headerSegments.length - 3)
+		if (hiddenCount >= maxHide) return
+		queueMicrotask(() => {
+			if (!breadcrumbSpan) return
+			if (breadcrumbSpan.scrollWidth > breadcrumbSpan.clientWidth + 1) {
+				hiddenCount = hiddenCount + 1
+			}
+		})
+	})
+
+	let scopeLoading = $derived.by(() => {
+		if (!scope) return false
+		if (scope.kind === 'all') {
+			return kinds.some((k) => !loaded[k] && !!loadingKind[k])
+		}
+		return !loaded[scope.kind] && !!loadingKind[scope.kind]
+	})
+</script>
+
+<SearchItems
+	{filter}
+	items={isSearching ? allItems : []}
+	bind:filteredItems={searchedItems}
+	f={(x: SearchInput) => (x.summary ? `${x.summary} (${x.path})` : x.path)}
+	opts={{}}
+/>
+
+{#snippet leafRow(it: Item, secondary: string, baseClass: string)}
+	{@const key = leafKey(it)}
+	{@const isHl = key === highlightedKey}
+	{@const isCur = isCurrent(it)}
+	<button
+		type="button"
+		id={idFor(key)}
+		role="option"
+		aria-selected={isHl}
+		data-nav-key={key}
+		aria-current={isCur ? 'true' : undefined}
+		class="w-full text-left flex items-center gap-2 px-3 transition-colors {baseClass} {isHl
+			? 'bg-surface-hover'
+			: ''} {isCur ? 'cursor-default text-emphasis font-medium' : ''}"
+		onmousedown={(e) => e.preventDefault()}
+		onclick={() => pick(it)}
+		onmouseenter={() => setHoverHighlight(key)}
+	>
+		<RowIcon kind={it.kind} size={12} />
+		<div class="min-w-0 flex-1">
+			{#if it.summary}
+				<div class="text-xs text-primary truncate">{it.summary}</div>
+				<div class="text-2xs text-secondary font-normal font-mono truncate">{secondary}</div>
+			{:else}
+				<div class="text-xs text-primary font-mono truncate">{secondary}</div>
+			{/if}
+		</div>
+	</button>
+{/snippet}
+
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div
+	bind:this={pickerRoot}
+	class="flex flex-col w-[420px] max-h-[60vh]"
+	onkeydown={handleSearchKeydown}
+	onmousemove={() => (mouseActive = true)}
+>
+	<div class="px-3 py-2 border-b border-gray-200 dark:border-gray-700">
+		<TextInput
+			bind:this={searchInput}
+			bind:value={filter}
+			size="sm"
+			inputProps={{
+				placeholder: 'Search by name or summary...',
+				'data-workspace-picker-search': '',
+				role: 'combobox',
+				'aria-controls': listboxId,
+				'aria-expanded': 'true',
+				'aria-autocomplete': 'list',
+				'aria-activedescendant': highlightedId
+			}}
+		/>
+	</div>
+
+	{#if scope}
+		{@const s = scope}
+		<button
+			type="button"
+			class="flex items-center gap-1.5 w-full text-left px-3 py-1 text-xs font-medium font-mono text-secondary bg-surface-secondary/20 hover:bg-surface-hover transition-colors"
+			onmousedown={(e) => e.preventDefault()}
+			onclick={goUp}
+			title={headerLabel}
+		>
+			<ChevronLeft size={12} class="shrink-0 text-secondary" />
+			{#if s.kind === 'all'}
+				<Layers size={12} class="shrink-0 text-tertiary" />
+			{:else}
+				<RowIcon kind={s.kind} size={12} />
+			{/if}
+			<span bind:this={breadcrumbSpan} class="flex-1 min-w-0 truncate truncate-start"
+				>{headerLabelDisplay}</span
+			>
+		</button>
+	{/if}
+
+	<div class="flex-1 overflow-y-auto" role="listbox" id={listboxId}>
+		{#if isSearching}
+			{@const total = (searchedItems ?? []).length}
+			{@const anyKindLoading = kinds.some((k) => loadingKind[k])}
+			{#if !searchedItems || anyKindLoading}
+				<!-- "Searching…" while any active kind is still loading, otherwise
+				     `SearchItems` would briefly write `filteredItems=[]` from the
+				     partial set and flash "No matches" before results trickle in. -->
+				<div role="status" class="px-3 py-2 text-xs text-tertiary flex items-center gap-2">
+					<Loader2 size={14} class="animate-spin" /> Searching…
+				</div>
+			{:else if total === 0}
+				<div role="status" class="px-3 py-2 text-xs text-tertiary">No matches</div>
+			{:else}
+				{#each kinds as k (k)}
+					{@const results = searchResultsByKind[k]}
+					{#if results.length > 0}
+						<div class="px-3 pt-3 pb-1 text-2xs uppercase tracking-wide text-tertiary font-medium">
+							{KIND_LABEL[k]}
+						</div>
+						<ul class="pb-1">
+							{#each results as it (leafKey(it))}
+								<li>{@render leafRow(it, it.path, 'py-1.5')}</li>
+							{/each}
+						</ul>
+					{/if}
+				{/each}
+			{/if}
+		{:else if scopeLoading && entries.length === 0}
+			<div role="status" class="px-3 py-2 text-xs text-tertiary flex items-center gap-2">
+				<Loader2 size={14} class="animate-spin" /> Loading…
+			</div>
+		{:else if entries.length === 0}
+			<div role="status" class="px-3 py-2 text-xs text-tertiary">Empty</div>
+		{:else}
+			<div class="flex flex-col py-1">
+				{#each entries as entry (entry.key)}
+					{@const isHl = entry.key === highlightedKey}
+					{#if entry.type === 'leaf'}
+						{@render leafRow(
+							entry.item,
+							scope?.dir ? entry.item.path.slice(scope.dir.length + 1) : entry.item.path,
+							'py-1.5'
+						)}
+					{:else}
+						<button
+							type="button"
+							id={idFor(entry.key)}
+							role="option"
+							aria-selected={isHl}
+							data-nav-key={entry.key}
+							class="flex items-center gap-1.5 w-full text-left px-3 py-1.5 text-xs font-medium font-mono text-emphasis transition-colors {isHl
+								? 'bg-surface-hover'
+								: ''}"
+							onmousedown={(e) => e.preventDefault()}
+							onclick={() => drill(entry)}
+							onmouseenter={() => setHoverHighlight(entry.key)}
+						>
+							{#if entry.type === 'kind'}
+								{#if entry.kind === 'all'}
+									<Layers size={12} class="shrink-0 text-tertiary" />
+									<span class="flex-1">All</span>
+								{:else}
+									<RowIcon kind={entry.kind} size={12} />
+									<span class="flex-1">{KIND_LABEL[entry.kind]}</span>
+								{/if}
+							{:else if entry.node.isScope && entry.node.fullPath.startsWith('u/')}
+								<User size={12} class="shrink-0 text-tertiary" />
+								<span class="flex-1 truncate">{entry.node.name}</span>
+							{:else}
+								<Folder size={12} class="shrink-0 text-tertiary" />
+								<span class="flex-1 truncate">{entry.node.name}</span>
+							{/if}
+							{#if entry.type === 'kind' && entry.kind !== 'all' && loadingKind[entry.kind]}
+								<Loader2 size={12} class="animate-spin text-tertiary" />
+							{/if}
+							<ChevronRight size={10} class="shrink-0 text-secondary" />
+						</button>
+					{/if}
+				{/each}
+			</div>
+		{/if}
+	</div>
+</div>
+
+<style>
+	/* Path truncates from the start (left ellipsis) so the deepest (rightmost)
+	 * folder stays visible. `unicode-bidi: plaintext` keeps each path segment
+	 * laid out per its own direction — defends against any future RTL char
+	 * appearing in a workspace path. */
+	.truncate-start {
+		direction: rtl;
+		text-align: left;
+		unicode-bidi: plaintext;
+	}
+</style>
diff --git a/frontend/src/lib/components/apps/editor/AppEditor.svelte b/frontend/src/lib/components/apps/editor/AppEditor.svelte
index e919f7d484..158e4be8df 100644
--- a/frontend/src/lib/components/apps/editor/AppEditor.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditor.svelte
@@ -877,7 +877,7 @@
 			{/snippet}
 		</AppEditorHeader>
 		{#if $mode === 'preview'}
-			<SplitPanesWrapper>
+			<SplitPanesWrapper class="border-t">
 				<div
 					class={twMerge(
 						'h-full w-full relative',
@@ -922,7 +922,7 @@
 				</div>
 			{/if}
 
-			<SplitPanesWrapper>
+			<SplitPanesWrapper class="border-t">
 				<Splitpanes id="o1" class="max-w-full overflow-hidden">
 					<Pane bind:size={leftPanelSize} minSize={5} maxSize={33}>
 						<div
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 8fd09a2fd3..bc7261b389 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -1,12 +1,13 @@
 <script lang="ts">
-	import { Drawer, DrawerContent, UndoRedo } from '$lib/components/common'
+	import { Drawer, DrawerContent } from '$lib/components/common'
 	import Button from '$lib/components/common/button/Button.svelte'
 
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { AppService, DraftService, type Policy } from '$lib/gen'
 	import { redo, undo } from '$lib/history.svelte'
 	import { enterpriseLicense, userStore, workspaceStore } from '$lib/stores'
-	import type { Item } from '$lib/utils'
+	import { isMac, type Item, userPathPrefix } from '$lib/utils'
+	import { random_adj } from '$lib/components/random_positive_adjetive'
 	import {
 		AlignHorizontalSpaceAround,
 		BellOff,
@@ -24,6 +25,8 @@
 		Sun,
 		Moon,
 		SunMoon,
+		Undo,
+		Redo,
 		Zap,
 		Globe
 	} from 'lucide-svelte'
@@ -52,7 +55,9 @@
 	import AppReportsDrawer from './AppReportsDrawer.svelte'
 	import DebugPanel from './contextPanel/DebugPanel.svelte'
 
-	import Summary from '$lib/components/Summary.svelte'
+	import EditorHeader from '$lib/components/EditorHeader.svelte'
+	import { editPathFor, invalidate as invalidatePicker } from '$lib/components/workspacePicker'
+	import { goto } from '$app/navigation'
 	import HideButton from './settingsPanel/HideButton.svelte'
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 
@@ -119,7 +124,20 @@
 		onHideBottomPanel
 	}: Props = $props()
 
-	let newEditedPath = $state('')
+	/** Mirror of the path the user is editing in the pen popover. Initialized
+	 * once from `newPath` (or a synthesized path for new apps) and only
+	 * updated by user input from then on — we deliberately do NOT sync from
+	 * `newPath` afterwards so the user's in-flight rename isn't clobbered by
+	 * a parent reload that re-supplies the saved path. The fallback chain at
+	 * read sites (`newEditedPath || savedApp?.draft?.path || savedApp?.path`)
+	 * handles the case where `newEditedPath` is briefly empty before the
+	 * synthesized initialization runs — falls through to the saved path so
+	 * rename detection still works. */
+	let newEditedPath = $state(
+		untrack(() =>
+			newApp ? userPathPrefix($userStore?.username) + random_adj() + '_app' : (newPath ?? '')
+		)
+	)
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
 	let deployedBy: string | undefined = $state(undefined) // Author
 	let confirmCallback: () => void = $state(() => {}) // What happens when user clicks `override` in warning
@@ -283,6 +301,7 @@
 				preserve_on_behalf_of: preserveOnBehalfOf || undefined
 			}
 		})
+		invalidatePicker($workspaceStore!, 'app')
 		savedApp = {
 			summary: $summary,
 			value: structuredClone($state.snapshot($app)),
@@ -511,19 +530,12 @@
 
 		lock = true
 
-		switch (event.key) {
-			case 'Z':
-				if (event.ctrlKey || event.metaKey) {
-					const napp = redo(history)
-					for (const key in napp) {
-						$app[key] = napp[key]
-					}
-					event.preventDefault()
-				}
-				break
+		// Only lowercase single-char keys — named keys (`ArrowDown`, etc.) must
+		// stay PascalCase to match their switch cases.
+		switch (event.key.length === 1 ? event.key.toLowerCase() : event.key) {
 			case 'z':
 				if (event.ctrlKey || event.metaKey) {
-					const napp = undo(history, $app)
+					const napp = event.shiftKey ? redo(history) : undo(history, $app)
 					for (const key in napp) {
 						$app[key] = napp[key]
 					}
@@ -558,7 +570,37 @@
 		lock = false
 	}
 
+	const mod = isMac() ? '⌘' : 'Ctrl+'
+
+	function handleUndo() {
+		const napp = undo(history, $app)
+		for (const key in napp) {
+			$app[key] = napp[key]
+		}
+	}
+	function handleRedo() {
+		const napp = redo(history)
+		for (const key in napp) {
+			$app[key] = napp[key]
+		}
+	}
+
 	let moreItems = $derived([
+		{
+			displayName: 'Undo',
+			icon: Undo,
+			action: () => handleUndo(),
+			disabled: $history?.index === 0,
+			shortcut: `${mod}Z`
+		},
+		{
+			displayName: 'Redo',
+			icon: Redo,
+			action: () => handleRedo(),
+			disabled: $history && $history?.index === $history.history.length - 1,
+			shortcut: `${mod}⇧Z`,
+			separatorBottom: true
+		},
 		{
 			displayName: 'Deployment history',
 			icon: History,
@@ -890,28 +932,17 @@
 <AppReportsDrawer bind:open={appReportingDrawerOpen} appPath={$appPath ?? ''} />
 
 <div
-	class="border-b flex flex-row justify-between py-1 gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto"
+	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
 >
 	<div class="flex flex-row gap-2 items-center">
-		<Summary bind:value={$summary} />
+		<EditorHeader
+			bind:summary={$summary}
+			bind:path={newEditedPath}
+			savedPath={$appPath || newPath || undefined}
+			kind="app"
+			onNavigate={(item) => goto(editPathFor(item))}
+		/>
 		<div class="flex gap-2">
-			<UndoRedo
-				undoProps={{ disabled: $history?.index === 0 }}
-				redoProps={{ disabled: $history && $history?.index === $history.history.length - 1 }}
-				on:undo={() => {
-					const napp = undo(history, $app)
-					for (const key in napp) {
-						$app[key] = napp[key]
-					}
-				}}
-				on:redo={() => {
-					const napp = redo(history)
-					for (const key in napp) {
-						$app[key] = napp[key]
-					}
-				}}
-			/>
-
 			{#if $app}
 				<ToggleButtonGroup
 					selected={$app.fullscreen ? 'true' : 'false'}
diff --git a/frontend/src/lib/components/common/EditableInput.svelte b/frontend/src/lib/components/common/EditableInput.svelte
new file mode 100644
index 0000000000..e772247c0a
--- /dev/null
+++ b/frontend/src/lib/components/common/EditableInput.svelte
@@ -0,0 +1,143 @@
+<!--
+@component
+Inline-editable text. Renders as a static button in idle mode; clicking it
+swaps to a `TextInput` whose width tracks the content (no layout shift on
+toggle). `Enter` or `blur` commits via `onSave`; `Escape` discards.
+
+Use it for header titles, summaries, list-item names — anywhere the user
+should be able to edit a label in place without opening a modal or popover.
+
+```svelte
+<EditableInput
+  value={summary}
+  placeholder="Add a summary..."
+  onSave={(v) => (summary = v)}
+  textClass="text-xs font-semibold text-emphasis"
+/>
+```
+
+The current value isn't bound — `onSave` is fired with the trimmed draft
+whenever it differs from the prior `value`, including with `''` when the
+user clears the field. Callers that want to reject empty commits should
+guard inside their `onSave` handler. The parent owns the canonical state;
+this component just proposes new values.
+-->
+<script lang="ts">
+	import TextInput from '$lib/components/text_input/TextInput.svelte'
+
+	interface Props {
+		/** Current value displayed in idle mode and pre-filled when entering edit mode. */
+		value: string
+		/** Shown when `value` is empty, in both idle and editing modes. */
+		placeholder?: string
+		/**
+		 * Called when the user commits a changed value (Enter or blur). Fires
+		 * with the trimmed draft, including `''` if the user cleared the field.
+		 * Not called on Escape, or on blur when the trimmed draft matches the
+		 * prior `value`. Guard against empty in your handler if needed.
+		 */
+		onSave?: (newValue: string) => void
+		/** When false, the component renders as plain text (not clickable). Default true. */
+		editable?: boolean
+		/** TextInput size in editing mode. Idle mode is unaffected (text only). */
+		size?: 'xs' | 'sm' | 'md' | 'lg'
+		/** Wrapper classes. Use for layout (margin, max-width, alignment) only — not text styling. */
+		class?: string
+		/** Extra classes on the inner `<input>` in editing mode. Background/border/shadow are reset on top of these. */
+		inputClass?: string
+		/**
+		 * Text styling (font-size, weight, color, line-height...) applied to *both*
+		 * the idle button and the editing input so the two render identically and
+		 * the toggle doesn't visually shift.
+		 */
+		textClass?: string
+	}
+
+	let {
+		value,
+		placeholder = '',
+		onSave,
+		editable = true,
+		size = 'sm',
+		class: className = '',
+		inputClass = '',
+		textClass = ''
+	}: Props = $props()
+
+	let editing = $state(false)
+	let draft = $state('')
+	let textInputComponent: TextInput | undefined = $state(undefined)
+
+	function startEditing() {
+		if (!editable) return
+		editing = true
+		draft = value ?? ''
+		requestAnimationFrame(() => {
+			textInputComponent?.focus()
+			textInputComponent?.select()
+		})
+	}
+
+	function save() {
+		// Re-entry guard: Enter calls `save()` and sets `editing = false`,
+		// which unmounts the `<input>` and synchronously fires its `blur`
+		// handler — also `save()`. Without this guard, `onSave` would fire
+		// twice for the same edit.
+		if (!editing) return
+		editing = false
+		const trimmed = draft.trim()
+		if (trimmed !== (value ?? '')) {
+			onSave?.(trimmed)
+		}
+	}
+
+	function handleKeydown(e: KeyboardEvent) {
+		if (e.key === 'Enter') save()
+		else if (e.key === 'Escape') editing = false
+	}
+</script>
+
+{#if editing}
+	<span
+		class="input-sizer inline-grid items-center {textClass} {className}"
+		data-value={draft || placeholder}
+	>
+		<TextInput
+			bind:this={textInputComponent}
+			bind:value={draft}
+			{size}
+			class="!bg-transparent !border-0 !shadow-none -p-0 !m-0 !min-w-0 !min-h-0 !h-auto {textClass} {inputClass}"
+			inputProps={{
+				placeholder,
+				onblur: save,
+				onkeydown: handleKeydown,
+				spellcheck: false,
+				size: 1,
+				style: 'padding: 2px !important; grid-area: 1 / 1'
+			}}
+		/>
+	</span>
+{:else}
+	<button
+		type="button"
+		onclick={startEditing}
+		disabled={!editable}
+		aria-label={editable ? `Edit ${placeholder.toLowerCase() || 'value'}` : undefined}
+		class="text-left truncate rounded p-0.5 {editable
+			? 'cursor-text hover:bg-surface-hover'
+			: 'cursor-default'} {textClass} {className}"
+	>
+		{value || placeholder}
+	</button>
+{/if}
+
+<style>
+	.input-sizer::after {
+		content: attr(data-value) ' ';
+		visibility: hidden;
+		white-space: pre;
+		grid-area: 1 / 1;
+		font: inherit;
+		padding: 2px;
+	}
+</style>
diff --git a/frontend/src/lib/components/common/button/Button.svelte b/frontend/src/lib/components/common/button/Button.svelte
index 077994d842..b739076cee 100644
--- a/frontend/src/lib/components/common/button/Button.svelte
+++ b/frontend/src/lib/components/common/button/Button.svelte
@@ -385,7 +385,11 @@
 				{@render children?.()}
 			{/if}
 			{#if endIcon?.icon}
-				<endIcon.icon class={twMerge('shrink-0', endIcon?.classes)} size={lucideIconSize} />
+				<endIcon.icon
+					class={twMerge('shrink-0', endIcon?.classes)}
+					size={lucideIconSize}
+					{...endIcon.props}
+				/>
 			{/if}
 			{#if shortCut && !shortCut.hide}
 				<div
@@ -434,7 +438,11 @@
 				{@render children?.()}
 			{/if}
 			{#if endIcon?.icon}
-				<endIcon.icon class={twMerge('shrink-0', endIcon?.classes)} size={lucideIconSize} />
+				<endIcon.icon
+					class={twMerge('shrink-0', endIcon?.classes)}
+					size={lucideIconSize}
+					{...endIcon.props}
+				/>
 			{/if}
 			{#if shortCut && !shortCut.hide}
 				{@const Icon = shortCut.Icon}
diff --git a/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte b/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte
index 20ebe04c85..1305d611c1 100644
--- a/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte
+++ b/frontend/src/lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte
@@ -58,11 +58,8 @@
 				open = true
 			}
 			if (savedValue && modifiedValue) {
-				const draftOrDeployed = cleanValueProperties({
-					...((savedValue.draft || savedValue) ?? {}),
-					path: undefined
-				})
-				const current = cleanValueProperties({ ...(modifiedValue ?? {}), path: undefined })
+				const draftOrDeployed = cleanValueProperties((savedValue.draft || savedValue) ?? {})
+				const current = cleanValueProperties(modifiedValue ?? {})
 
 				if (
 					orderedJsonStringify(replaceFalseWithUndefined(draftOrDeployed)) ===
diff --git a/frontend/src/lib/components/common/table/RowIcon.svelte b/frontend/src/lib/components/common/table/RowIcon.svelte
index 7906b01d33..67a707ff1e 100644
--- a/frontend/src/lib/components/common/table/RowIcon.svelte
+++ b/frontend/src/lib/components/common/table/RowIcon.svelte
@@ -53,9 +53,10 @@
 			| 'email_trigger'
 		/** For 'trigger' kind, specifies the specific trigger type (routes, schedules, etc.) */
 		triggerKind?: string | undefined
+		size?: number
 	}
 
-	let { kind, triggerKind = undefined }: Props = $props()
+	let { kind, triggerKind = undefined, size = 16 }: Props = $props()
 
 	// Map per-kind backend names (e.g. `kafka_trigger`) to the legacy short
 	// names the icon switch already handles, so we don't have to duplicate cases.
@@ -79,44 +80,44 @@
 
 <div class="flex justify-center items-center" title={effectiveKind}>
 	{#if effectiveKind === 'flow'}
-		<BarsStaggered size={16} class="text-teal-500" />
+		<BarsStaggered {size} class="text-teal-500" />
 	{:else if effectiveKind === 'app' || effectiveKind === 'raw_app'}
-		<LayoutDashboard size={16} class="text-orange-500" />
+		<LayoutDashboard {size} class="text-orange-500" />
 	{:else if effectiveKind === 'script'}
-		<Code2 size={16} class="text-blue-500" />
+		<Code2 {size} class="text-blue-500" />
 	{:else if effectiveKind === 'variable'}
-		<DollarSign size={16} class="text-gray-400" />
+		<DollarSign {size} class="text-gray-400" />
 	{:else if effectiveKind === 'resource'}
-		<Boxes size={16} class="text-gray-400" />
+		<Boxes {size} class="text-gray-400" />
 	{:else if effectiveKind === 'resource_type'}
-		<div style="width: 16px; height: 16px;" class="bg-gray-100 rounded-full"></div>
+		<div style="width: {size}px; height: {size}px;" class="bg-gray-100 rounded-full"></div>
 	{:else if effectiveKind === 'folder'}
-		<Folder size={16} class="text-gray-400" />
+		<Folder {size} class="text-gray-400" />
 	{:else if effectiveKind === 'schedule' || effectiveKind === 'schedules'}
-		<Calendar size={16} class="text-gray-400" />
+		<Calendar {size} class="text-gray-400" />
 	{:else if effectiveKind === 'routes'}
-		<Route size={16} class="text-gray-400" />
+		<Route {size} class="text-gray-400" />
 	{:else if effectiveKind === 'websockets'}
-		<Unplug size={16} class="text-gray-400" />
+		<Unplug {size} class="text-gray-400" />
 	{:else if effectiveKind === 'postgres'}
-		<Database size={16} class="text-gray-400" />
+		<Database {size} class="text-gray-400" />
 	{:else if effectiveKind === 'kafka'}
-		<KafkaIcon size={16} class="text-gray-400" />
+		<KafkaIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'nats'}
-		<NatsIcon size={16} class="text-gray-400" />
+		<NatsIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'mqtt'}
-		<MqttIcon size={16} class="text-gray-400" />
+		<MqttIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'sqs'}
-		<AwsIcon size={16} class="text-gray-400" />
+		<AwsIcon {size} class="text-gray-400" />
 	{:else if effectiveKind === 'gcp'}
-		<GoogleCloudIcon size={16} />
+		<GoogleCloudIcon {size} />
 	{:else if effectiveKind === 'azure'}
-		<AzureIcon size={16} />
+		<AzureIcon {size} />
 	{:else if effectiveKind === 'emails'}
-		<Mail size={16} class="text-gray-400" />
+		<Mail {size} class="text-gray-400" />
 	{:else if effectiveKind === 'trigger'}
-		<Calendar size={16} class="text-gray-400" />
+		<Calendar {size} class="text-gray-400" />
 	{:else}
-		<div class="w-[16px]"></div>
+		<div style="width: {size}px;"></div>
 	{/if}
 </div>
diff --git a/frontend/src/lib/components/flow_builder.ts b/frontend/src/lib/components/flow_builder.ts
index d847664fa7..427fb9a9fd 100644
--- a/frontend/src/lib/components/flow_builder.ts
+++ b/frontend/src/lib/components/flow_builder.ts
@@ -6,46 +6,48 @@ import type { DiffDrawerI } from './diff_drawer'
 import type { FlowBuilderWhitelabelCustomUi } from './custom_ui'
 import type { ScheduleTrigger } from './triggers'
 import type { stepState } from './stepHistoryLoader.svelte'
+import type { WorkspaceItem } from './workspacePicker'
 
 export type FlowBuilderProps = {
-    initialPath?: string
-    pathStoreInit?: string | undefined
-    newFlow: boolean
-    selectedId: string | undefined
-    initialArgs?: Record<string, any>
-    loading?: boolean
-    flowStore: StateStore<OpenFlow>
-    flowStateStore: StateStore<FlowState>
-    savedFlow?: FlowWithDraftAndDraftTriggers | undefined
-    diffDrawer?: DiffDrawerI | undefined
-    customUi?: FlowBuilderWhitelabelCustomUi
-    disableAi?: boolean
-    disabledFlowInputs?: boolean
-    savedPrimarySchedule?: ScheduleTrigger | undefined // used to set the primary schedule in the legacy primaryScheduleStore
-    version?: number | undefined
-    setSavedraftCb?: ((cb: () => void) => void) | undefined
-    draftTriggersFromUrl?: Trigger[] | undefined
-    selectedTriggerIndexFromUrl?: number | undefined
-    children?: import('svelte').Snippet
-    loadedFromHistoryFromUrl?: {
-        flowJobInitial: boolean | undefined
-        stepsState: Record<string, stepState>
-    }
-    noInitial?: boolean
-    onSaveInitial?: ({ path, id }: { path: string; id: string }) => void
-    onSaveDraft?: ({
-        path,
-        savedAtNewPath,
-        newFlow
-    }: {
-        path: string
-        savedAtNewPath: boolean
-        newFlow: boolean
-    }) => void
-    onSaveDraftError?: ({ error }: { error: any }) => void
-    onSaveDraftOnlyAtNewPath?: ({ path, selectedId }: { path: string; selectedId: string }) => void
-    onDeploy?: ({ path }: { path: string }) => void
-    onDeployError?: ({ error }: { error: any }) => void
-    onDetails?: ({ path }: { path: string }) => void
-    onHistoryRestore?: () => void
+	initialPath?: string
+	pathStoreInit?: string | undefined
+	newFlow: boolean
+	selectedId: string | undefined
+	initialArgs?: Record<string, any>
+	loading?: boolean
+	flowStore: StateStore<OpenFlow>
+	flowStateStore: StateStore<FlowState>
+	savedFlow?: FlowWithDraftAndDraftTriggers | undefined
+	diffDrawer?: DiffDrawerI | undefined
+	customUi?: FlowBuilderWhitelabelCustomUi
+	disableAi?: boolean
+	disabledFlowInputs?: boolean
+	savedPrimarySchedule?: ScheduleTrigger | undefined // used to set the primary schedule in the legacy primaryScheduleStore
+	version?: number | undefined
+	setSavedraftCb?: ((cb: () => void) => void) | undefined
+	draftTriggersFromUrl?: Trigger[] | undefined
+	selectedTriggerIndexFromUrl?: number | undefined
+	children?: import('svelte').Snippet
+	loadedFromHistoryFromUrl?: {
+		flowJobInitial: boolean | undefined
+		stepsState: Record<string, stepState>
+	}
+	noInitial?: boolean
+	onSaveInitial?: ({ path, id }: { path: string; id: string }) => void
+	onSaveDraft?: ({
+		path,
+		savedAtNewPath,
+		newFlow
+	}: {
+		path: string
+		savedAtNewPath: boolean
+		newFlow: boolean
+	}) => void
+	onSaveDraftError?: ({ error }: { error: any }) => void
+	onSaveDraftOnlyAtNewPath?: ({ path, selectedId }: { path: string; selectedId: string }) => void
+	onDeploy?: ({ path }: { path: string }) => void
+	onDeployError?: ({ error }: { error: any }) => void
+	onDetails?: ({ path }: { path: string }) => void
+	onHistoryRestore?: () => void
+	onNavigate?: (item: WorkspaceItem) => void
 }
diff --git a/frontend/src/lib/components/flows/content/FlowSettings.svelte b/frontend/src/lib/components/flows/content/FlowSettings.svelte
index 353c9ba563..3c6b268e00 100644
--- a/frontend/src/lib/components/flows/content/FlowSettings.svelte
+++ b/frontend/src/lib/components/flows/content/FlowSettings.svelte
@@ -139,6 +139,14 @@
 							namePlaceholder="flow"
 							kind="flow"
 						/>
+						{#if $initialPathStore && $pathStore && $pathStore !== $initialPathStore}
+							<Alert
+								type="info"
+								size="xs"
+								title="Deploy the flow to make the path change effective."
+								class="mt-2"
+							/>
+						{/if}
 					</Label>
 				{/if}
 
diff --git a/frontend/src/lib/components/icons/BarsStaggered.svelte b/frontend/src/lib/components/icons/BarsStaggered.svelte
index dbfebdeb1d..eedc72de8a 100644
--- a/frontend/src/lib/components/icons/BarsStaggered.svelte
+++ b/frontend/src/lib/components/icons/BarsStaggered.svelte
@@ -1,18 +1,18 @@
 <script lang="ts">
 	interface Props {
-		size?: number;
-		style?: string;
-		class?: string;
+		size?: number
+		style?: string
+		class?: string
 	}
 
-	let { size = 16, style = 'fill: white;', class: clazz = '' }: Props = $props();
-	
+	let { size = 16, style = 'fill: white;', class: clazz = '' }: Props = $props()
 </script>
 
 <svg
 	xmlns="http://www.w3.org/2000/svg"
 	height={`${size}px`}
-	viewBox="0 0 512 512"
+	width={`${size}px`}
+	viewBox="-64 -64 640 640"
 	class={clazz}
 	{style}
 >
diff --git a/frontend/src/lib/components/meltComponents/Popover.svelte b/frontend/src/lib/components/meltComponents/Popover.svelte
index a88d90c7ff..87d5ff3f83 100644
--- a/frontend/src/lib/components/meltComponents/Popover.svelte
+++ b/frontend/src/lib/components/meltComponents/Popover.svelte
@@ -52,6 +52,9 @@
 		closeOnOtherPopoverOpen?: boolean
 		allowFullScreen?: boolean
 		extraProps?: Record<string, any>
+		/** Attributes spread onto the trigger button. Use for `aria-label`,
+		 * `aria-current`, etc. — overrides the default `aria-label="Popup button"`. */
+		triggerAttrs?: Record<string, any>
 		disabled?: boolean
 		documentationLink?: string | undefined
 		disableFocusTrap?: boolean
@@ -90,6 +93,7 @@
 		closeOnOtherPopoverOpen = false,
 		allowFullScreen = false,
 		extraProps = {},
+		triggerAttrs = {},
 		disabled = false,
 		documentationLink = undefined,
 		disableFocusTrap = false,
@@ -219,6 +223,7 @@
 	class={className}
 	use:melt={$_trigger}
 	aria-label="Popup button"
+	{...triggerAttrs}
 	disabled={disablePopup || disabled}
 	onmouseenter={() => {
 		if (openOnHover) {
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
index 8d9fa070af..247a0486af 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditor.svelte
@@ -943,7 +943,7 @@
 		onApply={handleYamlApply}
 	/>
 
-	<Splitpanes id="o2" class="grow min-h-0">
+	<Splitpanes id="o2" class="grow min-h-0 border-t">
 		<Pane bind:size={sidebarPanelSize} maxSize={20} class="h-full overflow-y-auto">
 			<RawAppSidebar
 				bind:files={
diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index d98b7e9015..888f360fb3 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
-	import { Badge, Drawer, DrawerContent } from '$lib/components/common'
+	import { Drawer, DrawerContent } from '$lib/components/common'
 	import Button from '$lib/components/common/button/Button.svelte'
-	import UndoRedo from '$lib/components/common/button/UndoRedo.svelte'
+	import { isMac, userPathPrefix } from '$lib/utils'
+	import { editPathFor, invalidate as invalidatePicker } from '$lib/components/workspacePicker'
 
 	import { AppService, DraftService, type Policy } from '$lib/gen'
 	import { rawAppToHubUrl } from '$lib/hub'
@@ -15,18 +16,19 @@
 		FileJson,
 		Globe,
 		History,
-		Pen,
+		Redo,
 		Save,
+		Undo,
 		WandSparkles
 	} from 'lucide-svelte'
-	import { createEventDispatcher } from 'svelte'
+	import { createEventDispatcher, untrack } from 'svelte'
 	import {
 		cleanValueProperties,
 		orderedJsonStringify,
 		type Value,
-		replaceFalseWithUndefined,
-		defaultIfEmptyString
+		replaceFalseWithUndefined
 	} from '../../utils'
+	import { random_adj } from '$lib/components/random_positive_adjetive'
 
 	// import {  allItems, toStatic } from '../apps/editor/settingsPanel/utils'
 	import AppExportButton from '../apps/editor/AppExportButton.svelte'
@@ -37,7 +39,8 @@
 	import Awareness from '$lib/components/Awareness.svelte'
 	import type DiffDrawer from '$lib/components/DiffDrawer.svelte'
 
-	import Summary from '$lib/components/Summary.svelte'
+	import EditorHeader from '$lib/components/EditorHeader.svelte'
+	import { goto } from '$app/navigation'
 	import DeployOverrideConfirmationModal from '$lib/components/common/confirmationModal/DeployOverrideConfirmationModal.svelte'
 
 	import AppJobsDrawer from '../apps/editor/AppJobsDrawer.svelte'
@@ -130,7 +133,13 @@
 		onOpenYamlEditor = undefined
 	}: Props = $props()
 
-	let newEditedPath = $state('')
+	let newEditedPath = $state(
+		untrack(() =>
+			newApp
+				? userPathPrefix($userStore?.username) + random_adj() + '_app'
+				: newPath || appPath || ''
+		)
+	)
 
 	let deployedValue: Value | undefined = $state(undefined) // Value to diff against
 	let deployedBy: string | undefined = $state(undefined) // Author
@@ -332,6 +341,7 @@
 				css
 			}
 		})
+		invalidatePicker($workspaceStore!, 'app')
 		savedApp = {
 			summary: summary,
 			value: structuredClone(stateSnapshot(app)),
@@ -562,7 +572,24 @@
 		}
 	}
 
-	let moreItems = [
+	const mod = isMac() ? '⌘' : 'Ctrl+'
+
+	let moreItems = $derived([
+		{
+			displayName: 'Undo',
+			icon: Undo,
+			action: () => onUndo?.(),
+			disabled: !canUndo,
+			shortcut: `${mod}Z`
+		},
+		{
+			displayName: 'Redo',
+			icon: Redo,
+			action: () => onRedo?.(),
+			disabled: !canRedo,
+			shortcut: `${mod}⇧Z`,
+			separatorBottom: true
+		},
 		{
 			displayName: 'Deployment history',
 			icon: History,
@@ -617,7 +644,7 @@
 			},
 			disabled: !savedApp
 		}
-	]
+	])
 
 	const dispatch = createEventDispatcher()
 
@@ -824,52 +851,20 @@
 />
 
 <div
-	class="border-b flex flex-row justify-between py-1 gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto min-h-10 shrink-0"
+	class="flex flex-row justify-between gap-2 gap-y-2 px-2 items-center overflow-y-visible overflow-x-auto max-h-12 h-12 shrink-0"
 >
 	<div class="flex flex-row gap-2 items-center">
-		<Summary bind:value={summary} />
-		<div></div>
-		<UndoRedo
-			undoProps={{ disabled: !canUndo }}
-			redoProps={{ disabled: !canRedo }}
-			on:undo={() => onUndo?.()}
-			on:redo={() => onRedo?.()}
+		<EditorHeader
+			bind:summary
+			bind:path={newEditedPath}
+			savedPath={appPath || newPath || undefined}
+			kind="app"
+			raw_app
+			onNavigate={(item) => goto(editPathFor(item))}
 		/>
+		<div></div>
 	</div>
 
-	<div class=" flex">
-		{#if newPath || newEditedPath}
-			<div class="flex justify-start w-full border rounded-md overflow-hidden">
-				<div>
-					<button
-						onclick={async () => {
-							saveDrawerOpen = true
-							setTimeout(() => {
-								document.getElementById('path')?.focus()
-							}, 100)
-						}}
-					>
-						<Badge
-							color="gray"
-							class="center-center !bg-surface-secondary !text-primary !h-[28px]  !w-[70px] rounded-none hover:!bg-surface-hover transition-all flex gap-1"
-						>
-							<Pen size={14} />Path
-						</Badge>
-					</button>
-				</div>
-				<input
-					type="text"
-					readonly
-					value={defaultIfEmptyString(newEditedPath, newPath)}
-					size={defaultIfEmptyString(newEditedPath, newPath)?.length || 50}
-					class="font-mono !text-xs !min-w-[96px] !max-w-[300px] !w-full !h-[28px] !my-0 !py-0 !border-l-0 !rounded-l-none !border-0 !shadow-none"
-					onfocus={({ currentTarget }) => {
-						currentTarget.select()
-					}}
-				/>
-			</div>
-		{/if}
-	</div>
 	{#if $enterpriseLicense && appPath != ''}
 		<Awareness />
 	{/if}
diff --git a/frontend/src/lib/components/script_builder.ts b/frontend/src/lib/components/script_builder.ts
index 24d8e69d32..378e562e98 100644
--- a/frontend/src/lib/components/script_builder.ts
+++ b/frontend/src/lib/components/script_builder.ts
@@ -5,6 +5,7 @@ import type { DiffDrawerI } from './diff_drawer'
 import type { ScriptBuilderFunctionExports } from './scriptBuilder'
 import type { ScheduleTrigger } from './triggers'
 import type { NewScriptWithDraftAndDraftTriggers, Trigger } from './triggers/utils'
+import type { WorkspaceItem } from './workspacePicker'
 
 export interface ScriptBuilderProps {
 	script: NewScript & {
@@ -44,4 +45,5 @@ export interface ScriptBuilderProps {
 	onSaveDraft?: (e: { path: string; savedAtNewPath: boolean; script: NewScript }) => void
 	onSeeDetails?: (e: { path: string }) => void
 	onSaveDraftError?: (e: { path: string; error: any }) => void
+	onNavigate?: (item: WorkspaceItem) => void
 }
diff --git a/frontend/src/lib/components/workspacePicker.ts b/frontend/src/lib/components/workspacePicker.ts
new file mode 100644
index 0000000000..ba2985ecbb
--- /dev/null
+++ b/frontend/src/lib/components/workspacePicker.ts
@@ -0,0 +1,151 @@
+import type { Flow, ListableApp, Script } from '$lib/gen'
+
+export type WorkspaceItemKind = 'flow' | 'script' | 'app'
+
+export type WorkspaceItem = {
+	path: string
+	summary: string
+	kind: WorkspaceItemKind
+	raw_app?: boolean
+}
+
+/** Display label for kinds — used in the picker rows and search section headers. */
+export const KIND_LABEL: Record<WorkspaceItemKind, string> = {
+	flow: 'Flows',
+	script: 'Scripts',
+	app: 'Apps'
+}
+
+/** Lowercase variant — matches the editor breadcrumb style. */
+export const KIND_LABEL_LOWER: Record<WorkspaceItemKind, string> = {
+	flow: 'flows',
+	script: 'scripts',
+	app: 'apps'
+}
+
+/** Composite keys used for keyboard nav and `initialHighlight`. The picker and
+ * its callers must agree on these — keep them all here. `'all'` is a virtual
+ * kind for the cross-kind root view; only valid for `kindKey` / `dirKey`
+ * (leaves always belong to a real kind). */
+export const kindKey = (k: WorkspaceItemKind | 'all') => `kind:${k}`
+export const dirKey = (k: WorkspaceItemKind | 'all', fullPath: string) => `dir:${k}:${fullPath}`
+export const leafKeyFor = (k: WorkspaceItemKind, path: string) => `leaf:${k}:${path}`
+
+export function editPathFor(item: WorkspaceItem): string {
+	if (item.kind === 'flow') return `/flows/edit/${item.path}`
+	if (item.kind === 'script') return `/scripts/edit/${item.path}`
+	return item.raw_app ? `/apps_raw/edit/${item.path}` : `/apps/edit/${item.path}`
+}
+
+type WorkspaceCache = {
+	flow?: WorkspaceItem[]
+	script?: WorkspaceItem[]
+	app?: WorkspaceItem[]
+}
+
+/** Module-level session cache. Persists across picker mounts within a single
+ * page session. NOT invalidated automatically — call `invalidate()` after
+ * creating/deleting an item if the picker may be opened again before a full
+ * reload. */
+const cache = new Map<string, WorkspaceCache>()
+const inflight = new Map<string, Promise<WorkspaceItem[]>>()
+/** Bumped by `invalidate()`. Each in-flight `loadKind` captures the version
+ * at start and only writes back to the cache if it still matches — so a
+ * deploy mid-fetch can't have its stale predecessor repopulate the cache. */
+const cacheVersion = new Map<string, number>()
+
+const cacheKey = (workspace: string, kind: WorkspaceItemKind) => `${workspace}:${kind}`
+
+const KINDS: WorkspaceItemKind[] = ['flow', 'script', 'app']
+
+function bumpVersion(workspace: string, kind: WorkspaceItemKind) {
+	const k = cacheKey(workspace, kind)
+	cacheVersion.set(k, (cacheVersion.get(k) ?? 0) + 1)
+}
+
+export function getCachedItems(
+	workspace: string,
+	kind: WorkspaceItemKind
+): WorkspaceItem[] | undefined {
+	return cache.get(workspace)?.[kind]
+}
+
+/** Drop a workspace+kind (or a whole workspace) from the cache so the next
+ * picker open re-fetches. Use after creating/deleting items. Also bumps the
+ * version so any in-flight `loadKind` started before the invalidate won't
+ * write its (now-stale) result back to the cache. */
+export function invalidate(workspace: string, kind?: WorkspaceItemKind) {
+	if (!kind) {
+		cache.delete(workspace)
+		for (const k of KINDS) bumpVersion(workspace, k)
+		return
+	}
+	const bucket = cache.get(workspace)
+	if (bucket) delete bucket[kind]
+	bumpVersion(workspace, kind)
+}
+
+export async function loadKind(
+	workspace: string,
+	kind: WorkspaceItemKind
+): Promise<WorkspaceItem[]> {
+	const existing = cache.get(workspace)?.[kind]
+	if (existing) return existing
+	const key = cacheKey(workspace, kind)
+	const flying = inflight.get(key)
+	if (flying) return flying
+
+	const startVersion = cacheVersion.get(key) ?? 0
+	const promise = (async () => {
+		const { ScriptService, FlowService, AppService } = await import('$lib/gen')
+		let items: WorkspaceItem[]
+		if (kind === 'flow') {
+			const flows = await FlowService.listFlows({
+				workspace,
+				includeDraftOnly: true,
+				withoutDescription: true
+			})
+			items = flows.map((f: Flow) => ({
+				path: f.path,
+				summary: f.summary ?? '',
+				kind: 'flow' as const
+			}))
+		} else if (kind === 'script') {
+			const scripts = await ScriptService.listScripts({
+				workspace,
+				includeDraftOnly: true,
+				withoutDescription: true
+			})
+			items = scripts.map((s: Script) => ({
+				path: s.path,
+				summary: s.summary ?? '',
+				kind: 'script' as const
+			}))
+		} else {
+			const apps = await AppService.listApps({
+				workspace,
+				includeDraftOnly: true
+			})
+			items = apps.map((a: ListableApp) => ({
+				path: a.path,
+				summary: a.summary ?? '',
+				kind: 'app' as const,
+				raw_app: a.raw_app ?? false
+			}))
+		}
+		// Only commit if the cache version hasn't changed since we started —
+		// otherwise we'd overwrite a deliberate `invalidate()` with stale data.
+		if ((cacheVersion.get(key) ?? 0) === startVersion) {
+			const bucket = cache.get(workspace) ?? {}
+			bucket[kind] = items
+			cache.set(workspace, bucket)
+		}
+		return items
+	})()
+	inflight.set(key, promise)
+	try {
+		return await promise
+	} finally {
+		inflight.delete(key)
+	}
+}
diff --git a/frontend/src/lib/utils.ts b/frontend/src/lib/utils.ts
index 0911fe44e1..20d1e496ff 100644
--- a/frontend/src/lib/utils.ts
+++ b/frontend/src/lib/utils.ts
@@ -1022,6 +1022,16 @@ export function generateRandomString(len: number = 24): string {
 	return result
 }
 
+/** `u/<sanitized-username>/` — the default scope prefix for items owned by the
+ * current user. The username is normalized so emails and special characters
+ * don't leak into paths. */
+export function userPathPrefix(username: string | undefined): string {
+	const u = username?.includes('@')
+		? username.split('@')[0].replace(/[^a-zA-Z0-9_]/g, '')
+		: (username ?? '')
+	return `u/${u}/`
+}
+
 export function deepMergeWithPriority<T>(target: T, source: T): T {
 	if (typeof target !== 'object' || typeof source !== 'object') {
 		return source
diff --git a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
index 471a3c1643..d22875f9b6 100644
--- a/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/edit/[...path]/+page.svelte
@@ -33,7 +33,6 @@
 		  }
 		| undefined = $state(undefined)
 	let redraw = $state(0)
-	let path = page.params.path ?? ''
 
 	let nodraft = page.url.searchParams.get('nodraft')
 
@@ -48,11 +47,17 @@
 	let stateLoadedFromLocalStorage =
 		initialState != undefined ? decodeState(initialState) : undefined
 
+	/** Increments per `loadApp` call. Stale loads (e.g. when picker
+	 * navigation races a draft-discard reload) bail at the next checkpoint
+	 * after their captured token no longer matches. */
+	let loadAppToken = 0
 	async function loadApp(): Promise<void> {
+		const tok = ++loadAppToken
 		const app_w_draft = await AppService.getAppByPathWithDraft({
-			path,
+			path: page.params.path ?? '',
 			workspace: $workspaceStore!
 		})
+		if (tok !== loadAppToken) return
 		const app_w_draft_: AppWithLastVersionWDraft = structuredClone(stateSnapshot(app_w_draft))
 		savedApp = {
 			summary: app_w_draft_.summary,
@@ -160,8 +165,16 @@
 	}
 
 	$effect(() => {
+		// Re-run on workspace OR path change so navigating from one app editor
+		// to another (e.g. via the workspace picker) reloads the new app.
+		const newPath = page.params.path
 		if ($workspaceStore) {
 			untrack(() => {
+				// Clear the app so AppEditor unmounts; it will remount once loadApp
+				// completes with fresh data, re-initializing its internal stores.
+				app = undefined
+				const s = nodraft ? undefined : localStorage.getItem(`app-${newPath}`)
+				stateLoadedFromLocalStorage = s != undefined ? decodeState(s) : undefined
 				loadApp()
 			})
 		}
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
index b22d1884be..3f9d08b224 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
@@ -37,7 +37,6 @@
 		  }
 		| undefined = $state(undefined)
 	let redraw = $state(0)
-	let path = page.params.path ?? ''
 
 	let nodraft = page.url.searchParams.get('nodraft')
 
@@ -78,11 +77,17 @@
 	let stateLoadedFromLocalStorage =
 		initialState != undefined ? decodeState(initialState) : undefined
 
+	/** Increments per `loadApp` call. Stale loads (e.g. when picker
+	 * navigation races a draft-discard reload) bail at the next checkpoint
+	 * after their captured token no longer matches. */
+	let loadAppToken = 0
 	async function loadApp(): Promise<void> {
+		const tok = ++loadAppToken
 		const app_w_draft = await AppService.getAppByPathWithDraft({
-			path,
+			path: page.params.path ?? '',
 			workspace: $workspaceStore!
 		})
+		if (tok !== loadAppToken) return
 		const app_w_draft_ = structuredClone(stateSnapshot(app_w_draft))
 		savedApp = {
 			summary: app_w_draft_.summary,
@@ -128,9 +133,7 @@
 			}
 			sendUserToast('App restored from browser storage', false, actions)
 			app_w_draft.value = stateLoadedFromLocalStorage
-			const rawValue = app_w_draft.value as any
-			files = rawValue.files as any
-			runnables = rawValue.runnables as any
+			extractRawApp(app_w_draft)
 			redraw += 1
 		} else if (app_w_draft.draft) {
 			extractRawApp(app_w_draft.draft)
@@ -170,7 +173,15 @@
 	}
 
 	run(() => {
+		// Re-run on workspace OR path change so navigating from one raw app editor
+		// to another (e.g. via the workspace picker) reloads the new app.
+		const newPath = page.params.path
 		if ($workspaceStore) {
+			// Clear files so RawAppEditor unmounts; it will remount when loadApp
+			// completes with fresh data, re-initializing its internal stores.
+			files = undefined
+			const s = nodraft ? undefined : localStorage.getItem(`rawapp-${newPath}`)
+			stateLoadedFromLocalStorage = s != undefined ? decodeState(s) : undefined
 			loadApp()
 		}
 	})
diff --git a/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte
index 1b8503163e..0fc9c0219d 100644
--- a/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/add/+page.svelte
@@ -4,6 +4,7 @@
 	import { page } from '$app/state'
 
 	import FlowBuilder from '$lib/components/FlowBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import UnsavedConfirmationModal from '$lib/components/common/confirmationModal/UnsavedConfirmationModal.svelte'
 	import { importFlowStore, initFlow } from '$lib/components/flows/flowStore.svelte'
 	import { FlowService, type Flow } from '$lib/gen'
@@ -179,7 +180,7 @@
 			await tick()
 			let attempts = 0
 			while (attempts < 20 && !document.querySelector('#flow-editor-virtual-Input')) {
-				await new Promise(resolve => setTimeout(resolve, 100))
+				await new Promise((resolve) => setTimeout(resolve, 100))
 				attempts++
 			}
 			flowBuilder?.triggerTutorial()
@@ -193,14 +194,17 @@
 
 <FlowBuilder
 	onSaveInitial={(e) => {
+		if ($workspaceStore) invalidate($workspaceStore, 'flow')
 		goto(`/flows/edit/${e.path}?selected=${e.id}`)
 	}}
 	onDeploy={(e) => {
+		if ($workspaceStore) invalidate($workspaceStore, 'flow')
 		goto(`/flows/get/${e.path}?workspace=${$workspaceStore}`)
 	}}
 	onDetails={(e) => {
 		goto(`/flows/get/${e.path}?workspace=${$workspaceStore}`)
 	}}
+	onNavigate={(item) => goto(editPathFor(item))}
 	{initialPath}
 	{pathStoreInit}
 	bind:this={flowBuilder}
diff --git a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
index 7bc082b29d..a0b21703f4 100644
--- a/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/flows/edit/[...path]/+page.svelte
@@ -2,6 +2,7 @@
 	import { FlowService, type Flow, DraftService } from '$lib/gen'
 
 	import FlowBuilder from '$lib/components/FlowBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import { initialArgsStore, workspaceStore } from '$lib/stores'
 	import {
 		cleanValueProperties,
@@ -24,10 +25,11 @@
 	import { page } from '$app/state'
 
 	let version: undefined | number = $state(undefined)
-	let nodraft = page.url.searchParams.get('nodraft')
-	const initialState = nodraft ? undefined : localStorage.getItem(`flow-${page.params.path}`)
-	let stateLoadedFromUrl = initialState != undefined ? decodeState(initialState) : undefined
 
+	// `initialArgs` is captured once at mount — it's the session's initial
+	// argument set. Per-flow autosave (`stateLoadedFromUrl`) and the
+	// `nodraft` flag are re-read inside `loadFlow` / the navigation hook so
+	// picker navigation doesn't reuse the original path's state.
 	const urlArgs = page.url.searchParams.get('initial_args')
 
 	let initialArgs = $state({})
@@ -45,7 +47,7 @@
 		| undefined = $state(undefined)
 
 	afterNavigate(() => {
-		if (nodraft) {
+		if (page.url.searchParams.get('nodraft')) {
 			let url = new URL(page.url.href)
 			url.search = ''
 			replaceState(url.toString(), page.state)
@@ -72,9 +74,15 @@
 
 	let nobackenddraft = false
 
-	let savedPrimarySchedule: ScheduleTrigger | undefined = $state(
-		stateLoadedFromUrl?.primarySchedule
-	)
+	// One-shot read of mount-time autosave, used only to seed the initial
+	// `savedPrimarySchedule` before `loadFlow` runs. `loadFlow` itself
+	// re-reads localStorage on every invocation (see comment there).
+	const initialAutosave = (() => {
+		if (page.url.searchParams.get('nodraft')) return undefined
+		const raw = localStorage.getItem(`flow-${page.params.path}`)
+		return raw != undefined ? decodeState(raw) : undefined
+	})()
+	let savedPrimarySchedule: ScheduleTrigger | undefined = $state(initialAutosave?.primarySchedule)
 
 	let draftTriggersFromUrl: Trigger[] | undefined = $state(undefined)
 	let selectedTriggerIndexFromUrl: number | undefined = $state(undefined)
@@ -84,20 +92,36 @@
 
 	let flowBuilder: FlowBuilder | undefined = $state(undefined)
 	let notFound = $state(false)
+	/** Increments per `loadFlow` call. Each in-flight load checks its captured
+	 * token against this before writing shared state — if a newer load started
+	 * (e.g. picker navigation while a draft-discard reload is in flight),
+	 * the older promise no-ops at the next checkpoint. */
+	let loadFlowToken = 0
 	async function loadFlow(): Promise<void> {
-		console.log('loadFlow')
+		const tok = ++loadFlowToken
 		loading = true
+
+		// Re-read autosave per load. The component doesn't remount when the
+		// picker navigates between flows, so capturing at module init would
+		// keep reusing the original flow's state.
+		const stored = page.url.searchParams.get('nodraft')
+			? undefined
+			: localStorage.getItem(`flow-${page.params.path}`)
+		const stateLoadedFromUrl = stored != undefined ? decodeState(stored) : undefined
+
 		let flow: Flow
 		let statePath = stateLoadedFromUrl?.path
 		if (stateLoadedFromUrl != undefined && statePath == page.params.path) {
 			// Currently there is no way to get version of flow with flow.
 			// So we have to request it here
-			version = (
+			const v = (
 				await FlowService.getFlowLatestVersion({
 					workspace: $workspaceStore!,
 					path: statePath
 				})
 			)?.id
+			if (tok !== loadFlowToken) return
+			version = v
 
 			if (version == undefined) {
 				notFound = true
@@ -105,10 +129,12 @@
 				return
 			}
 
-			savedFlow = await FlowService.getFlowByPathWithDraft({
+			const sf = await FlowService.getFlowByPathWithDraft({
 				workspace: $workspaceStore!,
 				path: statePath
 			})
+			if (tok !== loadFlowToken) return
+			savedFlow = sf
 
 			const draftOrDeployed = cleanValueProperties(savedFlow?.draft || savedFlow)
 			const urlScript = cleanValueProperties(
@@ -126,7 +152,16 @@
 			flowBuilder?.setLoadedFromHistory(loadedFromHistoryFromUrl)
 			const selectedId = stateLoadedFromUrl?.selectedId ?? 'settings-metadata'
 			const reloadAction = () => {
-				stateLoadedFromUrl = undefined
+				// Discard the localStorage autosave so the next `loadFlow`
+				// (re-)read sees an empty slot and falls through to the
+				// fetch branch — otherwise we'd re-enter this branch and
+				// loop. Scripts dodge this because their state lives in
+				// the URL fragment, which `goto` clears for us.
+				try {
+					localStorage.removeItem(`flow-${statePath}`)
+				} catch (e) {
+					console.error('error interacting with local storage', e)
+				}
 				goto(`/flows/edit/${statePath}?selected=${selectedId}`)
 				loadFlow()
 			}
@@ -156,17 +191,20 @@
 		} else {
 			// Currently there is no way to get version of flow with flow.
 			// So we have to request it here
-			version = (
+			const v = (
 				await FlowService.getFlowLatestVersion({
 					workspace: $workspaceStore!,
 					path: page.params.path ?? ''
 				})
 			).id
+			if (tok !== loadFlowToken) return
+			version = v
 
 			const flowWithDraft = await FlowService.getFlowByPathWithDraft({
 				workspace: $workspaceStore!,
 				path: page.params.path ?? ''
 			})
+			if (tok !== loadFlowToken) return
 			savedFlow = {
 				...structuredClone($state.snapshot(flowWithDraft)),
 				draft: flowWithDraft.draft
@@ -190,7 +228,6 @@
 					const deployed = cleanValueProperties(flowWithDraft)
 					const draft = cleanValueProperties(flow)
 					const reloadAction = async () => {
-						stateLoadedFromUrl = undefined
 						await DraftService.deleteDraft({
 							workspace: $workspaceStore!,
 							kind: 'flow',
@@ -226,12 +263,16 @@
 		}
 
 		await initFlow(flow, flowStore, flowStateStore)
+		if (tok !== loadFlowToken) return
 		loading = false
 		selectedId = stateLoadedFromUrl?.selectedId ?? page.url.searchParams.get('selected')
 		flowBuilder?.loadFlowState()
 	}
 
 	$effect(() => {
+		// Re-run on workspace OR path change so navigating from one flow editor
+		// to another (e.g. via the workspace picker) reloads the new flow.
+		page.params.path
 		if ($workspaceStore) {
 			untrack(() => loadFlow())
 		}
@@ -245,7 +286,6 @@
 			return
 		}
 		diffDrawer?.closeDrawer()
-		stateLoadedFromUrl = undefined
 		goto(`/flows/edit/${savedFlow.draft.path}`)
 		loadFlow()
 	}
@@ -263,7 +303,6 @@
 				path: savedFlow.path
 			})
 		}
-		stateLoadedFromUrl = undefined
 		goto(`/flows/edit/${savedFlow.path}`)
 		loadFlow()
 	}
@@ -280,6 +319,7 @@
 {:else}
 	<FlowBuilder
 		onDeploy={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'flow')
 			goto(`/flows/get/${e.path}?workspace=${$workspaceStore}`)
 		}}
 		onDetails={(e) => {
@@ -291,6 +331,7 @@
 		onHistoryRestore={() => {
 			loadFlow()
 		}}
+		onNavigate={(item) => goto(editPathFor(item))}
 		{flowStore}
 		{flowStateStore}
 		initialPath={page.params.path ?? ''}
diff --git a/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte
index 8f43dde796..ad2452dce1 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/add/+page.svelte
@@ -4,6 +4,7 @@
 	import { page } from '$app/state'
 	import { defaultScripts, initialArgsStore, workspaceStore } from '$lib/stores'
 	import ScriptBuilder from '$lib/components/ScriptBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import type { Schema } from '$lib/common'
 	import { decodeState, emptySchema, emptyString, sendUserToast } from '$lib/utils'
 	import { goto } from '$lib/navigation'
@@ -63,9 +64,12 @@
 			schema: schema,
 			is_template: false,
 			extra_perms: {},
-			language: (wacParam === 'python' ? 'python3' : wacParam === 'typescript' ? 'bun' : null) ?? collabLang ?? ($defaultScripts?.order?.filter(
-				(x) => $defaultScripts?.hidden == undefined || !$defaultScripts.hidden.includes(x)
-			)?.[0] ?? 'bun') as ScriptLang,
+			language:
+				(wacParam === 'python' ? 'python3' : wacParam === 'typescript' ? 'bun' : null) ??
+				collabLang ??
+				(($defaultScripts?.order?.filter(
+					(x) => $defaultScripts?.hidden == undefined || !$defaultScripts.hidden.includes(x)
+				)?.[0] ?? 'bun') as ScriptLang),
 			kind: 'script'
 		}
 	}
@@ -139,8 +143,7 @@
 			extra_perms: {}
 		}
 		if (isWac) {
-			importedWacTemplate =
-				imported.language === 'python3' ? 'wac_python' : 'wac_typescript'
+			importedWacTemplate = imported.language === 'python3' ? 'wac_python' : 'wac_typescript'
 			sendUserToast('WAC script loaded from YAML/JSON')
 		} else {
 			sendUserToast('Script loaded from YAML/JSON')
@@ -159,13 +162,21 @@
 		{initialArgs}
 		bind:this={scriptBuilder}
 		lockedLanguage={templatePath != null || hubPath != null}
-		template={importedWacTemplate ?? (wacParam === 'python' ? 'wac_python' : wacParam === 'typescript' ? 'wac_typescript' : 'script')}
+		template={importedWacTemplate ??
+			(wacParam === 'python'
+				? 'wac_python'
+				: wacParam === 'typescript'
+					? 'wac_typescript'
+					: 'script')}
 		onDeploy={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/get/${e.hash}?workspace=${$workspaceStore}`)
 		}}
 		onSaveInitial={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/edit/${e.path}`)
 		}}
+		onNavigate={(item) => goto(editPathFor(item))}
 		searchParams={page.url.searchParams}
 		bind:script
 		{showMeta}
diff --git a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
index 8afaa2ce61..f3002daedc 100644
--- a/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/scripts/edit/[...path]/+page.svelte
@@ -3,6 +3,7 @@
 
 	import { initialArgsStore, workspaceStore } from '$lib/stores'
 	import ScriptBuilder from '$lib/components/ScriptBuilder.svelte'
+	import { editPathFor, invalidate } from '$lib/components/workspacePicker'
 	import { decodeState, cleanValueProperties, orderedJsonStringify } from '$lib/utils'
 	import { goto } from '$lib/navigation'
 	import { replaceState } from '$app/navigation'
@@ -15,16 +16,13 @@
 	import { untrack } from 'svelte'
 	import { page } from '$app/state'
 
-	let initialState = window.location.hash != '' ? window.location.hash.slice(1) : undefined
+	// `initialArgs` is intentionally captured once at mount — it's the
+	// session's initial argument set, not per-script. URL-derived state
+	// (`hash`, `topHash`, fragment autosave) is re-read inside `loadScript`
+	// because picker navigation reuses this component without remounting.
 	let initialArgs = get(initialArgsStore) ?? {}
 	if (get(initialArgsStore)) $initialArgsStore = undefined
 
-	let topHash = page.url.searchParams.get('topHash') ?? undefined
-
-	let hash = page.url.searchParams.get('hash') ?? undefined
-
-	let scriptLoadedFromUrl = initialState != undefined ? decodeState(initialState) : undefined
-
 	let script: (NewScript & { draft_triggers?: Trigger[] }) | undefined = $state(undefined)
 
 	let initialPath: string = $state('')
@@ -38,21 +36,36 @@
 
 	let savedPrimarySchedule: ScheduleTrigger | undefined = $state(undefined)
 
+	/** Increments per `loadScript` call. Stale loads (e.g. when picker
+	 * navigation races a draft-discard reload) bail at the next checkpoint
+	 * after their captured token no longer matches. */
+	let loadScriptToken = 0
 	async function loadScript(): Promise<void> {
+		const tok = ++loadScriptToken
 		fullyLoaded = false
+
+		// Re-read URL-derived state on every load. The component doesn't
+		// remount when the picker navigates between scripts, so capturing
+		// these at module init would leave them stale.
+		const urlFragment = window.location.hash != '' ? window.location.hash.slice(1) : undefined
+		const scriptLoadedFromUrl = urlFragment != undefined ? decodeState(urlFragment) : undefined
+		const hash = page.url.searchParams.get('hash') ?? undefined
+		const topHash = page.url.searchParams.get('topHash') ?? undefined
+
 		if (scriptLoadedFromUrl != undefined && scriptLoadedFromUrl.path == page.params.path) {
 			script = scriptLoadedFromUrl
 			reloadAction = async () => {
-				scriptLoadedFromUrl = undefined
 				goto(`/scripts/edit/${script!.path}`)
 				loadScript()
 			}
 
 			async function compareAutosave() {
-				savedScript = await ScriptService.getScriptByPathWithDraft({
+				const sf = await ScriptService.getScriptByPathWithDraft({
 					workspace: $workspaceStore!,
 					path: script!.path
 				})
+				if (tok !== loadScriptToken) return
+				savedScript = sf
 
 				const draftOrDeployed = cleanValueProperties(savedScript?.draft || savedScript)
 				const urlScript = cleanValueProperties(scriptLoadedFromUrl)
@@ -87,6 +100,7 @@
 					workspace: $workspaceStore!,
 					hash
 				})
+				if (tok !== loadScriptToken) return
 				savedScript = structuredClone($state.snapshot(scriptByHash)) as NewScriptWithDraft
 				script = { ...scriptByHash, parent_hash: hash, lock: undefined }
 			} else {
@@ -94,6 +108,7 @@
 					workspace: $workspaceStore!,
 					path: page.params.path ?? ''
 				})
+				if (tok !== loadScriptToken) return
 				savedScript = structuredClone($state.snapshot(scriptWithDraft))
 				if (scriptWithDraft.draft != undefined) {
 					script = scriptWithDraft.draft
@@ -105,7 +120,6 @@
 
 					if (!scriptWithDraft.draft_only) {
 						reloadAction = async () => {
-							scriptLoadedFromUrl = undefined
 							await DraftService.deleteDraft({
 								workspace: $workspaceStore!,
 								kind: 'script',
@@ -164,6 +178,9 @@
 	}
 
 	$effect(() => {
+		// Re-run on workspace OR path change so navigating from one script editor
+		// to another (e.g. via the workspace picker) reloads the new script.
+		page.params.path
 		if ($workspaceStore) {
 			untrack(() => loadScript())
 		}
@@ -178,7 +195,6 @@
 		}
 		diffDrawer?.closeDrawer()
 		goto(`/scripts/edit/${savedScript.draft.path}`)
-		scriptLoadedFromUrl = undefined
 		loadScript()
 	}
 
@@ -196,7 +212,6 @@
 			})
 		}
 		goto(`/scripts/edit/${savedScript.path}`)
-		scriptLoadedFromUrl = undefined
 		loadScript()
 	}
 </script>
@@ -214,14 +229,17 @@
 		{savedPrimarySchedule}
 		searchParams={page.url.searchParams}
 		onDeploy={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/get/${e.hash}?workspace=${$workspaceStore}`)
 		}}
 		onSaveInitial={(e) => {
+			if ($workspaceStore) invalidate($workspaceStore, 'script')
 			goto(`/scripts/edit/${e.path}`)
 		}}
 		onSeeDetails={(e) => {
 			goto(`/scripts/get/${e.path}?workspace=${$workspaceStore}`)
 		}}
+		onNavigate={(item) => goto(editPathFor(item))}
 		replaceStateFn={(path) => {
 			replaceState(path, page.state)
 		}}