From c16bef8f296645ff873f9d8d28e3dcb50a65e304 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 14 Nov 2025 18:28:54 +0100
Subject: [PATCH 01/81] feat: add support for switch and attributes in pwsh
 params (#7143)

---
 .../parsers/windmill-parser-bash/src/lib.rs   | 621 +++++++++++++++---
 backend/windmill-worker/src/pwsh_executor.rs  |  44 +-
 cli/wasm/regex/windmill_parser_wasm.d.ts      |  16 +-
 cli/wasm/regex/windmill_parser_wasm.js        | 162 ++---
 cli/wasm/regex/windmill_parser_wasm_bg.wasm   | Bin 351019 -> 355438 bytes
 frontend/package-lock.json                    |   8 +-
 frontend/package.json                         |   2 +-
 7 files changed, 645 insertions(+), 208 deletions(-)

diff --git a/backend/parsers/windmill-parser-bash/src/lib.rs b/backend/parsers/windmill-parser-bash/src/lib.rs
index 5bfe6b20c5..f1652ed5d6 100644
--- a/backend/parsers/windmill-parser-bash/src/lib.rs
+++ b/backend/parsers/windmill-parser-bash/src/lib.rs
@@ -46,8 +46,6 @@ pub fn parse_powershell_sig(code: &str) -> anyhow::Result<MainArgSignature> {
 
 lazy_static::lazy_static! {
     static ref RE_BASH: Regex = Regex::new(r#"(?m)^(\w+)="\$(?:(\d+)|\{(\d+)\}|\{(\d+):-(.*)\})"(?:[\t ]*)?(?:#.*)?\r?$"#).unwrap();
-
-    static ref RE_POWERSHELL_ARGS: Regex = Regex::new(r#"(?:\[([\w\[\]]+)\])?\$(\w+)[\t ]*(?:=[\t ]*(?:(?:(?:"|')([^"\n\r\$]*)(?:"|'))|([\d.]+)))?\r?"#).unwrap();
 }
 
 fn parse_bash_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
@@ -98,10 +96,12 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
     let lower_code = code.to_lowercase();
     let param_start = lower_code.find("param")?;
 
-    // Verify that only comments and whitespace appear before "param"
+    // Verify that only comments, whitespace, and [CmdletBinding()] appear before "param"
     let before_param = &code[..param_start];
     let mut chars = before_param.chars().peekable();
     let mut in_block_comment = false;
+    let mut in_attribute_bracket = false;
+    let mut bracket_depth = 0;
 
     while let Some(ch) = chars.next() {
         if in_block_comment {
@@ -110,6 +110,19 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
                 chars.next(); // consume '>'
                 in_block_comment = false;
             }
+        } else if in_attribute_bracket {
+            // Track bracket depth to handle nested brackets/parens in attributes
+            match ch {
+                '[' => bracket_depth += 1,
+                ']' => {
+                    bracket_depth -= 1;
+                    if bracket_depth == 0 {
+                        in_attribute_bracket = false;
+                    }
+                }
+                // Allow parentheses inside attributes (e.g., [CmdletBinding()])
+                _ => {}
+            }
         } else {
             match ch {
                 // Start of block comment: <#
@@ -126,6 +139,11 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
                         chars.next();
                     }
                 }
+                // Start of attribute bracket (e.g., [CmdletBinding()])
+                '[' => {
+                    in_attribute_bracket = true;
+                    bracket_depth = 1;
+                }
                 // Whitespace is allowed
                 c if c.is_whitespace() => {}
                 // Any other character means there's code before param
@@ -134,8 +152,8 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
         }
     }
 
-    // If we're still in a block comment at the end, it's unclosed - invalid
-    if in_block_comment {
+    // If we're still in a block comment or unclosed attribute bracket, it's invalid
+    if in_block_comment || in_attribute_bracket {
         return None;
     }
 
@@ -214,108 +232,269 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
     None
 }
 
-enum ParserState {
-    Normal,
-    InSingleQuote,
-    InDoubleQuote,
-}
-fn split_pwsh_args(code: &str) -> Vec<&str> {
-    let mut chars = code.char_indices().peekable();
-    let mut state = ParserState::Normal;
-    let mut splits = vec![];
-    let mut last_idx = 0;
-    while let Some((idx, char)) = chars.next() {
-        match (&state, char) {
-            (ParserState::Normal, '\'') => {
-                state = ParserState::InSingleQuote;
-            }
-            (ParserState::Normal, '"') => {
-                state = ParserState::InDoubleQuote;
-            }
-            (ParserState::InSingleQuote, '\'') => {
-                state = ParserState::Normal;
-            }
-            (ParserState::InDoubleQuote, '"') => {
-                state = ParserState::Normal;
-            }
-            (ParserState::Normal, ',') => {
-                splits.push(&code[last_idx..idx]);
-                last_idx = idx + 1; // skip the comma
-            }
-            _ => {}
-        }
-    }
-
-    if last_idx < code.len() {
-        splits.push(&code[last_idx..]);
-    }
-
-    splits
-}
-
 fn parse_powershell_single_typ(typ: &str) -> Typ {
     match typ.to_lowercase().as_str() {
         "string" => Typ::Str(None),
         "int" | "long" => Typ::Int,
         "decimal" | "double" | "single" => Typ::Float,
         "datetime" => Typ::Datetime,
-        "bool" => Typ::Bool,
+        "bool" | "switch" => Typ::Bool,
         "pscustomobject" => Typ::Object(ObjectType::new(None, None)),
         _ => Typ::Str(None),
     }
 }
 
-fn parse_powershell_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
-    let param_wrapper = extract_powershell_param_block(code, false);
-    let mut args = vec![];
-    if let Some(param_wrapper) = param_wrapper {
-        let params = split_pwsh_args(param_wrapper);
-        for param in params {
-            if let Some(cap) = RE_POWERSHELL_ARGS.captures(param) {
-                let typ = cap.get(1).map(|x| x.as_str().to_string());
-                let name = cap.get(2).unwrap().as_str().to_string();
+/// Single-pass PowerShell parameter parser.
+/// Parses the content of a param() block and extracts all parameter information.
+///
+/// This function processes PowerShell parameter declarations in a single pass, handling:
+/// - Parameter attributes: [Parameter(Mandatory)], [Parameter(Mandatory=$true)], [ValidateSet(...)], etc.
+/// - Type annotations: [string], [int[]], [PSCustomObject], etc.
+/// - Variable names: $Name, $Value, etc.
+/// - Default values: = 'text', = 25, = $env:VAR, etc.
+/// - Mandatory detection: Parameters with Mandatory attribute are marked as required
+fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
+    #[derive(Debug, PartialEq)]
+    enum State {
+        Normal,
+        InSingleQuote,
+        InDoubleQuote,
+        InBracket,
+    }
 
-                let mut parsed_typ = if let Some(typ) = typ {
-                    if typ.as_str().ends_with("[]") {
-                        Some(Typ::List(Box::new(parse_powershell_single_typ(
-                            typ.as_str().strip_suffix("[]").unwrap(),
-                        ))))
-                    } else {
-                        Some(parse_powershell_single_typ(typ.as_str()))
+    let mut args = Vec::new();
+    let mut chars = content.char_indices().peekable();
+    let mut state = State::Normal;
+    let mut bracket_depth: i32 = 0;
+    let mut paren_depth: i32 = 0;
+
+    // Current parameter being built
+    let mut type_annotation: Option<String> = None;
+    let mut var_name: Option<String> = None;
+    let mut default_value: Option<String> = None;
+    let mut is_mandatory = false;
+
+    // Track position for extracting text
+    let mut last_bracket_start = None;
+    let mut found_dollar = false;
+
+    while let Some((idx, ch)) = chars.next() {
+        match state {
+            State::InSingleQuote => {
+                if ch == '\'' {
+                    state = State::Normal;
+                }
+            }
+            State::InDoubleQuote => {
+                if ch == '"' {
+                    // Check for escape character
+                    if idx > 0 && content.chars().nth(idx - 1) != Some('`') {
+                        state = State::Normal;
                     }
-                } else {
-                    None
-                };
+                }
+            }
+            State::InBracket => {
+                match ch {
+                    '[' => bracket_depth += 1,
+                    ']' => {
+                        bracket_depth -= 1;
+                        if bracket_depth == 0 {
+                            // Extract the bracket content
+                            if let Some(start) = last_bracket_start {
+                                let bracket_content = &content[start + 1..idx];
 
-                let default = if let Some(x) = cap.get(3) {
-                    Some(json!(x.as_str().to_string()))
-                } else if let Some(x) = cap.get(4) {
-                    if parsed_typ.is_none() {
-                        if x.as_str().parse::<i64>().is_ok() {
-                            parsed_typ = Some(Typ::Int);
-                        } else if x.as_str().parse::<f64>().is_ok() {
-                            parsed_typ = Some(Typ::Float);
+                                // Check if this is a Parameter attribute with Mandatory (case-insensitive)
+                                let lower = bracket_content.to_lowercase();
+                                if lower.starts_with("parameter(") || lower.starts_with("parameter ") {
+                                    // Check for Mandatory (case-insensitive)
+                                    if lower.contains("mandatory") {
+                                        // Check if it's explicitly set to false
+                                        if !lower.contains("mandatory=$false") && !lower.contains("mandatory = $false") {
+                                            is_mandatory = true;
+                                        }
+                                    }
+                                }
+
+                                // Check if this looks like a type (simple word, possibly with [])
+                                let is_type = !bracket_content.contains('(')
+                                    && !bracket_content.contains('=')
+                                    && (bracket_content.chars().next().unwrap_or(' ').is_alphabetic()
+                                        || bracket_content.starts_with('['));
+
+                                if is_type && !found_dollar {
+                                    type_annotation = Some(bracket_content.to_string());
+                                }
+                            }
+                            state = State::Normal;
+                            last_bracket_start = None;
                         }
                     }
-                    serde_json::Number::from_str(x.as_str())
-                        .ok()
-                        .map(serde_json::Value::Number)
-                } else {
-                    None
-                };
+                    '(' => paren_depth += 1,
+                    ')' => paren_depth = paren_depth.saturating_sub(1),
+                    _ => {}
+                }
+            }
+            State::Normal => {
+                match ch {
+                    '\'' => state = State::InSingleQuote,
+                    '"' => state = State::InDoubleQuote,
+                    '[' => {
+                        state = State::InBracket;
+                        bracket_depth = 1;
+                        last_bracket_start = Some(idx);
+                    }
+                    '$' => {
+                        found_dollar = true;
+                        // Extract variable name
+                        let name_start = idx + 1;
+                        let mut name_end = name_start;
+                        while let Some(&(_, next_ch)) = chars.peek() {
+                            if next_ch.is_alphanumeric() || next_ch == '_' {
+                                name_end += 1;
+                                chars.next();
+                            } else {
+                                break;
+                            }
+                        }
+                        var_name = Some(content[name_start..name_end].to_string());
+                    }
+                    '=' if found_dollar => {
+                        // Extract default value
+                        // Skip whitespace after =
+                        while let Some(&(_, next_ch)) = chars.peek() {
+                            if next_ch.is_whitespace() {
+                                chars.next();
+                            } else {
+                                break;
+                            }
+                        }
 
-                args.push(Arg {
-                    name: name,
-                    typ: parsed_typ.unwrap_or(Typ::Str(None)),
-                    default: default.clone(),
-                    otyp: None,
-                    has_default: default.is_some(),
-                    oidx: None,
-                });
+                        let default_start = chars.peek().map(|(i, _)| *i).unwrap_or(content.len());
+                        let mut default_end = default_start;
+                        let mut in_string = false;
+                        let mut string_char = ' ';
+
+                        while let Some((i, ch)) = chars.peek().copied() {
+                            if in_string {
+                                if ch == string_char && content.chars().nth(i.saturating_sub(1)) != Some('`') {
+                                    in_string = false;
+                                    default_end = i + 1;
+                                    chars.next();
+                                } else {
+                                    default_end = i + 1;
+                                    chars.next();
+                                }
+                            } else if ch == '\'' || ch == '"' {
+                                in_string = true;
+                                string_char = ch;
+                                default_end = i + 1;
+                                chars.next();
+                            } else if ch == ',' {
+                                break;
+                            } else if ch.is_whitespace() && chars.clone().skip(1).next().map(|(_, c)| c) == Some(',') {
+                                break;
+                            } else {
+                                default_end = i + 1;
+                                chars.next();
+                            }
+                        }
+
+                        default_value = Some(content[default_start..default_end].trim().to_string());
+                    }
+                    ',' => {
+                        // End of parameter, finalize it
+                        if let Some(name) = var_name.take() {
+                            args.push(finalize_parameter(name, type_annotation.take(), default_value.take(), is_mandatory)?);
+                        }
+
+                        // Reset for next parameter
+                        type_annotation = None;
+                        var_name = None;
+                        default_value = None;
+                        is_mandatory = false;
+                        found_dollar = false;
+                    }
+                    _ => {}
+                }
             }
         }
     }
-    Ok(Some(args))
+
+    // Finalize last parameter
+    if let Some(name) = var_name {
+        args.push(finalize_parameter(name, type_annotation, default_value, is_mandatory)?);
+    }
+
+    Ok(args)
+}
+
+fn finalize_parameter(
+    name: String,
+    type_annotation: Option<String>,
+    default_value: Option<String>,
+    is_mandatory: bool,
+) -> anyhow::Result<Arg> {
+    // Store the original PowerShell type for use in the executor
+    let otyp = type_annotation.clone();
+
+    let mut parsed_typ = if let Some(typ) = type_annotation {
+        if typ.ends_with("[]") {
+            Some(Typ::List(Box::new(parse_powershell_single_typ(
+                typ.strip_suffix("[]").unwrap(),
+            ))))
+        } else {
+            Some(parse_powershell_single_typ(&typ))
+        }
+    } else {
+        None
+    };
+
+    let default = if let Some(default_str) = default_value {
+        // Try to parse as string (quoted)
+        if (default_str.starts_with('"') && default_str.ends_with('"'))
+            || (default_str.starts_with('\'') && default_str.ends_with('\''))
+        {
+            Some(json!(default_str[1..default_str.len() - 1].to_string()))
+        } else {
+            // Try to parse as number
+            if parsed_typ.is_none() {
+                if default_str.parse::<i64>().is_ok() {
+                    parsed_typ = Some(Typ::Int);
+                } else if default_str.parse::<f64>().is_ok() {
+                    parsed_typ = Some(Typ::Float);
+                }
+            }
+            serde_json::Number::from_str(&default_str)
+                .ok()
+                .map(serde_json::Value::Number)
+        }
+    } else {
+        None
+    };
+
+    // has_default semantics:
+    // - true: parameter is optional (has a default value OR is not mandatory)
+    // - false: parameter is required (marked as Mandatory AND no default value)
+    // Simplified: A parameter is optional unless it's mandatory without a default
+    let has_default = default.is_some() || !is_mandatory;
+
+    Ok(Arg {
+        name,
+        typ: parsed_typ.unwrap_or(Typ::Str(None)),
+        default: default.clone(),
+        otyp,
+        has_default,
+        oidx: None,
+    })
+}
+
+fn parse_powershell_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
+    let param_wrapper = extract_powershell_param_block(code, false);
+    if let Some(param_wrapper) = param_wrapper {
+        Ok(Some(parse_powershell_parameters(param_wrapper)?))
+    } else {
+        Ok(Some(vec![]))
+    }
 }
 
 #[cfg(test)]
@@ -402,23 +581,23 @@ non_required="${5:-}"
                 star_kwargs: false,
                 args: vec![
                     Arg {
-                        otyp: None,
+                        otyp: None, // No type annotation
                         name: "Msg".to_string(),
                         typ: Typ::Str(None),
                         default: None,
-                        has_default: false,
+                        has_default: true, // Optional (not mandatory)
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: Some("string".to_string()), // [string]
                         name: "Msg2".to_string(),
                         typ: Typ::Str(None),
                         default: None,
-                        has_default: false,
+                        has_default: true, // Optional (not mandatory)
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: None, // No type annotation
                         name: "Dflt".to_string(),
                         typ: Typ::Str(None),
                         default: Some(json!("default value, with comma")),
@@ -426,7 +605,7 @@ non_required="${5:-}"
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: Some("int".to_string()), // [int]
                         name: "Nb".to_string(),
                         typ: Typ::Int,
                         default: Some(json!(3)),
@@ -434,7 +613,7 @@ non_required="${5:-}"
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: None, // Type inferred from default value
                         name: "Nb2".to_string(),
                         typ: Typ::Float,
                         default: Some(json!(5.0)),
@@ -442,7 +621,7 @@ non_required="${5:-}"
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: None, // Type inferred from default value
                         name: "Nb3".to_string(),
                         typ: Typ::Int,
                         default: Some(json!(5)),
@@ -450,35 +629,35 @@ non_required="${5:-}"
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: None, // No type annotation
                         name: "Wahoo".to_string(),
                         typ: Typ::Str(None),
                         default: None,
-                        has_default: false,
+                        has_default: true, // Optional (not mandatory)
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: Some("PSCustomObject".to_string()), // [PSCustomObject]
                         name: "Obj".to_string(),
                         typ: Typ::Object(ObjectType::new(None, None)),
                         default: None,
-                        has_default: false,
+                        has_default: true, // Optional (not mandatory)
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: Some("string[]".to_string()), // [string[]]
                         name: "Arr".to_string(),
                         typ: Typ::List(Box::new(Typ::Str(None))),
                         default: None,
-                        has_default: false,
+                        has_default: true, // Optional (not mandatory)
                         oidx: None
                     },
                     Arg {
-                        otyp: None,
+                        otyp: Some("string".to_string()), // [string] (last type bracket with Mandatory)
                         name: "Message".to_string(),
                         typ: Typ::Str(None),
                         default: None,
-                        has_default: false,
+                        has_default: false, // Required (Mandatory attribute)
                         oidx: None
                     }
                 ],
@@ -602,6 +781,242 @@ non_required="${5:-}"
             extract_powershell_param_block("function test-x{   param($Name)\n}", false),
             None
         );
+
+        // Valid: [CmdletBinding()] before param
+        assert_eq!(
+            extract_powershell_param_block("[CmdletBinding()]\nparam($Name)", false),
+            Some("$Name")
+        );
+        assert_eq!(
+            extract_powershell_param_block("[CmdletBinding()]\nparam($Name, $Age)", true),
+            Some("param($Name, $Age)")
+        );
+
+        // Valid: [CmdletBinding()] with options before param
+        assert_eq!(
+            extract_powershell_param_block(
+                "[CmdletBinding(SupportsShouldProcess=$true)]\nparam($Path)",
+                false
+            ),
+            Some("$Path")
+        );
+
+        // Valid: Multiple attributes before param
+        assert_eq!(
+            extract_powershell_param_block(
+                "[CmdletBinding()]\n[OutputType([string])]\nparam($Value)",
+                false
+            ),
+            Some("$Value")
+        );
+
+        // Valid: CmdletBinding with comments
+        assert_eq!(
+            extract_powershell_param_block(
+                "# My function\n[CmdletBinding()]\nparam($Name)",
+                false
+            ),
+            Some("$Name")
+        );
+
+        // Valid: CmdletBinding with whitespace variations
+        assert_eq!(
+            extract_powershell_param_block(
+                "[CmdletBinding()]  \n  param($Name)",
+                false
+            ),
+            Some("$Name")
+        );
+
+        // Invalid: Unclosed attribute bracket
+        assert_eq!(
+            extract_powershell_param_block("[CmdletBinding(\nparam($Name)", false),
+            None
+        );
+    }
+
+    #[test]
+    fn test_parse_powershell_sig_with_parameter_attributes() -> anyhow::Result<()> {
+        // Test with [Parameter(Mandatory=$true)] attribute
+        let code = r#"[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true)]
+    [string]$Name,
+    [Parameter(Mandatory=$false)]
+    [int]$Age = 25
+)"#;
+        let result = parse_powershell_sig(code)?;
+        assert_eq!(result.args.len(), 2);
+        assert_eq!(result.args[0].name, "Name");
+        assert_eq!(result.args[0].typ, Typ::Str(None));
+        assert_eq!(result.args[0].has_default, false);
+        assert_eq!(result.args[1].name, "Age");
+        assert_eq!(result.args[1].typ, Typ::Int);
+        assert_eq!(result.args[1].has_default, true);
+        assert_eq!(result.args[1].default, Some(json!(25)));
+
+        // Test with complex attributes
+        let code2 = r#"param(
+    [Parameter(Mandatory=$true, Position=0)]
+    [ValidateSet('Red', 'Green', 'Blue')]
+    [string]$Color,
+    [Parameter(ValueFromPipeline=$true)]
+    [string[]]$Items
+)"#;
+        let result2 = parse_powershell_sig(code2)?;
+        assert_eq!(result2.args.len(), 2);
+        assert_eq!(result2.args[0].name, "Color");
+        assert_eq!(result2.args[0].typ, Typ::Str(None));
+        assert_eq!(result2.args[1].name, "Items");
+        assert_eq!(result2.args[1].typ, Typ::List(Box::new(Typ::Str(None))));
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_powershell_single_pass_parser() -> anyhow::Result<()> {
+        // Test the single-pass parser with a complex real-world example
+        let code = r#"[CmdletBinding()]
+param(
+    [Parameter(Mandatory=$true, Position=0, HelpMessage="Enter the server name")]
+    [ValidateNotNullOrEmpty()]
+    [string]$ServerName,
+
+    [Parameter(Mandatory=$false)]
+    [ValidateRange(1, 65535)]
+    [int]$Port = 8080,
+
+    [Parameter(ValueFromPipeline=$true)]
+    [string[]]$LogFiles,
+
+    [ValidateSet('Debug', 'Info', 'Warning', 'Error')]
+    [string]$LogLevel = 'Info',
+
+    [PSCustomObject]$Config
+)"#;
+        let result = parse_powershell_sig(code)?;
+
+        assert_eq!(result.args.len(), 5);
+
+        // ServerName: mandatory string with no default
+        assert_eq!(result.args[0].name, "ServerName");
+        assert_eq!(result.args[0].typ, Typ::Str(None));
+        assert_eq!(result.args[0].has_default, false);
+
+        // Port: optional int with default
+        assert_eq!(result.args[1].name, "Port");
+        assert_eq!(result.args[1].typ, Typ::Int);
+        assert_eq!(result.args[1].default, Some(json!(8080)));
+        assert_eq!(result.args[1].has_default, true);
+
+        // LogFiles: string array (no mandatory, so optional)
+        assert_eq!(result.args[2].name, "LogFiles");
+        assert_eq!(result.args[2].typ, Typ::List(Box::new(Typ::Str(None))));
+        assert_eq!(result.args[2].has_default, true); // Optional (not mandatory)
+
+        // LogLevel: string with default (ValidateSet is ignored but doesn't break parsing)
+        assert_eq!(result.args[3].name, "LogLevel");
+        assert_eq!(result.args[3].typ, Typ::Str(None));
+        assert_eq!(result.args[3].default, Some(json!("Info")));
+        assert_eq!(result.args[3].has_default, true);
+
+        // Config: PSCustomObject (no mandatory, so optional)
+        assert_eq!(result.args[4].name, "Config");
+        assert_eq!(result.args[4].typ, Typ::Object(ObjectType::new(None, None)));
+        assert_eq!(result.args[4].has_default, true); // Optional (not mandatory)
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_powershell_mandatory_attribute() -> anyhow::Result<()> {
+        // Test various forms of the Mandatory attribute
+        let code = r#"param(
+    [Parameter(Mandatory)]
+    [string]$RequiredNoEquals,
+
+    [Parameter(Mandatory=$true)]
+    [string]$RequiredWithTrue,
+
+    [Parameter(Mandatory = $true)]
+    [string]$RequiredWithSpaces,
+
+    [Parameter(Mandatory=$false)]
+    [string]$NotRequired,
+
+    [Parameter(Position=0)]
+    [string]$NoMandatory,
+
+    [string]$PlainRequired = "default",
+
+    [Parameter(Mandatory=$true)]
+    [int]$RequiredInt
+)"#;
+        let result = parse_powershell_sig(code)?;
+
+        assert_eq!(result.args.len(), 7);
+
+        // RequiredNoEquals: mandatory without =$true
+        assert_eq!(result.args[0].name, "RequiredNoEquals");
+        assert_eq!(result.args[0].has_default, false); // Required (mandatory, no default)
+
+        // RequiredWithTrue: mandatory with =$true
+        assert_eq!(result.args[1].name, "RequiredWithTrue");
+        assert_eq!(result.args[1].has_default, false); // Required
+
+        // RequiredWithSpaces: mandatory with spaces
+        assert_eq!(result.args[2].name, "RequiredWithSpaces");
+        assert_eq!(result.args[2].has_default, false); // Required
+
+        // NotRequired: explicitly Mandatory=$false
+        assert_eq!(result.args[3].name, "NotRequired");
+        assert_eq!(result.args[3].has_default, true); // Optional (not mandatory)
+
+        // NoMandatory: no Mandatory attribute
+        assert_eq!(result.args[4].name, "NoMandatory");
+        assert_eq!(result.args[4].has_default, true); // Optional (not mandatory)
+
+        // PlainRequired: has default value (always optional)
+        assert_eq!(result.args[5].name, "PlainRequired");
+        assert_eq!(result.args[5].has_default, true); // Optional (has default)
+        assert_eq!(result.args[5].default, Some(json!("default")));
+
+        // RequiredInt: mandatory int
+        assert_eq!(result.args[6].name, "RequiredInt");
+        assert_eq!(result.args[6].typ, Typ::Int);
+        assert_eq!(result.args[6].has_default, false); // Required
+
+        Ok(())
+    }
+
+    #[test]
+    fn test_powershell_case_insensitive_parameter() -> anyhow::Result<()> {
+        // Test that [parameter(...)] is case-insensitive
+        let code = r#"param(
+    [parameter(Mandatory)]
+    [string]$LowerCase,
+
+    [PARAMETER(MANDATORY=$TRUE)]
+    [string]$UpperCase,
+
+    [Parameter(mandatory=$true)]
+    [string]$MixedCase
+)"#;
+        let result = parse_powershell_sig(code)?;
+
+        assert_eq!(result.args.len(), 3);
+
+        // All should be detected as mandatory
+        assert_eq!(result.args[0].name, "LowerCase");
+        assert_eq!(result.args[0].has_default, false);
+
+        assert_eq!(result.args[1].name, "UpperCase");
+        assert_eq!(result.args[1].has_default, false);
+
+        assert_eq!(result.args[2].name, "MixedCase");
+        assert_eq!(result.args[2].has_default, false);
+
+        Ok(())
     }
 
     #[test]
diff --git a/backend/windmill-worker/src/pwsh_executor.rs b/backend/windmill-worker/src/pwsh_executor.rs
index 4a4b85f8ac..cda448dc31 100644
--- a/backend/windmill-worker/src/pwsh_executor.rs
+++ b/backend/windmill-worker/src/pwsh_executor.rs
@@ -255,20 +255,42 @@ pub async fn handle_powershell_job(
             job.args.as_ref()
         };
 
-        let args_owned = windmill_parser_bash::parse_powershell_sig(&content)?
+        let parsed_sig = windmill_parser_bash::parse_powershell_sig(&content)?;
+
+        parsed_sig
             .args
             .iter()
-            .map(|arg| {
-                (
-                    arg.name.clone(),
-                    job_args.and_then(|x| x.get(&arg.name).map(|x| raw_to_pwsh_param(x.get()))),
-                )
-            })
-            .collect::<Vec<(String, Option<String>)>>();
+            .filter_map(|arg| {
+                let value_opt = job_args.and_then(|x| x.get(&arg.name));
 
-        args_owned
-            .into_iter()
-            .filter_map(|(n, v)| v.map(|v| format!("-{n} {v}")))
+                // Check if this is a switch parameter (only [switch], not [bool])
+                let is_switch = arg.otyp.as_ref().map(|t| {
+                    t.to_lowercase() == "switch"
+                }).unwrap_or(false);
+
+                if is_switch {
+                    // Handle switch parameters: -SwitchName or omit
+                    if let Some(value) = value_opt {
+                        match serde_json::from_str::<serde_json::Value>(value.get()) {
+                            Ok(serde_json::Value::Bool(true)) => {
+                                // Switch is enabled: just pass -SwitchName
+                                Some(format!("-{}", arg.name))
+                            }
+                            Ok(serde_json::Value::Bool(false)) | _ => {
+                                // Switch is disabled or invalid: omit the parameter
+                                None
+                            }
+                        }
+                    } else {
+                        // No value provided, omit the switch (defaults to false)
+                        None
+                    }
+                } else {
+                    // Regular parameter (including [bool]): format as -ParamName Value
+                    // For [bool] parameters, this will be -ParamName $true or -ParamName $false
+                    value_opt.map(|v| format!("-{} {}", arg.name, raw_to_pwsh_param(v.get())))
+                }
+            })
             .collect::<Vec<_>>()
             .join(" ")
     };
diff --git a/cli/wasm/regex/windmill_parser_wasm.d.ts b/cli/wasm/regex/windmill_parser_wasm.d.ts
index 59f34f2b18..7886800b20 100644
--- a/cli/wasm/regex/windmill_parser_wasm.d.ts
+++ b/cli/wasm/regex/windmill_parser_wasm.d.ts
@@ -1,14 +1,14 @@
 /* tslint:disable */
 /* eslint-disable */
-export function parse_assets_sql(code: string): string;
-export function parse_db_resource(code: string): string | undefined;
-export function parse_bash(code: string): string;
 export function parse_mssql(code: string): string;
-export function parse_oracledb(code: string): string;
 export function parse_powershell(code: string): string;
-export function parse_bigquery(code: string): string;
+export function parse_oracledb(code: string): string;
 export function parse_graphql(code: string): string;
-export function parse_snowflake(code: string): string;
-export function parse_duckdb(code: string): string;
-export function parse_sql(code: string): string;
+export function parse_assets_sql(code: string): string;
 export function parse_mysql(code: string): string;
+export function parse_bash(code: string): string;
+export function parse_duckdb(code: string): string;
+export function parse_db_resource(code: string): string | undefined;
+export function parse_bigquery(code: string): string;
+export function parse_snowflake(code: string): string;
+export function parse_sql(code: string): string;
diff --git a/cli/wasm/regex/windmill_parser_wasm.js b/cli/wasm/regex/windmill_parser_wasm.js
index 25a60a9b8e..b3b62ebd32 100644
--- a/cli/wasm/regex/windmill_parser_wasm.js
+++ b/cli/wasm/regex/windmill_parser_wasm.js
@@ -68,60 +68,6 @@ function getStringFromWasm0(ptr, len) {
     ptr = ptr >>> 0;
     return decodeText(ptr, len);
 }
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_assets_sql(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_assets_sql(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
-/**
- * @param {string} code
- * @returns {string | undefined}
- */
-export function parse_db_resource(code) {
-    const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.parse_db_resource(ptr0, len0);
-    let v2;
-    if (ret[0] !== 0) {
-        v2 = getStringFromWasm0(ret[0], ret[1]).slice();
-        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
-    }
-    return v2;
-}
-
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_bash(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_bash(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
 /**
  * @param {string} code
  * @returns {string}
@@ -141,25 +87,6 @@ export function parse_mssql(code) {
     }
 }
 
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_oracledb(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_oracledb(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
 /**
  * @param {string} code
  * @returns {string}
@@ -183,13 +110,13 @@ export function parse_powershell(code) {
  * @param {string} code
  * @returns {string}
  */
-export function parse_bigquery(code) {
+export function parse_oracledb(code) {
     let deferred2_0;
     let deferred2_1;
     try {
         const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_bigquery(ptr0, len0);
+        const ret = wasm.parse_oracledb(ptr0, len0);
         deferred2_0 = ret[0];
         deferred2_1 = ret[1];
         return getStringFromWasm0(ret[0], ret[1]);
@@ -221,13 +148,51 @@ export function parse_graphql(code) {
  * @param {string} code
  * @returns {string}
  */
-export function parse_snowflake(code) {
+export function parse_assets_sql(code) {
     let deferred2_0;
     let deferred2_1;
     try {
         const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_snowflake(ptr0, len0);
+        const ret = wasm.parse_assets_sql(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_mysql(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_mysql(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_bash(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_bash(ptr0, len0);
         deferred2_0 = ret[0];
         deferred2_1 = ret[1];
         return getStringFromWasm0(ret[0], ret[1]);
@@ -255,17 +220,33 @@ export function parse_duckdb(code) {
     }
 }
 
+/**
+ * @param {string} code
+ * @returns {string | undefined}
+ */
+export function parse_db_resource(code) {
+    const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.parse_db_resource(ptr0, len0);
+    let v2;
+    if (ret[0] !== 0) {
+        v2 = getStringFromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+    }
+    return v2;
+}
+
 /**
  * @param {string} code
  * @returns {string}
  */
-export function parse_sql(code) {
+export function parse_bigquery(code) {
     let deferred2_0;
     let deferred2_1;
     try {
         const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_sql(ptr0, len0);
+        const ret = wasm.parse_bigquery(ptr0, len0);
         deferred2_0 = ret[0];
         deferred2_1 = ret[1];
         return getStringFromWasm0(ret[0], ret[1]);
@@ -278,13 +259,32 @@ export function parse_sql(code) {
  * @param {string} code
  * @returns {string}
  */
-export function parse_mysql(code) {
+export function parse_snowflake(code) {
     let deferred2_0;
     let deferred2_1;
     try {
         const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_mysql(ptr0, len0);
+        const ret = wasm.parse_snowflake(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_sql(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_sql(ptr0, len0);
         deferred2_0 = ret[0];
         deferred2_1 = ret[1];
         return getStringFromWasm0(ret[0], ret[1]);
diff --git a/cli/wasm/regex/windmill_parser_wasm_bg.wasm b/cli/wasm/regex/windmill_parser_wasm_bg.wasm
index 45a144132db83055b45b7a905509a3bce50c05a5..34d6284a98f4a78b2f801adbd5ba6b71f666dd54 100644
GIT binary patch
delta 74047
zcmce9d0<pU^8f3eJ2R6^?vV4%5FkLpO+e0c5D<{V1H9!>JQ5VSymf-2prV2gZB$g$
zpsa#|K?fC;OGQORMMVU~6<tJBTv-<vl;5Yi-yA`9@%zsYchj%CtE;c->guZMo~K{P
z{c&6Fyk0(6l>Qmxobv~4j^6B;=`akZ%jr+^`kkC}hr{7B($X?HMV(o`Y?s4jxSWnO
z!^eG$JDpBM@gH+I0qV-ZABTfE2nl664TBO42Se0nFqZ+0UgR3iK*-_u`+2$%B8Xg7
zYc$;fOh$kkt~{rc8wNwN6YVk5T=)k#?(n&|3oQ$B!yBMF8BkCL=lS@*5p)^_0jJZ)
zgF)27DJzW|oO_Y!O#?=>#>u@dPG!ARP_+<=$gq4o$LB-$dC+0_tk&ENQ(N^vG>86C
zP3oVDaj$hTpBQcAX;+M&I&I?E3FD_-Vm!gq?bxLkPnj`s>NUpSc&1LdaKhNB6Q@m{
zG4+Cp#!?=z6K7mdf8hk<NgmYki>Hpi;*u$ojK{fOCtNmd8lsC6(Q7EWBwowpsowDy
zOqvJ`k6EWVTBkq7eYzMyJ#Ec)v}<<@&l)@SstK1~e&NLvFGmZ;PntCO0^<Rmk&=4R
z)QJ;~!`A1H(rAO@M|LZJf&IjvWN&l*{SL2wgY8G;b{=Ct^H2G9`+GCL;UV@p|Aimm
zpYe0=<p1Jle$969HEb(;kH5>8^Zo2T{wrU>R<ND?^7r|_`7``uHj8iJck$KiApgRy
z;5Yt({T0<U{)ad5Rd&(?EczUOlx^pq^OgKVwwXQ8@8DnZLwq0mmOaNlVt?=$K(_<i
zAN(c03x8)iKIc36i}?D3zrw#l{AIqHTl@&0%U?x&F8?>%!`ASBv5)xQ`3|;%|H|HD
zAM&qx^ey%*|DAn`_ERS{(%1NIh4c@;j(-DW-!YA9En<Y~eYTZ<%il)HKiD?5o_~hY
zH=(&ZQR;R64^>v<+KBJB?1pSW4wc@^-r!r<C;U794tutoA7Q_-kNF<H6Rr9W`nHMh
zMU`*z02`O~X;bD*$Ngtp54fsx8`rEiLi@PkHw{r-&AkYAue82#)v{--3isJO-62^6
z>*z7lE4UGHSueT!^>c|sMtwT>xKPR^8X7hlgM!6=lZ7l+$ZL}SA+x+b-S1-Ye-0{O
zReRb+UC8^&7+w@{ivJiU#r|WAEQ&aWJ8MjbFzdr^(}^I!{9>KXU#FqB>)3V$JuK)U
z=sFEu=MOtfZn~@ag$Nwgd>jH-H9uDeXPQBii)}_-=qu(F&alh++H*Gh%IfFs#L}$E
z-dr@wQNaUYF9lxUMBofNDKNqgQ4n%Qd;^^|!impiG-5u}Q_XV_ppp;*Z#54fKm)u8
zoYmZk0PQf$G!dwaIE4N-eFTt3F((3NU1+o!6yCZVRTF^+&9t`M*@FsN`MzltE|XOm
zZ3UZx+D+l5SS4abVV56WYT&)uB1WCGp7RYFVKIy$3q8XyBNaRpMq%oen<KS?7eqV*
zgEWR78fpZCf-GSAO}FW(t27Kzb5gKO$HHEea9M-WD!g%M>&mo_0UZ%6jDA}y(~6?L
zpdminu--7e!V#Lyfn8BTAj@x}E;J)vJW-i9Q4^}5;yaE}Jmg2_u^XFOo?FBG>1_zf
z!qtCn18Vo^eyZ+T4gNMBP${+0dd6Q+lG-#LXz4fOs3SzFU;9tUbeX(@H!{!x!o@7&
zv#J8Uqi%G}bc^CT(?jbbjb_bFbl^pxX5LNHOo_a$qk;7RWw=F7o#|-nFlb`kRYpnJ
zBaCoBcrZmiOlQ!Is6P;}SCXEsOf`vvF!7aPm)M6chMj?2>mPw!=Cghe6m>`=YN!Z%
zQ5H=Vi&>p8L<2kQH<03Xq%21aXSy{gSlQo&%Fuq%5g1p!pfDEt&5)=<HE1OZqjwI`
z2Dx7+a@_;NSOQ4;{yA%9a8Td00BFw<_5_?1_yZ0K0s&5e56c#TmxvSXF+-sJD#M^E
z%YosonAI)4s)bJ+VN*nC`qW5SZ==1*OiwSP9fCCL+Vu9FU1FK;YZ0)Rp=y3T8rW+v
zMqLq?jhTf&_Z568!)pE{y`wLUVyjs=!%EM{k7DfA)MW-T{bCW&g$~oQ<-(}OOp0wp
zFI*fp>NGa7gFqyKI0WluAfz#&1q99(H2k7JT7P>?Pk~=FVsJvg13Xad7pq>hBPOqH
zz`y-RUh{i<@H1N)B2*u7ThC?`4OC3SX@=GOYmUG)jeuf6I07*zf&@oMVF+%UA-JuK
z(0MthQ_s8+uscv6%^DB=Vl{-$WR~?=s5aMadd+OX>LUT+nqC(v5(Raj+fJD|%w-MC
ztYL2J*36bUZqc+6ebMALFv!u(XRKE;tD<h2P2v>^+B+fa79YMrz{nyxBBJ+;%E6#Z
z7EZ%tyG_5^2{1!}5*jJD*qMsmLD-q5X^+Ai$r%JHGf-M#bBf;$paa{tF3l>?bBE>T
z4>}ceI7d}PtqOavsLdQ&6TMK)qSsZsK!<j#5*w0VqZF@WA&5KU%?F-%m(iYhqjXn6
zUb->&Wamb~C(t}U?Lh~?pTeqFW(aG8$Q&&x7f0~VGX$+p8)!OA_wcE-KlDItpXf#b
zj)S>kg|?rDMc2!?1aa&Sv?YOOoQVLt0Bu*fYP(X)MQ>7f6f?63%mb84^x^}Ju4Z*@
zx#Au!YejZX*3bGbyVh%(44X%2pw%^JBxd&J9N`6U1wT2GW^K+X!IbaKDME%jw|}L}
z<~|{mFnu~g<AHvH1BC-T!7jimrsVeLi#A!$<#unmY!j&a5s*3n12iDSx3B{w2QuAC
z%PVZ195OU_lTjC8p?it0eqg47jhv|55O-KZ^E!fiU7OcF;|^wKCp+o3R^@fUX8e!5
zHboYred_4>F?bX$Ynxx%-X+#IVNyUHSe!QXYWlLLk_+Y!=QxPzP0jCi;y=NYXjE!<
zVs&ou)0hIHnvW8|;u24<N<l^|-X>NX8JHcCtiAbd(iMTY#CGFk%)84fD=3J%#ODx*
z94tV*!zKQJJcQlYUJw32>-aF)Qj`OX3}qcQfHwtzx<_lvA-<s1AdCbQD-5)W<MC40
z5K)W4QFB7PObXgT!8U4Su>UH+Py}KFZU3%85Ss7>i2$wtsh~I~zV*Kr9U62JTc^#j
ztVJzoW<ra$QJ-3srmsE%k>$z=Brak-*h8)yiRA)PAgRZ%nBH0tCy7=L6Os=V^MjY6
z4<5)&-q3bH>v|D*!{9M#GzwsNj_IIAGwm==SAHxPY7ilHAv@4cIP3L@Ts<X%CIc8k
zBk*Bl98)5WqPii$Dtu#0wYnAd&T!G@lSZ^dvRImRV_{wv_GKeLs70u*9CAu%wDm;c
zurf$^VV46e$8?PhIzanT@fE0o_KZjx(1nUha(vjDm1ycE0m4h7sm~Hcg;B~-QmA(r
zh5;FM5Qsbo{9zB_Sj<e<AZHXrhAlAkPp0v@%rv49bQtpi0l^7Q4IvV>B9+xe(9)%7
zzZ>h51W<58BsvFU^Pzo<Fpc(`IcSMT$4<1qD(ckn7fstCfD^yR4x;vxTE#h(1Y&9d
z#OTe6(XpE1BGBxCEm+it7{-N#upRzk3=VokcdUh<o~N}C$gnf2217DwkMxZ?J>5=k
zJvitRRY;dQJ&2y6!!FZHgyAyXae<N|o_d!sNI>_Ru6n_ToJ}hPARP@uyz~+yDHP0-
zHZBiFVi)*rXdA62z1!=*iZLqcFdd<JYDCWzD5~ac9EbzMes08JwWw`ponPXPx|Fm|
zq7iLqF39g*h#=S~Tv~qj_`{h*e?+Ms5EJ+|_#i%6y>N_FiHE`9*_3d=^g;}9gq=h!
zRR(QZE|9jG9z<yZF|!mn1+TLKqS)dQcTikG5Yx4RoN*wM2{CI)m{0=7oq&Ou=@gzM
zOo0vKBC2yC57go$dPkcgK20rd=TKT)VC&Nf2GmAWr+VO`1`=(d2Sjyt`*70H&EzRa
zA(W8#vaGa<jkdOzwqhsVQ`W{yOBNX1R>!gy9*`TYZfj&&yPj?=+)<`;V9*IE!P|W4
zVknMYx-`fRK}&aKS><Ui@q^;R0Z5KEm(_bYWI#m$!08e@G-E`EA;|S+Yd{AicrQb!
zm{6x4Sijhu&_+mwoy?p+iSTY~wAmwyGUHGbONDl0Y|3Y%l4lsl7N|HS{Rxqfv34CT
z2hk}^tVLzpEV_yaC(gxL0Ouwa>Lhl8`_snN39=(jCHvJbC3@RpWMZevA#SYez*69}
zwy|NCg<C*|J0aY)VCmcI4N)RCAqd?}D*?o<<lI@|KG@UOg=tUU86Ff&3-vR@PYQ<;
z-mOlNzC~^`o;Db$v8EuQ2ono+@j7cxq$Df86@mhY5z#!xBBc-~K8ZvFZn5q;)!%j)
zz40yE^;QR<74`vW8OD_uEE+S5hS-Zmh1q7{p%_7@4h)Pw=ql{C-e}no+xf38yA`E{
zTKU0(X(6KQ92Rk)**Lq0W^!v_xmh`rL?uF+l0g*}k^oT%0Rq{I|Mf#_=a=V~xk&6%
zLIwyQi&1YdKrt$e6O_w(v%ICprKr(u{al{ig-Dh-W3!DTqNtBV?>2SAih?aoXQ&lU
zGz2A<%60$Z+2%Tu4jR;u5M65Fte@X>2HiB@&sdkXs$&1NWUKOlE_<?(d@PZK)+M?m
z8Z||fs?&P~KPloE7$l(@Z9h5UzNdA!d^cJV^al#)e`awoC|aWp2Vb;?wQdpB!ZXoj
zS0p|`f~hl*<_BX^ROuG|K$VJ0-CDk&7?>)N8_}zqWR-|RIERDfVm933OJflIJ#xgD
z0vWAd6b_jR!8{AtXRjyh$b5<o31*n?(0wcl={LhKnCX}<a_JNawjIbNG#!ZSQ76Nq
zZeIFtY<MuJN`p|`Vx=8j$WR)ahFf&17imKfewoq&BLzqNOblU$WGND3+==Dc3k}_;
z8j4|{j-$Kj)}{)xLLKx;1)`1+0b*FDX9x}y&?=CK;-Q@zffZ_-+h!3^Xc7}U@M)g|
zZLJ82MyjVd^7kJd`B4xnkg5Icwdl!c7GcKGN3=y_R_MlH$5xe~UyBJLZD*=+Xn!Z{
zOvv@rVIx7w`fvt>_-HlnM7`>%^a8{{5$O|grE{p5X@ViAK<Yx*qhRw6GYzxq5P?ag
zS#s7vMlv%H_tIB{R$|7mBB)~km|;5WO-GS1h8AHcu<O>7_%_TY$7Qdgaq3`92%Y~0
zp&RW?AdG?*2qP#L{a_>lb`r(t`WoN@Ia1d}*_Eaf8wpW%hA>7zGROe4$ik3kgtG)A
zalp*d8*#=!FcDzNLZ33U6sWomQD6u-SSj_*L;S5Y^fShq2@Dd(0$o>XEl3w5L3@C%
zM;a|BB1CMykf1a+v|X!aveXIN%&@}ki?XRb0YwT_d4MXnMz+s`QV2`2F-7GgI8`1%
z2f(dvYTxB#C`htU1@>i94jxbab7n&Olh<7PqclJFRCZ^-Sk;xK<!QZ)Vw$&VYz)}W
zNw*03kaUZRy9N-rtg9<~4yTna+CpX$q)*uj)dL3I=NB7E38AJ^ZI|FzP(O64j~Ebo
zF+S9H2r9J68>D><AZUEb`n|G$*KI@u>VSvoQIjI_fqK8%`bfv4B{20@&Gf<-t;tpA
zVk6pIbqfBLcA)L3SBE}lCS*~Ml0_jX(a5K1rC1tu2U<;1ieaC|kf-Xz(r7^4=o`Us
zlEc8ib7&VptF8AswDy{qdv(@5++iFP)aP{^9#@4hnzMu|<kgN-(40=4N}~|zl+0TT
zb!y0TQvi0aCF3m8@A^pYq_2pNrqU2xaY<7(0!lokcOf1Kdh+3qeF9g?JRe%0h@<U3
zbU-&BNX4A@*Bd;v&w9U8F*d<{oyI!Sa2^@axeT$(JD1h^95s+PLA=lmfV>RRM+tl`
za91UrK}n~Q`>JHHYM-bf^kIgB3JqeK^?qk4XLWI(b)<7%0771Ul>u@9v=#0WISWmq
z<I`Z5iJb>3V?Q{K&kPPCWH`!TsbI0Xg;Gho&3wH)l#uE+vsB-pxCB=q<wXhcD)mK&
zh(%pWnD4&TtfjTHOD2x<KXrlTJU%}KUC*yt5H~FZuv235<~Vy{>o{7l!DegPn{BT>
zB<+w&4K-n4u*MHk3b9VH;EN50=pZ&C2+gB}tvX@Wmy}@b@A^XSH!rQnw1LP42MGo8
z71>%Zcbmc=e#z?4eIQ@7+4{0)=RS>_<J9hi1``A0g-!{4ipU#7PGX?iWz-%6whjUm
zCurrx9P97hhvsT9%r*`ekaNJBNfHp%z4-oDtQ)F_v+dS9)fJHB4pa;N*=tsh9;YGc
zjviH6)@xX-dN~aYrmJFa_vk<{|LH-+PU_h;NLrL<Rszl|URY_(={cIsvA*cp<-B=V
zjcSo%G`ARa;)fLw5nc94XjCwO{m;(152cei1A|Zqk(T9j5Wn~V3QW-+fZjT>a4o)9
z<4@@Orprzk!C($q)9ZTv)=N#jdhciK7OQ>Vo6G;(m_Sm*Xp``?W|Q?{-x;C(q{XKl
zNX(&GlhzsiW}-`<^{ep4aag|or9SFk$1oFjTb=rcJN*vb650yG0pu)BB8f-b^cK>T
zF~KPsoU}qc;ucCv3(dA>_P@F9|0V{ajyJJR#H(*vRW+A(IzDuBqO{(q=>c*0kD40R
zuc^Oi#n`f@iM6LO9D!aO(2kvG?H<rO|4-w%RE?umePU^%yG`ewIFIu^uUbD28jrCZ
zHTXjIqxJmYF1_O80n&1UjnkID8p|c@&@v{*brfc(re3T<sy(R-U!g&53ZInE`2ICk
zuOTl0<<CPV@uja=V~0lC{s?4T>^J_)GE1zjkFBSM_C=5O4Bh2o_gim`n#3M!sy?NJ
zsYpxfs#6EE$E?>*4fC1I`s&n6Foi=;+t0Q)^*%ko5S%pHOTj5)iV;|+jLEZRopA(T
zv(AKd(wcVG$b#KZt&Jbw(IT)au~ns5+s`_aH!QKbon6azTUVX^FgtAJozolNr=HWb
z<*X$e4X~==L1?OiTr}ut1a<>x4KERVy4Y<kJ?DKuUw!VAC~2N|GCN>hc3vBN-+Nxq
z(RTR=mav$s3x_$c5r-QU-iQNID}xGadc;MXRi#4+b4{h~hKZ}Ehy#ypB%LK@0Yj-%
ztjPK8N(mdCZwx_o&{k#yJkWO|f<IQ>`TfQuDkm#PymsT5wR=))_Z(fjBg_)D@3#Ip
z|J*=o?bbzO`(gkZ$4=z4mRSCAs}b2a?s`wWDTBw?up6y8<NIVL8Z-<X%_Zh6u|6K(
zg)dlQ`6d)c7wF-si_k777E-5lfbowoY`1J!5#`L&a1lo1wb+grm{HK=@S=F4N!%9a
z8sv*3WmIlI29l&gL+rtq8Zfb&z6eq@xE@FL0jvE5qq7&&=K}np3<||uYw-m+gBPWy
zub@by4Md@!Y$~yuBFpRug$b~=6j^0`bwQ5BFC3A*m7<$%z+DvCYF%+*&fq=txx-H1
zof_Fs5lW$Y_N7J+QiM_{=YWb>D=*Ax`tU+0i*5t8iOu*!nG}kRc4QYtw%QR26JUEN
zvct}yFafroBD?Jz3KL)lDYDPbp-_X3peChe(G;p-#}?oe6%Ymm1I;->5j5*)B~50X
zsGzh(G=&Wf4P=%g3g2yoFA@=&_~h&Z4+;z+`XH1L!2vewq7I<Mri(6}kcvXlkDl{n
zZEh%G#Xb;2LUQtg4i$OmloXmFFxAEsirQ`6c=72V@{ca=ong}_3`wBhxl62)OTz3f
ztN$fEi*AG>+wLNc1rh3yY7PEa{p%_^V~xB0sSDMFma;y=MF#Y|DqYhrEhF`1bv&;m
z1EK;Y=q{nY{7X-05nm&Q$fyGoi9kXnJXmm-URoUeU&BF-!dOB@PJ@q~PmdRA;Z)Pr
zAFN0~sD%n<WltV)2#0D)JlmdB#VZs7)lS25*5$RLv8RO%DS9|GQhF+mF)EL;r>(E*
zMzW`yI@eb-6=`o-lgjO{uP0r`9=A@pY%Jm{FS`bR+h5*+J!{RsBHOy`@-y)D`sHE#
z{m134@HaU520)ZfZ)ZI}c^tm-uIPl+5z~s&aO8)y4pmD^6iQ4)=U;I<Ad9EevuEYH
z%UHJc>I`ohsiAG~`BxNKo2E<xO!ujTE%Tb9G}1;R+k@hWT2D-^QYhM3ho*+{RWeOi
zTdpcMUC<S(ii)hJX?4giosRruWhrf&e}!o+m|lY}e>^>^Alq2i&+sLogDx-Zu8G2#
zsDT>z{R}EodF5Kff4Fi0jpkJ~G@4VdJ_&zczB)b*&?b@k!K+$M?aREzbU{;#_&L{H
zlB~yTeR)m3_gO}YHp6eto0?aGr3v+?K0G^wtCtY~Z9pf3^GWDwtMj#cF?Pk*^<%GE
z=Ums3&9?5it}XsPe_bp5{rtKM@VEc<x8U#V*I$gkRX6Cr<<^Tg3`G3M4RhG+ra3p>
z%nIi|N{p<)%%p>pX=cKbEEXUw^oZ4}VH#lXZ@3VD|FHj-TeD}@BL4PFU~d|A(|qP`
zB<Q=F{&91uyXU-H@x71sip7bqzmjJ4y}cJJu&%!S1N<F&M_X3VH2sc~SozXLaeS*2
zUq`1|yXHO=g&HkOY@q{)|Faf6BkH&j2jdmcY`e-8ziYTUoWX12|EZ&7#6yg*;c8o(
zMtPL(jo8Wzd^>UA$)HV;g|kU+C4E9RwtubL(8p*q1KV#j8~S%!v5}!I7KqmgUQgza
z&z1QDI!kEt2`+RGNdRKi{tYlyL3hHzP5?_1GFgcl;88(@cMnr8Nt_fINN>x@%LJ?m
z>=jV+61HLp`cX=mlSqMnqnei^=@#l>HCd>YMl7zc=fuXes+5zBjTb>vH6(~)*!k%Q
zsFbBdxvi+%sLaMgr{2|Qww`17Nr|P3^<>kznwdsXrU45dkK(@@<;t!sFG_4Flo)8z
zrqG}&3nSDxuomGkD<bvjZg^di@1|e3IZOj#xBevMiDKf^!RY8KBIJUg6m*HCHc*w&
z`Oa0rP2E`NVrfRBi79tL%VvP9Qib5&?P1R4jN1uet~7TEV6I$O2*v;qv0_FZYd8zm
zp=Az{39XfKj5#_Ts!^O3p*^CbE#@hjW9HQMpIw_4`W^=~YCW_yX~H)wi1Tk-M*;l_
zMe+c0DpI({PbL}EmbN^STWg$Z=Hb8G8zMQQrxAOgZSN+U4$>?R4ARlm#;e*4%ruRv
zoxl@?ZHEfsfbON1W7ac<q3!553Oh*YcvNXJRm4l%g*kx%9CKo(_6Kc;u@4$Ay8|qa
zOZN~_5lx^<bm(;Ij+u9TyhB7^n&cg!GfbGS8t8Cvv+g3T6T7#7BjXxqS;2?1u)=HV
zBEfQUr^Ale69JS@-OOMutkjh{F<PNh%i)060GFRW2*K}60HK10P!F&^a?J~;Yiz!9
zMK(x-M@^uD=fE6}AQbVFH3DA&s9Tkx4m70PsRCFoN{t1D3zm047@-bCot%{3N22h6
zN&`_KGe~Xo5m7j3J)%&AI)ncYDGHqposCa)gN6x}(Vv{qZCJw<rmxn~!(kFa8$APh
z%$`p`?Pel?sgRm=Oq9X|V*s)O`cn*yAc1s3Xqf55BD{o2^^)seI;fY4rox)3P=o#G
z))F6b=+@e8h1C(21G5<j{ltz&Z~D5nb(pn|Q-dtNw6I7~qJqZONaygiRt@ly)1qpF
zGm<V>zUC+#MGPs^<m7fk{Al=8Ecy_Ds|*;mzyYXf-Uum5!!Ral{dhzvYdQLWam{oX
zSh%G3^H74qI?To@pvH)^xsd6H>55P&Hw48S9U>%h&}+pThXg}t2UN}u(QRZ9(n>nP
z2ksr`Xb~L(6%R2@hv+l12sV%aIHocJsa|3{;Dcjg89Pov8;(6lGzaMfUP%gDJue7y
zF-uA#SWhHr2C>%Sc(TkOsDv~#)mdsb2?Y|tN_t>LW|_IL7EW*L*z)lJLPDj<qT)vr
z@KGG`sIiFpF~a0AOJm{JEFZ*7eG5V{QEre!g$w>FSm6yUlB4^ewwcfknm1FuaP4jD
zn8SL2MSwf>aP-vc)gJ+UokRe{J0loBPOg_skU0g1cGD51eb23T*EH;~q^E-o$r*uf
z2h_1>ER@NhJJW5e_>l!FaRCT<9^~o_n^n+;p_m4$MN4p)rv^bK-bcrJ5(gtqg`Q@Q
z=!`v383I8Fm}gHB>^(z*Fp*$DsMW2=U<d~j8W8w|VXKxyTk*nZ2vG3)1(X}^gKDSr
z(oTt?!0rRZuB&z?Sj!yZFVP;@w5hZ9ri6w=;|YI67uF9*m(B-J!mETzrD?{}q!H!i
zJsg)H3yd*Tr-s=sHVYgz0`hELnsjn>wo;`X>gy6gt+<-JaJZf=m^k!DIMbd!(uvZ4
zfcTvp-Rjb@+tIAIb<}{^s0UZv9L}MRodiz`1bxC$DE!HU<p!1E1WAz^>?+FsqX0Y@
zXeBbG(XOK=6pBABGP$)xYnSOXDGZIhc<SS)a-qY(fQD2y+7luS-f)`gIo0Y#9#Mv~
zCMxKA88uT)s5|U&pn#bP5kL<Zgs059&>#><W*ug@f<}8OWFz?HVto9>rCnliN&;A@
zODs%DNC;T*BH)BtzH%5*g+wn3`pgua>M%Co=k*Z}wptt@)wpNY8YCf*7ZbzyZX&5k
zskvbxRn14TJsg_WF>Z>`ZF)v|c(<8u|8g^DmOTgLc@%{ekUR<vGn@PyRP0;?n6pcI
zfY_nhq4|e;(I8)VXt|WZP@O~tv|s25=*>1$K|`TZK$12!;w&oIv^dEOo=P5#U=Xyu
zqOUk9T#OLQJcIzdaR3398hQN@F)Lz%CYMG4)?!Uvf-E3JOIJ^$#WkWRov!I<LK8jf
zLd%piM?^)IJxn4QMY$z56?S%Dt&z4Lox(V(wT3+iJeC*_m7T7L5$Y?fPbw$>$l(?J
z0S~7{4Ud9qZQ?Yb^rqly%?%5nq@zp^)~$C&Sf=&2JIh&)_1>Mm*qcqhyIyh>F8z$G
z5AeLzwx(=Sgs(ta=#i$K^NSt%nIx!UYpnzSz($FqUpA)LXNB%9$jqcIJb-R6v6hP5
zZJls$SKsQTbow%(s+w_cZT42gsvsgV$em6G&W-f9@2xy-*IcM5-Z4TOnCXR6DsfWN
z+m=_5vVY@j<h2K*L|azT_p&>2Wcr?=a3iAn<_8?4NcaFZC6U4_7R|PX+;;`rYQ1z{
zdG{T+QX9%as?@DYWS7^8HFu*dnF}HBqgAxak}VpQtU)yNu9Yp%W~;5s<)!QuYn!}^
zEwe@~e8ateAysJ=-(R1tR;UMJ4Y~0wB6QoV2ktNB4fk0u-T#i;PPyZO?=>Xdq;O;7
zvD0sRFhY>aA1w7Qybrx%p?vG32M4f@R{o-i_<O^m6QGKY;crLl=S63Gs5Wu`eb%WD
zO=LyZ>WAjDgH1yp?!&_4h?VchF5<wt54{3vsK9L_TBkbYdF#nX+EuFJ$2TItJS&!3
zzdzE~`{h^bsZj&0+Qo}nzd(^tXh1MGkV6E(LjGV5RNOwerDHjDsxytyoy@v+NugEx
zsL%Tbfww@}j*oW8iz9;X5z5-Y-K}YlhLdoM9__;NtoI*n$ya@49eA|=(0$tlyw_<y
z>%kfQwHagZ$2lkLN52FUhqtdY1Q8&n3#vE()`$9{yW|@g%r-Hbp$N?HhIsxf>xRdA
zCp)wDvA5Xw*6oi!!2DLL#*`L}Xw37*dudH->{=0zVBJwC(dS;cuLr*zB`9$b&$r%e
z90O#fOUiogqHc4HQU<lafS!tMqpC5m03cDMj0L2u_`q2+mQ<w2#|&Zw>a)b7`4QYc
zX;y^Bx~-#UI8m~@wR=gc<S1r7(ck-bYJ&qqf94ZmZ@fX)%qMa%zV|)Rqr)0<G$wBs
zbc49|Hw5nq4InodOpo2UeU$11mP1dpJZnEiKnd^{&;vUV;-V7*6v!aYPJ}KJdZ(j?
z=D0(5)srR3L0|ObxR&t-<8(=uz<71ArX<I^Y-x*Rmur^J#(ZvCdSWy_A2=`y_-@h0
zO~oOtD8>zLj&qA2+bgCL%svDLD-Ql0J?pFHLF}RL)n9{g5o<9WYJ-Qvr1&M?eJERj
z7?fV74xsOn6QA8gXH6}dc)%XDAk|H^k$+XZ4^VE2gElIhOVx>=L`H}B*-o|I{o7@{
z@iVK>Q^gdV{nRK5mOa((!X=;4YJjc{q|ZR@9_1NQ2Lawqbnn5!2i;>EQFKpOnfPa-
zE;`3+N>n=-={qzan$Hs5vwA%}Chs>Y1PaE?339Cx4BfrOdgAE{Z@lf+Cr`f!#x!qP
z2k+jQYl+q-STk1?via6m%UY?7Vyory-uN23{5<@9W%-G0g2kU1iSM7DDYnKv@AAWv
zk6G|Qrkr5i_)In1E*IDFV(ZoCeb)A8aui?>AZ+t&6}~f8wzjT&HlxiCc5UbiG_O?#
zR6T<r-NQ`?2M5}&oml>%`PRy3v%UKX)&=aFpDit(k3%6XTzJGmSU{Jdt^OAQI04{Z
zQHq)tt<X*H;QcM0q5BliD7L;>5nuu9`xPx!le&9<k5_T>O1lbNB}lE}rkhX&_3+k}
zr9D&|NLwmySIIO35Gm+n`2-G?M6Ic1?;#*+|K}@9qpB<@DHT8x0EWKVU_b+X)L>B0
zv12pw0Kxl?u9ci(#N(8eesmUygcvB!o7Ph+^3i9S@RbDWMzib*e=afMO*Aa?mbJ9%
znzFrbVQ4@%bFEvNOm>^~MAI3_)N}8&N>^o6Z6G}89>*z%!~rL*B#-G)0xaC8F;OA(
z+E7A}^~mxPO(CYWa8+NR`eaold)ab4Uz0!^LVU{eosxvq4q4wl-y`_YvmodSu?Ybj
zEUI2;oi+zj3iT{B$2#wYHUOiJ#q0)A$M}41jeDV7<<PXdt<o4UTO(r~*h|)pF{<^o
zSS7yqQMxAG6IORbGLh=tt24Z72%QJx^u%hSuGd%hNbW$+7hg;AymwwK%GtFGO$2)#
zh|M(*OA}^<vDSZHJULlp#7nek6}<ca3tCMtCpRs*r7uhFTJp!ftkf!4Q<eV`u`-1*
zL^l}Sq(L!4YprwFRG2B-47eF5p6}M{0$xkS7?j2}-IMM6YE8a(Jz;Z&2Hf*Xe&kL1
z#=ZdGF;zMnV+mdXDvGmT>x5T|*|DnvaPz7je&umC!m54sqe#5;z+gb(MXQg-+vBzN
z?cT9F7KEBau`tc0iHXik%?fq1=DybB`~)}*EJuMKvbkdrSx)gG?hP<<TYyvz=XWLT
zhq}R~RW$~zLzTwvMheW|sVMD@;kDspiy&<sRmG}!6_geF#+tOY$ossVX5GEEq-COc
z@trQ&o7?T)Snsbrqu^Lf8PglI`mGxoxg*~1G*v$xh8^T>;1F};IG$ZslAEXtE_Rr9
zljy^5eYMU^Qkif4NhzDChxYS$kAN-Sq97%QzQOD;;;He0AyHy8RS3}oS!&!8Lqg6w
z$@X9rv9}Wh6q3*tJGDX*yuh%wtUuoy@2*w7;rwLl7HwFFHPC(IfFyA?Y&2PS>(PzL
z1!29tv2(vX(4#|qK#fs58SP>aPrzX@Ftnj3iB0>dk-ixaYD|LG39k?C|9+yd3qFau
zlO#8#(0R~{;|{gi-f|7(#n+bg+UwzDGxxk+fpwetMu9iJC0m`}Xu-xd4SS;pYr1Ol
zJC4$3ZeS$mHxtyG#%=l3d3+c+wuG84``}p$N<Qk1z?%H_7so3%`eUDiwXnu+%VjN^
zW^CKWi|<DRo(pn+l#zuA69kR1KHP?#*1A3A)~H{rqmX8xcht#)$O(+}#^iVl0m(`F
zj*ktk@X+^EuuVa0L@Ey_d_%|_O4p~-)P)x1n1OSL)_A}`m~J}5+))E9kq7$%iqgIB
zG}47Sv=Sz*A_^M|JYxwV3)4*C2&}KhFet_-rVeLVP&h~?TxjVEJ1WIBU0g8IH$@af
zf;fmXK3yeIuAL-Z;Vj6NRu5Jea0t*3@epx0o$*Nv5J;C*qgip3szK|>^%q@J3O>~}
zG6s_}kCO4JTSJ_Z{4XKEJ5&#Gcb+_8bq{g4_rmfXS2Ixu)zH`-WX(FrG|DI(g;Woj
z)*zD30QS?{8R~&c0#4)9HE0s)Miq2Eq?}i}6EuW6OJ`CAqP#?*Q=xGnrML~0hOL99
zi2_%AMCfFxWaxm|2FMk+q|qcb#$EORfqP(Bc$`4w1!3MH3f^Q71(|`Ny@DL46+%jP
z0umuI(q%{@Kr9Dy?wlTWDYc73T~;-Qp*?h|$un#!JhDAdChF0T-}wz;^5~|N8$$~T
z$0jVtz$of;gZDYYjHrv)6#Ns>Ox%C>LXD<I9^YiXqk{rSOWg+d16P1}8VuXGfTu^E
zRL!_jW%_jo=w$^jl9aUqI0B(89A4FkSHwp=N-7LMnDGRd7TWRxZSjO_t|C58Fn*df
zP6P=LYSQ$m1en|E)hvX_MCSo^bQH~kYY2D~WF<eXEcbHLvAov2byk=-wHYLzVLe-t
zx8%7#aBXzk$!p}xr?V1k$bZt^7$g|tty2ya$bM%szx?J5@Q!)^aXJ1cRQ{QOI{csT
z|AH#CZa!4eQ4I<v(}_V*wp|}omNtc{{-%rx><Ras4u<s0p)P$vQvtLc1PW0(PGK``
z3M0!wCmeg=j+?a78WDqzEM%l@8u@vU!H$34jsf`l=#B}n<~w)Z#SyW-T!2W$t}h($
z`StAn1b@HSUBP@!o^LiWM7Dg}j{V$p=-bn|d*S;K91mHeziaJYsy}Cb*Ui0Jf4=<P
zDeg`BGiz^8_cr}GYHxAP9`#A*NG}Nuq{fKgRvxZsf*bkB8M?|?^+|0w4O4-1(>okH
z6X4=G*0R0DeAOq`+j~nX*t@sQV1Pqy314rlKDywya0|7Jsz@nkgJ91hkb{X<P;8DW
zV4eAW%K=oij}8W@je*6^^bW&{O2tQ49B}QM>c#3!0k>ZLKA)QQ>Gwm~&sJpLZ4iH#
z?HdQD%HR*<cy!ZFyLBKfwYro(N?TpXzJyKU@b-8IpvD&4;sub$#AfntR-J=+!fYY7
z?Lho)@LJea;o|i<Vn5J6IhVfnQF@S6w`2pQvppPA#p0dT{+~v>R}<bxnuhJKcCrTR
zrUMoHrN3Lt4ixi$e%18$fpo?OSfBl?i)S~4a8%ed;qaRvnx=MtoaC6)@aQ_b5wxcz
zVgic_@wJqzngnix_=-fFV)GJZNxod1h&9jiCi3JLj8(7_>EY}QwkbB2vs0LR|6<ZL
z#$Ir+Fe}z>ELWQuq{D2$6$dhx*p4i*Uz}_s%PdhwaCOAhE-P}Ao0W8d=ZFs*OBfeS
zh$E0AwIfslUk~!IPzz|6s)z>Et}@@l_B+}A66Vu7Ozha@<x&P%SDbd<39!=aEz8#%
z6}S;<;Fw3J>8;Dx%fkVN)08X^vOa8r93Ny*3CQb%s?drct7L_8XOQ9eCX3QpE5t-P
z>uw*Pq?L{?ZkKm#;>GgD9uA+}p3d4L!I_~-sPywQ*oZj%TN!vZV}jhCp`k(wVY?86
z`?*3=SgEv!G!!6OoW!&j25uoc<>W_r8Nl8Pv1+u!m8n`t`Ug2WlikD{8sy|GR!rfY
zS*%EAWwCRPN<0_E_hzvzeAkb1O*ZRL1kVSENbqpk^W%E(t9qPcBk8rElhF6lmBVT)
zek1^>=b^+jux&U*blS4(Bgm$77;0d%*3gr2r?N~z?}|ffpe;5~04QGo5c^SnnZt&+
zTPp`d6w+EgE0V5ZwY6=N+@P!=5qJy0p!>ZXlgkFQR=8mwYSxepT@Kq7!6GJK%VptG
z1-k|269uecYU&jXHRF$5R?dEmwajB>ENk)l4F)`cdV?ewj!@#U^|90QSyu<URn947
zCn5NtkWEK0sE7?^3*`JFkjt&|#UjxA0-0IN&e4h4vZ0to@cno(>xFUtqL^Js!+&B4
zHV}lDm$0*u{8kCOn4(=ub@I8T4Ciu!E|NHNcVY8m-<Psi8T(#7WwOWE8FF}-)v^oZ
zyf7Q%U3fnf?(o-_KZe<z8FMXC-4pf0mo2nR-X39tQ0{{WyOk}IXSQUwmNt{e39^~Q
zE)Tb46SL<1uz@Tc;Iyy{=OAd1)5=*VHbyp<vp(6I_8pbI><9TvIct|bMmwv(JZ^|J
zKgjm2ShupZ3OHnXYVp-DFAYX#AjC#kj$qS1c_V;;xCzd1eC<Bjr#0)4Glql!FliW2
z-~dh7*8d=HY|U=T-mF@7lE%;n0gB|cVI4BZ(7li({Na6abQ?D8xV695hIKo-?5=&%
zS;4O72lmOEDp*G}?zsxI7ty^HtX(NJ4&$p-iV)W^(#@*v(w5EiTmjba30)C;sV)1|
z(QWN5#QeA)gKd8v`zu7}6|q7=$6l{uKE`t8`yE&=+Zg+%1H+AnTzNt#)-o@-r+Cdm
z*tPYZBH@MEb0qZP`r^4+N}2$-l5k;#O>R8k`Xs#XNo+*0IUv3u5r>Bk*7YnEm%nvl
z7r2+HZ7MdQGkDvH$=XTqO+iflG~}KL#RrKy0kIFoNa6`-8(aVap*TRO9+7W$VO<kP
zV#&L*8G%{f)|xnjF8Zc6G(g_ml}+=;RU7h;uAuk@QgmaHgu-0bcVp$JCR7szm<iGb
zK&73J)~_>QK__&uo{;=4=GX_}U<>RV0y>8vHk0^~HxB@Dg@*j98&pwoC4oHBjh%mN
zWpbIE)}5uOE%Ft*Fz66MY%Vay)fRGhcXms%vs0>>g+-a!m$jDdd$2<9TTs=L8b%K9
z!HU>Ad1(*UzSX;ws89V6Z+N^fT16FCEXWsoFf(r*>VqE(7K{;Ui9;#Qkob^4^}uMw
zH3YInPuA0WCk+DCbXHGxYqCZE=&4$C-3e@F-h2X4st=43kU^q0Lg&e>UaWn2yrJqq
zq3$b#lyI`KeX5LF7Fs9A12U!cq_Y2StzX#-yV^SWVJ|j5BVI2Sm#VO~H|yK1^`&x2
zZ#Do_@LlgzD#-4`Dib}iM!Xc3m-Jyv_4wY)%H)%MSyHR=XEkHjk!1;EkfM_X_7DZ3
z<1<3n2D8Xy26b*h#5W43F07o;I;PEHAT12MB0JdeY<-x#q8}@W#x-jLgF!lO6C4O4
zJ{d~$WOA~?Y4s8E5?a5YA|pTU71n@`w<tPBd5n~}iQ48?YAMoK*;wOs1!<{=%Ao5D
z<j3`J0KwTiQL!xT&x$G%Lrn@H)gP#}NN0FdGv)aHtVMr6X}QQ&o?J_D?GX9*p#Rhl
znza=DQKF{~>*v>V<h%V@HY<yL)t?RJjtc`0`K16a8&JzmU>C|8YOy>0BAo;9T%!t3
zq8BE}VW7W0H^cm>uIlTni7N;2Y&qmaHvBkSS!~sbkb#1mzrdJPhyw^h^W=cRtT!7P
ziw<V5Gk)MpIcNwQ9a=yVGuh9@8iLvvdwK|amvvmd7ZD}7!#hB1O2qIohv~u{0F0e;
zND;EOsjS$O!`MB{y<;CrZHx6Ej{P!wAtnq87h(zY028LCyS!-xYm;PRD@U-lNizTY
z2-Y$g3yx%+s_v&bS5{4oG_7%{{*?Qy8gAQ6xtM^wSl75Oa86NI8n%K6R7M~na<GGx
zOi9H6*fo-!$GXaXqgYWmu3U$?jUd1m@I@{ty0xLM^4d|XY_LM7=73Ju<cNx+?`o=1
zu_v_|;?Gi~r~?ctO>NuD1PO*Bca35bbK;y!EgVHwp)z^aDXg_O!7XQ>!cHuHl}e#S
z8V&;p%BE3-Kv*uXK9gOSwHa;-kcpw?j(cQF*IDf1*7FxYB67n&dti{*x@;beK|+Fx
zV79#HEY>r6^F3O6;z6&tl}_WBtXzNm6Qy4PxbP`ta1sy?5wc|T^LP}x{+sOLutG5L
z9@>UUqc&s-?P5em)0^fclCu$gB1+{oSauu%(tk*nCa`}~8*C^<H>MW4S=Wl>L(Op?
zXdXQnF9d!BeunpjX!N4mjXmB%vam35Gl8nxo;;C(7yIn~0pK7NrIKVk$E{Al$D_78
z6!mo*8W2xL^vCAW4^=b@B*8Rzil$&+o<v8_Fsy7IJ&>%Mavw}$rRYn|f!~Yg;sFhN
zpp?Q^?4<!l7v&r0u*&E=$x=Ze`KWnxck}30n|?TK^Rw+Khjt3$1K>yy=L4}j#)(1Y
z{6X`luGG2{&4A|0E^VH`#4Ym^V@0TLYaZPfZ-LsM?n!jYE$5vFF8bQJti?rJPy`nc
zFr1D!Vp8`r@j7MrDT606l<{^AWe_Pt9T@Kj3=3Fc@#@I4lZhkAC{q<yDyEO4^6Yzo
z!5g{<x2x=dfN_2v5)~KFsw@d^ohuid$FAdZm&nZXStV{t%Kqm=roBs!KA%M*iA!VT
z%WhxQq#I=5NObXmhwhU1pU+Byb{1q>+_aJ#&S#TH?tT<5a$$!66QHMz=+-693R6%R
z1W4LOI1oV|jo%Daxu%n@c#<1|x{60&>IxSA$eCkVK@YnglaU7|UE5Ng2FW{UwByk=
zGSoC2dn;akz+DWnTW%T4I+YPTGECfC1-Dig`v{+E4K=%L9Lwt;zX8k9aF8Kxz&et5
zP|<C52h|V<;f=1Zz`{#_wh*1PTTUOxzV$Rx%Nm!+@#9$z+b3Td&)T<8X-CS?ZA@F)
zaJmzi0ohCF?0~xbhG$Jwxu3_g2iZU6ofFsrc4_RU3)lvZaL`5UQHF5O#cTm%`puo=
zY_sy2OIfGFr7N_gpQ9yxym|<4JETF<KX@r#g_<3Ez79uhwo7iWXXm5h6DA?pB^ORY
zWB(~%oP=HJX_<c+yAFYM8LQG4uIK_AF0{#CFJmPmm%aylztc8-kiO_;4YA-uY!mIF
zl`O6kv*>#*{%DW7Sx>J`WF5eTXR!haI*T5V(48w=oj|oI{)K@qQF>aj?LE2Ra`pjl
z{8U~%nMKkYKNWazf%aec3t3W5X4|^Q(_AD1L9NfGR2h`U0q3M?bBKmrFv?=rL>YA!
z2|XhluTUz1FRx(9+xRkL3j2W{d|Cc6g|+0HUzRPWvNQhAx8>ziQ`s=jMOXr!&_(j_
zR5pCTMd%Uy+Q>&MbP)o&uXGKh7kaZL;;W0$J2SgLvJT{WG$hn%h`@&s>(Eyhx<<~O
z#x7yA<-ew}D1sT&**XM0X0Y24te?R~v1?-4SF!;PwkLMRH6S9~R+qnB%i17}g|7oO
zx#v7gx{27!*F(?GhRNS=U`yQxK8NOUTkPo@nU}d|?VyN!G0Hkdx4BuXs4z*nuk0mE
zm~=6N78mRW2w+o!oPlKZ&JnIpig8oOh7gANO&O%ne>wqru%lyQIK0`z;1iVw>?9O$
zD60`TU=l*$3@Z><I6yIXI0{$$O2ZR|gMX#r#d|;qeDHrpkOu!@1pY7#0F_1{j0ZC-
zjUaq}5u}H6DaZ)tQ4k8}Q;-=hpdc&Uf`aUDAq6>Mye3*{<c5nW$P1THkRL9kpdeg^
zhYBl=7GaZu!f=>^qHu(Q;&4j}O2Xw7l!jYTP!?{Dxx(vnV4D=c7=<N)XOikMLMrg-
zAWa8;9Rzd`)IquqGAM}F<6N%_X6hhI2iZEv(Lt^b@^p}|g9072&_SUNigZw{gAyH-
z>Yz*qrVhd?h?)@{ZK;ED9kkLxYZZXwo5PeY9tIT>$f2u(#9_K&hlEiK!(srAo&`m!
zx)NjOV++Aa3D#S6WFZ$UeY^_OQI{yo;fSKVNpHBpg0~S&lu)SqQdP#%Uk2D!!S@;_
ze|<Kw3xbM{E~d`LC=NqO#JN@&C&4U14I<wRmCQu{DVR8?D4PNbb&4<9aOYSeZTEES
z1-fqGh(mKgW3JuPr>Zjh8C?P*c`GnI4(n8~Ok_<*>-QT|sBTB1*i`84{qi4Cw#fXm
z1kHn`Ku!k$u!t)8cmo^e{g{NMObAQAHn4{-Ns(+Ls5M1Y4I`QmaJAo{l6=w4K!gN~
z+aS4UiG!R_YsvZ*zjt8-OoF(NAe5w(Bm0$bQx@IC+C-nCRFZ$86r@LFlmKc=`1y#g
zq<k&#V=4uSmMW@Gr%LdnHbC#gL@a@eW?#!`l&SE(naCu+RX~413DFQ$tqhV{s<rDP
z;|@u+DbYJgrqV6(lG7*rDB~zGODQsXkk02?7^K?C_b4Hh+G6!hgp0)RC_T85Y^jpb
zEy~PBCfq>C9Rz0yO370xPO_aqE~l#XSp|*)A|dbD9-B-&LI5Nh4#Y*86iJbkuUHC9
zXrZ#Rf>1|KCiYM@^pKfS(`dnwdVmFmlY@PllKXFFZ8GK{cC;iI>phF*v%>4ivD*x$
zlM;jY7Li-6A&k&uIq4SGC+lpT3Ltg+6j#<HR0R3*gIic>N@j@A;O<=vnVhl7(m9*8
z%Ur2m?0_=>Y*~2dDs;W<Kbs9nDONzmaKTPKFq@suu9rW}W(90=%sU5?6uT@|avPh-
zT3v>-sla1G=of^AsD3XRPaDz#$Lejkl{Pc^<n0VkKbuZ+8R4|HYXsyzDBkPtV8zh5
z&%T3AVT)tG-NBw@d2vaB-WI@U*^+{M;ZAmHe)AV^AlT^lVPx4|th;*wo+w0RXWzx{
z$eyLXN%SGk<bT=Eg7Sw`*dRG|og+^UIh9q&8K<%^>XxUn)(Bobl?_JVK8@Wga5hb$
zBvNoCX%KXU2USRrr}@NzkNf}>X^_hVsSli?&T_|TtZxaqtm!i{ff9#G5<<Fs>2y}w
z1v)Q|@(iyf>dQp-^>{<v7O#R_uEg!}m|vC4!Mf1p@KUM^23y3I$<?PbQ@vlWFv55c
z&%rQ&Qh<Uku*i(p;l-l7kqLz(2>zT32z3G+K;Q>t;=#po12ce!9F#>DSGOmTi;94+
zPdn}Fqc8jL8ht$q;sHr=>XJEb{s6mjs(=`&Jt&mk%z@{}NN|7_8ru&n&)A26KzU?1
zQ#>;8a2y>G@m@CxCgfY=Qyv-A+qh2&xP=eKHSJOY8!h?qkSmM>o)QsQoH6d?umQIi
za?HR_0mOX};LU``!|441_2@7@+HyR64@(_!_4Ky-!E!G-!H{z*f`oSv`NDt?kmQ?2
zUK;S|(WfX{p%||ej~H;AqyrJSP10>aK0knGctJL_Cp%^47*<T%glatvAuh@38K>D-
zw^|W6<ilsM_41dySfg*vo9m1)nAe+f@!f1VpR-AZ=d*U5aOT7wFBaj!&&_dTH6HgB
zbOUP6rgg^PB9eMsv?szoj8a49u~O0awum@r=;77`RW|B(ibnOK91~04UT2Vx0!ELX
z+VrXomF#^AP;8=V_Q|F5SWDl6b*fGGt&>~lv0;4wI%-q5oYa;;7Y5wOxpY2oY}_E1
z&Bw2=yuLwhn$Jqy8d>anl;ZBW-(WT09c#6Kjf8z(&bXJon$TZA+50}mSXlOvuqB4&
z0?FF45%N_Dg?3n8ypVMm7+0)<Nkbi|C6-Wxbb{zeG7~a38K}1GR>vcb85C>jdj<Z$
z-no4tYwtclYR_#k|NRi+-Ls&+29J600d}u@f&Q+3kkz;w)pzXr2hs8DS<BWcyP!+k
z1@UP0({lSmtTJOv&{as(tSo=~o|d@}<Mo3@%jAfMF$##+J<NV&A$is#Y&knkdKN=b
zIzv9N7&_c$)<<G%&Fqsg*Q0DK%hj9{+Y-pY8E2faYaU}+jLv3vK8`hqaK+<ndg1PW
zk#Q342>K*Sp5|g7(n62K`ZeNrd5%+~-1Rs+v2fQcx@OfJ$sVNrACL@evG~t879#Dh
z;>dcM-3$+=`<`Z%#r`7f^1OzmOl@?)n))SfaQNbBHa-;Bs|J1e@eo{ekRz9|Ww3%A
zUdFCxedIOES<BW5wLO`L1eTe`ht-PxH$gnH^~*6#u(K?Gmd!y>y@E|f@Wcw(#!Wdt
z#!mE_0H=o^<;>?`q^?@Y=E|BE*xF|4<J$f2sl{Bcb21W!Lker5Y}Ld%0EK>2Ql8Vq
z9%KFGA5H8=9TdrhtDq}S1t^lcSFxJ^V@1bk{tVgf1(qk@dg-V>43($GSnl!hZ%FOP
zG4RiY8d|)7j;NqWmc7VY{a**`_;u9kI#h71I*vp6v5YnB6Aop}x397@^LKv$ez1==
zSUPjlp@wGapK|nT?9EUkWs+q?tWsdIaxH7wC0PXA2RFgR#st{b=GfeEY%|xgC8)8@
zI@UcjD*?SgBb~I44RRl#@4Mydb?mI<)VEj<+NdGg=q!I&4_6uWtq3GX)@@+9%|JDk
z9H;j$Y-BZfSWt@B(fDQZ+D$ABp=!}4_5jpiHE*!;(Bhvq=tr{D?i#vE*1yGWjs52h
zxb+-WZm=rHm);_KzQtOG7T;pOuB8iJO$B$r!{em4+1&`Xz0EctSo99tmfi@PyNHNQ
zWO~1u%bPZ{>w^geDZOMT{qMs6=q}mwT{w2km(h1w6)9Aod6&)7FVoQ>m^6+3-eZHk
z^VQQe&}`oM9y2qQ!V{Y$e!_r&<}8W5`W|b+_}yz`pS{oS<V?zoKV+pt<w{)9!sEqQ
ziOwrU2J~4fC0nI<Q&O^2N+2aAQ>BFBDf0af*-2cklr27j0Nh2c`-l~5^ez5`zT{8n
zi~oea=qU7Uwkq_oDO=e;c+n%+0wJYBFF?9mi0Te{!In<4kI0dq;rMX-r>r`E(Ido`
zaRwltRFa$k$U?8jKK&Fb$fI%4rb;i#;$Z=WV~X7RIp$8vl{+v{d-m4SK+&Po9w?Op
zjSw+0JqRiVsv@M=1Eo@+Lqdu@P<!^u7CX@sgcs~&?J-by?_?z!J(NaAp@*vIDD==F
z9fcmsrDo`Vwb9pn!G3TrehzxjL$R)3;=JQtp(1klE+#!|)i;x`>}KD|SH5PJJmFh5
z;y4Q@wq`fGfw5`wl-<YO&Lv>?vQy=&Uqb+x{?|*Krc2EDD<xt}zGWxy<0!3ThxagO
zqnF9>UY6s4hm(3_<36{;DSv#Jx#f>z9e#Q7URF?vBNJp+5`f8O&`dZXX{Fg7C!gNS
zJ`FD2f;HS$Y()Tr^WERGhr!`G>|+<XcT>_K`M^GQmd)2<zwKjPJ?<5+Vn*(kT@J9n
znR7POm@OWoBVxeJt;O|ydLBgVdUmbyfP?II=m7hM&)FdV{x1lJSIWSztTVeZ*6&v~
zgS)rT4BjnYJjlLv?^55fCBLy4%b2-U(0v+QGz8IyM#}m_>{2fh{ZRUzFLxYbC$f<;
ze3-R#pD+IKgqghIcUBOaaG2#WHZpe2@9f`<y(Xs|!AZHVy!{9(<$r9K8H^X+Tg-ih
zi95`&3YF3wW(V$aLaGRGdG`_4g6~Vhn#Y7y8g=Y5V$bG#2l8I*wR;<Qj;k;19{k?@
zyu?OOmV3;?_wM6iyE*>_A~t~W=N#@mA43ehTOM-q1?dOXH>PlblX;_Z#~fC0He?z)
z2GSE2;0g3@1`J>oyc=l<@k%@n7YNEl6bCz;T5#<GtBh`$8=*-!1hXn59S1uK1Eh(j
zf~rKPuvfB^S&<vkD_#STqi$n4QGDPc19X%TpVAx9PtYk%Anq}cCXjxF5eh)(R7A%O
zfeR`DDCM71DgSU40}xR9A^!@M?@B8C0IC#z3Un%+d(_Xn`NJ+j3UZvFqf>$|$dmMD
z$q=}(a8jF#h7f&&G17Mfd>cq33jRqi9%5gCF5bQtZK~g6Ayp^lSobRa>oO>z(s8{E
zJw*Qs2>|z0k~$PrKP9T%Qs6nF?xKJpYb9%POc{+ST1(2U)WT2*Q3Yb*FZL51CMUwi
z{Rcd|M`ub{{8C)($-d`b=wyK?KyU#+Na75h8IL{f;(x>8VTl~$;gcaCzv1B*mc&JB
z7;eaBpylGYWGx4Kc?s(-Cwln_xp`!v6d&2H4P@Mbe}ZiC@?mBiUU@FyFo_Ytg{)9_
z+MMWD_vB<R@7N-boGy|Gz*`u}<3MtekB1|1Q62D<p)^Kxs7`U^`J0b-O<ZM`yM4SH
z-~XH}OvB642nVL|)A?Pm$_LYU#9XZS3kh?a27#=Jq5(e+;TH2K=aAf)#_Qbk6#I`2
z_w(h9&5?%!ymj<Nv<dgLF}$kzYJ&~+)w7Py&`q;XXb|8DqMW1X=|}i%sO~5&V#=+5
za_IyKrJiAu2UgUAcHziM`gnt8(}_SX4)RgmQyl|!<F}zsEuA{l%?XoZ0lKl1)1c~e
zt!$Of&t^@sA)Sw856dm-yeI69z6}1%@%Dy~Gx$<=93c5%CMO^94Vj!AwKKCg`RtyW
z#ryDmpUZh!ygj08viPue`*schQ^9X;U0G$&H}oweP{Uy5qTjHhmyp~v!lCW5b2dK(
z#Sr93nawvy_hObKFVBIG{51Jf4nN*jEYHd1wQPIr;am=xv{vrO<1dFAKNj$iNp~2G
z!|CAtrSi#qUdj=^nU97b{5hX5r11R$o+n=`;4TM2{jGqP+o|_LOEIwp?|@)I3qA<}
z4)xUtdKRL(+48zVe(;#K1X9k~wuFnNRm6vR<4S1xZ4vJu-9e9qD3=LberMvVWE7ew
zk#L(J=QO3!PBAt>y(_*Ycx4w*7hYkEpai^0j)kj!2{T3guHE1g<_X%H9I~;Pcl5^n
zgXHJMyhX-Apg3A-Eupk7mfcGDgP5ExCGb_9AXhxYiy?o9OF6D*)4l07a#|^dXuJHr
zj+dIpxK)5_G9YSDHmzm()paPpUH*YUwkYEj`nz0SRL0Yr-}II<%lP8lld*Ll0lORt
z4(Ao`8+9O<lVhSAcBWWaOJ2wva4xeZe~=qHrJOHeEF<>sR(vQzS=)wxa~xuhrMKf#
zQvKcNj%(82%|Y(L+TRWD$sx=3cYCHie}Hw|^G`5h`+kc<98ARiRB8@!>_ahKY75Rp
z$x^!#u|JjCud*acRm#V!cx(P<qkN}|3;sx>Oz!|1ZETd?I`B@x+wl7}Fs;&?l8YPV
zlnxk^+vMC1d{D_ljq6A~hYgwZ^qI_1fY3=o?!Qg`)Pc7nBt;#0YeHfqk&NibyYfwq
z^5%~GCD;$tk4(@HV$iQ*I8k(DC%!l5Y|MyL{cadpE2swK4DZaz;t(%^i<>%qX=i>B
zTN%sf!f#|D?dVNXr1lDz4|U~_Gc~Jka`{6q%;Qw~Ob@=~IMXMm^yH@k^lyFmc=LZt
zsN9H+>kjV5PLV(M!jGy<`|J3pDg4K2O01$Ue*PG8^@aWTC`kCv_d9;;ukMf5PnYlX
z=i~nx_T?J;jK7Y3#$UlMht}|+c@4AID?z&!+G&$t6LH-N2^lvpYIte-oMax-VxQDN
z9*{dm^6Jp8-)-FhuBV7?zi)^|M)A?C<$-6lS4>drBI)f)aTsaZ*_3{(VJSIC70BmK
z!4IE*ARjrES63~geL5Y|KS?SO+`Ix?^auK<Q1!_+oigyp3)=`kjZejiYQ|~&R&f5q
zr|}^){DVgGQUnu6b20(V9nH(3%vd>^-xXRK*J99PXi#a$kz)XQmArfmmjHF2f&FZ{
zJpBy*DOghFnfxZUEcWb~8tZRoVJlrGhn&r;fbOcZ`Mlf|bRJPjUQdLx_#DC+>wOMi
z#LA9Ck#hS;-ZNtx6r;9rB3*1*91D-)WB&h*-)Vng{06J>%UBv$=BV+zMUEJQD_B?S
z;ajeUZ^mC3zQJnva#FCxhwm0ybPl1^qj#JYA^&wQAB!z`^m!Pr*>c%=`~zHdyYYNp
zo-irMr_Sf6jYtYwF7-GB&MZMZd#hzJI<$!Q>AnHnbc6JE1ZC46NroO$IYZPlkoqyf
z;Qb6aY%CA6YvpBQ`Dp_`j29%}(6v-dT{^K<)eN}fwQGkcg;AM^l1gXk8pq2LUeU42
zaeOXwA0&<YHu>s!ejAvni<m5KmP2;Z?Dwn*yfayQalU|HOs4|a&nC+UC-6(yO6k0S
zPquBr@mvpbXI;SCq#(nSxQa8!Ubz6<<#ALUveiUBvWxaQ<QyhE{OlUEO>w_NI{ZO)
z#fby$!Feg+cqpHk$k#S=`_n&s;Y@Y=Q+|mUtEAf>4mNaj(@DGKl8g8(-oR!1i}`QI
zX=tqW5`HGDInK(%#`C`+<g9w$xp3|4Adg{1c>k7*n0f~nPpwX`;A>x(@7MFZXli~3
z925bjvy;X0kDUzr<*}gM$4+(}J6T>g39nb6F;gb-+)$!1@h09kiMMoYe7(k6`%13-
zU=q*ARn&D5J>-v*cxSouQhpNnTyvrBsyZc)L8u#wJd)>*c}ujop3}WfCBjXp=eb9T
zZN-=I?;s(%FXvYV=VKb-DhvNCh{UlsC-W>~(%Y}#<t^7dwHD+V8Uu^)yuYo*X^Nx?
zJVxF?kv;f>%_lsCTizhajdVU-GX=8DI=OQShZCMWbt;d*%rj#u@0`3i@XS<x8B8|C
z(|GH$1wYj4n~d&yoR9G95XK}tb$rAz1wTdF(O4kIPs1*@Kt`wW6ANuvNLTO{#DY_>
z8f@n@eip!bOvl(PkmIKFXzS&1zh+!=0hP{|&7}GJ?5K3j;3xJ=aT_9vPDt|btHG%~
z#rXy9;L4ZeK`KtJG+-xba(|SU^?o#w<k7y(i4y`Ys3@Q2CkY}zg>0{wCQ1mxcj>Dc
zyi@)hifNA+459LffpU1Z+}^+k%gI;rf}EvvSp?4)I$$ss^!}zZ6p1}}C3aEwGIcdX
zzIheD5O0~us;haMen&rM<`Dim`t=Uz2A}{V9Rf-HVU9zs0hBmH*NHShK&dXE6Z`pU
z-Y%}vQh9#Tof#-9Ke!r)G^p4JBx-BD6o`5vkU;2gMQ;T9f8Z=Fs@)n~<kmoU)bRqy
z^stB5a5y5wUz+fwyfop!gCyjHKtH$!vLewKx+;(DivW#<M>{sCM_Wy|dSwDv>Y?tT
z^Et3Wm*EBLQ}0YT<n%C)sP{umCwO4WV;IVZ1W7JB2citUCBeyMfqY8r{hm`Ey}urh
z(~G*wXF(l1{3NI=*FO9(7$$_+D;y5&-`s^gm=f?lMJahS(2$@bI8G;Dl1MtD=j7YZ
zpX%Rwh8$02UBZ;zui<B~{;@l+f!uPuE%&W!`7q5h+RA>{@id$Uhu|3JnXjC*o${1-
zv7olgwQs?H?WyaqPfn1Vuj8FHt2m)>KBz*^9Q0ew-t>~ET+e@E-^auayoj;g^1K`Q
zL^nB$i^Fo$jeJ!6XN6>0l;7LqR`}&B|1jM5YPNvX198o+pwMYLzT)KfQC@yt${i0d
zrdir0gH&*~&zo|2qg7^KSfJ&SSZ(k*Lv$|HuMh7oeLTO-ZjqeSz|Y7}xj7SGY_#@h
zu}zGwU7-XCoYX;tuOp)LWKcsA=sT&ITXZJr5XIKijL%etAgz(g{5&;tS4yefsTtp?
zjHoVR|6-eN#XnU}65oN;V!s`gc_=lrVI{RcS@I^t^~j)evyaNWjWP$QaYOE1Iv0-w
z=@!|)6sKGCpw7fQFFNx{DoQ2c`mt=KY`BRRc2+-32lEqPXdUAh>HwqICT?J>@+3kS
zBBHdSV*N__&Q1Jc`z}VL71)J+O@VGMXm=k>K{edEh<U+Oa2H$<#-GpfPEMF1Y0Ez5
zJq@S|NeshJc4?dx#TgsO(17OGH+J64t8#C|0#G(d5}9C*1U<o2SvHFoj%fysbOk|)
z>PvZ?#jjdGB8m5b0F?Zt?rqpL$J^lde=hsZ<vpxjy}bCLi-2&{rw0s{=5)Bz=$}vd
zYrgyQhWM&tYLmg+5MtjKFTU(n9{efZb845`Lg4ypmRB!=Hz~z-0ma~c8jr$xg;d#u
z?(bi?U-=qd%3SW4%UgFBJL53=!p+z5sCKc8FHTJZ-%(~dmJwVm^U6pfNH|m_KlS8^
zo8`54@{5nJ5x8>}RGDQ*dmt)3JEl`Cd>aSWZStdA_zw^?*4@e<$(RF&C<x-!9KSp%
z4zHDyL9l$sTKU3kekxzOR^nyCv)Ci@!a2M>U%FDxpTqO2m#!4TKi%YzBpC(<(i{aG
zg5*&-L_mogdCDEUAUhSpE+R+X&I^M}SHg*l9ugufvg2+19KLjkJn|5a$Y*Xt;(^t&
z><*qs;r`or0fmGx9%dg{ootjs3;>1r!0H5IBwcws5FdChf!IAJmo{p#WvO$d7K|av
zg8b1zNVK|Fi`Ee8A-cD)xySpY(~mU{i`MAI*<p4nq-q>8sBxu>)+8E7Fu7NTxp<t1
z8TMtTXe(=O<3stu7n7}(hi>N)zF?~wi{b@alYOSPCYuHbH9B^foeHTMfDAP{3$`X2
zfTUOM!07DVtn1@<@!uj_Q-2GT6kJE2Grp8J&f~>7tMEKE1SIU%@i(+rEtSvA<L!Ni
z@4#CB0Iz7vnRoN-9vf#P+8(Wi0!2NXy#=pq>$^OS$kL_&$R_k~Hn;&joXzlXwtVMq
zeg#`4`^>|8Q9Evx<LB{gw|*^KUOSJQ*$19Dx&a5|@_D?{JNGtJSp8qC--ztLSUo@R
zgzP&H<9}5B+vh`FJV*NO;op`W#*e1jkI;~$Bn}|n)-ZY)B%SR0Ql?wH4PX16>|ybf
z@f^i0i;pSY_1yq^9td8M_yPCt@eS`1>UkxCZQsd*7C)iI7;Fn<$WkX}@^!_zl+Mlr
z<j@7YlYPHy+|iTM+^CJ|Bky=BELMLC?t|MbzyS^lO)9<esdBbZ4!jPMIrJ_wmHGZt
z`Qrj!P<_ibK){<J2?76O1@SQD;Nnd(2foNE=c#S7&%L~$_!WYHTSXEAF31XE%Qkrh
zAgaG02;A05LXZbC)xYmg*dZ^eoP$s;pls2tpB-Hmyj?*okU!tcTkt18lY#rtjCBOq
zFSQb!IuziM&twfCs;%vS=#~lr!-ax)lX5Ckb0D>-oL{!fyQr-E{OD$Yy(@?%l+&#H
zG^uJrK9@UCmT&!B{(2wp$rpYqJ4x`~G4giFM^vx)1O<D5DJ-UsJ@})E_J7Z~Okc=f
zg{|z}g?#dHgyGoP_w#PJ+I0&lYGMl>;Gtt|B&12DjbxkNNH#pk>*xg4aS^A-q2=&J
zd<=zqmt&DG`AojO2&}BH+_#8#;+q>~=|kY(2o-0t!|ctCNgk#+6EYNM+T57nOh|g{
zA#kSMj}mA44i^f)dzjbadST@wygU0%PI!b@LMXrc5#Fc$TQk?fJsb=iPXvXYV(?ox
zz)WFA4?yq5#k<Hx<_=`emB0SK^1eJisv>Lq-m2<O(w(KVuY}u4zyM(t!X}Ulf-Hi#
z;Vz(nNKh6T#~GdJfH<O}qN0V0BPwFh2<QNfvM-}iL6Jd?f{KC&8a9oJ3i3Ut>fTN#
zpztpLe7`qPU3=YHPMtb+>eQ*H!CU!6UN8@bNAFWU=q^?}0FT-M$hPy8QYOUb`MQzr
zCQ{)SFAvOPqmgaPGdS^?@C-}!ZKu4@=fuk7dkb({@sNDs83rxHl;k2<*0ZQzjvV|f
zJ1c1irKQDwAF43Tl+&JN&`&0JKZ`o-r8ww+mV<6rrF43ZX$8J{a_V#J`rrpID+WL;
zP60`fsSyJJvC=c2K|#OlHJ^>)<gc6$))P54&sR-t_B@!v_sCnGXYD)AP`ezj?IXoN
zbiRQL4+cF}1TxdB1;x#iHa0cSv(ETHU;(=eR^kijf>#%?)YyHHYEe~pj?=zbz@U7Y
z5)2;qE5$+QG!|OAJ4G6@8IES?t#UjKf;)Ubl+diK@f+@X*mo{DDFYn{os<C;C3y7M
z_c<BliAwC)9+JCXU^n9H7`OsCp^_yut97b}XLWQHNRwmZ0_8K6YIAqrLbU2oB}>A7
z&nd9ULa<?=#cLsJ+w3rv<yU&5|DdeT7b*zwyvRsD7+6ctb?_o<7rTdYn;7FIFR~_S
zy49dJfa<?;W4=I42fYW?F?%V7sSbolit0d|ZGjANI*=CAz(ca#OKcRr1#VZKeB~vU
zoqw9K-1ibzj!$HE6>HD0V<8!OOF`Y(Dr}uqa9%(`y%*IZVGV*zC(XM$&4DU**B>E(
zq(v;(N2=@<d*cl`W--2q`z(vut@y&B&8TS0B`m+>lWAyR90n4%3#OUQoaOGE-A%D1
zyp^D4%;Y6FkorU(dxcrFn%Pjk0?neRA+rxsN~-2BOVpum<|}Ftdc2~J_V0TI({R3A
z@e1ps^S6et<*RDUkt9#v_A1Nl*I*-$B@?v)ci64Vck~5Z9<me11;#dv`i-Ijh)P0~
z{NPpAyrrIETu(9HaEftfiUAP)frAj4#`_qFGGi%(S%%7WOL5*ZSzfb@%^Pr95{&kR
zU__0>c6*&me9)Y-H^JXR6Ccc8wM6z?&UzK9Ln&<gL2}r;Xx_9!mBEYJO71HBfK6Gs
zoShS+4qI2vm)|aD-Pqds@~kk>`1<+siZEgO`SQ<U*1pBnz^Wd5EpRmelst5|16(0R
zRnTh_M6d+t9QXY&E0$+3a=EmvV<3?Qo?YYse#;^?5GNKv;Nm*jYB6h)OAHnbJB{%W
zlRt&o%UL)}BRNrhmPU*$&6%o_t5&d=JJv#9Ble?ek4X-IF<4B3_NrU35mNWh=aEa@
zKi^5(9goYWUSrd63TM5}F8`l%-Bn>1|1TA`;&t{y<mQ=Q-|KU4p8aVhEAip^cf}&W
zefF1D0{uQB-&@I=w9xm@0LgaajbWnznZAk*_wJ(}`BnaP6)Q07<WsBIS%K<Ech#uw
zlG|6YA*^<@ELzP914kpVGv1}nl$Wh$y)xDUJ&`aBkbeEZ^pI7nSyPe$+ydKWnBus{
z5jG@Vt2Eaj2^gk-kYv~zHiK1ekh|8fcIw#PJyCKGfn?EI*0Dj10z^9MAHSA8=3ff3
z9CN04Tws_?Scjd3I=xMm53K`{xbt&awT?ZM&|u=pf$Q1WwkMHWCj~Uj^u>A{>eWem
z1Dn|u$F;<|VRj7hjWIoEAS5t{2Ih=Qxv$%F+~I9l%uIxwQ8BGH(OMM#>n3nI%`YYF
zjp6=pu<Ic__pyBWO-;kS^ClZi{+w!TR6xV^sb=Q^TSD1o7hg4DI1i34UX)v^vGU#{
z4_1TQ>MS|ey#+d83nlSkR{!lSg@K=VOJQKJP)WEd@oiw>m9qQWjAX3TLN(`YP?{^{
z!nf60gmiiG$G2H#qa&D{cNoN>h!dM9|MCuGqCSz~cTl5`=yP1v=;wD-jdC`t8iAf_
zk%;+@o{ms<3$fmSICx{TIuyd{Q<$S}F4E$JiPMOMTe2nc$?$z!7=uz)`M|sEVl!WU
z`7V3Z+$3*%4~@!~Z@kAkjoeInV{2(FcYVCUu=DI=umZCX0F3AbJylByNHeRwGm>;>
z#0ARBo=ZM;6{9K=P7`RA3YS-JWjB{L%(2f^Pir3~m-;;Am_Y{|s-!vUsN=EsS;tmu
z%pfuKKrVrkhd1}sf{s8SVf;fN?%O+oa`^j@3%Fa}|31#e?v~;AA#`xJ-1$BmNs!TN
zn}(EYwy}$g=6`JCObW7oC{xhG^(Y3LSKQ0Q8h~@D)&^i``!=@2xuYhR{f7<8siuQw
zdb|hOhEg8eeQ!eMY-d(W*9YbHI08U{pbH?s$j~+ip(v~(fGtLCXZ@4=1eJb{s6*)0
z+u8WQon`^)#L)t&JTO3Z{eTVmpJVkmKLC+k6~+~tZ%y+vdEg_^oIS(-8U`)*RdVIW
ztfyHcfBBf@rF?E$2Ht^z@(EahV3J)Ui$7s`*G>m;C^oK^Ch^)c30j^e=%{%H><Wm7
zVFLq~mDHIVb~U*Y;j#=xG|)4q#rlw>7`Fj|e-$C96WZ1C*-zNW#1(F^h5p+rlXtL(
zuw!~|2Ts5i%eP^9=V)~O;|_Kmq${u3siZ3x?o`s1U+#nui7o&7DZ7vD+$Li_V^(X>
zU@<mSzGAlEMs+L{jX2K`8wIGcR&Y(4F$Mlr%Jo06)YI%a<z1h#fu~Dz;4{{rt@w}Z
z{5i;w6(7i3K4-o1mexezU26pqb}f|Qd`NIF-~F6@@8~FzZ|-87%~Co03)ZF8o2Qxq
z2t0WPyeWVBf<4^|H-}E1GIX8jq$yJ^*MG^b$*G*@aIowZja>5R9`-P+`bloy4I=x@
zdZ){7Hp1*CAK%T|v$_-i<(%DBPQLT0O>)a_mVJgFt@(=mgB|@wj@Ziz{hOcx53??d
zmdOY9vUaHz-xA;!(@Z3mF|(2K{l+Oz>}5FxtB?{53&^>Tv#ZEmhabhWpfgItp7X8j
z{x!S794Mdrnib_$9RyoLKhvSu<55IIAG!N$*4euRDIoH1?PD`C^dblxU?0NCE?)6a
zOQ2k{518Fq$$#0$nmqOmG*+$smi_HC3oOmMKVE{F{B1wW#9*xZmfdl>v}amccU9W|
z93S0L%SPvKP?w_V@d*nGb!aaw>^M@i109EfJLQR5_AjElmL6bM1G-C{LMys!{{dFv
z5=LsoryK;}ff#z>AZyDuZI(3$SxL%UAd|7;GMwAmONnG&DBn8*e$~I{%b|x@4%;+e
zjz7e@dDnf7bP00jK~|iyh1|3hBhM1JPm$-G!>o;W1sw~mkP{EHrnyVu#$FdfoHjW%
zN?by&CGy3?tW&`XAVmNYy@A>vcOA%!WtN_V)*gG6G>@>3ZC2@YdXuwGd!TCq%J@|t
zf<?2O-shl<OXc-PSP82=CLe;Ga^x66rLOo+xKB}WYOGl;M|{Uxr);?s)pL@sfctln
zvx*sV<aa3kt{L^|4-@nIlzrJ$?)jc&WvG3dV!wgSuT&d=TT>-d>ezX-55hLfy)8%k
zAb8^uJE;!4nGLe8j@>Cc{Kz_H?E8tRQ1HjpX*;$;xK(YR89M6x11mGT%iDfnXJ^cN
zim1^4RxvOC$i}lhugKh=Kns2*`~Sr5KSR_MbClh7y4B*TqmWvyk{=&sz06Bx_Rm<0
zp)LDo)-h|x@9h=m{|wd`v{?NN8R#8y&M)lQ%mx=f&`DU_K&~Xn3x8#gfg`)`SJr*#
zN53hIg)>~xpZ2uqgZED;N~^g+lzZ%_&g9>xD1E4?*l&=Prx2V4%Uh1IVT7%`@;}E}
zztc7Jm18Um_~_l^Y|t4c?S4i{JO2jxjP1|J3BR#(aqPGBH+IeGN^g4tM;L#MJ>_#J
z*oCJ_^JofhpF|Sa;D%$9MBsbRqZjdBr^~jOw~OzOUOq?DuKgeVmbW!W$Xt{6fEaFj
z#xno_6HR_e1K&m53Pi_V#6<(YC8gk}B~4BUemd2)@&(RUH2AbCIt>%4O7KpnX`RFu
zGS4vSI1g{hcCM9=d3a9@-3K0i-swt@kKuz#|9I%IG>$b*To@<x!ij4NOg=8qO|JCv
zv;TW}yQ{pHpZ2@67<390f~5wfutf$qw?sEU(qaP?#|OC`r`cW*A40gg-4`1eNZREW
z$M8;8ABdrVErxJ9PQw~V<Tmk=@B?P)XenX=Cw*kcSl-bbEpLqF*PgDozKZ4T@`$a0
zE`S!HrnjoSNIkgrknQ7mYZ`(PalAc-;Ndtv!1RZA#&Kxn*hA}HjU4aid4W3RCaPmQ
zxoYJcKmR&&`~D3Em~nBCJhL~EyW$%}ej9!)o)0pc*6yYJ$b-hv4sKj9iLPMbWp=#L
zV9#Ej$QQ6HkM7$5`4!T5Mb94C8|Eq1mp?ZQ-8NH&{?agXbEOLXwPEO+I`r7S$C7zk
z%i|3rx6LylN@4$|LvfDhwKtNEYx~4L*)y4UY*K?5UFTT)2PjSqKybn)nmWN=vR^)!
z%yYf7&`@;Cl4L%fAuK<Iw}epQfD~Nko~NR8i*eBqdyl0mB>Zd&f5h}wXixVvem!l?
zpHAnkvi3zjsIEpLOSK9Kf0@n)o8C(0k)1O66{Ra8N$L5iBEwRm7Fam(CA>-=iH!wH
z0?WgmuJdln<ekks<*`go4}=cO=B?zlS^T>6PXHA_Ty%CqQw8H=S5K86WbtM$L7JG&
z&jZ&5Sq8a5%d&ZZZT?)ona!us1;#-+d@<XzMjp$-7W!$~GnW^!&1>bTT;*Lr-paL)
z953lfG~LrOF^~5~vJ3Ngo-Q#>PRm0(tK`-^{s0swkf175dyHvPk0U`q1p3QooA6E-
zY{i}vvmqX=Uvgoq9e5OqAi80?>siOqD|Ca5G{um@16U-N2hP>}{TnF?S(OX>p}?cE
zc|H&3?1UP~sGTj<z}`cuA)l5b^Lca7A~TRIc{#I-Afl**#)MsDYoc8+yY?6Pem=kE
z_Y=&TD~C1J35rpIey7bYc1rL-rR=X8<xLj9NVc(f29<M)WCD`dPlm@^+-sT@@|hsd
z>i8j=j-dvgAgV@5DH`@3pqhI0QUHP!;LzHL3sCA8@?^WWc~AceNFJ2384zk)Aa8z=
zm!)k#NfZGwTi)ia&RInSUoU!49Q<*5P@JAdZSbJDQgWl@B90+#v|xffGLok;NJ8{_
ziBDuG@s*dj5{3BU9iG}mi$Y+s;Nft59+;98SlX-L4s4O{UdOL9SIG9)bG#caKikYp
z<eS&?zJQd3QT&aBd9J2kaH`_KDd6eyhf#c>rASUMq(JeSxbs3dO-Bz_0qD*`(pfur
zUpap?e+(scAH(;1m#C6t%Nw}!5;@)Fgt`eQx2(K@e-(<7Hugc@^VNFcWAeV?dU5j)
z=liiX>G{@zaGWHJW1}^BllL8pSL%<IroLEvCj~&VilGE(PL8#|p#aDZL(?;)i}Mgd
zim!E<>Mcbip#ah&U3?>N8j1)=Vu&0~&)6N1*jH?nQf*QvH{GH8NMtNFT3I+rvPP-<
z7LNEOY4eO|62t`yc%#&P1AE{uZ-xBneV!qA-pI#5C(pob{4VpT+`5ggllPQ!Su%o7
zdsaankAWFPPpe}IT4gHrnG{kG6Icdh2_QBDK6(Cl-WrH%>UM6)C&pu}=TcuJL)9|`
zga0XSx{0>{?)c{iJfoWr+R5VThxzooTwFWC>Kh-Zlm|cH@0$bUx(|7wI$t_XUU}kX
zo*vpghz0d?j#%NF6d6D|R(U}VkWLOTaxe@2CA_>K76J4|U9c$v4jbhK2?$6aZ6DM^
z4re>4L9r5`2(Z8+%d&qW(K=5c6LCdY@B>$|GFC=WMK)F}L;D66v*H4ux`}Q1=>D#$
z-aXXPl0J0_9y&)!oq>Uu3W<dWqGM{sCL`$KWj0<&<7J$RWx*KPKE#4)9u-R@l1H;6
zxs@opPUlTR>JB=N5S3N{h`5nf0NM@@r_a*Oe#<i%0i0BpDIK>+s}ux~;(*CP$}y3Y
zgW^&&=?PFtxsz1X>k2?Fr7J+?(y5>)kNbxp8>twC%r{;N#Fc%hp@dStN$Ns6bJ}D>
ziyc~}*aqc^7st>aJLwNWLfWs3Ovbpf<<QqfOehKLhB(VVnF>vTU;>2X0`$JBX$1!1
zW3c++=C69WHqQB;6%%C6_jVW%8iSHQ#M8rbs4O%YB-1FNdw~#dEns#=d19`S=Kh(k
zL)(4R8036VAmwe1mp@4jr}joEafZHpNFzC^cA+=oNjD;W5d+mPAs}b{gQs6h!(fgh
z+R+`b_)`s7ygOh{N;O>ZYPcx98ZOYCQNyLkQTgeIkPj+w#{)`sFopa<d=fpct5(<#
zHz@*sf-N;_7=BehL)EVp>B4DPzuyBWk8Jv9mK|yYJCvWR_WeHOP#RS&s*;T!!Z>(r
zUwNWPU<`-`9)c&WeHTdxErUXX-ab;53KuAL+c*z55@P+uR0fHkqlHmJkFF^^4~qAx
z9Nj`W{BB@g#m7Ihp4WG(kT$CC=}v;``xJbj!Bo)$%7Y+e(6%71NGNcLXx5D<wYn)G
z8o|kt@d3gYs?xA}o>$<{MOCReK=y_eh~Nm^vM`7uPg9|)%P@Wx16oRhtP2U9kb009
zt-mma)ZVE{t;bO~hyhiyL%<C5il)L0j4%VI`7eMO6#O`ib+rb^=*AMui5g1@_1Lm{
ztbpR9R0gXwG`0)_62oX*<DkC)+CtQP>q`Mvd14%Qran<ck<lj3tRL+T21tXB0R;$%
zBCR8OuBy^7Te<9U4=)TMu5~}WJ`345I5FYi2A<$p^gOQSKU=>}TknUmb=$m^bcLYn
z%OQeJ^8#oES>pOlCJoIbs7E&wW3m0g7lCKc_f|k-aNrsJXp$8ujSLTt_Gp$XEEJ2u
zprI>JBO>&Opf3m_ls-Z^^>LPZKIu_+#(;1#s-TcGjR9nS8sKK3#{gI5C?Vj3hC(HD
z;7q>vILiw8?c(z=k<-u!dcq4IOoW$}2T=zFF?eb#m<^~AK_3gDmYhHak<dgNK}9sc
zfDo$P2wD)FYN3y4?NGgY>e_kmB&`AwN(m6bIK<S02<A}K!cm|V(gF=3E%e2Z?p<E4
z@~9qCUo*$~-3Y&eBZfgD=5q{ICsN+&b4HeCfRB|?i#*gK=5{$v0)h-Z2|STWaEjFt
zbAVFnIe?U^|J^yj><NQNLI-_9bAS?ZR1RYX%^c(ON-XS9WTGQ~)O?6E)`xs(Y$O}O
z40GXHL7Lw#C{K)K9{ibHU|!&?7dTK@@xTZ`0r6IndXzMYAl~(;w|cX!_~BO4WUV)6
zTriuU0}0e}Y2Z6aF!6X$6nHaRZRhFgllo>NgwSIMTm|%_1KQPHThn41+Sz%yi-58W
zixJhH8p6Ip$3Vo+nFk_j8c-(z<Y<e7-5e$t5w$8mibVfak;(_fV*ss`2DSLG0>I)x
z>VRBOPHOh4=?3ABxslWwm7XvMIS(cfX#pIGKYRt#4vA+*5+lSmKqDLjk)|Iw#N<?S
z8STRdvkK^)BTK&2oaKbrI4DFy%?$Jcv(FkgC>IpD6=>$Snp!E;j;3@0jOamnO$a@t
zdJV7m#TFz08tvF1L*J@J1%dH+A|RGT%drLM4Z^*m0=iAp5JXNWOD?H*c2UlODi~BH
z&DU(qg9NZ$5Q9U|U{jqd7;x-Fd?-e*a8QU%&mAZ-F<$+8_#^FqY|;*GAPSObM7(BT
zrIHF69M)h6gq4IL!z2;WlSB@wF|(7@j36AZFcO!y)|f$eS%;b>1@>Nal1BZ!eqOt%
z->X(N=&r%ZET#s5l)%(Lk)#$XCWzrhP4r@nM;LT3*8gH=V6p-_6S>JaxK?OGNFyz}
zhKgCyO{96#pnVO0zJ{b(T3S-$fChdKw6b~av(AG)D@9u~kZv}M`0(U4ec`;xAS+|7
zq*5H_!cHi~TfVsO0I-O)tFaRTbx|HD!F2406&h5Y&Ff3>+KRsPCVN2bnTW<4Mfd=e
zU8__k_R0QWE@I;8c{d~(M>Hr6N1PRh2Lx!SQdMU}4-TFcz;TOye;l2ohR{J_1gSvM
zP@Clv_*g=yqp*a;sFeZZqEHy2Z^Bp(3ZoH3Lh2A;GCxX4r8Uq4&CV!alS;VhK+8%D
z>OwXZ8^LVuaQoG8<6uk^X@*7n5p0BEsp)|T6DNa!SK8e!GzVjfc>|A`YP0())^qaC
zF@e<pm|nYGx$PSO`*Y}4UT>7!IRhpKS%_jjH~Lu&i?T%*+wcKSJwiApiExEeVeFdK
zSDkr6u#Xcbh=;^Nh5>vEn!d4CYzt;}=JTL5Mh$2zG*G}fPbKRz4m(YAQUIxn0RX6V
zY;lNHn*~_(`a%0xti1xaoYky^R5d+)P6_iseZfj21(LB4y$l>hYY>oyo;z%er?*nT
z<pH0Ncs{@{*kbCE+%nYoqI6_Yp9Ds95lLRKxKV_asL{Y=ZK+m5`&>bc9Qq8;2_*uL
zWuSjB7D%b^SUNV~z+))h0%fQ$P(QG9sXGx?gvN<-bWeeY-cIt-IUTKRlL|b!Rt!o@
zhYx5J^;V@}0i@DsV?ip^;h3r%lW~7K*&m{v4+xBMJQ<JIs?nJkd|Z4A;+fAN-kf*P
zFDnD^VJeI(NKr(cl|sao&q|?11(vhiBv>g?iwb4Z$^1H*-&uR`{I#1bL_1Fm5Dx1p
zGbjhYm4eD(`;N9=0>T;A<)96G0}_}$11p1-rqn+HN*}KGk#aT#A6TaGN{c<0_W5zx
z=W9sefvc#Tc~GGZktSP_gs=brAuAcX+vjyjbR!lQUkMq+(YhU7A|<f{Czq%SOaYxi
znNT*mg4@e<c`2$qb!#($dI>n>=wWvu)rE(2eJO*T5?#6~&Z#rH2({FcCEkvq&O|Sv
zGc7!W10ur<RHOvXi`AoAG}mbUVo<$mPu4I|kLW}pHx<ojqL1u5CKUjJ${jMpW2N^i
zu!wxiwsOZ=>E*yZ`t2R}gS5$XKL~Ay^g-yMFE79jwt!*Ks9*{RCIg~CT_&I$s<B-$
zZF($Tr-N)+K@cSnL>JhVTj#B3x0G82m@X6_1jm44f{~cu<VkkL)M?Xib1dvNQ3EJi
zWLENEd>u&Bil<o?Pc$^CC<K~hzt=+{Rb$<?zu!!B*(sXIbwksEC5dcSjijjqSX7O~
zM|C4ej1@>%w=vmX{Y%|`jy5KvjUj5J*J-3T66HNbBZ<Eb@W$t;k@z^hiiAxoH4@v4
zs79i?1m^CjXfU9C6JQ2wcr>{^66uKER-}eYYSRLRb*i4Qpasf1Ig&^%QHpe+{?)sj
z2)RMy9Ytw)<e?EPGo*VM3&ROg#IF|%R6hf4e-TSgNG~%0=+=gTuJ$XsVuyj{T>(%A
z&;%+Dq%;I+<H6p~$FRo-^PT4(^0g|1cno_!5NSN2dW}If+H0#97jQ)nqI!6&m_(Ig
zt$cc+TKOz09@A~8qA}Ctz-BB*CamGU5Vg=jq-j8;7~gb<AOR7O49b8G)qp|AflL57
z>?~$90&4AQ*O~Q)D^SYL1wN?(o{NoI-LSR=3lXAlGrh(gYZZ3pLlL6a!Lo8(W7Z2{
z3#clMN(wTRlFqAN7fF?c#-tkQowPF2!ic?+?uuPV-PB#s(C|Ef7OayN#Sm#xR;wa9
zf>uS$e_9p2dR0U*kwTD=glzJ3Yl4Zi+d+|*_7k+m5?>l4fKDWKcN*|Lj>HJ15M7=s
z$}mld7S*dTjRp^4Nb$VJCA83~RWFWKy=1lO#nGx42W@p&^-{pNgt{iwK@C<av^itd
zL(Z$QUOG!3?>kv-M2p#oGcGRFusnLPHVL4Dg0oP@U1}*s%ZNzOD3eGU8#`nD(Ocj!
zhU6xCgb*ejksxC+z1m8SBGi^mp;KL2$jb}xrnhQhGWm%K;2UR$pp_2`KGyhTYOOC<
z(F-UP>cgD2X5x8Y-Bzo>r%TRL<S7qagfwNq<){T#1E0bis_Iw?v7x15ht^8<Q6GJj
zlmdG3R-yW!k3Jak<xVD=!q*pkTzqiyV49M+5(?RUqd+aFC?>v9G4=U<dU(<z1&l)h
zCLUk~SppuGQwWYFPA&wWYd1a=T^Usu3@uR=sy5>WC19JN$R#4m3WSwP1SXa;Dwq_N
zc%A0OQ1gft0N4WaggP{a+80C3!^`#PP>NN+lMHOs423|sQ$>l|=ouDn!~*)&F%!{c
z%!MhYVG3{#!c6Ax1lssIUZi%w`|30(k*OWEgR}rYCliI4N<For2cd3URmY(RO)C>c
z=?~(4x=4{-FpV;t;6w)}At)IPFsdhBi5ZZf4h=FWArub~XyV(ng+b3?-XSxXtjzKi
zc+^gUxG|Kbem_GzChQ)Z_si6>Kr5l*F)8K6;J^@rK=YW8GKvF3<PbP8cw7*a1#w^~
zq05D&MTh*vE`sV*z3q%Q&%tQY_Jzg*7BIufyO=n=i=iPPRx{{OY}#mjkcS3|;*d~B
z0-U%p>QC`yTn}twTneR`7j@9@ID##~iQq$##Qs+ln_3s$XCCzmkLcFK+6InF0v6?9
zzi9<L=rE<`8N)V&5SCt36%D4ivtFkM>1YQFEA^n-v8x^w)G=O%hlP}?2ekrdrw8d0
zo7;n4^q?Pbj$Juz)M>SKIt-8wrk2$qs>e{8;%J?!$7uYi&9JE7vO|imqyPlu)UB8!
zbh2Wq;~sV76LDz=w)^NtS{)m9BVC48XDv#jNmOj)u}sy=O4SDSBTZKt$=3CNh~=M%
z=@>v|s^tOCQ^BpS8tN5So>(N;l!?rcX$S*<>L&*KN-HP;>eOq*d~VbrkA{m#Gg!o>
z9RwGi#tkB!vZ|Kq!8NDm*jrP@xl%FHxP>}S@%^YDkW7at{m#e-vfb~(3u;Rf%mEKz
zUt;27jmG95&W0+%)fgg)RtQeK<%AIKzW(lL6J#i^tlus{CtJi~cRL6$6HEjqpz2^F
zrLh1qD2N7YA?Q(E9tG8>1nQ8+3l3D%xGSh8E(4UB|1MPH;Y`h$&A^68;{_M0Q|qCc
zz?ty54nfKYH^YVM4ChP+-K-IT(+~yOAjkpP^^l{WCyqFOYM<tSkvhvTPx@nK427wm
zIP@d-5WotQlkPV}AS?td;;>FMaMHZ->v<FB{xR3#*feka3B(GDnm6EOVJId;EWx9&
zOFshP)}VgX6pc!XN#rE;#B*Y`ARDCxzj?COXpRuzDB6%TV2f3gKml>YQi&1(qC%rm
z2j^<u7}^E>dd_eIDAi+HR6hbD7di=?0G$dB;T%3VA%wfeh*bznv6c!*2|Y#>(Ev}x
z#+^KBng<1->_-~JiNi~M=m*O)ky-;#b@@ZkkgApk57rP=#2sBQ-GK3lcO+ZS<=LSK
zFM%*KSQgksSU!?(hvoEyC&F+TNQr1OPA63R>Nn%?CqP4)6;mGQf{B6UToizBOS=uY
ziCiVU|A2r@>e)nWKr->6#9*c!GQn=~V~JKWF^TwYriIjM2ck>r0$@`V=t(Rfhc;1+
z91wp|j2r<nF9B5~I>(_(KqD!N!b&Wqa;?l#b`Go%yhI7$yaZ3uDt0ZnQ64`wBW{m@
zSxMWQI88RGzJZbehi4NP=^G`|0E&)|OjIIRP6tAm!r|CNI*{nE8gyVtvFcGg=nY)%
z(tSp^4N#vv>MV}V%A-PqdCqPvPxlp3!FgyOI-a}T<!qlC_EbA;o}*Y^4SOmSKv!YR
zRaXTx0S5%Fy9x}vj_9MjQq~R@d?ism6#!7-4~rmGlZd?;*rvsU)Pv5rScl?+McU_x
zl3T)Ykbq4M!D79Ps--XUoup6&vMP{)$$|__b&{}Cb4UizP-p^9h^JXOGI<1qd0uVK
zGGmC`0g9GG(N{9uoTZc#ZG;fZ)Gbn{GJyf4q!j>+=V53o)`SG_NGL`<UBa<yTKWmb
zsOtS*?V13pE&QMqc_<(T`{q=Vu-Y6GHy!#Vi(>0Zd?%H}ZIWz?qDerUHQWlB3ok^+
z9!M7B%{lVdWI>{1qf^8!koEdFMQrj`%t3-$`CO_fM^I9lH~{N-n%M81rDJN-g(C$<
zr)u=b>Rd=!LE3X%hG>Qhg|jk54+uEDn;{_J6uu-=Ty72<LF>zACENtD9`1-YZ6@(1
zfY>rxUP1WUkkLE&?iuYwnT>1)NkBnM$pWXXbu##8-Yk1AMwG&+k$3<adpUb2yl7-u
zwiw207RY1CqLtj3jcToiW_&RT4Z0-<P2B}`lW1y>T-DTtxvHr$PwY=PtYQdqfDL5(
z8z4GYxRNK!e>D+3Qx&ctB91n3PTNJk+xB$XD_<1r4!Bi*mM@af3kUPj3vC+oLUbSK
z2BLY|0cK+|guJj0laSZ?zw<p&@?8exyB-OO=8*4tJt&&=(-ly=Q_PZh5TlWhGk_#I
zcCeBF=S>O($$A|s5N9Uq)u~W4jd8vtGnVsneMfPNN5SB1IchoYojMzX(AqGtV!67b
zX3N)>^OB3V-U(SXa8e;JiJczFOX4jRM_zI!#kB%Lz$hM@2KVgg7^81N-r2SAYCTdw
z7laysG>H=gEvVCEmoT3Q3FC!fUKE^<gy0QfJ)wJ;B}h<&3re_;p{`<rjVlj^c~04M
zUB4i+$)#>0p(0Q_F@YvJa3W|1Y!vKShy`rXol_Kb46TIEu2>-Zui#x<&Oo^|k3H(n
zn#Z0+-<gBqQ2D3~EZ9h3&y+8%;O-s4H1$b(ZUD<B_*vl0K!@ak75vYT2^{?z9|uU?
z`Whb%NG*Mxzmu?!O0A_q_TYUQ7aj*{P{d{!!Q7rliE6?XD|wO`d(_DxhvbS(xo8#c
zO;pL+Rs4>$xhJT`TXFu{8|S1u=^S>3ykj*aw5Q7#R`X}gujRlsd{&Y!j#?t@EC}N6
zU&DtZZopbjD$6IXMTuXB7p>*#CcK;0xuT(j6rc*ptxfOsJllj?x~n(f!o+1VeIvix
zyk1V;$p4DK0~`6C+&!k{Ck_(RXB))fVibalPT|^3Jk<<f-UvFJ#cws#>#UYZZ}1TG
zZ$9`2%C3?N-{6mC>2Uzpj_%=;V4*V-a@d=EG7`P@CNIq2icSGYQnxESQ4N0!SCa;`
z;#Kn;SG3qmi=ePw31sfIcgaE3d}7KBbe|du9EAg6arDfVYMz%{-(4;u2h#_WD}c$h
zemD?F_FL$I0dm`0ys)!EA!&dk3qKGiQnKnex~yNBPKo;E${;`gY|uCkg!<4+YAfrb
z_dbh=Z>1hjv*0R*0#>XoSfc%SJgr*+1V+v0<k&(!02hU83wg2pq>v|@VRBz<-Yy3f
zLC|*-vICQMYX&*^+vTKY+%^Zxe>LM5o41E!nnScWPNx7=P;9Ckdlvu1TqpY!Bkp#2
zPcbh+hULZl4f7fKw-&qu0++PlSqOZq1@8qbt|cew_VZg}=$@8iTJpiU4>=FM#nYw%
z{C^065<e4Uz`y0YEqO`uV@?9PHm-uh{#Ja1iTvYBR5AZ3;fv^HILH}9UYEmZy?z<a
zPcOr@=0n-Er{y!Pd7Alexx6(Wl6kLFY66Xtl01zE+WmJpw+;VAy)zeG8VRK0ojDxV
zp|p1G`1S1mr{$yV_!{$wyrey@=5&#dwCCHg{Eh9v&o+;Q=XT%|Xkx^7<W`9qZY@Rh
z0kECD-WY&UNhJcELcu|(50sa8<g-!EfsT9<tl^z_$b0yoYFPGk;%!i5YALV4x-h#G
zzUSq}QchYIL}zsU^Rj(sPRf6v*C9{-y)(x5pq$m2-;(qKG{86t?3g`&iA?FjKLjxD
z@4}0eUSLok&eO(NLcz;+b;tw&LRyE+Y^6hn_SvZfxA?*S?hN79@b4|clUjx9)=xSF
zeGN#VnCegox6uR1qU3**g4v~|)lWge9M&;^Ou;<({}BbVPB-Wj6wFo?Lo3FAg@RFS
z|35^*_#?E^J$>Y>WxNGcJPh5<bJBR=bD(ij^3aN`K(GW#9{#?Y=Y>}N=qP;AN*=hq
z2?3{6@=(&5J4zl}!G#rvD1EHpK+X0p2u?N7?tmN2@E5e|ZQenNJ$8+o!h(mCMyTXn
z(ts~eTsumk2(DRpL`lA8b33&T{)PlsolNM>OM2ANedo6n!G%i&L~!AsLvSsjIJA*g
z%z5NqhnG?`!8MDnM%PO7VO&s|aZJwa4HBzP9`6m5QT;1*0!S>TNi0Sr*1AJZM}QvJ
zR1!GBM9Bq3p_cJyMYw#UYl(w<a%r*)T;_VR3o`6Pb{*D5(A(>%-A?VZcPTpr5=>q7
zt~Idd!q%AB)VO7&q(szyp|{Z)n?crlD)#Q{;3hU#1?oqn8dIbi1QMveid3U-f!zU8
zjl|CETKzGEuqkwa4Gs(T7)lpKrHYbo{J;`BsroBo0<XXj4JTAJ^(U0z8Xb|~P!bAL
z^f6g{Fiwu^!}Dx?Ln??}BCP@R9zy{`O9buTai1O}Bd8$SL$YH~y@BBpP~%4hd;QqR
zVd&+XeRxR{zIrv_A-R-Y4vR~6E|!GVvi-R{KOQ8(6dY=S|7!W<Rp;`qUbPDO<P+!e
zv8le7dt3jQ-WggCz#d^l?fPVTUv8N`S=tw*pihqM%hSC+I|e*Pxu!4Am9j5CKj5=*
zE`d7IF-l@z%NPE>FOOl~CDfHQkM-wIv8u!J>Hb)fo|L=#^Q`nIiTi`5U}?vZbYMD3
zv^*sf2JnKW>M)Ra&<w3d_tNzRbtVX&0C-Vy$N=6xc?3<Evhu)EBEE3|Ia1CV0Ls%R
z-yOi4!Kxd;+p;<Tk<AA3w%*GB;M(ES^2&i&kbUy;fjsD~+oo<Jt{cd$LSmFDjt0RL
z2Lx*FPh34mBTn)`ycP1c9mI=ZT{4J|fwgiFx}-|(9fU8($)fZ5SqMD;eBRXbg~y){
zlA;eNu~<-y=*MCL_!gkOu=^&s$K{voB7?fP{+~sJTLGOr6TL(1E*#^?je~hH3alLr
zIuYeRe*wQ8-r!K&GfgJ$E=k_teMHi-AN0#r7xJ+oKasLQ&?d3vR>~wu%#oi28%IGB
zO3^gwR)O;PK~*^fKmw|UQlQUYlfLxokt)^oTYkrd6Q1${K}>#<fFTg~S+N9$K1gWB
zmzRd0yNIW-Osbr){AjOJInYV8>OAv3Pm{YY;TJXWw?@7Es7f|?tW-x5<VT$osm}6(
zOTh`Gg^D{h<d(k_iQpAMB9R0fr3SsIiEvoOMl8Zr`q)x~lo%qMw8R<lZu<CAgDwao
z99FRraMK4$@tnCz53ATnbJJUCrAC_00IS%@ax-L=8aPEqEn|l9`%|2Tvsl6ir1i_u
zOY+(<UXoL}MC<>_)=NV+`qf^7Fo5KVVb~{Oid{xv74CK!zrjrP5g5?bOLG#0cVp41
zzVOn^`EBMU3g|1b;ZdNEyI|NSSDIi9L;98u2o<XY-`04l09Z7lrUx7VU<+&~^^|0W
zJAc9zSMoJ1tCnV}+DQr^9MV*8q9>tKV%RmjJQSxmfX=117%&}yh=KlWGni(pGZ4tJ
z(1A0=W#f<?LjMitP+VW!5CS-J3kkFw2c=7+18WtLhA1Zj=hW)#I*AT<18V-uvTJ#4
zLLBBl*xxn;`hf*5y%smRkIK8Q<rfgXqrpql7gyut?rV8}bEGU8&O3$dY-$fx*o0Hz
zI#M53!0l{x!BunJl#iBxEQmg!D*%^zHwf0)F8Cw6K@43@w0~>82MCPed?Xb-N9TMQ
z`(4_^W97j}0G-I$!$FO!ecu*P*$<9zw|w9pg5^h~GhK!&f(onCZuzo5;=O%yULckR
zE~74$H@%3ZekuH@dK7PEsa*demijsOVok*egST?}yQn*n_;>H3noH%9mvA*1TCp2n
zMWxyh5GY|ixWQ^WQNynTKk>#YPW;5pA7k%QC3}9t-|((d4>ro=MSP5ASKx*z;Rly<
zcJCri9L7mIvHjev(~kJmWhVHrGr}Y0Zraa2<s-paEBnm7J9(EJ^f}-5U%NXw^k44X
z$x7Mu3*Iw|w?=m-CoKgPSSg=e%JVu#sKe8Z5@s177`RN|nzUufGCm6<zj_%jEG1Yx
zg8~|DtK@{Pylvc^1vKz^821;t@}8+n;cYzbN4xTpb7suIxEIo}pG4tpx*Jgrg{Q6{
zS0QbKVJ8YNZZ496q{FM5Nni1x{AV}bpDkS=f9uT)gFFA>aMYs7y;a2ZCFN#*dyXvW
z&PQSVAL`Br^rkukJPNQ<bfj^HH?T#)qbPu41E41Y9^A&)>1g$du?+B$VKCk-kT3Jj
zf&PX%dEq(yZ_xVj-Z@~1)yZx>_@)+B_3wWIE>493?JBBRtvstIzaD^fUr+uglwtPb
z1ztU#vPCc6E=wz$>VgVlUoRjU<f@yR)Qf+Kp}VBa89FPDCM|yGt-mvxw9<N!_wm(W
zW~ez^r{`=P{0+yhPR-eK=8`J?9%ndZk+#9uMPDCBAN}5xrOLQdb|>8Kl&v|{lwGI!
z;%78vx9YTiG-aEaH^{_oys2#Y3RD{WUzxroZ}Z;%qb>~0u2f0{QfK4%r6CZ^mYd(k
z1fJ=<XK*HXyY`QOfZ<cWr$d0MLr_3E1deGaNZt&@eUzY}n_RRRORZ8QK-hce7GUpr
z`poB#K;a_!^}GB@WVrJ^zTdw@WgxNxMDz{dGCsYPchiWUka?8SfZDD6yjWKYfb9N0
z?_Tb{K1|A&y!PGB@=C|*Ns+7kAXyMM&5gt1b5i}wM+tO!|4ug!2S-T_FYhPW?hC{6
zi}(3h0HeN#AI3fW%gq1oI<mLX5>kKt{=c?_D1PyO_u@VH;VHYZKT!+}rK3`@FQC+q
z*cUBa_C*a?i9`=6OdbH@+eN%ZLgS5fRJMq)FN&kt7aY4Wd)DI)Kf+Z`>98+aIP42<
z&u~+80h*4mFNWrWd_%$g5x7Fljad;vA68~>m*xrHLXOzOGgG%Cy5UUOF7MrgnNmw6
zj&){B-OR=_MKLp=Z6o$8Ff+ExzkG%BB4>5O<`7yooEZXEGm(g^^dwpH6(0{p8?E-@
zd}g(LZZFolDjEAV|J+xD`CQ6s81&m6`5K2_D;Cz*nh83#S|R)G<84Db9-xGmW8&qO
zvP)pCQvpNaf{MEHVJ%Yu{o%?Yd1Gcjr2?=wv~h@i4y?yjKo__&XlZ5kohpFtpW)EE
z1lIBU=_?p>JC)7@nEj0ku&ll+38{A6qe37NY2&<{D7ft^fKE<hh^}V#78L*xvB6j%
z#>pxb0L6N;>waETru!=v{bkR;o0eLd?O;}vs!KRpGZWr+QE-L`y&1xG58bIq2Km%}
z-odxC@?6|b!y~yh;g9$8`+55Ok8JFOAj_w8ZaDHa^7aG#>h62c%Zd>bfK<sY*P~v>
zgB}ym4G^6syrV8Tl4cWZrtDoRM5Y|%+uen~_8=eF<O;fXJ60XVbE@=h7;02{JgmBh
z<;911&o*<_s|C0YLDUpZ{)hm;j|d=wwoAm#AVLM)3@=E=wTJkW)+4Y{wO5$q=#ZL|
zq;Uo8V%83uVptsuVz4d3D_|Vs8R#sBALg@ydXs|P8ey~ut!WYO2ci}B-Unsi2*1Fb
z6drMedl>97-}C#KnDjzHGrhN7bP10Mr~Jq-H$k!Do#Isa_n&wmvJcJFU7uOM4-HrT
z1YJbMs;+pc!l^Mfn5g1d>@NlOmvMf5vL&#$4gG>6%VqM3U-*%f%@5Ovj<s-p)0si~
z*M31h^($}D8l3=fl43T3entgalQb{{S)EpsRYDT09CyD0N5kL$$_LT8NU!6>QVEYc
z4lLZZ@k85$jr5b-a8bV=1*urdW?{U*Gn-9VqAYbb=4L|#F<V}80tjL|Ev4<x3_;9j
zyajR*#I_UaK)C^ehyjA2no#@b$^;<#m?CZ;oguC@k3Rafm<;rAr70do%MP0&%`~r&
z9xkSMkD>2Cl7_e#k~K%UY0i)+A{amJ?&d2l#-eA22=NW9t{yQqNkIr<=}OA<t6bs{
zV-T0=6@_N|aCa{<z&k%i1Yx}qBU->Z90O5=^JGS>m>vBXa<)D1F8Nxl$Tx2b*Tjkw
zCKkUMpO|8H4iENIIWNoQ@!|sWPtuzp!tGpeMl<P26AdCOOvMY*K?=?R@I<;pTH!!~
zz^f**NurRf!j#JrMUSXukztygNEA&{R;Y#mF_JJIu}mvvn<UYF_&Rs~5|8eb+l({V
zLQ#i8Fe7R%<<qV#SIhB`e8UrgGn8-G6%gt1m*Audpi6s`N_k_UD9M?3=Q;pltYzq_
zr4(Upg(@wucor9mW)Si4w?cA47z8E+pWtr7S#h8@h1AyerdaHN;_*6@Y+oeWNnRw{
zHft8iK>QQap1pHDDZA;T)Jr~29(on(A4MX+TLtqsMQQ@SxlnlTyvhktiHIi>Ulj>L
z`uU&B&x%Bgj=Qi}qhiD=A*W)&<4QLnK_ilLMQv2cOKRn>%|vdft3MJy9U4a?Up|H-
z5bcS?&yJ3t8SzBoHyw4e;LEEbo=E)mND$&TYfq?iR0a1$C)gSBL<*>j1fhW1h$j-i
z6X*Dm25gUbBJo=xmKuq#R-RlOB-HoNuIL0cazb-a7;?vDD^Wj;lH=pm5l^J>U6CNf
z*F-##_`{JP#P5rEBJmYZM3sLu65lnF;ON|_1cxJ@Nc;?FdW}@D0=lG+H4`}r-TnS-
z4ZZf!N;&B)k(IaZrFHa5OFhg+QXG3(rC?jP$+c&RHtg3u@(^;Iy%^f1Z5;1LpgfY}
zDBicS@kU8~Oa}GO%%A0j#UcYQKEX<7M=NBA>^V<pd;1gev10K(t6nYdYax2ES!?Cy
z7Gf1UyjtGdQv7Jv%BiiyK(=*_+|o*fAQUjTM4VOF#~(mT)Fh-IOdb_L6O+CV!M|Zr
zmS7&vJt)_gi0sbW)w!PGPo*jq6XAmy1+bw>p~9yBLLLOGcPn++x?fc0f-1mIB%zae
z9^fMqwp5<qTI3Wyg`tXs&3ckN4GY}-q#WE@WQ%GHnOx9XJn7rB76Z@<^_?XLwLyLN
zY><Cy1IGN*GTcTC5A6c-0sbB42eAUpT2;}$I@jkz96E#PWI$&BMwwaY5@f==0_3x_
z4_IRUdR<^VGO6wg>^616#k(-F%uT4Yh&PRV`q-x%qbjob3+<Cj+lprF*ao?yt!U4l
zW^!Fyk?r`iW$$((3k|udow$`PT_pe0PIQMJ-lX>8EVgQq?9yKRm2F-m-#b_2LFO{>
zo!s6Ydi9X-M0?RJcJpH0R$0<PTxM+toDx8*v(wG4XDm4ASibD}Rr0wG;v6>fW%)%1
zF__hTA={lTa`4o}ptHqYg;ijr10x1an_T)#(q}<kKZ$Ufkaf1J<o9Qb3wkX@vl^rS
zRR~iXD56A(2F7(QBBXtG?Jkv?2<19BK>$qcD6-qkgqlSv1cz%RqXRTP8zJf>((>tb
zMTPEB1<UG=qHl2Smq_s-K#|5I)*pmCvCDprhjZ7LvP~z<!F^xKYdeX@%slx+ClDh8
z<=9fu)tdDU#?2eZWVpJ7gF7I8P@##mGA7cIT7g_&D*k4c%U+#DI;=}Oiviv_$OB=r
z`JF`~G;Au5T+u}o`Ht<~K#Dm?sovf$;yiD~*Xn@n?5<*P)-2_wTGD&tI8C(YsgUrT
zt|G*JpWuB6Cu^{WXqL4Len&A0l0t{2U9m?Mc5M$a%zIeH%GY~<<nha3Pw@z>Wj)0h
z?<}1v*h{p}Jo+Wt)&oLAO~KG7_dJUHHhg0*v7ezIF77RUF%O1^^by@mwtbPj_grB$
z`*0CJ2WKi*<5KwDxHS%%Uda^R21{)PJoZrqcTLRi<biX=r3uxTN_I<oI$$m^D||s;
z;W4vz0?PE5K=2t6wDAhqQy0te{lozC%kc7k;sJV*rEh<+9CX>S{$dA0YX*ovF*g4r
zdBOSE4#1v#zPLGWDr#i6vuCUFsRJVw0k|JKUvxo5It>=X`W+-9-Gcm$<s}*dlxP|q
zJIqH$Na?Mj{C6V1jT0L>qFVYg!aJihY})6OyB0rq3hMpABC{;gfYXy!ew2y-{>SEs
z5e6V{o#8)TEW2JWs^u-$i8r#ZA31U4^*2uWi#6fa(UZrFpYUhn0W)Ag8@rr3LfGN4
zL&V?x;Y+U+-+0;lB$+=-v}Q9F%E6<=X!aK_myQzMQjVqtj5NbA;?o00ChWrW$3~0%
zV4gQ%jEDDW(=d9$cK!3<KN~M^zbJc+7G2qZWck<8q9w}?$OXujaTujABxi>G0LIR5
zdhj?wmHcG1nB}cPANY66iDPi}Ezu|cHAY;^`e(}28$`?eF`25`#>L3Hmj{e1VB;*(
zXsZ13svAUec8^!y30t0fooJhDgp&itS%}>L(-LOD&9{ymf8!{G%Z)dPYdM0XHC9Z$
z=$4p(5rS_9Oe&1)Ujnxk<$n|IW>NlOaMK6e^mTBjD}VU=v0{;@z>S!ME{QI9Jp8#x
z*vBt7-Yh!!%9;j@4ETpNg{nr;t<4np1Mp9WT>yLX$eV8%ZQU|u<m4&VjW>@PeVb(%
zD-f5W(#RVoh?U;=*Q4*wu2&K$FDJEu4{ngdCyFZyl7a!FIZ}6m-3s;y*r)`I{lG?K
zeASdaN<6O$JS6?^@T^JVVC#!sPYD=zAPH2^7)@Y*k6yY3_6=U$O4t8rBmZNK{8Kyz
zNw^`u-1@Z0VOxiWYo8V=i8))Y4H$`t*a2I>{v0;7`p~s9Ymw+z5EvdX{P5?(rn=j(
zV_^?~jc-u8ibWzn#Z7k`!l@S#zGRW;=BtF?g1>sWtXm{{r~Cvzl^-)g!*Tuy*?+Mp
zXz7NRA)Mle!j6NT@7T4-cM#_A@bK)#VuL58X?(!=3likOC=iSfk6k7<3-8_!*PlEF
zW%EBms6R@#Bj{!die)qp)J(Xu27VJ$Vxe+iR5rPe`5%WDzYYocmJi$%FwRHvNi1O8
z3Hxe{3%b_Wkq|H@z+U1rR5$HN2xqJk)6+xp?hPn(o?*YB9My&$R*qi``weoivbl!+
zp>hoc{kK=Sis}se2XgU>$L1LJT{FmOty*K)k1A(z`9Z^eUO9hekKzRfa*DEWpVv`m
z<qkZ*eV<`(pAn*nmS0bQ$gp=)gr}m;+PloKzgM1l?H3N;ZP<6-Los6QTe%My_9M#k
z?>4KReZ{b!C6Bl4)^6qg&kXxj<=c0UD17r?DB4!O>#F|!?QJjPv19VZRQxqF-29^&
z!~Q~fXH_-1xx;P$xZALgDF4#Se7!QpE;Q_^_agP{eZtGOiT9FauaV*h8uN4j_cgGm
zVn|xbWqU+ZUyTeHc?h~aLB6<0wDiT#asA=X_K1tjl+_?yM<PK_OeBKO)&6kry;xb;
zYQNm}wfK?jxA%#jWc&7uVUY|^AVWKyVe)=4q`suB2-GFXZQqE=l(FBp;$gBs`4%`7
zwzpQi8!2clrcGN_klb4<hWPr=3m84Mzvlt*0HuHTfapfH@1U3lJN&>w_)|7Nr(r2;
zzD5J|fy3gHNWm7mfu;b$-#8-Lba0zmgRpEBuAANtEukgBjsFsE!hp!v{5$ciZ~gND
z<0|dn_MK>+(m7T82Ri9Gr%K=VqC+HnI=<TiaR?vsy~qeHSrEWBZ3{;1HR0xc0%<@K
zB8@KVN%*rG`3c3j@rxp5>hz1@Cp6*42hj#Xq^_UZUZVX;s`6(cfDjle_1*WPO~_4H
z;1sknF<=Zw{G}*}D&qR5A-*umkLBNJ6XpL0{L$%WHu66Ve}|~_k86Kn<OA~>C3qp?
zmmBItw~$+rFHkWWP1k<}e(Gh{FX4}_*gNpksJij*!{0l~zY%^K0XLrf5Y~wJtKr88
zv~LhVh|<mQ8!Flb{_H@&m<YQFXugPUVpRPA=mf>E?+4L={oN<?eiQ}4=?epD^^~wt
zvhjCcz_=Fnt{7UL?G@YQ@E^t9Y|{sF-;bhrz@ZNSE=km}x_h;4-;Kwr{HaCw4t<OM
zT(^41%AfEE;OS}v-wu-lamWwl6+ej!<LK!t|0}*nQsuvX!W28VN>8zDkMtiEIXQFT
zr@sBc!O8^LM3Vf#WUr$bgPpOuvbCr=rRyH2zcLPP0uDDG&&Mfj6YaMe#Zw<g$J11I
z{fCjCaEj|c1V7@>js%n;fTpIKU=jSCqx^q^zoYWYRzHiLEmyr9P(b0Pr)f+LaQ)B0
z-BqW5<Y&>Lzzu&5V@s>L>)#4L4aUw``8CQ7-L@#8>Ty5pKvcRBSk9u$p9H@Z6+an%
zT|eES|3Q6qx%GZR*Y0;Io?tH8j}FXKy>u93O;a`>iQ2<HoGMrTB1#k7@b(DLkVk4o
zYuV~okRsC;2UKHM!v@YZ*26A<y&E=YY0Ce|uVP4VH~+l|OHkqZJ8MxML4_Nik50*t
z@)yES<)NIyV?flfUpOY(B)jPk;G?Y}s{5tfdkni|M0YwanvZm&2}=-t>H29+i1rgY
zjP_p%KVdXC{UEq$%x(a%PJz7u24s2l9=Ync7{EZe#r%fP?)gd%`%M&u+Aj$hMKHxM
zSHqORTmeIWePNfuT;ljkVGo2k2WBYD2pD_wUd*Z0;%vCjgJ}yh5{CY|!X6AW93}yC
z>UxBYfuW%te&rAfYpMc!AOL71l87dU_RFjjqC?2dOr#MJ>8^hw+(gd0{>g9$qx?kT
z=D^TX%x;>$!ylbzDg3lfyYb85jxGbkpJ@z;N^l?CH2w)p?m8hdO5Kc4A*@qWx@mCJ
z+T+GghnsdBgq;)Eqa~h!SGrMD@BS1ue*CRBA^r-G>m%U54u<v?uKz~3Y3yBc{VULn
zX^s3;_wQpK-RfzNt9s1zjA2)#$Z=$2=(m}kf;6!lXbvVF#)4@Dqjs4g!#;EnqiJGT
zPbf#4VLy0?Lb46}pX6X=O$~dIa?MCJ>@~_YF3YgDkc(GL&o}H(m2+zf;twe2^p7$P
z`?zwB-qHkX!(pTq*6?{Lc)3%#_ubkbNkUc1^X%*#Bw9&sPuW*<+ac9E$}=l})2a-^
z-l04loBvRrXV~A6$6K+h^ItY58}={CH?QWd%Q_<Ay+<gnddLkot<N>=CzP+pLnHQF
zj+6_@7gIKK*=<c0ryKTb<c*IRdg#j!_v9e)TSvm5aL<Vp_MQyy$nad1&K7M5cPa6_
z7-#MJV58yh0VJUQ?hR;^^%4RIjPDIdR_bZSDnFDhN<DpP>pQX3)5iMSw|b*<Cv4jI
z+y~nS`%&0bmON7GNegeIEdJ`9_=0&g_z0iMg07xx*#3Z=+SSvO?Dbte3%GGOAQK09
zdiXjX4yeWV@p$=4H&0LBbodFr=ETXLyLp;3ga^Ar8<j6XUI9C~<OpUu;%U(Ynldg4
z&+G0vi~DY@11P{hN67bkdOG-)!cP-$EiO0o@+=SCfqXMzo`P8nvliw(m@i@KV9f6V
zMiNXBOgotFFhgNR!%Tsh2J<M)N|^6q;=d0Vg)nVly1?{?xd`S)m_NhZ1@kb>0+>bL
z2bvpi!SNBy*D%LnQc%GrFlWP*!3=^KCdZa}&MTYvqwY~(H%s*_nqmA6Vbosi%AUZx
zBz_Z{<N4%hZyClut95<K${*#SGEdOEi()s*4BK;I>)fP(;wRjIfog|RJ_XS-8aAO4
zS}|NdVTNQm{t{1N&k;Yl9U3qy5KOa{R>Tv|-yFm%>0$p%+@*mEy_!_3G^IJflh^9H
zk++PsZn=K)jS~rvw@=X=kiKx!5W9W?y0phG^c05TkD^cDyXu<y*p;X<4Y-^7E%*zg
z{BD!n_=gcsNX+%OgTEL26Gu)SdDG}AqbC<fT-Hq^Zyq&r%7n>((T+U0dK8TrIsTT>
zkr=Cor9<SCeLQ)gTmF3Gl<UV%yyf~o-7;muO%tvgH~RW1syz2|qwpzeg6n?<ZrY=`
z{v~h|LU;YU;BFb^|J3origfkRpV8I(aM8!#d!2cD%&8e89|N-nQHY!VMxiH-d}e|O
z#bHnXO&tns%%X{@`~ji=ik0TCqNU6~AY$d<ejcB%@)s<cC~dAsj_l_dl70++5OhYi
z2U7!fIZT4wWqVp#T@Q3mvwryKf@ePOx4F3UH+{kvJonI750|(9Y2<(-MOVe`maTew
zirCy=<%PXH-O_7*4X8ze76$6OaWG?4K~fI(Sn}Heo`Af2Fn%ao`W?pt>RaQH>?Rlj
z;+y5D-k!5UE1W1=VkwGBx*3L+*diFT-<Z_MPs<jC)gdn}wFIVrg1Hsu&oH;a5b(Kq
zqy28)cE?p-xxBB(mY)ywl<>L79pttZQC*N7NbJJ%Jd29lL8mEr2aG$Hw*E!~j2l({
zl`(R{B_6BgK7?3EF-J6<eW#vjrM4Gyi@=EJ0D^YcPs=xro9m}IB3@{Q%{igb%;RKJ
zmv`@a52E5>sJ-{XMEeOhP}m+Mp9%YZm<M1UgqbCm4Dbx<6rKF{vX2GAc?ek^hIxdt
z%XR}jt<3rI>VclNs{hzgLnaKuT2NvpM|EG0oG{2UlX+9*@j;$}p(2*-K%{1u(wt9$
z8HD{Wfq)GPJsox#dhjyXw*n9NV7q-j2l;K1DDm$|{XALo^gO_@7Scrfsa$ssMNumQ
z6}(VD^d$SeNf%w<Ngt3q(Q?*~>qd{_4H}Khx)TR^x|<8+luME7^JMw_rJf;V|8S|N
zAK5*Id3uvQb(rTOvOgH+X+yT>GS83{_rv?p3Ibk)kG{-v9mT(OndeHfn_cc%u7IxF
zsF>t40=mY##!54M(*>S^W<U39$Iy=ib*?`Ef1fCSD*Ob6ZhQv(v<%TS?H?zP5A`(9
zxg;)GAyPL@BGPnJdBQy|gqYKHZbSzRbeW3KgGgIG0&_QhHT;QD{)qsD=*moip8&^A
ze+B$HzkKE*PqzX$oZz3xde<L{d`BL?$kUR#vc<)oejzvhx=6gP*O*522sWxmvqtss
zMe3pRC&C}yj=7D>pQp>eGE%_~2q4<ptx#w9+eZ1j!%wUyH@=tiL3f5!#AAlc!BI4@
zl3EnygmXQ`=xsyFbAg(3djl)KFc_<1CBo=07KTvALKq5*O-MFgg#8js70k;pi(nSR
zxM+qJ#AyF3@Ke~iPTp7Hro8`xp}b3B2u|ob%d|ff30Up~Rv>d2?iDbv!MqN$5@r=l
zF^roz+VAFF<>XzBbkTX&z`qt|9n5-|4KN#Fa036@5Kl%Ew;NB1L<qeO3L$l*kAAPu
zW+f&YZzJ71Fq>hh&$hrs_tEe5*=8s2yG~x}Gs^4WKsoXX&w!k)q~w#AZY283D`T(l
zT$IoNVG`G&lOh2^+mVkZ^;|6Z)Djor{$ab3&IPCb0f5u4c>t#iPnYGU8%J3^t?{F8
dM)nG1i-T>Q%+t~*59cBhTd$?E_m!Ug{|`y&{}2EG

delta 74393
zcmcG%349dA@&`WMduMl(h1@5zOMoN<2sc8|3<$_2cq4+~fnow8hj_bDKv6)@L7FFs
zJVgi!as*w(2nnE~f`TF<Mg&Dc1;p!#it_(f&&=)ydGdb$|K}fcXS%z(ySlr&s=B(m
z=lI^#7hg%8)74`S<4+ms2tVF)d-yc}lPikdVfQ9@?VNL)&E`%>Xv7r{g7(JlWQWb6
zI25}rL2+|8v)k<s3NxD>kd74m*lf&ZLlGQlcDx`$u`vYQ%%Pw>58@QNFQC}GUN28n
z0su&rRVLb$VrKIJNO7du?Ob7qwxjd}hr>bTbDP`29YD*^eTv7fZ(<n*ZtnM^Kp+i(
z1g>!I0otAf1vuG&g~!1ut4IHfHTAgBFz&Z0ZoP=BL1e=pp@SObA9Bh+BjC|1_^9AQ
zo^acB6DE!tas71@M=OhXq8Ym7=JB_WnsAr$to{Q}Y4kMr8SyvXenZ8L*DKHKX|^Vz
zXSmmh9edZr@ne)_R_1XNuDfB(D1a^2ud+2yT*5sD7y&KSXV{909^j2fjJV_aTW-Da
z=25qfm@w+PF=NKvpv>b*aj`c|7&S^csef+E3!mcOvIqGZ_8otYy=lI`#XHooqX<02
z*Ro^$L%zp+-^TC$7yFoh&rk4=_|=c_ANZA@v%NgRcCvT)+k81c%AVjq@)y~Q>=Qob
zUH%h)f$w6Kd^>-XSF@k_KC^;f_zv?eY}EcAzKX9lqvo-DU*b=*J^W+7lE25^Vr%%r
z{8RobKf=CXE7|+(cU}$9Jt*yWzK+-9_fNon!e7SQ@BCH%8Nv~Mh|T7I@acR#!qfRr
zYy*FVzr)_=`}tP3g8#;TVDItId3Y~-k^jg(1pZc$uki!2$UXRdogYMDUztVKAVfvI
z%XacF_!}tZcea~tl$HO^>-d*4pHWUN-hby?`61-r%)d5EcmrW7VH4lNe_^}$*ZKSt
zAn+fyoqfQ+;%}nJKiFUFBcS7B*CtGTywRWhlVSQIN2k=8uWwcYN4Vlu6)mR|cjK{r
zt^SRp2V1TeJBRWlo7lC4x6lu?^Ei_VxDs;e8=dE$@6`TKDiXQNfs9VAvU01^+n?iA
zSztEH;$^XaNX)ND^g5XJXQK>yS65NkiL`^t!0eD+`(05f^t&=BJ7gPZFH>!rS`l=p
zc07E{tJN9lbq4f4BeYLK_xHO9y4-*+_Xce$R~?=Bjd<8P@sW5qJMm%0V~FZkxwcm+
z4}8Y#nmy>$54(o4&-5PdlCURVG15Y|0-h2?sRcX`bkf5YbkoC)I`FUu?etKBHZ3Dy
z4<+=nmuYsqR#7J=sIE>t1rJmjz{A~%`|tolZanOrxE&ARrKldwS01uy#=DwOL=YYd
z+VQZL2QE|nn!8-qMBskaQ^@U|DWjh4naG^_Y)?j#(+iv{c{jF@Q496Ko)rBZPrHj}
zGjt*gEN2)JqZxSkf)0+@0-h0a_3~3Ex~Q-5=<R1d)vG#GS9!6bXk{1qn;4;>8#$bM
zzk~v}1+Cwm&<0~iSv3|!Ln%A=g}kcU%p3F~6I#|cl;Bsix~-cP)vehAQ#k6B1mbJ#
zRe=GJvkHx(V3pB?%Ao99&yqdRh*BH0K|jx%--6&PU;TS^sK{kBRJK>2>TOX9IyI1?
z4pA`>;XeK(U&`4K<G!Y`#-W{{8t-|HoGLHiOBjd&&&4d1pttpP3p>y()uH8-t1g->
z9vV6a5rZ2KIs6Va!HDFAwo29+<l)d#FwTWGg+|xWO34knG$rWMT%f)Ljg9v^5%l_e
z=JYZ~u#p_t-WY`9pi|q8RtN3A)HFHX`Pymxx%v_fv{G6H6LjX!ZtbB!LC}rDfV;Ms
zm22oOcFL<D#$k(_wCLO<y`R7M0w-!mgS0lNVqrv9k>ynbS}W8Gv{?|%wP`Jo`ffDU
z(JP3Ffv69w^_Ts<nMXh6&t?gFMq-ZLsjXSBcS&rOnV_9!<F&w~385z4l$I(}U0szT
zJUsgSi7f#(_f>smVn!+rlEf541p+VNRSa`>Ut*iEheGRFFp-|?SkOn$)eI9A&lNz7
zo*11*zD8bcDtaeylBOruluj5dt(K^SYp0ZQvnRF^h)y6jjdfM<q*kJ%h+zGSSGxc$
z`q5})s#goo#B1O;!25E%+QJQHK;=Cu@pt0%CU<8(q^Y6>Dnbs6uM~167}VTg8FqtZ
zxDA$JSA%lk4Sv83;sB|DVl;&8c>IkW_`nYwCO>fK$${Z1mr{e>A#gv?9Ssi;e6LRp
z3}LhN&jLM)9I9JQ)>uWzr#U8-hqASd@=yXW>TIKan8V6Lb~RfIl!LwZZB)h_`lF4S
zrZ}_(Z(z_3y6ffV=#1rhU87cEhtDPnEh9>V=LH?whPMb9Nkl(H{a&rOkK_^_)rJxA
zN;%O7ye60W)1kc)U%HJ-X9jV*WVxY~-k>fe=rKyOYkw*z4njd6+c=}69AV5muiq}A
zgDId#&^Xvz(1mHNrqJZ*ifX35De<y<LDd@?XSH-_zZfw#FS1yzL)BLOvOMraz@KiM
zMN|kZyd;R~!Ht3vdA)UVdIwK0)uuWIPN4DZjG8tY<#G@j*eRx4%ZZplU6s)YLj;f%
z^5}OZ=jBdkYPQM?L5ei=2^fO)tel1eA*a4BxeF`Rk0tkTH&GdcK%l4IIb{$A<>3^~
z4d4PkAmq_^rsP5j98bwcLPF{V#ZHrh1W0To7y)V@a0eF&`gnAPqg}VBUcjfmt-q4m
zvFY5mLA?t=$^i6HBZ>Ebv&T9nNl#46Y98wbpu0^e53#`GL=xXH=nQq3SEM`qq+guY
z2DAPCw3bO|WOA&L4t;%EJ8*;V(pqHCW+Z>k>~DpKfmy5cycDPQ!a8&`1{Sl=BD@jl
zX)H;foZf*Q*I!J}Y2noLm*apOe=E;HEm*D}Pj3-6G#723G5`eR)S6c$y17UGF%QVq
z_=ki~q14!zkNAL7`wKb^gsMrkUSD&oM_dL$+O)1jk2Vv)9S1-yp&4M)_7lzOUD6Z7
zEv)Qrjd_XeB&FKSxzeDp-u@P{=@5|;E)a4{@Q|}N)E#7mC@0z3*AJ213lqSlx(5Lj
zJo@;ZJ~Z4C<(tC&{C0|9JTO~tn%M)ya#LnudV-uuYC=T_I>+RY)OOsM{7W;{t7MuN
zOh;2x7gQT}U=LHhMx}VTgP8mtYB)HPZ4zir^_;@;#tV|CYDwd9BH5?eD~vw4b9@Ns
z>bY52sJ%;8x6V$Gnd%`LAmzx+?IzX94L;=~rspQ1sraZ=uqE(Nci=Mpg{=Nz=wLx7
zdd;pn2l;Inxv+K+JdC(~$fG*SLvFKP$|?0r7wMO7LL~w6R4SQnQUu(jWI|z!DVdZ-
zDw!^j3NTB+11hPzKX?J4%K;q*IJ8U`)wr0c&ffMgrUQg&;5aj|aHt-l9`p=G4YHov
zf|dbC#DdYHT~%nl1JjfgO7Jt{zI`BMNIp?XmwD9`;AaGSP;3EIMb(EUbkcvy4u!u*
ze$*d8UgG8u5K>(9klX}}vCyU(iiOgR<)EfG{esK-priWoywrzU{Vq)ZUl}@@1r{<8
zeILI|>j-K0@hddDd`V_PD^Ql!67efu3Cn~;Gog7Oze8(<gwt|5`uu1;I>iZ+Bwa{#
zS~?|qOLbK^G=-FOjBka;`(lC-L>ooXHf&&|hk|*MuyO&lZQ!<n-831c+GzfAtrQwO
zfLzd;0<&bV57CfUQo%@&8oFj!$X0=c1)mgj@-XC)UHc0vk*z<-a8Pb$C#RIaqzjQG
zb3!J&q2@qBI1QQX@&+3bebX#)X}0m;?ck#NqTCFqzP6y9=&zMRqREMQBD)kp8f2#`
zbv{&GZUOiRz(zp{K<wFsu}5JrLKw>!Odty5jKV;vv}<8k3@F0{auR7ekqC;i)06^E
zp#+1X9B6@!)W}H$0)iyMlnrnaenfs~01>8%9~L(Tnmn#dXd=*Lh(z^ud4=pUeScmv
z)<d^9X;DBt0L92&zlgeiaL8BDUy?6`1h4^h5)08UYf_{i&v)umnxudY%x{u|-<O*d
zhn?C-2I06NplOy`>&a|$+%bG0Q{tl-1gP5@sJaHjP8?zdo>J#3=?n${u?2L3lD%-6
zN+20dIFa5+&m}Q^-Jx+XQ?IIzR7*-x(nu7DX+$y_qIw8&E@vE)K{8(Y36MTfwV7yN
zE0J}`<RpE&n$@C>_8FuF$+R}m8?g@AD+QR=%~T;RAy(HYB`4$w+NoTu5)A%G%V(lA
zP`Tbc*gj*<yPFj)S6huo;55xlvjzI}U}-K;g<zGqPNgSCs}fJG3S7jY9}M>Pdjh3u
zaG7Q!EzqHN2zAc}OETm7$O-4h(m+!&Wv6e}XNGbcA2;~P01yMQEsUoAS||@X$i7h6
z=g^i{%SIPL_a4=>sGICb=-P7SL%KF`bD%htdf(7*{S3SX-Do!+iiZBj{|^0~rfr}D
z{NA)fwkOcc3-(U)4|%7vkPRqeB_H^c>3#Fn>;JS0jZ2`4vPkR5g4Th2l3SL7!bt1B
z6WSsb6(vH|Nh=_!tAGqKQ4L83kikJLrkwh_`AxxlI`P3O)-gaeUSN^-ZJUH1O>CBa
zkwa@y-ap&lRJ8}1`Rovlnp>-Ueyc*mhqkFob|VD>5V8Z!JhGO0%Li&UObw;rvwkep
zNf#O0tQEAE1<mq%IZX<oLAO*K7Na$qyrhfGG{`6~NGpA`EoAHEC;b}l1Av^pd53fd
zaPoV78T6l;<M(ULfy99g`k>~SVbp38ZhJ&NM%t_0m*55aGS!pwL3fgjO)Z8(s?3!^
z6lo)k2z=B&5S$q!Wz#-adeiUe)5>@>w?fP6I{`|1W0d~AoEk`cf%Ww#fi*wD!hRd%
z2Rg_;NlT@bB)GdTm5OOilLd7$s4We1FJ}Y&ewiCYWYgAAkeIKQs!@)eRdz^Z2S&#W
zdPjtJ5{Z3q`T{<4lZIelBN>{2BitZC_4GHAY?L!TOEiV%(ElaH6<05EdU}HodirAV
zUk<&BPYOdc&)ig}ltW)|82F`5hIaiN4<@3YJz62@A+QwKHN+>9N(8co&P9q7E#j5&
z(8B?l2yH4nv79s}Fmp1EC4wUdZRi*m2GfP)BQ>Z8JiHvroP!h=C=8=XweT5&06P76
z3;?9FO)II;68hr#dE6i>al>HQ8Z7-Y18uVisVjzh_ZE|oh;)Enl0LJAdWAHpkhMuJ
z$b3>Lc>7{vd0{00Bk&Sdc=UlrO0(WriyISEn~EawN>+)jcs1AJs#j+P$z)Ygh?7un
z;bE!?U{g}H*c2W>-G&7w)|Of!@SAVo2Zc)3ixHhpWs)i(@kLuopaCG&TMikHoE7MO
zriDB45^87{X@QYUx`3C4!p=l)LtgYWX-sS~x&so{rh3rxHqAGN40(29<`^g&q%iRX
zVttAIvtjlEV4`ZTP;J?o(k~mm<5V3LkaDcQImzd40&>zmK?U0XR$$mD5tJEUqJv5V
zKR`Peb!CZ`gQhP*S(xM0bgju`pb5@F1f(e!Ln%vyrqdXskQi*NG3Yd2wXvb_B=(Y4
z3AHiWlxS%4=!a6!lC!Tr%+)+<oQot%Uf>uyn>q<yfu>8NA{4tp7$QJdAdZ+6ELkvU
z0Arg`8c>%ys@hnZG$^E~u={{QJMmJy(U{0UiNw+;X@(l-Q#(a*;zS@|nT#0VS%i85
zgu2X<NMfXSQM(}^oyI@~x)a%K&t;Gs61B&rHMGZBwm2Y!IS1CP9}FbxUlygY@Acn{
z^4y-TN)8RUuC`2ZL-6^CQuNZ6T?P`P)e1qfT0VxS2BsnmkH@R6Afu5SbgA4zUcg>d
zQV~+H)<I8FFF~86UQ);^?89T*O1-Y-1?_8zT;zfs11X13OGnXrCI5wZk|M>lZc3V{
z+@QBF9tLB<oZ?GzrSzU^O7BXB<r4HDntEl>@btfmONT^P7cRNFfR0Ne=P}He9x`de
z2u+I&=v+Q9vAETRhdLUZPHMW`9NiQW+h~jaM62d8i$-m$k=SAgwjP*kny%!STBa-H
zzzBnp=(7S@`tz+X4#ReB{WJJPs4*G5+=<whqcsC*g;?wKfQ>w0JRri26%hdK!30`a
z&|4^h2tm;}2{?x;QH4=fTGPnb2C7ZKk7<pOi>CxF<@{I#nwVhdZs-Y=s-1Wr19Aim
z!YJQQ>NqU+RBJjtuujldw;2JWCH6KokUiLZmWm`TpIAj7Fjol4@!4MRB0t7~7T6dT
z!q1NvEb)Snh?J0EBl5#+12|F@t&~_krZ|)<QsrT;mC@a0G>S>k%BYGU!!p@H!{*WT
zl7b>IAIgt~LIve_QGO`?W`3*@WHd-ALI0{GbTyhw5~%^A397$06%V8^+re)f8df!A
z=1w<exM}-tEISg*0Eu2#B^PgmK1~>hKC*2tOAvLNSX15EI?2XRVRhSJJe8#BKeoLn
ze5%ImVjn3&+F}lq05pp;HDzdK>RC0jouo_uMnfbGCtzI%D2610c543?MQg3C_<V~J
zm`M>ectgZdD`H(M{nd7BQg^(z8N`BVsc{<kbUD%VaQpH6q1W^u+xOyAcj)JJXzQH0
z10^reZ|jiaw)SE4nH@6O34LjYez3>>&><O=@95Z-@7<_t9S5>K`s|JcNLb%d<8`(A
zA0014)SynS8vjAe+?db3{18ykARp`0nqW3|qHMm-?fqnyn@1|ATU)eNAJF*<exi=h
z7=E&j(4Z!BZKqPMeY9q?qB+b3^I*RZdZ3x|SA&#ZeoSt%+g;w7yS0zjBUeiRy34gn
zl&CGHVh>lh?Q${0&ROMo_wqHbRsVI~3C51;-*=l5Yx3QtS$xUc`n=NH1AC!(g1S(|
ziFc4&*R#7n0Q8^kUJwJ{(LK*YZD|u^+OPW0-Ge1x!7vGgv2O$gpOebq(!QlQxtC<u
zD(y6-UD`2<O9)KSd!0X}@SKCGy@lDJEqzD-;rv@l&JEp=!t_Tk=!|92<_pSLX|=7a
z8Dmw|h1z8dE8_cl6k$bN)uUVb-@0s$>@xlL9(mE`R;xYdaK3YszP8tO=*E=ZH?nW_
zyLz{Su^ID{)}FL#U>a#6i(l7kd#5y7h@Dz<z$!OVFIIomJDu^puj_yHc?D&>e9;&_
zXQSS<Z>aEFVxQUx<-bgl=w#Tf-`cl3ny{kp0SB9_&l)s_Evo)~P%e{!rh2za`mja%
zluLpvtS`M}G=?nc(i3dY+RJ>5?Wy)(?xsiD6*=^1e`P8jdf%&#<G0I@K^fCus<o^)
zKnCVC?c_>|(VrPIgzsIV|2CuttI<oZUc`3mpI(h6y`Da_ebf3Sa#=Od4~wTC3n(KP
zQhFgm84aCUtI@{}eIL->uUUqiUtKeRZP(ikYk~Kn!@68y<`1D8wL?bcAm?S;ZnGfp
zIH*gu$ynMEuaxo71054csxj@(@!Ixhw~}!?Xd|&@#OQ~I73EQBQXp$o2T4Q42gXSl
z;zw^Y{QN7UmD8q~Rl9Q5+FkLryUwiL7G%-dYxFI{hxy`b*IQoO9UXAXwWE0b5`E{j
z>k)Wl#Jw&H72n7*c8@-AWND))LS&F}Xa|<)PmOHHk1o;Q8=2GjsL>_mArgVw32Kz_
z0ILr%NNm<Wn^KM#a3Mzhb#jRwye>I>lAwtVf_>suJKcmJx1sAu6;-rayvZ)oYUqt1
zwY`)|y-R@u6xeMB=ow8pLV<cSg`QEc6BIZ^Dcw;5y+q+oQs5{hA%&g>90HZkA@H-A
zLQn0ee(QBtbe&7_Gx0+?7E^#?D6lX-P(=ZXp_C;upr5!dC3ywCQkde`Q(%SO_WBfO
zExoSO&%gePt_SFKw+TW|ZMzvbLV<cSK+h=H2?`w2Yp+j9K1r`fO(1$Ap52h*{8`3V
zC*I&?{kK!!Z^aK`LE|KQnyf=w0aQtifw1ftb|er8#*~+91r+x)<*cl%r2R%B;~M?z
z8#NaVD-Ch$QCXm=zN1>>_s&tbgyW%O^~4qIgppp`irzKVCMTFZ>ZidsV&W)*z$7|x
z^b(~KNah@9PgrUxnzWiLSXt>KZ|V$+o_|xfwk9!>tp^<fbV01WvBt#H9>T;P4@)qq
zKyv0{i)w~$zqw2HJ=g*<v8A;aHCi?UKl)WSx6Y57t5}Kvf@?`wY|07@g2qH!esc?-
zocfZQ4=vH_Z$2;6njDIjR1WR|6x@^>Gp+ULoD2S`-{ej&CW$d15N}4ulJ!-hN@YAU
zI`>+04%3R$8c@j$B%s8{99mns>{Vj@?s6zcH0(5$u@oB!i=;sXXK8+cUVO`4Y?<Dw
zqNTp;mVD!_I#}*y@^uh?@2i;4p3&3BjKKTkF$8>KOl$Un-ehb!epigmc9Esu7ohiM
zi1}dbeSjH!>!bMn^wtu@v>m59K$d`LJ1!sL;S;j;@#DrJ{ouF?gm0Uaoj_X+M7sc@
z<XN|kLGtgnQTD;(^H2p=6i6F9{vw&Jg<d;8h_^4s8x>^httWV7RoMx&IRS8oENU8n
z2H#qQ0<dj^7}TY=nMj~i&E*q&p>0o13`?jM3FK#iB|2eo+a%Qij{^B-A-#H18Nh#-
zREz9uZ|{jr=(p<NWJteddgnU`waPmPp*43<mciq*6JQD?WD-zLG>AP81l2o71BUQf
za%Vc;YVOQuRr<j@Q;cHu;9Z+oBmLlA=d)LJ_3k!oiaz-6Lj2x+cQgDhzWWCJ+V7c$
z-$(Dc8NWmC&DYcJ?J3`G!SB|4r?V;51Mi!{vT7eCE|H-&q7{;=Hi8F$wheL6RKLA{
zB4Do#--zFW%6$EBxJ<s?gx}efD7`xMfybG1FG0_!Uh!a_v&;6yct1kyzdri*zr^YM
zk*+LV@BYXx{3bnG$kMCNd-Nife>7Uksp#98ar*N!p7ucNZmjKu`mZ<t7pAw~_h0#}
zv3~2ny0XpH%m1~(mNjP|Y3cBGFjj)eq;<|mTwp=<eNX4u(gU;`3PVk~iislaL&@0n
zaqFuWXEX|sLg~X`F|CTS%+Nns+}^Xgih54fw(F_??vcD5A*`8TeoM638Qj?rU;gjn
z%jPcx>wH%UY-F_8m=8NU_A(230V&a^<{_;mmU6)5D7_y7aNsaZ`&vDM#@Z2^QJr`P
z0D&<S;IVt2{>{H{gK{(U+5C=k0oIA<V_itiDn@dCxmGm;c}c_fYJ?-^I_!*6&0dFK
z;BCG7*`aK;p7`7?Y`uQxb9aEWPCWOfvwkjBsn;y2NUlO=ObV>+!8E2*al7@d&*$-@
zkLyF9f7fZov|Rd~0SVVM%nZK;S-31jkOP<Hxu-sXR<S^uK5<!3)>@A&8-?H8s`H==
zUWMP*`r}nYT~wPk?Fs$Is!=RUAF}*$_H*^O%S%~sI9aPsz_Me*(mAjmw#x#3g4}K>
z9x<!+J}(v(%k1aY*l7)4DK2r?ll9dv7P;U0Vl!c;>0i9Ku=yei1Ol2rm0Z0bBmxQk
z6eyY=xCudKmVko>9%Xvgnk;?e3Xl6G0?$O=_gAz|vkJm~2lAT0?e*l9!5CcW%62S8
zAGfk8U-*SScjX2B>Oa%qO+<rQ0pBEVkEAQ{W1k-MqH!A2j(%2$)g-78gaH8xz=}XO
zw3&9i{mCTM0wEa26z%CR^xT)a#Tqm6rMKB(y=c`_@U?hjRU8J#SEaeFR_eah?F*~`
z7U|STw7Dz1ox$Wd8R@uYrRz7Zz7mCPT-~J0HflCUFC`HM3S<Wy#0+Ghha*yp>kBY#
ztK;<4H3f-QpJB%f_2~y!q=(?{*B}e^b)l^bR<_YzoVuo2tQXg;xxoDn;b248pIj4k
zTL|gFwJGS|PHQ{2j?ktF?IoZYV6NH@f_DWpglKro#_gt9J4#uww&~S-DF8}<LD1;f
zUVhp^FRK6<q?nP=`e7kIqifFDb?Mc)u}&|o9@*4FxR>8W%WSJUtZ8EXy{S4g*5m`#
z4`Vz>ue&g8jYltRx6|GlwkRn(%sW!G4$vb&PNx`3r~m=lB|7jWTGn0mrnZyb7as!m
zBL1S<pv9mV(A1|^^QE;2;~B_<`v`hY?mZeP+RJ(X#d@>XXnR!FM%!0b8*BhLU={@%
zEpbzrdqKn6CuXcZ_T{mBZoOXrat=Lye|a!H2E0;q<CFC?8z2oq`mkAJ?G9s`vs_Do
z-57N5!dwU4OJxppFZWEfebKr&ZM{iKlqwk+1T3skqSZWo-z!(99i&X4V2qqb8&?`b
zbEoLNBL!{?cYSi?RdA=0^{w5<s%nYWM(DwsEH+DjV0|;0kfU!|-wki4*AK_<@K-Nn
zBlKrq9fbGU8*-kgb9iC5!yv%v23hkqbYgqNnrxP%Ut8zV@7|Ci;X0$dw>GrG`>LAe
zdiHBcEl!w~p(RjtS}AZ>>5UC9Y!?*T+?{Pik%98SEd7$#lHETMtOKQwc`Ywz77uco
zx3tYKMHDp0lLTM~z|z<9P*Z7*fq859DJ#Kfl9iC7-(LfQ(Pz{&l_+&|S1vcJI9g*?
z0q>RgDy9(twXpf?d7UK=q|RuwWHb!`*5&XG3Ovhz9tb8r?~_*H_q?7LmU%%)@c>T|
z0D8VbXTVZ;MrTmV$%jdMn&3TW)=DOCZ7C%so|yz1A^r)UZoOYkI@(O*y^cVgXp%YJ
z8>8dBk-DX1eN#PQQ?h$I`VeIEh~8|I%BJbPH(iB9IrMgY<EErmZ&EQB9bTroNF%V5
z!Pcd^Xy?EN4;GA50F72?CGXHLcs17|kPfvPN}60-%wEx-t1Yui4ItR4uEc`6wyp>%
zkJNScA6kZr3bdKPCoogrQP(_SD)ba;S756CXI%?`QL{Ff_)xR>EdIpie3?LF4yXOi
zC|Lh~b8Ggpp0|bS9I>Ss?=!bVEBs_j8$=VGw%MBG-bAIj&`G_w5^0Uv+BqhDmTcV=
z<98KrWT$L9Xt35^5UlV)#;PVTOn>T)0kJH{-yngt{>`VDPrvM~U~@}MfQd_&L(C)+
zc4u&2{i(P5r$0*^4SXBynmosy&|EPruj!}WDp0Lrz$?J!II(_OdSZS!3wTc8A^pN_
z9b>3Iur1yF0+r@~NLairJ+z7fkPp}-lG&5dtt1xX*z_mca@g7H0&v5+&VTzkHc<cK
z?GHmSCQh!DoX|eA+>hUBSyXMd%pWjWnZd1znSNukJ((0}rx(B5`PwKrRyVS@V&Gp|
z;7GD-AHa!=kp}_^c#aJ=%+WwQcn(Npz(cIQ#%7TA6=fwES@&)*h7nY+Gpbl<RY6IC
zgSu~fw)<%_PH(e4w`mkTOX9`Q`_Y0MxBaS&voU9kuTS5<eNgBptCj>=KW&9Tyx{zW
z_On&SpdGoX(Ymmch7MMVKoax^cBnCmTfXC>IAQ7{xo))xrCAvHDLQZvqr-@~S{*|w
z#X1@ts32s_qd|;z30cTv_&`uY#uJ3GfoIQGcp3du75%pNu60|@)%PG^DNcIn`|~j$
zK6<}rj5^hwDr>K6JL9yu@||tZPXRsJv{wlkDbYxpK}`XxMaPg}j}aS;9F$}{WS{u-
zPj>dXAQH{&z}BPDNVFK<yV1;kH`YFcvs5{aIbcmLeZ;O{49)4g3NVM)?8<OkqFLXy
zE0YbY{%%)i#{AX(&sNdn_5I!O(3AG;&pUHJrQwdt+Ik<W4t@Bp?SFww-+NBD>R%3c
zY%D`R{bef4s7^h!m%E?D!ef`0C+qkARG{xV_BqzIYmU<@`IqC@V|6>^`^Pu}hkuxh
zz`Z~2w=uVV&42dbx81J=%w2uWuiF>``M(vhW7UIxyPP{KcS67VRbT!`bLSl6^`k#J
zI2RkQNvAGxt~Oq8I@P71R=(0&59&QgCrhpd;IsnwUD{T4X*&(zH&5l|Ed00!TwTbq
z5NgFh3@?24XfLmovhd?4{><SEKi2d9%%jKof41lYXpKz_dWbZspvtH(XIwTD1mjL1
z2P|x4=!8-8ia(nUqnbS=W#PeS)!2g;hwlD{H)k}G{089HPW57THUPKq#z~HN%=MOk
z^~3hi<i8$ad!9Hw61xT0ogT@ZtM^kcinkcc9eL<edMAxF0k(-+nL;6Q%UDMnYBJ4(
z)J(1RGlXZ*(lr&#ZfZS3-_X+XXDZ_e#rxGpSS@3vN*XdPSoezyIlIESn95xcd4{u2
zc6LPUaYBeb`{g_r%i;UJh`_{@$e1Qtxmmm5c8D}t>3f(MVRk<zw+gR~d}%eUyfbJM
z2L&tEJ05Ng_Xre&{V4pw2@M!S9}1CQh+K}p@X-q&DX_njzH98(lji3lW4aw?elmKI
zQ#A$$&Kc6i4u5XLD+3c84kglC6Pu<`FF+Y?Oi~Z+d~?I4!&4B(J~OOTR3O~;$%MgC
zQUY-;SeYnPMSa4do!~&4$_<AMI)8>rnRJ;p%*JG&u-@Pl3g2bJiv!CCY%RkNO!@=a
zzzRtKX|t)lfC*DjwwY@gW3Z3RH8i=%XtG^a4xH^qgFU1T$p)iPpy`p(cr|b&g<T1P
z`vz^cG9U-t7^2*e=#KKh&4}`li#PmZNe_^=<qK$i4a~^~ZJM9qU0ld<21fz)WR#;k
z8{u!076oY|_o>(nmvT|%`orJkWujINED19VophGLyFJK7qe-?jc%7qLZP8JY4iKhm
zi!tsPQtARDK#CwjDHtRBq@YU*11=9`Dg7}APtobD{u3~*92i!kU)(g8kSBo7CPFa%
zkxfDfOTEZVeH&!x7&<)%j1zz{ye-@~X(KVlI~*P0ZzV~=N2K6ISw4dlAeOyG3%tOO
zJny}d6pUkxh?4z`GJJtl?AFD1ahSI68g_9)w2R@eWD<*1?Y%@ccJeBQBR}3$8R5cN
zC`<=h+@KW>dSLlPqe6lRMB$~G;9jZnl|9slrUpqYtA6t3pz&%?{x7uLg(5@ah9#nO
zQ-;V!H{cY2?0joVpc~OudgXT+PIM~BUtjcH2D6Lb7qYBu7|Z_m9K}z=P}TitFztV>
z;@YQKroQ!PK|6zHF&^kk-k>i@Cu`W1@MH$H>Uqa5>W-}iYAH;B)KY}dQtbhAqLIEy
zD`eRAap3gteh!hF+&I_FrbJpNu#0Tr6VKI|Y?J11G^EjCQoFW#2~s5!g})%ei=$x*
zRZ>W@T+%1!L_-bJ-0^9V1eO#Amz;w!O@a<2e(|$ZmLt50>?*b;azi4!ggKXx4f#l9
zLlO(J9K$4ir<z1I%}N}%(oVup!7xfkehsj#tWgg6d%$c0QZdZWVtZqj+YVM>54Ku@
za5^J8A%_K9AP4^Abd*hY&|Fy&Nd>dY>|}Pr&Yl#$3|5Y1&gu2}VnGILkJZ-u87wbZ
zEUi@v6s41*pu@4UUa+)wUM9oRN)%+W(wq^hyOn|j+G--ZuCc@;wiB2oDl=s{>oQp}
z%M=GQS$AY>lEs=K)GLd1G*@&&WTDl2#JxG_m5;JmJG{HIC9sUTKAT-^fEKe6Vt+O(
zB!C=QOzRv5hY!ly5@}UAGVOyL)(KU3a%J^odk|OW;@JJ;FNn`_A=2=CJdb6Iv^;jr
z8Ii+K*zr6ZIN$cYsBOYpXCEdVx)QsCJHOuy`l~<-Ly0{=DuKfSQldw}w*;^nHd-%Y
zePF2Ji7W06A(`UIE6;+Sh`HEALLac84WOMSkPk&}01*3De5ta5MOE{AhGd~V_|#CM
z0Sn&+Fp1Ukw<zU=i63<$MGOtHp2)T+$kLKz#b8pDmV~q|K^DxD^}^f5z|ttItU|(2
zwLHY~*|(7vA=ZR7p1x&^(ne9bVaOR)N!p`ZB14+8_BJ+E%xums!sDanY!V**TCjfX
zlo(&Yl0{VumV&6)TY#ufiPQpijgit3k7Wg{EBf`{Md<TC3s_(3^NR|>jqsdM$c7?q
zM<KhJf}M(t=#fPXYjMglkj;vGU&J;tc38Yr%${Xeh)Y_r9&DtT+lpQ3p8g~Z>~Mw=
zKel4Cl1@HGrh1}oh{!;dc&s(+jeH-qW)HC{F{}-HDDR&Q<?~9|sKzIcZJ~_~NF*?t
z6g-Xy>|B+w%SBZQD@|T~X7b$Q;@1*Zlz6#h*rbJE3;eif)0TB;QYC={s;dXyD(570
zwsk>);A8oCtUe|l1P}_2v}F(Ts$-(89c!I(IdOh)Xn8gZ{h??t92XC^W7Cq?9Vg5#
zGD;}L16i`#v(}9+Cr{rP{Gnsw>h`SvIcwk2o^?1g@3v#Y-GSZ9>yL@!9Wafa>A=!}
z;VT`0v=LW?U}i^_%~4IKj_d)~tx!i@fm<URJF<^$9Zni7#*0xfU(fy)pyh{l#Nd2y
zpT|5b9i{`D>hJ4km`PmqW8*{hR|GaizUj)~Oq49Tm$Ig5F}2sNX5l=tq4tW&rK}4;
zR+X}hPEk!5OdV`c+Zol2p%Wo|igaVi<l#VwIeS!w#h<0@2IpL<H%D&j4yJTrtS(6U
zXkDZ>`pDRtfd{(9hsSPYBkANb_Sbx1fm%HkwLrXkK5HLc;R@#k>~`PLuY1sva_ZMT
z0-AXE0yfcYSt<lC19i_4y~^N&YOOTIxH6U>j#?Tr<gyy;^E`h#u&-0(*1lY!l7^+7
zAd>(V#r{mvM`1$n;|PScf=vT}WuNHfPa}UlBS|VpP}gEM03?yMF36!8FfL#V8gzCO
za-O&YX)z;3x-2qCDlJT3DAF=gh$9-C7VC@KdoUgI)6<icx!1rpPxcmZNl%u|YQ)%{
ztfl*9ibPAq;+`xuYBCV7_hf2X4aznS$|!*lRt(VU@FK43gO0P-{v!86*2Vn`^#>I_
z{6h9ntoH9Nl(mO@u?NzABM@oSK!>3)*iMzeP?6RfNJKH~+goBb3X#n$%xJFK&$JL&
zwhi%eZ;0p`v8Ok?F3GCGFA*IodiP=78z7n|miGZ4pCgV@6QX0Eei18<BCQ{PBPhmP
z#Hx&LYc9I=W#d?$c(E`0KNt`5M4%r_4d+F-d?eYNGP}u-X{ZG5@HeK7F_>*LLY~1e
zwqPO!YM8P4CAT4{r-)t-Q9jy00=NxEHnQ7W)aFOJWl8Jh_sb=bWl0Pp8*MsDotD$~
zn_(|PmZ+J}D9H=*D?`~kC8cBBN%8rXs&z^`6q%@q8saMROLJTvjC=7rO}MxqX4(mR
zNsF=?D9z_+m+Xq@Sdm#swi^}-vK*SVSo9^gf>en+Q4G0uK|z%}QO1E|YiglhYe4<9
z(N4E1WJ^a)tEUM0Xt6f^@m(omSAUl5KohVtaeP-O;vK;9IlE4jT+9aJ@xaB9YTpa@
zAoiZ|xJWb^%v>qmN$F1sVSiE{m6EQ%;(;r8vKTm+4LpYcjI19FP07FRbM$S2R*y$u
zrs#7S>&7mMOu3A`!Fc@v(eDa&Mc~u{Vs28CB&Z{iRadYbEM@U`2uKZ?9Isc)keG87
zOLf-D_sEM^u_u^w>oI`sj`X}5ay7XUb~wwgkPb&Gf%f8|p{zx04!k^+6~^Yu*F#y;
zSg6r8ti=5QnewpDDf(W+a^2G@<VNV$YuGi}ZK*>tLNL36h-kS_JIjd50l=Ya*zoRc
z5sz?yKqLTlpfoRV&9bsX!KG~AB6y?Q2k--218v3q!&s9(vJTnhpaZN*X@R9Jj@lRD
z4NnY8n}Zl>ib0KX;7!B+a|8+YBMuE?qf#vPL92d7wkL3UF?={{?vC=&8N=Cyp{0}y
z7#VQjwtxeP8Xm6R*?yKN-V&^L0?r`Q(i)}!kv^Ywu!EgDMgRHWb5&yOeAXO~x${{c
zJnHAOCpDV>+Joleifr_XHpL3jR=GCS3I)7!k&H&*Yys^*pyTX;ref{CSob`vTNUjg
z3sjm$9=1Y$uYTRp-1eCHWRqcjh*2`1SvDC(d&GjIX{<eJg%V`Gbj(U49~=nc@==*#
z7=Vp5>=VbOVU37FjMI?7GHNFxjIoJqnu(mm_$j*+r}r9U2OJr%q#?)l4~CquJY`EY
z!1zR#9OF#2Wyyi*3hW^W%S({MU}0KvjJ|_OQ(AJIIIBiWV+YQ+n}!<_!w9R<FkN$!
z5ogHZWHR71<<Vbc1EA%yQ?L9cEt58>qedyBCP{NRuPwq0Sxz|U!{QVsJXbz(Ai8{s
zdIzVzCk0_sqnTk@XyCA8S!gr`CN#rB<0n-WdC0;-r(FH8s-P3iTU-o&DXmuU^MKU~
z1>&HII|L%6lUE60$_Yms!#0yhQk;4%QQBsRBuo>S9a9r00abg<Hse8*>=+bCwiyp~
zn#(eOk=}<+qn<Q75vD}b`UOj9c_@kOGaj66!#ar|$#WTRFwn?DSV=|%U9%9R10#4O
zKm?J!%(BdY)Zi5*wLaBPHVGMmJyV(^<o>2XbQlgA7Az;oe1UUAWT-(%Q5Es_LiS3=
ze=}W(?}oE`8n2%L&rlfuG>$PYhdwk#+<7g#x%r>7vG{S~Bmnd{4AYc34T8@h6|_7>
zI7YB8;qPY|3nlJ%8<P?YH`QysBKLAC%p(hf>yP#b6&4G=Wd$)+C2K%-Y$`Hs18@W5
zB^(+Xi~+NWX~$#H$p}6Xru+t2vQ+@$KWPZ|CE;K~A$4_pCdq<i*@tH~fI84Hc*x2G
zZ3Em2dII%c7#)G@2rUfd&ZG7{RVPnP#1e2XlG#3FJw#b4Cowpty?~;vpurL)K3jo+
z6%D9;4TBqHFih1a_`on@rT;5dToUp<-7t6{RyU<S94nQAOB(`juu{Rc%#M;4bZrlH
zFq$aNyN(r)j>K}2Vz#MaaA(6{tw}!|9ygM4W5~g<nf7nM(VAQGOp6#~%D2>^v>M-W
z9n0+egM}27Fl76sVQ{Zi8)h-?*RWdacZxOFvsBUUdX{;84H0byb)7AW0(d{u)=+|%
z5_mL0`d?I00+B8FhlMnzDV%q#>gY&2)4nr<V&(NLnEw;C$Q^hL&VD2#&``M4oI<4G
z%PFmjq(Y?%*A46*erSmpJ(q_<42;!qC6D<V!|a23O}iH`z0DBYZeXEM)HxgHhhomz
z5IW!|@Qvnx^WDgD{ieG$9oMa2B0Am3#)WJCjZ+svupO080?(wQ3@`|chnqKM88Hx4
zgLSBN+(M?Rb~-mfO`wV;nDla%Kgg}(90wtZycYgu%_=#G%X1vkl}J0(1O>=fk|E@^
zjqC&cP6P^Z$&OYddX8cxVapYp$~8Mgx?&T8#;Fil9V&!whqxrHm!c<6Ah}Q+ojkF{
z&VHb0<k=5+-Qz+uIvjzbvB5$*j*OE1g4$r$42mB|u}^bO5vue<1`}{;qe>Du+E&r(
zX4W!OLY&6kQ5gTzO$O2-4vC48?2}IEBo0uDxbbGTfE}MVn*Gdfiu^K~ZQ=HtmW6V}
z@d}m}`JjSLXNbRMESt;Po$bbhf3`A-;5b&2H3!GbNFbyb76aU21&>_B!D3J`4mWvB
zi4@!hvmC1z1IM##*>SOg9`(XI0S!1ViYKt)Y?*j;0=owf=S0?uy&yVFWI^~#HyN8I
z#!O^c;W_W4yx&MkKR|CM>Fv}9n-#4k_J(rcbxZG6A0p{6b``a%mujO)^XYvzevBkK
z;eEE2E{>MF+Iqtf<r?cCUi-dqO~TEabN7jTlUOKm?mmqUQ<Aj`$9qM>?QCyHE6zc(
z-$pm!wNfaK1I|t(Zqq6cz;gp?1|10|b`e-E(kDx!;-!;W?6918a56i_57db9cd({>
zU5%J`2fOP3e3(t--pTsAZomX{1#S@I?qmZ~Z$Ohu=$e_5^1uyvkn{UwvFlEjnt21H
zy-WfnA`NcFnAV<hB%i*Mjb>BC=(|`Lk0W=nIy_#un>~t0$9u4Zn;d!Q9@f*wzK*<e
zKl?XhVKKInwP4}Myh_lO^VCCR%#4&gi0vTOS4^0~s+@=RWB*}yM4igq%=xnnh}P3s
z8^=ly^6RZj)5Yi0Stn68mHWh|mONLqdxWX#-xUb%&m&yPBZvoz#e_##e|H_pibmkx
zZ#=@D9u+6pLzpmek~)ZBRK6R|kkJ)Eh<NQURFGuCv|Q*x`!vK?E5lG&eJVjb2w5Nn
z#aoZEe&Kl(BC!u!3T#e>+%*-ObOfKKbVJV}djm;S88lYX(X|PzT}*o}T9)J$QaoW!
z8|79<6Uhk|(C<)0I6zg)jW(u{FgNR>J$4f2alzkWK{weIm=@JOq!^2;CVq1Ei7lJ3
zq+(H7Y-$t7sVvey!gPku&<hAta*EPUQ(`g_;mblkEl{CIvZcuwJJ~Iuju4EYq9q_0
z6@8}rDbr>U07=PSegcRJO~Yn|7(>3cl@RhG6Q=E^YUp|fX{It{C}D+l7}G2zQf!*Z
zS|t4p(7y@D*{yhvXg-Vmk#!fX3RHh08E0(Jh>6sCK$--`if)gw(#AuKSXyonq%SZ{
z?0k%+i^Y$zytu>wC8h+XMUcoD8!JAX&59bWkOu+fK0OSx_P|{taSrPnmo0;`<)F-4
z=CI4zU1H-LmchnGKAwYp3RV$0`ZycKnpGG+LDZXIZ(-wBLOPR8OMR}@ET$PKChKf<
zawpYJD?qL(7ePcq!eD#hytym~i{>lmvhi$TWZPV}jHOxJOy1>zaWuG@m^P1Hn%?lx
zEcmT);#3@;$2vMsRf7xf7KMV%@E?`$#H?`#lDPkA_Pl4sJ9SDBMx=K{@gg>mpL|EG
ze1;Wu#&Qm)G_{4e&gXrwh8f5M{sb)XdlFgtWW#)`I-sXwnQg?7w}NQ0n5E~<-JykS
zv<@p%$>jnQ#;z@q=j)mF<POp38J6o@PsJV)9iCxLJyW+z93I*#Mn1#(^8;H6hYl(6
zHN#qqLXh&yGfdOgy{UyT;teV|X_IaM+RJYm7qfu$>CzncqzOSN2-t9vm}o}5kvkT%
z4&3?kSLmA=ku}e<LD<I?Yzf;KwTLczYYAga72BT2){`pKrL2$*6#bUMM5>CPma^8p
zEUOyG9_AFX(@9$oSrOyC#K2~;l-1UwE{I1Ciq)#<eLhuwSlqOXwRF~#_si~xSOzZc
zJSqdC#d7wf^OW(vc{wX{&V*qSK<*dNN6A&IY9ZxSjFH?-a%l5ciJMli;-t&{jx3UR
za=U2GD)H|XxTdalmDsleS4AWIpB3ylOA=qLWGlt4e4Zkfz63!sK{Q_lBi=u|jzu0{
z#YV7HgA~D2K_qsI5+jZ^tT7{joVga}TRcnGvPoHUexscwSS$=>ggh3s`G|v8P|3^e
zTXv2b#hA71!mOze(rKKAh0H|U|E-W|XDI}6|7#(OUS(5ocS2|bE6z#C2Jhr$QEN02
znB@>J$~Um<0+y)_{%4>I$i7cEuobYaPk)Ww%eo3j4J?h8;Z~H?u-GY*$i+427g+1h
z+X!uNj@Z1BjSJ3!2?o3bo*Y!CuMwk5C{(9+i=DyPp#++U+&9^UxW|E`g9AOqqD|l#
zrJ~VW?0(~sEe_POW(@$c#i}=08*x<~ODp>4amVDZi?1k4tf^zIqqjzg!*%Rg)?GZh
z8MVnrw#eTC!>V<is<>hcyXOB`N5jU<5wC1zX`)vxtNnW$E<AV9|JY9#82uz4|6lv*
zA1f-86^Z_Dz|I>#RB<D5j`<K-@DAI<p`}mQ!G@%7hn8(P;L+kl#SL^s3&+L59qg^Z
zOiCn!xwcS(iS_TXrtM-`z?R5|Yef{SreSIFs!b}*|2}&jHCDgRItGsJvI;##Z%4$*
z_gQaeJ>{GsF5Jnkj*a>AJ3$oZ6H&AkckRM{yL^|Fks|)H3)^l{@<{%GU30F6&-{Ru
z;ra)$<3k``C6abCY@>>{yV+B0uh_nu<p*|tzr{HG3~vcY?n$qF#I~H7qnFHK+qP({
zcyBig1!@<W2d0fYx6k{CJtXei%dUiz!0x?lHXb*Af@0v7vXAXeoQeHjEu^icZQs*O
zB!0^7^+y-sP%oDV@hO~AW{9ny!a?9M;jL$_aA$z%TF<5$R|=4EjuzqX)U!VB$4E9}
z^(-<!V`?M0sD@0%?W6>BU`eFkXDpNP)0-os_On_179B=UI&heXlWTO!4I;K1BgC1O
zGP#xV@H(9K!9{Qg+9zvCSnbG|WEta*i)k!ld~q>!`6kl>R*bmjAiIb^yiPoS5NxDG
z4E%!S^pk~U{;l}jzZIYJx8k$UD8Bj&S$yQrFW6z8y#V48##&e*$VvbXXQNw<X#KE2
zoc@Xp%sGWYqCIiC^b0@O4uC6LpcZrxw2MKH+fpO<eU1H1wm{S!Mu*8<>Eg%3Y^ePS
zJ9CM)`8++{G}BK6$txFUCpz$P5(d5|hVS566<F4rx4=OWgXILhK?lX*`iQ=yl@|`W
zhj?~*UzjLJ2cq7RR}_--U^6NBQ=krE7UJqQw1G>nL8f(}%YZ^;V#d`X^4%r!M)Ry*
zb`(X*ITd9$io!`2DvAXL0Jy9o$ROH*mjkwUaC*9)3*L?LhF`@%(J2mYhxkrx#$CA*
zp$Yx5u7%_$W+08p^kxrn{osdL`eXB5m-j-mY^ZJE1bE+L*-Oa=+U|I?B?cwr#u<l!
zEEEKYacO{t{@(mdab+D#Z*mS9BKjR+`<X5ZzhQa(c7E4`Xq8r7CauaC++U3tlU8L+
zV;N)8s*GtQV@z7z`JH(D8xRwopMJwyf>vGMvRtG1%)b?%`?unA{#HEh2?q+X;&1)d
zD1QC7?3i=T%P?E~8hP<MDErREG9cbK%7kmRd}ku>C-w~+B%1t)y~x|df#c^?sYLEi
zaIhM1oat=*{|?{r1UmBb<Lu&daZTqh>^y$1t=ZwfvV4|NMJhg&Y`CD)-L`cKZY&Hm
zRxy2s+p@&!Pi(1T+ewyDjAbMa{E}a!G-m$eWlqBP8~fNl2ckkN)M`j#%oHbnV~Ze8
zX8+D^a&DL6MEvnPyV?{Yk)eOE_Ack*I&}05p>w`mJ^4nNn)xizt4~esp{OaiYju*g
zb8W5kRf7gS%!ZGyoP0y{wDUqXQH-_owrpbL89Tq7J8NlRW{4~o|Ju1zzDJyHeCj6Y
zhdr8c?-%iuz{O&_hu`8xq!;&}UL(3E@C(_+;=u&o)On5emn+D`elO36Y)Rm0j9nbr
z=jFe$tPRA1h+OC&Rz|eqq}5!YoA}Pp^Z4=4#BE7DOWc>pJz3GS$6zdZboSVWGnkl9
zJ}yr9c_y!q16I!pEUjCZ+uGju#nMFHm2D6Q6M2fG8w{9ST$03d%|e=_o;AN1n8br7
zQvU@cvLuPGwK;e0frdUq3`^#7od@K5#Fxf5LA{3nPUqvG!FJE!H|AP8ufca<4j}Ge
zslH-k28XMpsL$Z%rKU*!^%`v~V>_B`ZnXDYl*#)yJfDO`8WvJEq_!8cGI{6B6xtxy
zq8VX)W?)Q|`Lj$O3|Trfs-^^@5@TyH>hmDfEZ#nP3{_l{#XIl=FN?>saOD=BIJ<W_
z|EpFs&gLO?jwCxd5x{$;U0ADx<iLNF@~gN!o0mH)<z$a+&E_i^)P)JTy!p-RfRjlE
z5M~%$u+~5~j4swlIK+(xX&b5W<UOUR*wz8J*I<W~9#?Yhs99%~P_6CE#f7!h6sL3f
z=!|$TF9XS1lnrexoX6A6wWL^>$A_|)#IJdL5PM4WX~Mg}##`BhzjQ8kFhJ#1>>NO%
zafp+%Zr2beKiTOaPHvTNhj=O9T`ycsc}oP_H|6~kckk~hFVM3?L)pDw%xucDkyO=`
zUxLT)P5H;f{5)b`KA+(pZ-_1?cAj8q`i}Wo;^}5Q{Tw__e9(;dV0$8|&3Sjm%EV<Y
z_-lc=dtv9rjS&jN4yiV8slbJrc^uF43wQxNM;Gw<>b#}3n6(gzyd3+V7!${!>|#aH
z=oWuYxzs|QPtd&!`IE2@)EDyBczBEW7(DJQ;+^nVRfOu{CtAc$p4A>oMk>=DdZS1v
z=KbB4K}`%V<`;yw(Nzv|*9-1VOxqC)l5Ne}`NG`t7}mKsgDK2Z+6M$LZJhE1A`Ge&
zf$Q0j!$pJ@XG+A;IRv97R$@Ljk==^7DT&+SrDKd|m{#3h?GQ>mn@ui)QLMX{w}+SX
z$X9s|n<eJA<~T?zk7kR{TXS4VAu`+WvwD1ser>?9_lSe{@q97A4LGTM&k+~T;%@O-
z8=lzc(6ZXtSzJuaonlZA{)m`X!jn_`VXxsd{GA42KDo8`;mghf{UYD@Kso-m@L37+
zj+YJy`jT&OY6!*(<2VNCWB9Cxx#ds3CFaQyH!tH*-p=BeKqp5`zXW-OHuBKP5%Np$
zg7d`u642|I+*196LnvKCYMg#>z#jo0d@!67<hc<Wlsf4eDbJ12o%rUt5wI}xT6`xE
zCH>wR^GzU6BExBe<V-4PtD$d#q_sHT1Z*}Kz6k^1<A5ui{p6g0ojrJ(6IIF!PyNxu
zBYq=-93J31akf(<#z_d;vrGw)r$Gw(9tTe3u@Qa1cNy~g4$uv}%M$d!$3bzTE&tUv
z8b>peK1+?9ZpWWzEHUzY2i^})aiSyt>Ku$FQqzTxkN5tfqoAhum)4a>y}yQa<xjDc
zBR@lKnJ3q5+DRD_084ZHLJ1KAY9^UqqfiTFh@euPD~xx56^lzsd2=3FChjVQf5hx%
zqNWtQVD2*UMJX@wKg{S#QLqwKo3l(b>CUs*!=h_<-aB{JGI_-a2!u2N7-}RS^*ReY
zES~Ppi(GR70!MA}Ln#kZNlL7wQ{8!czJ8f#dp_R)qqCDPd&S9W_;!#ynI`@`pMRS&
z1buF&l$gRXP5f~ICo{E`11GYGK&FW+%lJ)fMdbA|em@HsPSKb~rU$j?-vb{Elyl}S
z4!w0@UtHOLo6!34=g%=NqDdcqDL}94&#yZNXyk`J`~@an>4m``|G$?#{(ma_<i+?J
z8|(oc2J^w*2{f1G(nk^MK%Op^4(3zOft|SM5;SCjSa8WX8zQnU<^9r5JhE9Tp3p?G
z?S5Ct@enk|!{Y8sd0yhlSQ_FYOD}~2bm`%2o)YGCpb?*^^5rWAS4zN<9dH}Tain_`
z?6vlg11tef-!PKS`Q5Z;;Pi(!JsKcmx<j<Rj%Qs>_Ia#O;nf8Z))y3U((s~!5=Nd*
zII~8(4KA|NlPws>z=)rahHvl_iuHwL99DEevgN`j8yc+G^#V_BmZm!C0GV{LN*io1
zvz1}yskkgx9>)R0C16o|Id6j-2yANF-OF%Ow^lm7B1E@u!`Vp$ujeVFaVP<cYq^NU
zM**ZyyYZz0c;XWq!i~n@jIi#KFO*zWfKlT}E-m;I3@7*mt$ww!rJZ0{k?Cxlb_j8X
zpD0kq4Mbo`8DV?0PqAJ#{4Oy`ppMZ^mR@;doHMr8PoRY~7z*8qf}VtZ0c(BS#ydXb
zq_sZn-N4%mndMraR5mQo;f+;jd^w8xOAeM9R&X>FpVJ^BgdZBdmP3LhiF6upNtg!c
zs(6=-!<G686os>oSmBcj0tYO*Z5`fo6~;MVI*N=~&p_#t;p&gUME_AHe9{o#Lx4KE
z1IHQAIQkX~5|I!LL(eqMk)p})27@Bm@bEWH{WI6;APLlh460q8A;nHw72smkp`8t@
zBN`<<@MF5;$=Yoy&MiuBH=}mw9)wg1i9q~MqR<QCKcJw^an!HS4bhN|s=cpNjis+M
zh?K6$MkF0$l&!XFPWq?{CrWghrWJ+y%rvcdG<#UuN2Cb{_q@amH>!f+q;&)x(@?D8
zq)%c%)DA!iu(!xto()pPBqKYDL<^pQG%$F#8y^usz=7Mq@WC2~R$LxT#RD@T36G5O
zaIi6uOT>W==cEu^OHi4b0^JgKt<zQa^2)JN5*uA`fjHeBhS$;%kSgFE(Dwl7Kr2JJ
zlAy0ZA-)v1MXS_IyyJ)u#DS_vbpS1)WHb#Ix*P6*L6JIyV-rRc4B<_}Ft5OnMzm>D
zfF1M%4!q4U>?*(>)I)O+`;vt`MShzOm*RxddZ^Qv;R<XZX9rur0|Th0EekRg+YYp%
z`Cp1||No+Fv0^ySgZn(Gtx~nJna;A<6(y1cD&#_1GA5`%k;O^xRO8gML9x6HOD(8W
zZu#*z1AQ3fs2~}QS6K=z5YhXXsPbzLpfWo3>;U({RB)Du0~ex`p)1+oCyQu!W8+L5
z^$z$SMU>HLJtIuENRVGNj81mIZ6g{6gOJ{~COo`r@u?`3<OEPW#d%E!Lc%F*BjSUL
zG2Kg-N~~`0_fc7piUWhufTIVTA1djqmMY*0eT;Ho5{9P{vc->lBP3X1wUPA(^#w@a
zX88tV-t~+@Cy_(mF(5;g8Jei!3P{M(O4azMK^+$F4dppuci;heY6j$~&`rXUjv<gt
zyP=$($$y)khGi9(uo=^n4&^tas!@s^!;J@gtAU332@XtKa*&}pL=uKvl+BZBVHZI)
zsEk0z5CSolFu}6rCL>Yucd!{S1QbGIDu4&{S~`6ywPjqiPJ;?gPX0}5k_-SV%qVm{
zI+qeDTwETeYw6{@!a>@Vs$U+krW=X^*l`I3RFCn25M1sT0^<1QD4=lyl;%HHd>{?U
zZ87@|o+H^19eIK~0`g*uCj}nJ#0m{7wd$#mw>D4=vz2K|IA{lTdwM9rG;rIU;I^E&
zEtw=rLpY61?$LPff=<Pw1dPl)z%HGn=>U7oNjmNTdm@J4IKVDxEr?I@;O|a46d(Uj
z!&hKXYyiD2(<h>PVQ|M7B|5Mgx7o38$w_dMmER;pB3p!`%nA1zP&mq;pvRc}37>6s
zhteh4-!>(fMm3R_Hy)(lq%T98Twz?w03P-KZzZUM>{LXQ;3a04+JS@8D=b%a9%<A;
zXL_Iq7#{y7`;nR8@--&t$EesP8ykoZ6-+g{6Jv+PnZd_A2*}R~%62B<bTE|%3puz0
ze9g_}EWr{S7LFdwhcKp#txOi7;+62=#2k{q*IdNXcpOV}8EhlU(#Xvn08y4E4-D`a
zOOtC)P6r4KmWJt9Xs|RtzNP`8;nKo#RwmKpgz`g^Q^DkvsDQ6=gRgN&I`mu|XCrxp
zJ)k)D#^czVYymBH!QSM^+T&?Q?)!nQLLo2Y;e6t-5EUvp)}NDLh{uq8g`hVjtLf<s
z4J}9ud*TD7c))wVixI-Dp>*L11Ue~O#46++3D84Hnuf7oWbq0$O;uJ-rO7YZ24NoM
z6yO|0_|b4Ng)=Of%;_Tn`6TAL5Qo7h_{<)M_@fA<Mk5-EsW9?1lv8vm2eL#575f_$
zj>;){>?lr7K^U5YYVJhYNI`;{OoQpfU}FCbokHL2IzUK*#G)drL>+)#BRYo+H{O%R
zfoJ)ZkOD-&^<^vK47L5AeOaXjss+TR%XrtoYHOPo$I`W`MO!1D%lQ?oskJQd8_NQ+
zXf#+Bz-$}AvcS&R4)M^Hyi-~gm5Pr$sZycDIS#EBYP2|h1FZU0;+re^1a^rSb`^gJ
z_QcaS^1igPY;`ry!(+hJoX#`NzKQ3vUSj^${IMkLBAd5uL*CXd5|`Y}o3Pu(_?x)^
z<guYJjZP5VuHhfUtkvcg{vfN0%o}DDdSE!LvQ?twTHXq!U3)E`lM+{&i>3lDbzda%
z#!!)w^T+Uo=QPQl9Lq<*5IN*lekGYDZ{@pi{lWv|cz)ESNvs^lFT2>XC6fmr8T+8`
z`>?N!F0oE2M(A`bndz-$vJ{dUN+1yE3NpP;Fu2!ETznhMU3ZAvZsV8r+F)fQ;J_V}
z%?XKW6itdi+)+g7f-6%Dn_0|Y?;g*aM4e+IZN~GN%vt{sY&N?^-30y!tQ_(yF|eXR
zb%g+cm1EdM-j;m#!1pm_zz4_!V60d)k&k98;3~|=nVx-Cstc(PPvR}&3IjPylS!m@
z67P3T$E1SEd{8^Xi=Oi`4I8WRe)M3;Ktd`3U`26`^kVsBUVFiA!<{_Dk<a)#f<4|x
zUHaK0A?Blw`+1}qX85R!syp~peu|0Kck<uPVIGh4x{D8C7oKynoqL^FB~G{EeL%}`
z_FmsC={s+0r9kk;-ML7XU$40SK8_0>|GW7&a-U`XZQJnDMe*6)ye(h7O$6@YX<4hc
zm8tkPLWoW|e2P^SJ#CZl{qb$0>>i#Pj!#dIPmX1SHXq9si-zswY|;2&-Pxj{y`3#O
z`)u(Rg5Tf6o7&cGE7M25ohpj%#rDjB=ivDGtLSqtZ!1Fg^RMA1;tBJ~$&Zm70tb^<
z@Of)EbA`qE+j(Al@LYV;Gq$od)V{MhCxGxZD0M0mv$yliCepM+Iw45O@I)ZZ*z!cM
zi-ix`@-pd~0$Kr@N-(YhHN6nTuE99k`{fSastY3~LFH;KCg8h_=mfyvXxX`lDl#*S
z<tX^vGnG8Q>4BBC3YK-3Lt9z5qE^xNkQEcR_%ETrOeDgJ_H`xK-9FM}Xov5C2Vlyt
z5zjurC*hI)AP>QVuIq!mZS0Wl#0U9UTm^FQL2&0&!aarOHaT^yhk3_H1+f9`kTRwM
zRu>ySRWPZIa!On{g<qIu0>QKkGb;Fr1TxZ}ox-n1S*ND(f&>H1`><WnA9v=9OQ-Tn
zoBzu^j0Cnt8#aH&Hf$*Ppl)pEh<B#)3(t#lcBh?~=-v&y!s%#v%yk=QxWFiJwurLB
zC0+EH#`C+)GD93&Ir4l`bUO&Az`>lErW1sZ+^S7??q?{%j{=rX<0a`o6LN+tH@Z@~
za%1qOh{Pv&AJO3<o{=&Khpe%0k_IZVYd8*r@ef8uK7{Uc&P5V76=y!oZ^Vtl;>U-1
z3;txi$exZZyl$fNbnK{M)B39EyvW*b29cDLnGFI0o7-X@fnXDyK&<_52_o;_CJ@>j
z3y51D<yW!pk-A4AY0qV@{c{HIZ}6Z(FGg2VC2r&u_s!%vE`uA{1v?1C>mG62XIvHg
zXF@)Wm^TYf0kPes+^kv9MM<BOw-+5+1`@Pxd==AX@$cE;$nB4zouIqNXY)}`;@H}5
zacVXnY<>4dTsDV4+4)E7te<fh%{mtcH+N%%<0ydk^DGJwO&;g@!{ZJLVv5NH05nKC
z<Yk;7kOv58=uMTB#xP0(bQ>jPM2s38#s=XpCPrfM<NT`hxZ{@=1rR|H1&j(;t&u_;
zdxe;kD-n>}?;5-WP;zyA;(8+y@)h3w@d<S@L1Wm5mWf;96Su|X+8&><OD5oBw^W|_
zr7Q!BeKI9hUVVJFgJ&du8J~FMjKpu_6Td$r@dru_TZaw*W2C|v%D~9{LYINjl(p0^
zn$t?0jj-IX#UAloBaK>5Hmd?f(SF_k_H#};YA3%EhP^?gkyipf7lwRv+6308B{E-<
zTzhCCQl)Vj&suR>=QnfX6ku^CoqjXU;$bvE7Sgp#9{yW77k*|@zeAEq<~ck0NnVh(
zdHC<}Tz=-^zeZ2;R^fZVyQQ}wDJTt(@IjVQU8F@BC+>ilS-5e05Ys^BqDc8BkK+@r
z(u_eKbH>p{0+1SzaZ=AJ75iYcO7cb)33w1RIrHcO<}+H07FE6r=CfNIn$M4c>3{Gq
z{!G%zEp=2$C!T|q$k8pL@+sbnZ{H%`dWv7l=Wh|&3&6M+h}#$NmL2A=GrvvC&=81u
zdT{6rM!d?QPEZsieJn-HeuifNLL6VfGm_&W&8%YN(>%*Re;s{c7B*8VO_VL<*YNpO
z;_=lyBsMMN1zCq)i>ul`AzHzq*93bS72rt~SkGhw-atuK1OQplq1U1nA?o3$QPCkd
zu9y`$#bwX%P}bCs&tBWqkB#QwDQh#I$p(B}ZAg%{P5n4p8=_JdqqcqT%i7phvE@nL
zdEPvpaIHgeab|PTpOcOc5yc<f|LSX?c$*=SKKW^jb=F$iikY^PVvJ)}F7)|<SdbXl
z*KtAd@I2l;Ol5wt|Mf3XCUod1TQs=a9s;M+O>`OwDic2HKrxAOUIAJfo#ZtI)~mFD
zoaxd)8b<6G6=Z>;JxKN!kfuKJm_rPjg)<WE1RtQDOUV)XV*Y#R%uSWQ=|-Q6z;iq&
zWd*(z0%e)ZVK(D)CM&8$*>k+*W$PATLhX_tG{LqBeb5AyS;*r*XhQ3B<AWyC&+<VN
zM$@qaIs{X#0FT}C#PDbNZCL-j_bhLk9sQ&Uqt$XT0P?L*nh4)>TunZ@^i0%_iVL3O
z#g}fK56n8zmsZY=*eSpo2Rmb5TKO-C@uN${`_J;wKVmj!30!VYhy_dd*G&!`*rI?o
z=*~debJ6M%E>x7xGQ9hMSo}N`l&WvV+t2d>xJoQ-DZesr+qXT*LW8|heB$Igyu+V@
zI;a?r+Hb|9OZj=3mxDu-WlAn4X|qOJkLX^f`lY<2>};n~&qWkoIu}SKX^Z!Y0n2zs
z&icKeQaG1ly=wRc$d73d#D{xDB_KK-BM3OH#vpLIPnPk}CrH75X)Fa!m@?&wPsDqa
z_j!VV_iPLTSDZ_T^^}qrp8|$0Q{MbU<WvE(-G3{cu1_J%4tyd81ESOMzm)-9RYIKl
zTfI1+C{t$d6N`|y<MMr||9pzG+6}!`LL8=)l=u`d6q)je_^yg)=B)Y@0LAeDP!}Y?
zr=JRSIS@Nd5DglKc`YGk)gz@rhtLSi0jU?aA}_D07t@#XF1&KD*t{Hq<8qPn0>8M^
z{Ev~bGj!qU^s*B_208!ph>OK9@Qv`V8}T9^cMc6Ua`Z*sfjN&#gGQwJN**|i6a)oI
zDOhVr!7E<k<)nhwy~ODoAL8?u_?7g$ua-9@m3-JL=(yd){i}EhuURHmui|O+l#Jhe
zCf6(@K@rFJksuj=&9W%tM^uN^VEnt65aa&_2fy!G!+YQu_{KH7BReU6Uc-x_MF-dN
z(w6kO1`Q@tvP1@!FkH5yaBRl5Qhcxv!Fq{gB-SJG5ixx&Y!J}C*YY;*-INdCppY87
zLu%}zZY|7QGCe1uD;;gX9jO7Y2v_q_h#s*HM?cv*p6vdZ^5P>2A_r0MH9Kz|$G0R1
z;8Hx+t^;<N;`4R9MdE&fB(8o02;47HU*;nLG5KX6@C_x=k|8`3ZacHYHblw~G31Dp
zSNILKg-grC-LLR$`7-|%>B08FEBq!I?iPV5h9E{nWRuoMVC9=8oa=ep4mcYPf#lR+
z6UG--;Gl!!oJwFChK6Fvw?Splyc#YxD%SJPsJ&!;NW8J0-vA{44L>^3>s2&&v4yGW
zT6f>8(w+i<f#+3I8om>PwH7CVf~!(F{D=(GGwjVA91@?yFc=%{ZoXz_5G^+F+!SM_
zL`3G$wpb}ckb(}Gyn){WJTO|Jc5s~Ns*phq`i{25#D|B?I{Qd7m$Y_As}vnxlS{3<
z8XS|AgDEq^zD@&YR<ZguEZg@8z_e*rMWuS>cRh@joVC;mHFBuu*KoSD6&{18m!S7`
z{{K|><$+NY+5g>D)sx9gj?NvD06mi+353&dpN+^N3SO(C+yZimfC#Lj6A^cDjT$vl
zabYzoM?{q1szF6=6%`fTh^VMhP@{qdMMXjVeO~qSWD-#L?)Ur8FVIu{>gqaPy?XWP
z)vJ!7<&=f48bfbr49r(bM2>B^hQ`n>tU&F5otOanTqh<V216xyfD*7qUx3<HI6*8b
z?|edTe}PRz`IK?kfty&f7N_X`8#Xbz5M=Epv>A-hZc=D{Y!ep3$}>lH-OLgZQoBjv
z>iEqnq<AyC^^fR5e$!ijpf`b?g=x0WVsz^dnS_RZUKLx~o(;lRAkAwR1Jfmt3q*7{
ze|&|ykS<>trg~6dK$4v@r-?<liO~S+<{0dSlM0T)H_{?H*`gX8{|@=`7F4!U9^Jy`
z;ltN#Wj)(`NY|c_s$m?4X_$sUn&{Aw&nb|$!sBTSzq6H{k7Q%FV^Ke78%y*areGS#
zqqnJMyMCKOk&10fC;6LgpavB(dpkSJN!1R}9orRdB1(?@U^~kg)MzlGkSGE~xo!b|
zpfBLuHjZ4GlNtxzyaqvJoh%VSvilAQOcu+rJ6Kw()8jlm;4wn{=2vpb4!U7Y{`E!n
zDD>=dUxGY;mfZ3Zs~CDp&XI@;?#G;FZ~pfdm;a&BZEpY^=6{%7^>6v;%dB5+C2etl
zuLjp+*C2x37G<Q%Lg~E%KajHdce36wN>Op`YB_u->&e!^;Kxo(9_yj!xRd6X)$;wF
ztW&{A&~n3GhZzFMPXH;MVe?4M<xHbc><N$#WYH@uU*7pDdo1&HG$3Ys=QI~>b`lte
zW9=8b#vW%iuP@!jGP91pj^*9YD675X4ZJA>B0H3yJnwaEm0Tcqzs@e}|L3zVCI9mn
za>^TQb>!^4qgdjeSeC8cWQ9K5fvr~Iuo`m3n;@@u$<Ujud4Y3+o<7iYh1$eJzW62^
z>)B0}_(`_e&4S=o&)dyfn^okcYPdz!P%hrhhNJqjW;e?<Ya^lcPH4<qtY7+bASgEd
zLqkUzu9qD37HdhOwj1HPqBd-CgwK)CsFv#~3Pf#x62<d2Tf$1W%hI=5N2NpR?xMIG
zAF}3cR@5j&buaC&<ot&%^)Cm%4NT0RW?n2`_zzYVO6e{|+BG=7vZGdxs$qA>H$rFm
zOAVXS;e;+a!J~1ayWhb^R=qs@4lC(V?;IazHZ-3U(l3FJS#}yd-;m4gJ$J*JGYMH5
zve^rt)5_+9cWJ_@ZnKy9bp0a<cYF2G_b^ct{T=;*!;jtY0XvW2S3ht>q~CwQXrp8y
zSsuT1AItH*MuY@sx6Kvu#(kipx5@|hLFTC@ilEH=5H`GaQxqRfgD$Z@=R-x$AjPCJ
z7Mnf<J$pue{UPh`q_gC?AA#d|MvnYQ%^`@FBUgRIGMenAy!sKt`3Mq*=E#DNaY$m1
zyy|1t-S<9ykgGC1`mrk0s~@W}flDe#fN&no6=Bv!*0P-NW{=WG7V?6vO2+zNEz8ZK
zJw8SDF_fC{H~VTMU$5@<31d1g{OJ2ByGU;?@A(v`DmKgf{it7aId4DfGX5#|N)dY}
zE(Eo6>;rT!XbHL-l*a=us)i!mPTjvF67>khsUtt|TlQk|SLdF~A~9%4tx*0l?f{$F
zwQ-8w?(HXbExoCnC`En5zu1w4R~=wQZJ*Tx;N$SmfG7*<Vknp};YmyqI31vA#8W1I
zhW*`JWS`Hl&vlEu>ND&e-y%ysW8(=~zWvNWp7_t%MR{fWY;0Pf2FO!nJKKj?sKO{9
zh%GiQ+G$|(7k|z^aF6#)`hpG1s-pc?vXF~pP|-z)xi^E!S7EQcjSE4TK)XhqW?7t6
zVyIl0#wbFAlS(qRjtxn&p+%x*8+VUbUR}p#n8iButB`<1eGotnmS5Jf;s1NuJpW7Z
z)|J)kzhqzQ`up-<Ujw0fS3mzX!-Ynba{3|GSFe(54zZl%4|Gd|B1a&B95aw;SINEb
zA9L`%ZE9R=jsk$kJ^~L%yP)bJ2rY0p1ZJr4W+g%=#IB&X1kw)C)a*=VsPjqXnKb?E
zN)Td4r9wrtE98aWu<;2MuD69~m2&Gh>~1WGF8US|{u+5b98d9^_~=o&>RUDe2d-l4
z)q$&#_3FUYJ@rrq=qKA8X1B8)|B=;)nU&g)z6<O8P@KTkQC{d!gfCF-1_d>!GOtv!
z)F6s)Y1v5{p~WdEW|!~SIj2~5%71;whOmkn`Nemb?<@Am-0xYxoaNMB4#H!H8B1hg
zAH-(dyYT%<-t;~DK5Q*Y&OgF-=|ytj53GCJZ6_N6@H}w@Y?G^hU=Oz4ezFAcJTbv`
zIr~R8I;)hZvnp0alQ&uSBO9l8lS6;P26278T=)~q`fn_yscgDC*%bfwzscqvUIoK7
zH~z$${Ws-U@-zDztNmJ<zpz~Y+C$rDg3Y7}w(l>jV@loEgx~ozU`guDY{a~|Y0P!M
zu&m&UgP;W65ToBTyNurV;YUd>NN5KHJ1D>Yg<Yi&kry3fc{yd@Lb##Kk}I7F#j%C?
zG+W+#jCJ#rBL<Fu?motrq!+7M7(?Iw78``zcIIF?^Ek_Qd4M&?VH515W9<5LXRd9C
z?98-HBX>q0et4WM{NGcNnZL12z5D-RX0kMqd*r9b+5G<tt%(hCWDFm#zaSs|o#lvP
zSbUJL#_(=s{IB5X?z@3ojTkz$F-i>GeO0{JWw;bR^wN1JVzOrHyaQYNx_nUQg~{u|
zF=GnHiTr8ya^jv>$q#kjojtu;?iM_YJ+)dM6uc*^tdrL;#DBUD@o8R1{BpdXJbueG
z$#fRV1(8&m`gSQOl3gmhao#e!1n*e?;n0#zuMUY_LT^jtY|gs`OF?9Tadg&g2zI&%
z#JsIfqpc<a>@vBN^P=`;PCRFIQtkjaDFJ$?q7l;S({Ty{ie{ilvW?({yzba`S)uc`
z$%l>+{yG)ei}#aPq$fXk%MK^O;al+KaDsh!|DyyOWH`YKvLQhw-cORC#KXI#R}yam
z?g=aGpdL9tA>Z@x!O%K`f_b_}MKR>8IG!pmh~ZO#49~~#TQCCpdHI=x*B&Mw7m_rk
zJ_rF3owxWeCV}5#_}sxqZY56lf1lahSU!X8dQyHG%L_3#C;Ipu{|$M2!^an#YGRt`
z=e;oBSNM59{UTZG=Y0XSjN?U_@BYzBa(W!U45kZr#PNUX@5-_9{NW7u)H&()lavi}
zCpe=xnVG<sLbkguf%iIp|8I)wVFwm$Z)CqmZMT0;L5`_F1T7A41*xD9DJX0ukhmk=
zK14obj<#nazXaWQcOoBls#-2IIgzQ;jY>r5+*9TGn+e_Y9kA${#0O&I^M)io`cz4N
zOyZZED$cZIe!;2YyqC;7CDK7e$kef}Qi^l3SqkrWs)X}Wc*nRwXye`v=R8P0nZi2=
zTuBcT2C2L|kAp&{mC8vWGck={$h}Qqs}X!L23bRFOODClspyfaG~T7_pEFGux6@$T
z(gLv(wz3@u(m2g@(w?doGt>EolYE(aO~@AMymQ{^d|ZYSVO4{opXz&^GI<-eYnvRM
ziP5o4F3;qHPnAS(#xu|oUpM1to>tWEryKQ@sNOq^XSZDQ&2~EWrS2c3`G(jKNEv}G
z<`BAfXkHfYf~DZvEZ#z&AYaSk9RMB6;zfWuX7e$pD)ZWG-Vp{cKFsD>*!eh`&D&A?
zw9et3&^{w`_)y(f{YVb~hu(P?O>{Lxrm?ibnJo8&KOmf>!^+9t=f<!%(p#Mz+k$_Q
zvGFTRmThs?0t!uQ>Aem=IMq42B_F1HYQCUc<r5Z$_3`SLExw8kto?EuG)2e)C|z`A
zZ>vydk3VVb`*w-){j{;~u1e**|4X?(m#6kW&?MB!>9fYZZ&&Epb+<ove6iu@vA5Gj
zCiWL!N+XXKdA1+~W$c&7({jtH2D+8tY(CQFc^bHVEJSoXN1cfC^FZ{=zmlKj@ix$a
zGh4yf(h{n)YCSjda^+J!wH3ct_tdGB)vPtYQbz|)&gX42cPl??a5qVn6YJ4@exB|r
zbv|~yfRF525s6A?&hs=&X}OSMIc-c7M?&c!9mFU0LDf_8_BOm5IM3~EINbu@ypXq*
zt=jSlX*e{4;q0Xi7aG>E3vItvDVMk9tz16!owk^lKcXbVT(5<N++<JH$~z1BA~JB2
z+>WnfHCyHOc36NflSX@<$2M-0ZQCpGY68o*-Mh7IUnrl!MAbX(`2a-A?7(xJ98=}c
z4yb3PlpXk;FmgspoiNGQu44n?1HWJnl2beKE+aNTc!5<{9K^ZwhK0I$x32knf;8o-
z6T=*>!eNYJ3+8n)1^|Z^tdRefd<A(Nt?8XNups8$@=!+}$l3)9zDlXcSr=0Y>>9G_
zyG-VH;%9&X8PSOclAdIC9!``f?Jr^H*^uXT;%U76=yutnGan>B?!?poAQC%pn{3{h
zkEY;!<l$VT3LQE}CTQq(F>)z7lV2!*=<MWjl4wG=kKa~(=9%2153K{iXdn_nFq!D|
zc3Q0YHkt$7kExE>8g*z`vv>V*Y?*KuKNq%&uegh6XVfa&VHO5D4oUd1>c>8m-`rAt
z$6dS~nf!dd6qMpF+3#+iFWcSClXOY%WAp{`fxG#ao)r&*^Q)0}+yg{gAa~pY6c{Ew
z_wtMM1=W||%g@FQi%yJ{WxO8y3rp{V-vVha1zkUU9|-U;8M~Cfq~9!eFXf%H7SLg?
zLTJ~)$yd^J_1e)KCUYd%pJ8&8RM_;O<YdU~S;^1KJ{&fG76&Q{1>`ua4}&;_jgzZe
zWT2cECjA(WKtdknT|K6pk0X0%o9|cIymvo;g3PSNV@w3Yf_YfbrGsqL8q4Iv|K#Uq
zd>YP1nS+R@BO~CK@r~GJe0auJCj`b>NodEJ%lI#P)4aKpH-<6tzU5#1N_OZ0S@$o#
zNk1f4KY$smtNi={UPI0QAU{(-RQ>IP{2G$^jC}}Vs!Cb>5Kl`_B3=vI4J1zkEg*YT
zeltlv_7KOl(X#);d^VgXALb#?Zj=q3)a?=89*HME!izx^aMNQ8X{_L;{*X*x!AWL%
z=?d_&56Q(VFmpJ<+2jw&ke;mtNI4+9Q?q{szcz6hHcG;(Cd@AXx16++@6iX#-m7@t
z1Y+kwp2EgNlobri-D)v`Va`^|61CMrsGEYN4E+czMbS7gr>9^J<YS-n4zZ=Hh?UQ=
z*UJ5$^S&u-0n)}>l;)5u`hpjZ+(IjrTvE>g8%BCVv<ciuZ-~+OKe!ap4$w;G3zW)k
zP|snG-Vk&2h9L7rM4aD&X_#GJ5s>eH!H2N5tK{|1^V~p0iHJE$L?9rp5)oPjn<a8e
z9iIrRrLWiVp#@X}R6dB~{Y9X0WdO}r&~k)^$~*zyw19zB{l3IB+FV}tCFcKndB>Oh
zMt!vOf5oQ(n)emokyzefe+DG4SYBX=lo-1l2Ej31U->m=pGx`i*Zevp>vNC?JxeI0
zMov1&J7zi(iS8%?5MJOIlpU5yJbsXWie4=}#B+O5uPQqU^n-(zr`c7S|JnYs{j<CP
zqRRLfk(J6#2rKDGZJ;eVW}pzl%3d)dCsg-ycrU{t%G|Dp$4P~ig%M$8TM|~Xu&|O&
zXxX(eYSKtbiIp?pVA}!uLW+!|Vr~oz00}=;^zNyaVIjMY@T|gey(=r#?On3VbKFkZ
z1-LP4?UJ`W#|tm2r)BmlN+<0E+*(Uvs3YOla(dr*9Mw^{RYEKBI%?3SxV8A0^ghpL
z>AU1#pXYf)cfhU%Pz~{-(CH}F!>U>Qs-T1-kgL;Yo<cdzoeIy-4}uiW#pz`_vlH;k
zk2dlgo0A$d4q@7wq8&Jc0n;3ycy#iJ;|PVihYO*&NgB6Eg1A5og6~5<;SZpBsH0xs
zg^7?jj6!4Kgda{CVOcWo1>U~x1~4S~tP+BA@LY&nf(s(fVEuW2@;*Np3(ZYjj2vP(
zNGRWYf%ot@2qhCX@hK^>&KY2~5Tr(#s6eFKHi6c~$~BvKn~Yc+m(y!3grcFHGjX>Q
z8HI_JUvJ_w%vd{?Y*8S<3MQOw#a3Unna42CUTUTqId?1n7d!BsOxec!x0g!agJWhv
zY%NNa4FRC0kS^2I!OTTy5A%L`^EMuA=_hSrI(&_bK)|TugtVV5VED-b25zvH+qUse
zNm!oIxp#9Nv1QgYbBq+*c^?#iz;^Ifv2x0GNTrHv<o$3xr8Qs~m&rG_gVM*!_#Hgp
z*+*AF)X1V8+{#sF1*u<PImzMy&{B1pHGI^V3>^98{2jb4(mt|-=fT;zgHMLj;YF~e
zmGbfz@nyd(f04I_=av_FOFg!__C>7w&LUGHzyWkZKJX<_poVckfRTbEt684L5Y+I`
zF@S<A!ql`n0w0DY4B72vo{tR2y^Iwe@^AJEzX9NVuV5*W<U@D+aK{tQxsnZ%fKPUO
zjZX>rNM$L2NzXgoN}dfqgJ28r#2I992{UP$6;yx^KzLq>2Zcc{H~{LXFe-aYl&cF{
zzVI7nY`P4d4!Fl!$;1Z5S|F)pnxv%_H@$0h#x9=BRN=6qq5HnWh3okSpAqt5WTVhQ
zyV<;;Dp)e`00m8GD5#*aVc7hxEQtsd5GQBB-G)obamp2W0HnLPFlzA9RfFmW`NPTA
zyl#ANS8#1AK1q|cxPb2xCqZ0SEzU^*Ctow&1ZG!_v@?+r+2hwz-4CR8)l!}KaPqZG
zH-2VU4TfMXpS<Bsen)b+0hkxq4a8+(?o+ng%?mra_n<U$=xsBiAkIA~G*tnQ>5dm-
zEh^!nP33L73EQfl*v+rfQ(~1}8juZr_H<&U0axe0%@^p2YAhfPQes4Gkn8@#(|LGK
zN|pQm1Brz*Hi-Z_qo(@EfA}Vrx#ByQE|P&B91*c;P(m}})jfRrWansp_@qaSb0}Y<
z;Q<RO%CI4remVt)Q`K}xpJPX^(a7<i9W-g<ki-5%_@F+;OC{@rDj*d>e!1*jj@#aq
z{n<p&8xvlyyo=TM5&84Gd;}3c>X1}tvEi4O?&U-DF|uMW?{X$;L)J{}C8&qp4A&Zg
zl-$oiol_#Z))sUwfuUr0Mn^F#<+%62bgh(kyvJY1RC~qyJQqVa^ghpMc`7DoQ4t^D
zs{+r^l`WyE>Ww09r|tp_gpT5ZcCC`dzwovf9w9cUAF)B;Du@jt-K0ir5UD6RY|v9D
z(Ne~|;IJv!YRShCf%<es7d2HSb>(@TBb<-2WM7B~jX57GD0L29KmQco%~#}AUHJr7
zwMzcJkN1$G8`^k-y!$vWl;gT#l~5^Hb>lC^m)uP(455k#DEP@?EFA9a&d*7ybi8~(
zJm{i2+|1YAc^%T#^x$8{FOQ@HhbikrNcVA1KEg>ynZfR}o6hdVKMO@2Tf>EV_5%&)
zh6sGp1#!|0WZ!GkEpN_g6;214ywUf#5m-&(>Mj;_VTsq?NghfKU!7I++Iz?YC(&@v
z7fuG`APrr6=HzM6aW+ID4=D4?t-X26P~>D2I?vOfoDZ#FZ`74)WFcd5SUyWf0=&^z
z#gPS$sLS3&cr?L`N5h3G#0_}u$c-uhNpezLEXVfY3-v7dt1fQEXju9Kzg2p<=p}>w
zxIB{tl=eo9dPegfxB<+txV4rj3HbzL%qmDyEDbCBSPIJnQ)2yuwe}u4_$O}3Gy9{n
zmr#==(ZGo@|0!D=qCi)yY<f@3DwwRCen!uqYJ~uFNg|<IoVijyWQeygw667t+|GnG
zr;#=lm}=oiSgEpP3O~<Ziem{~S-EcGG(yEJ9&E*69l(@m8CtVo!<`}^5!fUK54#K?
zFnsiCJ_F4DtE>4`;C4|ZzZU3OS;=>J4&oRhIP?C~`E+=F^e8_BXV)4msgFA$&p*be
zJID$fWy*j_7|DCA1xInK9J>~?JPd%Y<>-v+!!sf9zeM%HF4YGe!N`PrVHfoR_?apq
zlE5?@VuBO*Pv{I5RVt`aM?pUsV^r1npnU5I-l|zSW)SkDN@7h%q@u<d#)<3rC2aR9
z`PyoTna0gVu{Oxv>-cO`$ee?!?s6&=w_a6s!FpBI$xmX8?o%N&kOj=4VT_(3&%X{!
zIqD^NQMDsu^r7qAYNyGBr@(@!y3do3KgAQ#053d+258@?0ivt#)D1OrUaVv+&SPcL
z0th+w$l1^E15v1_0rfim6_{BpZ>#3b2Stz$1;Rb!7z+`f(?BH{@*&eAE9JpzPH4Dk
z1J4an1y3Vw8XDWekFe5!RCE#(tpW)~q*aj3$_rSlkhlpf9IWSAuJyd;5Q;S?%*;T*
z7F=H`;2}tvBLI(3J&fM?;6v<|8j|1`$ZQ70E;+#<IhOqk9UC&t^ag&A-YBf2qq^wB
zO3@M3%m^TTKAVC=UvMUZX@D~>5KGR*c8IJ;`7j+2`$)11E5xDqJq_v<lwUioFZgjd
zy#vam*hDAKab(GiGAIht-K|K=$<7!YWJjkE$toR*s{0Rtm0(0g2o$5CdQAbrSOno%
zI9(cK#kSLQyWi{}l;-W0vxDh&$TN2i-p66tfK^004O#)SA?1ZH;-uSgDs+|#O}CTh
zg7(#Gvne8vM4UtG1%p&2{aB#us4FJ)*~DF_!!jrj#IrgUEjB|K-c5SPB8%Qb#bRi7
zAeKtaac5c63J%5`gWRJkNH&2~#Uq~TZXf4c>XQ^74M&Ag1lvb!Mm`FLmhzE7!92<`
z+zX?fZUFCQPE&mVa!l(s&F$fQwZgJ6l~9|*p*DvM2rEI==9@$3(yTyWfNbzU^c>*!
z&BZ&g6y>thVwNqR9nSqe76{iQRz7wX#~s0x3ABf)JCtRrma_viBFEBa{OABHW)A#0
zPMtgIHi+BMIV#1hp@<6Zk9tW(<>9FQhMq#IsGd@>1lbMfhfc=DPPix?g-5T=ju+uV
zt2)HkvC|WZ{Pd@v@CPq0?+%H~5OWg~DZp(Maq6J46^Gje&{T1QaMB!;H@<}KN9(FK
zg;}6^U<}izCuD00?w{_ygk9Kp3>Sw|w;O~*@bOVT;VZ3jZQRg@<M6QC>@+w<u0@?<
z>4ZG+X;8dRUNDHKrBFla(-bO&o7^uyxkyj#<aZl69HyF>ntzV!4b{ZdK#?YvpUh^N
zeN+q#k#HO0W1wyR06u~t5GhOUpm^eVcz+cQIH`){RYj6NwdBd^WRmQ}j+dYO4R%1)
zC_J&Fk&De$RsOh}DUK=+h844Y(-TB27O0p>m?{Zb6@!tMCWRf0OI8Ub!sV0~4(2U@
zrs(3+MpGy5X`!hT73+)0H&J2`&!|ep+x<deV${&oVDVy93&ZI<IA~;p$bcqjR$OE_
z;&`=&{hUCS@<oR@cHj(1#Itbp1=R*UrGqI%7(svOZZP=LL0xtCBUKs4OK4<<0@StW
zAu{c$h9-m`6p_rTS$;+O5VaB3a9d#w43AJmEW`<URGw5rN*bY~NUBDsgHE_l0K?8U
zNWSBY6+Qsch=f?qoIer~WA%tW!U1a{{4uC?AP(orQAL^x6`6I?qUW&)oEMChorhwY
zMOeE*u*eA32Co<+cn1N3g)qSGeV6c~Zi&DcT`<&2*GB<Qr$b>C*a-cc*@zN5XbvF}
zQDYEUltqngjDNJe73YvjjQ=pHjO!5T9DKl`46wD29d%S77~K!*;{ii{bQdpZPX~#Z
zLUp%|J!)i9RaG0)lAJ~+MdY$?DG*k@1NVb`5CZcD&xtp%4}#96t85r-ccQ5XBjSMu
z*}T8y3HTw3!&FJgz?@mq#dmP$)b}Lu8b`F2zHY@vD27A8Ro@dj%mI=>E~g5HS*3ww
z(DV*C((5iwR*4!gn@~(`+n@`kt28h#uG8eeQGP$LR|WV3vFKYO*|dU>rP9%`fhkxt
zEo)9F9&-YEJIxxSnibdFcuRSH644$`4Fy(&O^19#_M--LX&MD98DKb+aLjOVOZ9e)
z9h{!vWd{CqE`XacHeHe`toVRIHV)#g6kKO`Z6JlP&IRJBF|rAq<J@*QEs#wmS00##
zLK?o4LLFq0CBR@daYV$varMnug)mmK8Y5P+gKx<Wz9r)jIAx_-$x-Nr#!^<JbW54d
zg%d$b78Q-K!%CjsH3SwDJEzD3VlyW<9Xv9#tH?yS+T8{xmI{M{aLhnUGIqtSEJac=
zA{F{ux?SPMZkP?+QAU$3tv?zfm%5RWJV%G51%%l3Lh<pTOl8k9C=1uHtPq1lhK7I!
z{*gHbDRnDIws-<oI?4P3R!frk`RsaSa*ZiF^uQCUqg_t+&7EC(+F*pt02_=LHG+g1
z19AHv9g8PJp}ncW>7PZWrfqM4p;vgEUIf;g;+8{hq9SjBJ<C#tc(K$SAaFz{46r|x
z)&#MIs9O#hCR&GxxL`m*YUB`8GJXpx3jA$4(A_DR+t&;Ojq<}HCJl6oNH|MU3&L55
zq^OU~hQZaCq=KS`xg4~q2vGvUYJUL5jsAyKKDviQMNFp!iKaBYf!=;j=&f*EpnJL9
zdT_u?1Q(3~C^$G9AW5*`F!;jJiI4PH2@Z-TP@BYB2?|AH?|pM+R)|FQh!9I+WH@1T
zg#KbQI-*xfnUx3~4YYPCn`VB4dcv~|p4hD*;XJ+pc_X2#VI>f{Vo8(;QV~p4okN<G
zfdpzEbP3jvFoZ!u#hMT*2waH490D9f2viYKVpUMeh*lDGt%d4Jq>HtWt8|p?l%=9|
zjZ-Q*%ITDf$`qgl8<jrb4>`F60#+g_2MfVeoj@L{c?8BXTESg`_$hG9Fx4i)T@E)0
zw*vlWz%2(%qUqy^kAsEw0l3+4%MjiYq|oHRJFFFf)o^HPgt16$2zAB5I{RP&-rAv#
zN|6haKf9hZPD>#S#5)ANcn4-vo6Awp@vMS_;rI=^spLb4U4a3}K1jxEftg<U;B!1Z
zv<rJ%ILmy}P1X}O!YY47k9>i7-Tt$UFtzhVM3g~%grDBi)Mu&3mHkt)kO>=?!PeN-
zI~!iuEns$`^2(=;KDEo67i>d^FV&@JYD<7qyw=^22^fWG7OY3$&1wV3KB)HGx}0jy
z4WmT0D@sEfTa32ZxO`|h&k7O6AagdrK8)D8LAw5eI0XzeY_56H@ic(EYIBWQkf5M*
z@c97ve(EWzpAxIX0rpTB7FR=%9;?Q#tb$ya-d#>Ev^~nn#VW6iTvV<!gcmoXuDGZG
z5O&*ZkTY!x0ul3QrHO9F@*Z?8{7GsC8dl&BfV_mRDsH)MHmA83q{XY)3!D|fDOStq
zsnyda7q&uh(->V10(y)+MvPf7mvn%po~n;&0+HBU<n8nr6bY~aK?zZ@R5coKYK8_n
zeGw$fvEXLVZX4}XM0VQ@+HEsvw=G?jkph)HVqES)<R9r*ASZlMUe!q?ga$)An_`Zp
z#SmHp=I}gLOVlxJ4poq)P_%MO-~rm3$|kIqDsYHXD5@;gnZ6UQvscyGOLYb*r8*<f
zsdJMmd+pGPbw)x}XRQ43w*c!i@B*TM4<Y2sCWOSkoGMB-b%uxbqgA=k>EozSQ-Eb0
z7veeTY1)F6B}gYAX`QZE8Z5eKT*d`Mn2&H6IiJly4dBeeAO%r`kz*he9Ag-GLm(wk
z$3mXO0Pw+BvVyt;i_A)fonO0-_D<^@lIe{i(4d$G(Qy!8BJFS@bli>RNCv<PP7kI!
zhJRCOSm=Q?8q28|5otid)IeHzb0!U+1dXL#F~W|9ouO2G0GkCECRVCr(4ATW>olr7
zDwRs24W<?jRC6;Jdp3a~;?c<?6}KutX1Nw(ET<}}O+Xb@o2V&XH3%jJY8US?T7WoQ
z6Pm=??L^Bsqq)&Eg=k)<6}(O>c*CvWL1D)^Gl`Oq#K876hO#n$9P6|~3u=W}v_cEC
zLTsQ#xD{GBtpEmxY8=%Hv1o-B@WVN}Sk($lzSW6k+*{GZ9}43WnFC0*8I?HIN}Fc0
z>7-nV`*gAFqcH%Qj)qJ%?<0b+1kz#5DXd{U6vHRk9UZhKRLZ*X1;nr-DdB5ZMv%P`
z4N3VRe_RG-GjlX{F2ZvLbrkZqGaZ6Qm2ffw8Y{{i`K0ndm#Qx+BnJgsh)>-b{uCx|
zYTGn*tzO8$u!qSPkS5@oGwd_1wD7Q}VFA4W@aGCAXh1ls0Z0%th`2=(XF`z%V?1g+
z(B=s`9AfqGc)%J&jUtN=bH_t0ak$J5L9+ns<FIA{Qwu-^=LOSA>XU#R!1kq+6YqS4
zwr?@$us@v77B~$^tAiLTepq~(g~E_H-$$JVXK;Kvtr=)V>oOpucWQ45BQ3-g!p;ou
z+J-ROMn$95CyZF5a@ZRoJcKhiK7}TqIBdbYXb4L<YQapa|3?2{dN~0-nZUS)B(O_D
z^3t|2yTo*oaFGW_SX3Ihd<6I6PA=US0%e>I@)8GLN6igMLorTJkp>T{V1kuCowy+H
z04>m(t3d<Gq$Xgi^?-hVAK){;z?jE}U>X}UK<qH|8R%jr{g}agM7a<?G-co`L`8`~
zeLUDYG(fx1%E!OfHwIh(<yy3XpH2!cA`}8;K<S7aMm~>Ehd-kDU3|uf&NS$y^su_)
zp}GXUb|Nklp=QJ&=a6GHP0TEeJhw<79F&^*8|nz$w^~P45S0NXCLJWFMwmULtE?u|
za0RJRse%Kvi>Y>2{zA8Y=tY{kfin<GhaB8VqhT4YG>un}+vh1KMUB*^r~&gy4t2n?
z!u*RR+G)5(TMusuk{W}Hz;x3HuFrv`m?=nN@pzB~`h-GiO|F~BvqLTh6X81%F~bBh
z8Zptp>g$2{T+Qwe)*ky2xJ5%DC0P=uaRNCB=D;G055SCANW_u$o<R!8el}J)n4f#Y
z#oQUP5DEQXY<5#O;X?Vu>*UMwK-W<s;sJxuMZ&y5DoJM0L(&br#RYLG*EGWaIJ+G!
zJ;>OrGh;JiJ;4~6?Wld@fTjwA)bM3CnxP2DhWXoPh1B&Zbb}2}VOuf7vdzmt1c^s=
zcp>5%VCsg7&j#>r+@cJ_+3Uz2t%1p_E3@E`F>(}(@<BPkUttVbo}nsB#S4SZQLZ^;
zI|l=U^25zCP$z{V2IX`@EhA+G<&Dm|QE9_vbyyo@4eivgbvJ)Ed(zpn2Jj2x^#;m7
zWoe#IZL1|PO~(X>SH+qj53ERnUirI)CA<g3JPUY?=JJ4+t6O%PA#yv74w%GaAW$;3
zu)s`;6)Q3f#?X%sy@E}pBo0mi9?*^?k1)&VBbE`$zjpX;B40MTlfFcU7vj){id$@k
zE~0sZSaHhIL#bfB9~QPe&W%Pi)2LNyj9oM$J`+(XzH3_8tJJ_ijA^4D9H}>ZXnY1<
zv8c6skH{wG6!&p}6i`o+Z~=n~O@*<{FHog7LMLfXime*Fkn~B^%^EO;j|B?VltF)n
zkk>KNAI>OVF*~Gj6HooFq&4sZ!K8&wyw!R&Rvra>!=AHL9%@b`Hk;$}r5sRrr}p96
zP@9EogY$VqF+r&c;mfMcpz}vfz*RYjgq1S4KFQ|wguz%n7VvT~3~DigV$+J!p-Hr0
z0kac_a~IC+9s(x;FGU{I91rZEc?%Aa2SS_31a~f27e!#eMly$iA}xI6bc@3$RNy;A
z4X`Dz2b#ejS}AHF1iw<183QlU3`oTS%^W6cl-11Pve?<qJz{iOHwFZAxJ!z!mPhK2
zF>ZnF2(z6hev^n`^!Kc04MHm16%M4pOyabmiLas!iI~!oe89~p{}Lipp|JeO6J`=r
z?drgcWkoGb>{{i~uzazy6sxwEnwbP7QwW2EP3aQt3mVomDq&*Ox(8RX&`n2sb;#yu
zn)LV`mJ6#{#U52)4dwV?11l@M((uajJBo}DX8Q!g<I!{mt_U?L*Mmt;rvNC^!ILMU
zbI=i)BpXjcLuSTfiUi>#s4^@=QK@jN2VzHEO~h0<`dXc`@FEMUkjfSZx+yDlVF(6^
zlTi|8dnKt#Qa7)GTL$ttje&uaGYyw`crBvzc0O^s8^Gy0H*t_&COoR5JV0oLT^Z#8
zQtoi7ZW6_*hQg3D0x+yFN^p4xrfM_{^vp=Hd$DR%Tze77p*;!_mK6rk1JRdw1f%co
z5Ng6AsiP}<vChEt9hhlVZ$>&jB<y1F@QJ_+)raV>aBpHIPUBC<sH7{Ya;f1;A&vtT
z2;_uY5!@6!^*|CaXlO>7J{uMo&_Z(?76^!G#Y$3GALas7g+dOFQK?d*FiI7Q)L+~}
z*-KE$6w=^y7uG2%=!8<9taKQsV8K*(;1@Z$nb;MO{lW`P5bjBmf}t>BNRgm=9i)d@
zIgeYpN|iWJK((&W9gH4~J$j^pNeRr)YOq8y-w8i(?lfH7{3!3B4=WU>+l3v%r-R_@
z?TSbdR0-)KKSCcjGwO@ID99F~O^RA}!=V={$Uv+%;PfW$LO_yb9&wPIxRQDeO0Ym<
zy3mhV1>GPxVOAzh2j~l;^Q88yWGIv;DoTb9NDkB;4t%zd)Ed+V`V~GZvRYx`u9Ub4
z03HO#+MGOWGGQJc3EBmSW>_bG$abb6C!$WE)uWI<?rpiuYQd})UD?GBcs|iS#U2gB
zpruBZ13QX#EkKU+Y2k~l;9ClELXt1Ml5|I|KbK`)NmC423nOMCOdc`2IM-OIh}2Dr
zypWc&5~c$?&qZ7eHz00gxKS+U3!t>&DNR{*_R5c5V(Cic9`zBQGmjzBI9KE}5$lap
zOPpx>Z<LQKae^v1&GNK)rb8S}t6b8buv(c=K{7)aB|+25qx})=PtY0-3%TeU3IZe^
zM9DG#LbNkG$Vk3Lf*ef^Pc{4Ej<xX2(I1sZ;d=*7hj`P9-*mc(UJ*3VwN3&BE-YJ1
zNOz}Ylmcpo+o_tBLDQz7$@@f4U?q7jF$w)LXpZxS<HLa`=((`BFsLG_$)C9L<tUn(
z)M!Hla(WEZ`fen<RWuD!X82&D3fsh>9OA(LVdc<3gP^Gd9jOfHNI?s>HPkG&Ch^o%
zt2wyA0N5X(8D4RO&T1|{e2-_#?rT_rocXfu(+!zeB$~@JaUW+$M+*{a(%h>%b1!Xa
zF>|oGW6f__s^V}Iwl~LgfNDTO6rq3?I@H3Cuq;qDW%$04;Vl&Y1f{L-GjPEMhx(QL
z;SlfU+r2uhj(bq*A3z=VAmDab-$seiS3BysHUES-z0c{X<Ceknann;tf`~#98n>}J
zE<3ndUUQ7+o>Cu|N{ad_g~b}YLtF99Z}|j$xBP7%Cv8P&;-<)T^*HNSDH9I!mpp47
zJ-#=8<&$0QTj<%N1YyO*mLDt4KKpwpF>Z9?c0A%LF@ojChGImU?};P4l|E5!)kRCW
z`4gNB&5|bcNukIGwbD!V!vBdjsciO>QsaXf>E}^ue566z^C%B%kf!z~6?LNY{}bgs
zlMvJI=#bj-hofL`2g|?x%yYX|o(vgIygIbW**1CfdOpxs4~e|uTubDj8~A{fl2uKS
zq(m;e0mqAu+yWed_!2tXSQ?SeHUt-8o$V?LYYX}W2BU)BH!OCMq!ged@&xrFBmpl*
z3s1vda*NDb2%YT`dHX`>^6!*Y3wdhXMwn{|A1JDqyBG4T{>M>5pe;5D=uO!$!KbnL
za}5ng3`in(;P{rH<cbP{(i`>>#06v@T`Ak#$a}Qe`#aGAqR?a($FOSwJ2vGg9pwS$
z9ue%t@{SvMR{lwCdeHaj5F+p=j`sav!%Dt+BcG3hZ-Z~*(}1W?-oz&XM>9kGHO~>M
zN}c>N<l?9oq=qzH)>1%C^@L(*i+UGRLF$+$FPP3VWa-UNS*?_B+{_oIR;nWJ#=JEE
z)9OCBID9u|5pSa}lD94559|A7;Vry0(aDZ*z>&|rb_*Yiu(pe#Hd={mP>|#P>e9tL
zjZST@y44*8B-6kF0Jk)Gf5Y)pSnu!qcfLXYi~Q;De3U*;Uc7`~56?H3@B`Vk*afCV
zF>4_F(1?I=z^tr(<2Ih6(|n^i8~oxTP8_#5{0|<|Yvt_Qk$0uM{dRs|rqdC$)Pt2k
zx|lfJ6|#E?pMyw`mGIma`_Mw@b82cwyBBcyfDOaxf`cVI%RS7jE@p=|X;?7HJvbTG
z?hZaHxh&kUq$7jv1W0J;AYy7Rox7#Ew4vD|L|3V4n;2rB-@)kw#8Y?j+-@|wNdH<3
zD`C6j_*6$CKK_{x@YlOExTI3PS;YINlt3A~F%d42p<j5k;dV@+r#KR^;`C`ShS$tv
zJg>{CjzmyFQAc$o;)o)_I^^CD>;o#*6BX_mbtr<gsrj#<!X;%ixaFTw;R|J-9y~@q
z^czkBSIVxx(`g8midxkdbs8c`jy}TU?i(Z8I|QAGbi=WT`yLd7z3wrG`@Rvqyp?xg
zFw*5Hopg~p!abZoy8s?{&95#KNNl)-1%x5$r~=mbiH(mVB--EHj!a=$MwaPf%8ADd
z-u`drf=anhh`voGgoYypIYs}IiQr_133?Egp1=^CI0rPvWB(C(=n(JcD|PX7t-~v<
z1>6`-VSSd4?p(C{el!tC)@hyHDFb71y37JTa9Yd)6_qfRPB)Y(Om&!r(m!MtD%E-9
zKSfhI@t~N64NlxYWftUvpYY!Qzi|ntiy=+81kL}ceA6TPI7g<Hbw_nzI-ewpW}v`5
zFnt8371RRJIlu?i5VEzfjIgqab;kk-Egb8Pj%tMBeI3D`T?`9?&QdpQ)-ilwx*&XD
zn%hS~JX8z_<r@x6pWgyY6=XaFo>dB!OO>{o!y#bC*c=oEvbk4er0hBYvv<kCUQu}A
z3Sxq-lWL6|r{nl-ovBD2&EIhnyk-u6!y1m}%NM<Zj!)}(BF{aIkF^R~B#gqejLgJQ
zX$OmMh!r!?%yqG1J~)YSJ~0tU`JzvJ?Awh=qbu7B6*&2XUkpg8dbDA5GC|5KRg%Yv
z4xxLM<%i2q(rmRzwvYacQl1YFoE4<S>mlVa1aDZ@4}|lM@*pk>SN+i1{VnBz1-%Vb
zHri8oUU_uH8y5P7aGq8kzyLdi_CA>Xu=231vsDy`1nlL?2SNlJD>WLaCCUTh1Up8F
z6YN`+2Q4`vSP*cI;F=U-z^deraU!p^Ghr#6t_Jf5YM}uk616c2L2&NRju$DOO3-bb
zV!k|HboSL$4#YMngbcf@m&S`bcv{)}Hfj8Ek_Rd+vvyk9`?7nI7}aYZ8kR&R&`L|N
z_qsqV$$uf@$MVf<Z=~5uY3soUtb@<qrF`U@NutIzUGQkKIH&ogq^3Ouf(AlnRAm7i
zlye50+B>D0BKqp(azu*AOe<Ggdg_EXZFeogyo3e9!W1!=CKzsSfb^n@^n$xjGjAjr
zd&dA67&?9uLrZK@>_f6HvU#c~4G`rATZtyb>=v0vl!=TSs9C&yyL=;6jL@&CZjmMo
z1~)H5+`+^(tAnj%|2KGg^=r+<XdMTPaQkYC?42#lEcY~ShBKHmh)Z)$<5o}37VB8P
zDkW}f2$vNn>`=NX5S$CY9|sN`jti@A*{6lb0#0AnLL5%sa3^)}6zq+Got=xMyW|xu
zML|1MU)>5ljxw2O7AheSZn}0VOim%msyGy?%p=w7TZ&=C$o^^x95AoW4`8D1Q1=gX
zQXLVSqbI&mi`Ik5hZq3;5)d#@2yy^c>;y_sB9n7L2})>+>vVdQU<=|lo#9SG2}*N8
z2}&AMf*4Q&Di`4&X_KOnj{wBtcTk=f1GZ~ro|pqlkl9MyhnhaoN~G%grE>cjVy>qS
zZ3)h+PirwebFq4NumI=;40W(TKGGU(Qz_%}#aD2C$`?}-6|$HZIc1dSCpoh~Oh(u{
z1tM3^t^T<H3362&FW6iZESNxdUz2jdns?TuDU*qiUscM*ZE+m3Qa;gEw9?O(HEl&%
z^bNbs=sMi_g`x$n!(Cb^e%CQsE^RO7>Rqb+9q<XHoZAsNIY;j3D5^WUIFB}<8$cXv
z+Mp|emE)xb14f0VSvayOAL}G=3yA!nlaTt2a&BkQCyKRV7)qNui{{BIR24xTX+NG+
z3ybBU&Z5`YweE-}xlyz+3x|pj7M+5(R|5_kC{|3=fNMeP^K55*o+_7}DPF(|Vq}rX
zRSkNIEaihmB2C^ig%AF}Ki;`ZojyL<@y>lt$e$nYEcyTFc;{NDLMJ)ixiNAC`!tVt
zs%roLf4uWj8qKFbJ|Z2bbG-9n&C)=KF$OV|wiJoNtb>nj0a^80nln)-+hs@Khq>6(
z1*BoLEbJmOW9tqLut4T&4$1Snh#XnoMOgCkE}}!LR>%=l1}hEPP}S|lA8*xg&eK-5
zJZ~d_Zua`Hi)hjFxbAO>*hD24(_LcNK*W+<vyXr50+H~t=<t$S*`=!}2yFl>>3qkg
zS0zWn0RWnzwMfc}LvCgWDUSe=@SQNO9QpE=2oMS18}UN=-4OucIB7#g-wWOUNCvwj
zKqP~@h!^75Mu158(TEqq>mxuUe94bd`4>k3f2v&5T_la{=8wdzgW_|fB()JB5?)aZ
zM%!)V@(2(KuZnn~B$e`|ZX#DM>nfUucHJ74a7P4)B-|JALc*E|5DDM-_o(zwMSw{7
zu80@X?}z|y_*wS8h#!3*0=N<EgAp%;ABX_{W<YEpqrH5sJl<VodJa6X1vlC(?IBWG
z#d_t%HvC7X_Ym#*{?E3_U%QJ8CJ)JRJw#@+THHNmL)H(0Jp^J&m~_$!IV*mYclQu!
zY@c$|<)$7Yoh@D>H<Ra<CGt=Y@jctHMSj{-^kc=_WNt69k=1UIpY#$x>UDB&Z*dOW
zvQ_5w5g}NJThT|f&c*FZD5n}W^n>xCJWz1;bxVUi@^AWxe7^YG?edepBC~rr@Q{!^
zg-Vo9%r-g<s1xxk|A_#2tE)?$cr`ycsdF~~H6k&?sq2+wGMwY$n`LcZ(X9V+bY;_s
zC1~A<-|-~`H2%zn+aiAQ*S=zzuVxz>y)9}{A|LLDwyb$k?&=4Af0<0^FUE!zuib)D
zniu=AjfKu#7Y&tHg&`lp&_v9MrrYH^k!L0v3W;zD@5_L&W#wd1wtB0RVH^^vMl?Ux
zorv<2Z5mWd!x5Fe_m+`QANU9ws1fL?PaQ~t(P+gEz9@@r(M%4rMP_qa0-xs?h=gLH
z4#hHPiO}i=2O(5EvVr=fE#|Sk>t&k(q8AJxPaYszv)c9Yt^wkDR=-~Q&k`;5Z)DrE
zpva0?mz*V9dF!8aYAbI!OI&Il1+LO)g+72`*So+J0N|+Xo$KT;XNlgds!DbrD9&rX
z55={iCL6(47(yjph_L^#e0ZR^HFxn!MJ@xN$#`?5?mi1TZZTB;K{%|uSe|pX7!g{I
zyqZn{E8wTr{<Maoy=0$LWuIO1iHeP{+57P7><sv5?=IEyMYis+D`y}1(#h9Ha$+CR
z&g1Y=B74Ndt(d0rjj?yBkI9yU#Myzx`w``Kv^e#p*B{Wqp@nylN%?B$etGL4(Vp$z
zFP|PHmg?E^+`(Y6hse!?MGx;$vbyRq)0Ykr8G1lw4iPtIOeJ-L1X$96e1XLNw5O<>
zQ{~zrVyLJ1YciBoeQbzG&^@IJkcsDrJl}yYwrSW@Bx5Ok&Jlw>b%0?}>mTQc^D>XB
zcPb*?K+f?jQFc<Rzdc8UxNqBmNYVwvMXSu6fSu(hMTad?yH5GYr-zG6JbRt@q!Hla
zeR9DFaW9;>^TlM(Q72@<`Jz)s?S53O4^#$QPP2E@`;yO)=@->o&KF-YG{TyT#4q|+
z)hjO+J#}_;z5L`aI6?T!df*p!dPdo}*jgrB0>ZWYNy5Y&W_}|FULyVye-OjZZev#h
z6U~z9RhI}u&n$+Y(*q_hPA2XkA7gFhlXCl|VyOO6b^K-GPP&_C`AG2$mH`)CE<S*7
zhbzQ&jA2#2YBW~2a9<fMX6CF!5$ulk29-axnA$s<0SANNqA{X7#ze^&aY^VaT6m&=
zQY_qe6PJYbR4SJ6_D&>(l3XpN|DB{Hu+BuAtb0Ky>~6@W|8#pNy_e!cY7qxNsGwtv
zQhIbbEvX|l`a>?N#X;~O>f#$eN{RpeHRWQA2F%-{`5!8jo39l8tFIa_Zo(~z*9f0+
z?To2cPLi`Gh;h}Q%@ALC<n$xrhxn@vQyZ;m+RaSU+Q^afMQ1s9oOnsjIwE#9zjFMn
z@mEfr`&a9ld6VW$o^j25O?xlR)ab&I=?U_!YehS@cJ0!+ViJ2xmsiadJ+D}vZfdCr
zu7aBZ_hq;`TrZwDJOWQF9v>b9&s<?@GvGdmNd2PV3czP#CIe0J-=<RzewjGZ=)g=<
zw!2QWVYLZz<aMG&dRd04q3C$*CxHZh-GG_Fb@GnuM5$*tTG_u&=FSr~o9va7=ZP`w
zV5WR&o@mp;*UYKMMM&G1nc7IWUGcP3uuPaQ&S0Mi*%fZqO{S@}hW}<fZSV}8IdA-o
zsS~xEOu1^l7$dz4MDc~Mp&>&ET!JSBj|*4f-HL)=#(S$M_!7KR=5G8Wcu!Ms_4^CN
z6GqStn2lD5&UgmkY(!iJ3xPL50##+1S~}pDEcy9OqNncwU=#2WOSTD#EMI=W)RG-|
zct||Yx9->?Tf8c|v)^~fLB(QZ^H9*#&On5faNEM&4VPM8*X-Y3lpBl1v+U^0)$?x_
z-?R(eoMdVX5eC(HtvTFb9#gv(?o}SA^e%i~6L@J8crK72KPo-JRLGtdeb@Qxf1%UG
zYoP8RbR$D=saGFZC-j7@KI2R+0g;BmCCnNDm#RE=oc#R-F(_CJ*bn%2xKy+Ca0wHi
zg^PkvysI{e7RheBI`~r)!e4Ge6K0MF*8{lwc=^F5F(COWz?A=dxP;wzj+Y%ai(nhq
zzbYKQ1ukLvondzr+%b5@jjz68v)E=N&-a<yUlAb-4`JPWU-gI=#V*12yeFH#Dteq<
z_Wo83=<xY}a)8z3<;5HQ0sfv~9WVEPKriT}r`(saeegNZP7Pvt<!fSAo8M-d+PO#v
zOP$&+a7UrvX#71KXKL5Lt-^q$7J4|Y`q$UQ;<V7;|FI33R%o_VFFQ4RwR-tQv!9_C
z)_=KXzog#I$F#mjz2zOz?9b?p7cVW>>>t#twQ-YX-+DXw=1>1dv+q-{KePLA$34A*
zN}cr_3a{SHl{IzXuWt`gK$|ZX-;K+UDZnT`VtxL!X75)(MW;u{?netKKx}>``%c`{
zT|&`bY`^j0^_qPT0iOQzdQSI$q}dNEsO~nA`|>|PCKNPb?TcS8cwDo$5)@N>eMa>e
z@9xFz+6pXP+k9r{1%LayW`CmKr!MvNOP}&6*c1Yvw5ykYD&9;wW61bxr&x2xPna>u
zI)PI5FE_OuH0XdhdH)Zhjc;xQu73RoaiN}^1{4^N2z`O()beS*>P|mlmSSl>x%H^{
zk=$p07JbS6`DbxSB*8zCpreyu{4Zj7Lr%Nl>EtB09uspYVVC3L9&%qf4w4D?hvVXn
zNJg76WN=OjUzYFuDu(;2Dom}f1GoE4+)43Y_)YXA_vhclBDmEz{th^~XoZ7J#c)v=
z%HS2<ct4V{1so;xhyT;eXy4hb>R$LYQ~plXJ0dX+BRBk0dRMSa<Hp0jf>ow=g#&Np
z#u>@Kf#?u?PB`9gN%CiIbPl=xi}Bq8gt_qF0249!J^Yus+JvD04RqnN!j1D!#K8hR
zk_L>kme~X*V(7+yqRBVbf&Eo9!;KI?rRbwBOpSq4DG|6eV4`>^{3pU_A1Qng{zQ8g
z#hcn#xPL)DR1g<lgz(%b_!hwJqhP9Rbo`Pg@I8P#N5#M2fpa4tsAv*lbp)2{4Wnns
zEyyP*81=3T9|laV?!ppqbirN&Oug)ezXf<e6uccU^?(~rFjO!i@J_(!fliG)h-kVA
zenUaK1FlUlwOMfUK=Si6D9J4I7(Iz$c-LceW_!HSA7caq2Ol-nH2OPS<gD%Sf;Lm?
z7)`Ulal9jk#~6QSYxl@^W59^MyGQC?Bdznddw@16dB~VDr$6^y-G%0lzdYI0M#1|A
zJXx?l|E?V3H7<yy>(l(}eU~T8hrPyd-`cg#7@N)IFJ2=nOFZt(6zAy<T_)5f7UVo#
zwvR=l7sWWGJBXrEqu&ddzA_CDVS^if4B<p>qG78EOpO{HPGjAL>ye&_iVJ@W7~y9|
zJo>|f#-<zL3BcW=;2QxKDOhItjJ|F1o-h>_xbbP+QUzT25xn<s;xF<UorA9bv*=8k
z(p`8rU_$Gn7`X@ehH8;7mE#AvW>ma!n9!p0pAFcG3ZDbmDWB7z|3P`3d>i2C2BdI8
zGPfKAqX9EiD^;VfX^ggjXD7JT$#RX~=o;_(cY=Sqto>EAlUZ@bpy0uErmAeKDu+)g
zfEz@*VQ`6=M*2l@#_$1d`hUPLUimxU*^K-ME8OrFXp|OFa4ulV5BVg=8;cm+rSV4l
zBscycQ2KV7y?4KSC*C-Zg7XrLGse5YL>7p%bYYqlqG6(c(eUMfiG;cFhvA+2Y%`d^
zxo}tE0UKWRnS3n47|Mou<c|sX?5@w{*@;G8=zi3?1WzfR9eB#{Y{f%=kHf9RvoQ=m
z0QX5eEAVW<vlEZ~)E5|2FNkG$Ux!EHc?A#sJp}h@JTK#!1O&Mfev|P~*N(k>IQg|y
zo_*i}IuVIPgTsMkjEOnLO-#%YvF9#43-846y6_yl2clqNg0t|@rPywqn*c|rc?vL1
z)Nc6Gc#qBl-JhWijf!wP-l_j5Y4T0eNbl+<{1^PXM8#W#cbaS5@WptiwFZ%6q|Ht;
z&bizTqk<2iuo*MvU5yAhrlO4lJONKO9v7a9cj|nXqyG$SV`>wa3XfjioMd#ur7(w+
zjLA^kmm`zm!h3775lo%&jH%7Wb0eN5c<#lc_){4EdG}lNCkUYZg?dTV?4Q(2GtK^6
zJ%U*OmYTg(y)8-6>{aS*TBc?{O>ew-aSP3UQN8X?M)*7Gb@96yU`EyJq}Q8cI-pl!
zjjc$Aw&h`ZubVdnQ9@-3c(^PJkshIUqyJ~iJ0jM<6;Rq@$HsK%9x0&cj31`wX!hF#
zc#3Pg{dIeiW`C-nioLg9T7-z-DQM^LtFGRft=WsdqnLf}9(Uj}#JroJnEoYCFKE6l
zO|u^&FfQi&Z$I60APbS#e^>oVs_}a=t1hp8wY70YTFlbz+cp0qDROJEc(VGVKF0T6
zYv&$#^#MUpe-|V=<m)kb5K3Q=C=U-ZTCvi1W#(YxY+Ck?9c;9>KKt5P@q7)JRzTmw
z^}+oWF6AX_2OFu?TPcaZ>O*`%9|b|@M>6RgV>GKul(Wt;`jT69j<JeOsh4XnGy3|L
z*PCkMJ?xVe!vG%yOsG~LBkP74XE6Ai=i)@>TYfnNZc^D{Q_&5YKS8myjn#LZYqaLR
zw~jc=EL?=TWrWe$m-B<OY-|04JU+sBCUgMlj^HuA!?FucYdqcXoP%c+o~d}|<0-*Y
zj^`0P8}Pi2XCI!g@cfD=_j~Y<c;@1{9goCQfoBb#=kUCR=VLsF@ce=&0p&_RVxFOO
z!b?9qBk)YZb3LA0@hrnriRa&VHpxpbFb4PE`=isKzMht9SX5K{41QE!tko8MLv1T?
zT_L@6vNWyEYS$1Gd*dHnU<5onDfD(}TxeV{@KZ2^OOX01^ixN;U1Eu}X&O-#nmk;X
zhy=kdx4ZKvjHudgk<l?B`%W;dv|9LBh*1xDM=@L)*0C~ssxeI7bcvD2#vPR_E&<E5
z{HUzG#7GaitWmDV;ozDwA3z)PawBKyMMgriqoyMx8H_v$2VA(HY<-c@IyCTSQ;|T|
z`#VGlMn(Gt??g7wo-^l~Io7Q4bFQ5_^D1lBHS;IUxpvB=88fVFubeY=*4#+8sb~x$
z%U6tU_*66a(HOXP?i?hZI&<#CNmow2di;!u*IXx$Uu49FW?g&bb=S_l=IU!EOq+D&
zTzq8w)sYNol4y>{E#O^vr?rX;KY({CpbNi&_cl@RYhl=J{qui8>({}Wm;VtXOgg)2
ze@r_a>B)PbtpQ}@(%Pw*xAWw&%Z;}3fvXJ58fdp$n6Nzb$iBp*{a*7QXx-ybuT<-Y
zcSk(*@t|G#-M%_YK8J41G>@6ubmTGv&((OQ;hBj?b#mWx!=W^>Q7EAjh0?@ElR7@B
z&29qITtR+Ij>+Sf8d*Uaz;3(+cz0np-i~9k`(?(Uz|~VHT79h<lPLd=#~n_0g5Ol%
z>j;J{Ks-_xx$!TC&v!Axdn4WvE_eUM7+zQjxG&(@+|(Aqr5X`W<TkMOD;l^Qw}bfi
zXUUr`GYa)g`PgMfKi|0spydFlPw^NdOD2po%0h0p(EwVAC%<3MQCH+&F>3y(D@KhT
z-L_!V=z@Nu^72Q`Z(DH1sJYhYHi*zC@&*9^g9}?1<X<r+IBMpoIivDMw<!qw6)Z$X
z6Wb$~0%S6$pZl%O_|8A^Oq_JB3`{k;45v{XhliT(HayWV=6vN>{~Kr%-b?V@f#*&<
zgo{nbqBHio4tyQsj_{E9iGFxoxDfBuoGwgZ#01fRS@F9=qgIAphdOKkWFbal>Hy>$
z)+M^2e^l`9AU<~^`8{~<#dD{;;R>UzK3A^3!ssCP{|dn}^>f-z#B=)Dk(Uzxk}Pky
z%%I!RlH}u;8GU@`>q(8eaPlalB;KtFF+w*sAWqs4cCrjX)h-RKL{$3o;-N-gg@^nO
zAjxXDm3SV-vj)#&c-G=^JLvHy@DqT^&*Dznb$F+=Rd^_EGRQQIDI0iA3zTwZW@(q=
zWgf_q&+%x0iR$)}!!I>Vx#=pS@DEFR1YcW^#82Y+Hy$b}v5%)y(vHGOOY9}3rIJ$G
zXYl0Xp%$rj;84V4L)dc$5<iRg=kPp_XCs~$@NB~44tGi%4ZCS8!)Z4oJUZ<bz+3Tb
z!?PXF4m>a7c}bJ?Q;dYrt9XA6&nn<F;j@8B(`o_}x<r$eA|pwy`%YXyI}7T8h@a6U
z5331Gd18FERC0hnp6sg2Cm84GL*3FHN9hQWUDyPCRur59m`0o%o(?z(FtuJ$Op>O{
zwig+>S^e=!6OS7W_9N6nb(L8?Wg;{uC%6Hffmr>cBGO8kMztIM0^o!wcoy(3x;%3M
zCr5>k1ni`jyCxYugKj=VeR@X4gWW(kUjAgG4O?Z(izgd{LT>yCk#MKiCO0WZph-De
zH7SQLQVu750^sO+EN_y3g_D0MQt{64pcRQ*pl*OWM8UlPlVr^e?-%|cydty7EFakO
zCC~%+KN356{ETa9R&?W^91W4FLpQ6C)I#*ebW;(uI$xNe<@g&BG~5e|&8%Mf8}i*T
z*waFbddC{W$-Qi>F^JrXvBm&$4~#V~B)9uGqdmD(#u>wt-GbHOt2F(>f9E)30)-cj
zH!df4$#~<Lb_j}8&`LxFH$YL_?{{a=?&L)`<N2RueGEBd8a`FdWbIUAc<3pFoox1X
dIg|g2lTk(e^PwHCTC+bG`%t32b-MB8{{z{ydm{h<

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 2c35d77034..e60edf14cf 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -79,7 +79,7 @@
 				"windmill-parser-wasm-nu": "1.510.1",
 				"windmill-parser-wasm-php": "1.574.1",
 				"windmill-parser-wasm-py": "1.538.0",
-				"windmill-parser-wasm-regex": "1.574.1",
+				"windmill-parser-wasm-regex": "1.575.4",
 				"windmill-parser-wasm-ruby": "1.526.1",
 				"windmill-parser-wasm-rust": "1.558.1",
 				"windmill-parser-wasm-ts": "1.565.0",
@@ -13759,9 +13759,9 @@
 			"integrity": "sha512-s+bdIgT/fA5em3zYUwF8D14uA/dZh7iu0krZYZQqZUO7txN37hwSCVfovbMkIwm4zPbsJ50mU8DRLt7UpAPZIw=="
 		},
 		"node_modules/windmill-parser-wasm-regex": {
-			"version": "1.574.1",
-			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.574.1.tgz",
-			"integrity": "sha512-KnNBnpTGcnBPSzTQHdsjTPJbRQ81iem98eUnMGO8Zt1qgBFJ/eFZPwmUg6TZMbMITzTi0QqRCJj08eQID1FcPg=="
+			"version": "1.575.4",
+			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.575.4.tgz",
+			"integrity": "sha512-G7Ni8XxdSKLNew50B1KRmwn/z9qq3obpEDaaDFS7Z74MeUdaBB/TD69SY6RxDL8SZrh0Tl7SCbS/GGLnt1AzkQ=="
 		},
 		"node_modules/windmill-parser-wasm-ruby": {
 			"version": "1.526.1",
diff --git a/frontend/package.json b/frontend/package.json
index 7bd2758467..67a75fac8b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -144,7 +144,7 @@
 		"windmill-parser-wasm-nu": "1.510.1",
 		"windmill-parser-wasm-php": "1.574.1",
 		"windmill-parser-wasm-py": "1.538.0",
-		"windmill-parser-wasm-regex": "1.574.1",
+		"windmill-parser-wasm-regex": "1.575.4",
 		"windmill-parser-wasm-ruby": "1.526.1",
 		"windmill-parser-wasm-rust": "1.558.1",
 		"windmill-parser-wasm-ts": "1.565.0",

From 9925932a285dd6f149d08b92979de407540efe19 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 14 Nov 2025 19:02:30 +0100
Subject: [PATCH 02/81] chore(main): release 1.576.0 (#7140)

* chore(main): release 1.576.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  14 ++
 backend/Cargo.lock                            | 130 +++++++++---------
 backend/Cargo.toml                            |   4 +-
 backend/windmill-api/openapi.yaml             |   2 +-
 benchmarks/lib.ts                             |   2 +-
 cli/src/main.ts                               |   2 +-
 frontend/package-lock.json                    |   4 +-
 frontend/package.json                         |   2 +-
 lsp/Pipfile                                   |   4 +-
 openflow.openapi.yaml                         |   2 +-
 .../WindmillClient/WindmillClient.psd1        |   2 +-
 python-client/wmill/pyproject.toml            |   2 +-
 python-client/wmill_pg/pyproject.toml         |   2 +-
 typescript-client/jsr.json                    |   2 +-
 typescript-client/package.json                |   2 +-
 version.txt                                   |   2 +-
 16 files changed, 96 insertions(+), 82 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index efd125ea43..fa67e06672 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.576.0](https://github.com/windmill-labs/windmill/compare/v1.575.4...v1.576.0) (2025-11-14)
+
+
+### Features
+
+* add support for switch and attributes in pwsh params ([#7143](https://github.com/windmill-labs/windmill/issues/7143)) ([c16bef8](https://github.com/windmill-labs/windmill/commit/c16bef8f296645ff873f9d8d28e3dcb50a65e304))
+* **ai:** handle aws bedrock as provider ([#7131](https://github.com/windmill-labs/windmill/issues/7131)) ([30eb9aa](https://github.com/windmill-labs/windmill/commit/30eb9aae25eeb563ad119ef93f3ff1ab17c66d75))
+* webhook by flow version ([#7062](https://github.com/windmill-labs/windmill/issues/7062)) ([09cdfb4](https://github.com/windmill-labs/windmill/commit/09cdfb4556748903dc5bbf53ef3356ac97c57d90))
+
+
+### Bug Fixes
+
+* use proper TLS connector for DuckLake instance catalog setup ([#7138](https://github.com/windmill-labs/windmill/issues/7138)) ([cf36fe3](https://github.com/windmill-labs/windmill/commit/cf36fe3bb1beec80fa84dc342a8a38cc7369bc4d))
+
 ## [1.575.4](https://github.com/windmill-labs/windmill/compare/v1.575.3...v1.575.4) (2025-11-13)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 6452d027a9..8d5f4e0ac0 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -199,22 +199,22 @@ dependencies = [
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e231f6134f61b71076a3eab506c379d4f36122f2af15a9ff04415ea4c3339e2"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.10"
+version = "3.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e0633414522a32ffaac8ac6cc8f748e090c5717661fddeea04219e2344f5f2a"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1026,7 +1026,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 0.4.6",
  "hyper 0.14.32",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-rustls 0.24.2",
  "hyper-rustls 0.27.7",
  "hyper-util",
@@ -1182,7 +1182,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "itoa",
  "matchit",
@@ -1569,7 +1569,7 @@ dependencies = [
  "hex",
  "http 1.3.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-named-pipe",
  "hyper-util",
  "hyperlocal",
@@ -1799,9 +1799,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
 dependencies = [
  "serde",
 ]
@@ -1945,9 +1945,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.45"
+version = "1.2.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35900b6c8d709fb1d854671ae27aeaa9eec2f8b01b364e1619a40da3e6fe2afe"
+checksum = "b97463e1064cb1b1c1384ad0a0b9c8abd0988e2a91f52606c80ef14aadb63e36"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -3625,7 +3625,7 @@ dependencies = [
  "hickory-resolver",
  "http 1.3.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-rustls 0.27.7",
  "hyper-util",
  "ipnet",
@@ -3713,7 +3713,7 @@ dependencies = [
  "http 1.3.1",
  "httparse",
  "hyper 0.14.32",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "itertools 0.10.5",
  "memmem",
@@ -3906,7 +3906,7 @@ dependencies = [
  "hkdf",
  "http 1.3.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "idna",
  "indexmap 2.11.1",
@@ -4177,7 +4177,7 @@ dependencies = [
  "http 1.3.1",
  "http-body-util",
  "hyper 0.14.32",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "libc",
  "log",
@@ -4231,7 +4231,7 @@ dependencies = [
  "deno_error",
  "deno_tls",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-rustls 0.27.7",
  "hyper-util",
  "log",
@@ -4361,7 +4361,7 @@ dependencies = [
  "h2 0.4.12",
  "http 1.3.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "once_cell",
  "rustls-tokio-stream",
@@ -5225,7 +5225,7 @@ dependencies = [
  "base64 0.21.7",
  "bytes",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project",
  "rand 0.8.5",
@@ -5292,9 +5292,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52051878f80a721bb68ebfbc930e07b65ba72f2da88968ea5c06fd6ca3d3a127"
+checksum = "3a3076410a55c90011c298b04d0cfa770b00fa04e1e3c97d3f6c9de105a03844"
 
 [[package]]
 name = "fixedbitset"
@@ -6604,9 +6604,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1744436df46f0bde35af3eda22aeaba453aada65d8f1c171cd8a5f59030bd69f"
+checksum = "2ab2d4f250c3d7b1c9fcdff1cece94ea4e2dfbec68614f7b87cb205f24ca9d11"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -6635,7 +6635,7 @@ dependencies = [
  "futures-util",
  "headers",
  "http 1.3.1",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-rustls 0.27.7",
  "hyper-util",
  "pin-project-lite",
@@ -6652,7 +6652,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73b7d8abf35697b81a825e386fc151e0d503e8cb5fcb93cc8669c376dfd6f278"
 dependencies = [
  "hex",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6683,7 +6683,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3c93eb611681b207e1fe55d5a71ecf91572ec8a6705cdb6857f7d8d5242cf58"
 dependencies = [
  "http 1.3.1",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "log",
  "rustls 0.23.29",
@@ -6701,7 +6701,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -6729,7 +6729,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -6750,7 +6750,7 @@ dependencies = [
  "futures-util",
  "http 1.3.1",
  "http-body 1.0.1",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -6771,7 +6771,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -7419,7 +7419,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-http-proxy",
  "hyper-rustls 0.27.7",
  "hyper-timeout",
@@ -8946,7 +8946,7 @@ dependencies = [
  "http-body-util",
  "httparse",
  "humantime",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "itertools 0.14.0",
  "md-5 0.10.6",
  "parking_lot 0.12.5",
@@ -10712,7 +10712,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-rustls 0.27.7",
  "hyper-tls 0.6.0",
  "hyper-util",
@@ -10772,7 +10772,7 @@ dependencies = [
  "futures",
  "getrandom 0.2.16",
  "http 1.3.1",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "parking_lot 0.11.2",
  "reqwest 0.12.24",
  "reqwest-middleware",
@@ -13945,7 +13945,7 @@ dependencies = [
  "http 1.3.1",
  "http-body 1.0.1",
  "http-body-util",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -15148,7 +15148,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15251,7 +15251,7 @@ dependencies = [
  "hf-hub",
  "hmac",
  "http 1.3.1",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "indexmap 2.11.1",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
@@ -15329,7 +15329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15344,7 +15344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15358,7 +15358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15377,7 +15377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15405,7 +15405,7 @@ dependencies = [
  "globset",
  "hex",
  "hmac",
- "hyper 1.8.0",
+ "hyper 1.8.1",
  "indexmap 2.11.1",
  "itertools 0.14.0",
  "jsonwebtoken 8.3.0",
@@ -15462,7 +15462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "regex",
  "serde",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15501,7 +15501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15513,7 +15513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15534,7 +15534,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15570,7 +15570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15582,7 +15582,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15639,7 +15639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15670,7 +15670,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15702,7 +15702,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15713,7 +15713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15748,7 +15748,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.575.4"
+version = "1.576.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 457c9f91dd..c78695440c 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.575.4"
+version = "1.576.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.575.4"
+version = "1.576.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index e57812e2e2..baa17ffac9 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.575.4
+  version: 1.576.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index d5d3bd172f..34dfefebb0 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.575.4";
+export const VERSION = "v1.576.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 6dba2bce7a..94ac4d1093 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.575.4";
+export const VERSION = "1.576.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index e60edf14cf..60d8af50d4 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.575.4",
+	"version": "1.576.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.575.4",
+			"version": "1.576.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 67a75fac8b..f16b6cdb18 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.575.4",
+	"version": "1.576.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index fb1c0f45a2..153bb83088 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.575.4"
-wmill_pg = ">=1.575.4"
+wmill = ">=1.576.0"
+wmill_pg = ">=1.576.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 5e3d9dad11..a74570dabc 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.575.4
+  version: 1.576.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index a843ee48ad..3244fb4436 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.575.4'
+    ModuleVersion     = '1.576.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 25994859cc..f1971f1e0b 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.575.4"
+version = "1.576.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 148cb808dd..d44a5c6297 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.575.4"
+version = "1.576.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index b2c821e8ff..fb7186f17e 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.575.4",
+  "version": "1.576.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 3f178725a7..494ce7405d 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.575.4",
+  "version": "1.576.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index b465773b4f..7eec38d94a 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.575.4
+1.576.0

From d3fc459b407682bf588236236916363d94f3e1ff Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Fri, 14 Nov 2025 23:14:28 +0100
Subject: [PATCH 03/81] fix: DuckDB FFI crash fix (#7145)

---
 backend/windmill-duckdb-ffi-internal/Cargo.lock | 10 ++++++----
 backend/windmill-duckdb-ffi-internal/Cargo.toml |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/backend/windmill-duckdb-ffi-internal/Cargo.lock b/backend/windmill-duckdb-ffi-internal/Cargo.lock
index a53a988f30..92bc697c87 100644
--- a/backend/windmill-duckdb-ffi-internal/Cargo.lock
+++ b/backend/windmill-duckdb-ffi-internal/Cargo.lock
@@ -415,8 +415,9 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
 [[package]]
 name = "duckdb"
-version = "1.4.1"
-source = "git+https://github.com/diegoimbert/duckdb-rs?branch=main#0df52a6941c9996d7ec60d585eaf6430db8c48cf"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e46d5568337ee1f7ea8779e1d9aa2eafcdf156458713ce65afb246c5d2cf5850"
 dependencies = [
  "arrow",
  "cast",
@@ -702,8 +703,9 @@ checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 
 [[package]]
 name = "libduckdb-sys"
-version = "1.4.1"
-source = "git+https://github.com/diegoimbert/duckdb-rs?branch=main#0df52a6941c9996d7ec60d585eaf6430db8c48cf"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6650a7ea86fce24fe1fbf5b037671a8b77c59d135703fc6085b8a1827e66e977"
 dependencies = [
  "cc",
  "flate2",
diff --git a/backend/windmill-duckdb-ffi-internal/Cargo.toml b/backend/windmill-duckdb-ffi-internal/Cargo.toml
index 9560e1d0e6..610dfb8fcc 100644
--- a/backend/windmill-duckdb-ffi-internal/Cargo.toml
+++ b/backend/windmill-duckdb-ffi-internal/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"
 
 [dependencies]
 chrono = "0.4.41"
-duckdb = { git = "https://github.com/diegoimbert/duckdb-rs", branch = "main", features = ["bundled"] }
+duckdb = { version = "1.4.2", features = ["bundled"] }
 rust_decimal = "1.37.2"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "^1", features = ["preserve_order", "raw_value"] }

From 5c893becfd3caca7c61c8898fd2ed9a0d2e33646 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 14 Nov 2025 23:19:58 +0100
Subject: [PATCH 04/81] chore(main): release 1.576.1 (#7146)

* chore(main): release 1.576.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa67e06672..846f4eae2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.576.1](https://github.com/windmill-labs/windmill/compare/v1.576.0...v1.576.1) (2025-11-14)
+
+
+### Bug Fixes
+
+* DuckDB FFI crash fix ([#7145](https://github.com/windmill-labs/windmill/issues/7145)) ([d3fc459](https://github.com/windmill-labs/windmill/commit/d3fc459b407682bf588236236916363d94f3e1ff))
+
 ## [1.576.0](https://github.com/windmill-labs/windmill/compare/v1.575.4...v1.576.0) (2025-11-14)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 8d5f4e0ac0..960c57b32f 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15148,7 +15148,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15329,7 +15329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15344,7 +15344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15358,7 +15358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "axum",
@@ -15377,7 +15377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15462,7 +15462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "regex",
  "serde",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15501,7 +15501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15513,7 +15513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15534,7 +15534,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15570,7 +15570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15582,7 +15582,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15639,7 +15639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15670,7 +15670,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15702,7 +15702,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15713,7 +15713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15748,7 +15748,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.576.0"
+version = "1.576.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index c78695440c..55d9842300 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.576.0"
+version = "1.576.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.576.0"
+version = "1.576.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index baa17ffac9..bc7469ee56 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.0
+  version: 1.576.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 34dfefebb0..e8b4b9fd83 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.576.0";
+export const VERSION = "v1.576.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 94ac4d1093..d67c968b8b 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.576.0";
+export const VERSION = "1.576.1";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 60d8af50d4..d0e1b807ba 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.0",
+	"version": "1.576.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.576.0",
+			"version": "1.576.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index f16b6cdb18..1313ba3b07 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.0",
+	"version": "1.576.1",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 153bb83088..b78b3cb6e3 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.576.0"
-wmill_pg = ">=1.576.0"
+wmill = ">=1.576.1"
+wmill_pg = ">=1.576.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index a74570dabc..0d53e44356 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.0
+  version: 1.576.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 3244fb4436..f3b6447085 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.576.0'
+    ModuleVersion     = '1.576.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index f1971f1e0b..322507c7d0 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.576.0"
+version = "1.576.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index d44a5c6297..ceb8715758 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.576.0"
+version = "1.576.1"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index fb7186f17e..76a994dada 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.576.0",
+  "version": "1.576.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 494ce7405d..871fc27f08 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.576.0",
+  "version": "1.576.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 7eec38d94a..9d295502df 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.576.0
+1.576.1

From fa1bc3c71185fcf52c06d39e71ae7c85166fa367 Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Sat, 15 Nov 2025 12:56:45 +0100
Subject: [PATCH 05/81] DuckDB test to ensure FFI doesn't crash on simple query
 (#7147)

* test_duckdb_ffi

* build dev duckdb lib

* cache
---
 .github/workflows/backend-test.yml | 10 +++++++++-
 backend/run_until_fail.sh          |  3 ++-
 backend/tests/worker.rs            | 30 ++++++++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index 5fa4a289f2..366e6bd27d 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -67,13 +67,21 @@ jobs:
       - name: Substitute EE code (EE logic is behind feature flag)
         run: |
           ./substitute_ee_code.sh --copy --dir ./windmill-ee-private
+      - name: Cache DuckDB FFI module build
+        uses: actions/cache@v3
+        with:
+          path: ./backend/windmill-duckdb-ffi-internal/target
+          key: ${{ runner.os }}-duckdb-ffi-${{ hashFiles('./backend/windmill-duckdb-ffi-internal/src/**/*.rs', './backend/windmill-duckdb-ffi-internal/Cargo.toml', './backend/windmill-duckdb-ffi-internal/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-duckdb-ffi-
       - name: cargo test
         timeout-minutes: 16
         run: deno --version && bun -v && go version && python3 --version &&
+          cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd .. &&
           SQLX_OFFLINE=true
           DATABASE_URL=postgres://postgres:changeme@localhost:5432/windmill
           DISABLE_EMBEDDING=true RUST_LOG=info RUST_LOG_STYLE=never
           DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go)
           UV_PATH=$(which uv) cargo test --features
-          enterprise,deno_core,license,python,rust,scoped_cache,private --all --
+          enterprise,deno_core,license,python,duckdb,rust,scoped_cache,private --all --
           --nocapture
diff --git a/backend/run_until_fail.sh b/backend/run_until_fail.sh
index d8c461504b..935bacc88c 100755
--- a/backend/run_until_fail.sh
+++ b/backend/run_until_fail.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 
 # Run the command repeatedly until it fails (exits with non-zero code)
+cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd ..
 while true; do
     DISABLE_EMBEDDING=true \
     RUST_LOG=info \
@@ -9,7 +10,7 @@ while true; do
     GO_PATH=$(which go) \
     UV_PATH=$(which uv) \
     CARGO_PATH=$(which cargo) \
-    cargo test --features enterprise,deno_core,license,python,rust,scoped_cache \
+    cargo test --features enterprise,deno_core,license,python,duckdb,rust,scoped_cache \
         -- --nocapture --test-threads=8 | tee /tmp/test.log
     
     # Capture the exit code of the cargo test command (not tee)
diff --git a/backend/tests/worker.rs b/backend/tests/worker.rs
index 57d7833c9d..0a92dfc74d 100644
--- a/backend/tests/worker.rs
+++ b/backend/tests/worker.rs
@@ -2944,3 +2944,33 @@ async fn test_workflow_as_code(db: Pool<Postgres>) -> anyhow::Result<()> {
     .await;
     Ok(())
 }
+
+#[cfg(feature = "duckdb")]
+#[sqlx::test(fixtures("base"))]
+async fn test_duckdb_ffi(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+
+    let content = "-- result_collection=last_statement_first_row_scalar\nSELECT 'Hello world!';";
+
+    let flow: FlowValue = serde_json::from_value(serde_json::json!({
+        "modules": [{
+            "value": {
+                "type": "rawscript",
+                "language": "duckdb",
+                "content": content,
+            },
+        }],
+    }))
+    .unwrap();
+
+    let result =
+        RunJob::from(JobPayload::RawFlow { value: flow.clone(), path: None, restarted_from: None })
+            .run_until_complete(&db, false, server.addr.port())
+            .await
+            .json_result()
+            .unwrap();
+    assert_eq!(result, serde_json::json!("Hello world!"));
+    Ok(())
+}

From 6426ebf8cb713443904065064b6a07eb1db0761a Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Sat, 15 Nov 2025 19:10:05 +0100
Subject: [PATCH 06/81] fix: temporary fix for duckdb type_aliases causing
 issues (#7148)

---
 .../windmill-duckdb-ffi-internal/src/lib.rs   | 25 ++++++++++---------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/backend/windmill-duckdb-ffi-internal/src/lib.rs b/backend/windmill-duckdb-ffi-internal/src/lib.rs
index 501b5c5dee..25f8e5aba8 100644
--- a/backend/windmill-duckdb-ffi-internal/src/lib.rs
+++ b/backend/windmill-duckdb-ffi-internal/src/lib.rs
@@ -245,7 +245,7 @@ fn do_duckdb_inner(
     }
     // Statement needs to be stepped at least once or stmt.column_names() will panic
     let mut column_names = None;
-    let mut type_aliases = None;
+    // let mut type_aliases = None;
     loop {
         let row = rows.next();
         match row {
@@ -260,17 +260,18 @@ fn do_duckdb_inner(
                         column_names.as_ref().unwrap()
                     }
                 };
-                let type_aliases = match type_aliases.as_ref() {
-                    Some(type_aliases) => type_aliases,
-                    None => {
-                        type_aliases = Some(
-                            (0..stmt.column_count())
-                                .map(|i| stmt.column_logical_type(i).get_alias())
-                                .collect::<Vec<_>>(),
-                        );
-                        type_aliases.as_ref().unwrap()
-                    }
-                };
+                // let type_aliases = match type_aliases.as_ref() {
+                //     Some(type_aliases) => type_aliases,
+                //     None => {
+                //         type_aliases = Some(
+                //             (0..stmt.column_count())
+                //                 .map(|i| stmt.column_logical_type(i).get_alias())
+                //                 .collect::<Vec<_>>(),
+                //         );
+                //         type_aliases.as_ref().unwrap()
+                //     }
+                // };
+                let type_aliases = (0..stmt.column_count()).map(|_| None).collect::<Vec<_>>();
 
                 let row = row_to_value(row, &column_names.as_slice(), &type_aliases.as_slice())
                     .map_err(|e| e.to_string())?;

From 7215aa971201ef8c9248320ff7feb55079aaab60 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 15 Nov 2025 19:17:08 +0100
Subject: [PATCH 07/81] chore(main): release 1.576.2 (#7149)

* chore(main): release 1.576.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 846f4eae2f..1a0973aab0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.576.2](https://github.com/windmill-labs/windmill/compare/v1.576.1...v1.576.2) (2025-11-15)
+
+
+### Bug Fixes
+
+* temporary fix for duckdb type_aliases causing issues ([#7148](https://github.com/windmill-labs/windmill/issues/7148)) ([6426ebf](https://github.com/windmill-labs/windmill/commit/6426ebf8cb713443904065064b6a07eb1db0761a))
+
 ## [1.576.1](https://github.com/windmill-labs/windmill/compare/v1.576.0...v1.576.1) (2025-11-14)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 960c57b32f..8907781c9e 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15148,7 +15148,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15329,7 +15329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15344,7 +15344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15358,7 +15358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -15377,7 +15377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15462,7 +15462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "regex",
  "serde",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15501,7 +15501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15513,7 +15513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15534,7 +15534,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15570,7 +15570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15582,7 +15582,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15639,7 +15639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15670,7 +15670,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15702,7 +15702,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15713,7 +15713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15748,7 +15748,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.576.1"
+version = "1.576.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 55d9842300..d1cab72381 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.576.1"
+version = "1.576.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.576.1"
+version = "1.576.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index bc7469ee56..5bcafc5c78 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.1
+  version: 1.576.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index e8b4b9fd83..a83713c98a 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.576.1";
+export const VERSION = "v1.576.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index d67c968b8b..beceeeb120 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.576.1";
+export const VERSION = "1.576.2";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index d0e1b807ba..bfcb5919b2 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.1",
+	"version": "1.576.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.576.1",
+			"version": "1.576.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 1313ba3b07..0727867786 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.1",
+	"version": "1.576.2",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index b78b3cb6e3..cb35dfaa73 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.576.1"
-wmill_pg = ">=1.576.1"
+wmill = ">=1.576.2"
+wmill_pg = ">=1.576.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 0d53e44356..e912b1a0a7 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.1
+  version: 1.576.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index f3b6447085..ba38065bb7 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.576.1'
+    ModuleVersion     = '1.576.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 322507c7d0..da0f5f1907 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.576.1"
+version = "1.576.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index ceb8715758..a1ec93bdbd 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.576.1"
+version = "1.576.2"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 76a994dada..92342b4f31 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.576.1",
+  "version": "1.576.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 871fc27f08..ef0ebfc5d4 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.576.1",
+  "version": "1.576.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 9d295502df..e0426c7b71 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.576.1
+1.576.2

From f1029d0f14f0125e3a90db4ed9de3e58868e93d3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 15 Nov 2025 19:07:13 +0000
Subject: [PATCH 08/81] s3 endpoints improvements

---
 backend/ee-repo-ref.txt                       |  2 +-
 backend/windmill-common/src/s3_helpers.rs     | 25 +++++++++++++++++--
 .../workspaceSettings/StorageSettings.svelte  |  2 ++
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index f6823b4692..7d5311398e 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-31ee9d3449f05cd0328c0fcf43e2b161dee767b9
\ No newline at end of file
+423c3c2d175b15b7c0f010e08f1848a7710e31be
\ No newline at end of file
diff --git a/backend/windmill-common/src/s3_helpers.rs b/backend/windmill-common/src/s3_helpers.rs
index 899e3a2fd5..69fbaa4b29 100644
--- a/backend/windmill-common/src/s3_helpers.rs
+++ b/backend/windmill-common/src/s3_helpers.rs
@@ -396,6 +396,21 @@ pub struct S3Resource {
     pub port: Option<u16>,
 }
 
+impl S3Resource {
+    pub fn endpoint_with_region_fallback(&self, region_fallback: Option<String>) -> String {
+        if self.endpoint.is_empty() {
+            let final_region = if self.region.is_empty() {
+                region_fallback.unwrap_or_else(|| "us-east-1".to_string())
+            } else {
+                self.region.clone()
+            };
+            format!("s3.{}.amazonaws.com", final_region)
+        } else {
+            self.endpoint.clone()
+        }
+    }
+}
+
 #[derive(Debug, Deserialize, Serialize, Clone)]
 pub struct AzureBlobResource {
     pub endpoint: Option<String>,
@@ -642,7 +657,7 @@ pub async fn build_s3_client(s3_resource_ref: &S3Resource) -> error::Result<Arc<
 
     let s3_resource = s3_resource_ref.clone();
     let endpoint = render_endpoint(
-        s3_resource.endpoint,
+        s3_resource.endpoint_with_region_fallback(None),
         s3_resource.use_ssl,
         s3_resource.port,
         s3_resource.path_style,
@@ -1216,7 +1231,13 @@ pub fn duckdb_connection_settings_internal(
         duckdb_settings.push_str("SET s3_url_style='path';\n");
     }
     duckdb_settings.push_str(format!("SET s3_region='{}';\n", s3_resource.region).as_str());
-    duckdb_settings.push_str(format!("SET s3_endpoint='{}';\n", s3_resource.endpoint).as_str());
+    duckdb_settings.push_str(
+        format!(
+            "SET s3_endpoint='{}';\n",
+            s3_resource.endpoint_with_region_fallback(None)
+        )
+        .as_str(),
+    );
     if !s3_resource.use_ssl {
         duckdb_settings.push_str("SET s3_use_ssl=0;\n"); // default is true for DuckDB
     }
diff --git a/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte b/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
index ff392f5447..69514e819c 100644
--- a/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/StorageSettings.svelte
@@ -218,6 +218,8 @@
 	</div>
 	<div class="flex mt-5 mb-5 gap-1">
 		<Button
+			variant="accent"
+			size="xl"
 			on:click={() => {
 				editWindmillLFSSettings()
 				console.log('Saving S3 settings', s3ResourceSettings)

From 2c04e04bf0e3272c89f321392158888d02a1191b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 15 Nov 2025 20:41:13 +0000
Subject: [PATCH 09/81] fix: handle better alias types in duckdb

---
 .../windmill-duckdb-ffi-internal/Cargo.lock   |  6 ++--
 .../windmill-duckdb-ffi-internal/Cargo.toml   |  2 +-
 .../windmill-duckdb-ffi-internal/build_dev.sh |  2 +-
 .../windmill-duckdb-ffi-internal/src/lib.rs   | 34 ++++++++++++-------
 4 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/backend/windmill-duckdb-ffi-internal/Cargo.lock b/backend/windmill-duckdb-ffi-internal/Cargo.lock
index 92bc697c87..5877d42c81 100644
--- a/backend/windmill-duckdb-ffi-internal/Cargo.lock
+++ b/backend/windmill-duckdb-ffi-internal/Cargo.lock
@@ -416,8 +416,7 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 [[package]]
 name = "duckdb"
 version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e46d5568337ee1f7ea8779e1d9aa2eafcdf156458713ce65afb246c5d2cf5850"
+source = "git+https://github.com/windmill-labs/duckdb-rs.git?rev=689b2755ab1d454577ee23f18f46f8b3503030c3#689b2755ab1d454577ee23f18f46f8b3503030c3"
 dependencies = [
  "arrow",
  "cast",
@@ -704,8 +703,7 @@ checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 [[package]]
 name = "libduckdb-sys"
 version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6650a7ea86fce24fe1fbf5b037671a8b77c59d135703fc6085b8a1827e66e977"
+source = "git+https://github.com/windmill-labs/duckdb-rs.git?rev=689b2755ab1d454577ee23f18f46f8b3503030c3#689b2755ab1d454577ee23f18f46f8b3503030c3"
 dependencies = [
  "cc",
  "flate2",
diff --git a/backend/windmill-duckdb-ffi-internal/Cargo.toml b/backend/windmill-duckdb-ffi-internal/Cargo.toml
index 610dfb8fcc..19255ae7c3 100644
--- a/backend/windmill-duckdb-ffi-internal/Cargo.toml
+++ b/backend/windmill-duckdb-ffi-internal/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"
 
 [dependencies]
 chrono = "0.4.41"
-duckdb = { version = "1.4.2", features = ["bundled"] }
+duckdb = { rev = "689b2755ab1d454577ee23f18f46f8b3503030c3", git = "https://github.com/windmill-labs/duckdb-rs.git", features = ["bundled"] }
 rust_decimal = "1.37.2"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "^1", features = ["preserve_order", "raw_value"] }
diff --git a/backend/windmill-duckdb-ffi-internal/build_dev.sh b/backend/windmill-duckdb-ffi-internal/build_dev.sh
index 0b42352732..2530dcdceb 100755
--- a/backend/windmill-duckdb-ffi-internal/build_dev.sh
+++ b/backend/windmill-duckdb-ffi-internal/build_dev.sh
@@ -1,2 +1,2 @@
-cargo build --release -p windmill_duckdb_ffi_internal
+CARGO_NET_GIT_FETCH_WITH_CLI=1 cargo build --release -p windmill_duckdb_ffi_internal
 cp target/release/libwindmill_duckdb_ffi_internal.* ../target/debug/
\ No newline at end of file
diff --git a/backend/windmill-duckdb-ffi-internal/src/lib.rs b/backend/windmill-duckdb-ffi-internal/src/lib.rs
index 25f8e5aba8..ee5396d45a 100644
--- a/backend/windmill-duckdb-ffi-internal/src/lib.rs
+++ b/backend/windmill-duckdb-ffi-internal/src/lib.rs
@@ -245,7 +245,7 @@ fn do_duckdb_inner(
     }
     // Statement needs to be stepped at least once or stmt.column_names() will panic
     let mut column_names = None;
-    // let mut type_aliases = None;
+    let mut type_aliases = None;
     loop {
         let row = rows.next();
         match row {
@@ -260,18 +260,26 @@ fn do_duckdb_inner(
                         column_names.as_ref().unwrap()
                     }
                 };
-                // let type_aliases = match type_aliases.as_ref() {
-                //     Some(type_aliases) => type_aliases,
-                //     None => {
-                //         type_aliases = Some(
-                //             (0..stmt.column_count())
-                //                 .map(|i| stmt.column_logical_type(i).get_alias())
-                //                 .collect::<Vec<_>>(),
-                //         );
-                //         type_aliases.as_ref().unwrap()
-                //     }
-                // };
-                let type_aliases = (0..stmt.column_count()).map(|_| None).collect::<Vec<_>>();
+                let type_aliases = match type_aliases.as_ref() {
+                    Some(type_aliases) => type_aliases,
+                    None => {
+                        type_aliases = Some(
+                            (0..stmt.column_count())
+                                .map(|i| {
+                                    let logical_type = stmt.column_logical_type(i);
+                                    if logical_type.is_invalid() {
+                                        None
+                                    } else {
+                                        logical_type.get_alias()
+                                    }
+                                })
+                                .collect::<Vec<_>>(),
+                        );
+                        type_aliases.as_ref().unwrap()
+                    }
+                };
+
+                // let type_aliases = (0..stmt.column_count()).map(|_| None).collect::<Vec<_>>();
 
                 let row = row_to_value(row, &column_names.as_slice(), &type_aliases.as_slice())
                     .map_err(|e| e.to_string())?;

From d062d5e390b9f1755627e33a4fb1852500db61d1 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 15 Nov 2025 21:06:19 +0000
Subject: [PATCH 10/81] duckdb nits

---
 backend/windmill-duckdb-ffi-internal/Cargo.lock | 4 ++--
 backend/windmill-duckdb-ffi-internal/Cargo.toml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/backend/windmill-duckdb-ffi-internal/Cargo.lock b/backend/windmill-duckdb-ffi-internal/Cargo.lock
index 5877d42c81..3ae3e5b066 100644
--- a/backend/windmill-duckdb-ffi-internal/Cargo.lock
+++ b/backend/windmill-duckdb-ffi-internal/Cargo.lock
@@ -416,7 +416,7 @@ checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 [[package]]
 name = "duckdb"
 version = "1.4.2"
-source = "git+https://github.com/windmill-labs/duckdb-rs.git?rev=689b2755ab1d454577ee23f18f46f8b3503030c3#689b2755ab1d454577ee23f18f46f8b3503030c3"
+source = "git+https://github.com/windmill-labs/duckdb-rs.git?rev=fe0702529de6ec5a568337726bba9355503157d2#fe0702529de6ec5a568337726bba9355503157d2"
 dependencies = [
  "arrow",
  "cast",
@@ -703,7 +703,7 @@ checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 [[package]]
 name = "libduckdb-sys"
 version = "1.4.2"
-source = "git+https://github.com/windmill-labs/duckdb-rs.git?rev=689b2755ab1d454577ee23f18f46f8b3503030c3#689b2755ab1d454577ee23f18f46f8b3503030c3"
+source = "git+https://github.com/windmill-labs/duckdb-rs.git?rev=fe0702529de6ec5a568337726bba9355503157d2#fe0702529de6ec5a568337726bba9355503157d2"
 dependencies = [
  "cc",
  "flate2",
diff --git a/backend/windmill-duckdb-ffi-internal/Cargo.toml b/backend/windmill-duckdb-ffi-internal/Cargo.toml
index 19255ae7c3..b1535daba9 100644
--- a/backend/windmill-duckdb-ffi-internal/Cargo.toml
+++ b/backend/windmill-duckdb-ffi-internal/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2024"
 
 [dependencies]
 chrono = "0.4.41"
-duckdb = { rev = "689b2755ab1d454577ee23f18f46f8b3503030c3", git = "https://github.com/windmill-labs/duckdb-rs.git", features = ["bundled"] }
+duckdb = { rev = "fe0702529de6ec5a568337726bba9355503157d2", git = "https://github.com/windmill-labs/duckdb-rs.git", features = ["bundled"] }
 rust_decimal = "1.37.2"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "^1", features = ["preserve_order", "raw_value"] }

From e1d659b7d2072ac92b88bd1aa9b3381a6e6365be Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sat, 15 Nov 2025 22:07:56 +0100
Subject: [PATCH 11/81] chore(main): release 1.576.3 (#7150)

* chore(main): release 1.576.3

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1a0973aab0..f32cb9c377 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.576.3](https://github.com/windmill-labs/windmill/compare/v1.576.2...v1.576.3) (2025-11-15)
+
+
+### Bug Fixes
+
+* handle better alias types in duckdb ([2c04e04](https://github.com/windmill-labs/windmill/commit/2c04e04bf0e3272c89f321392158888d02a1191b))
+
 ## [1.576.2](https://github.com/windmill-labs/windmill/compare/v1.576.1...v1.576.2) (2025-11-15)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 8907781c9e..836da4c13c 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15148,7 +15148,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15329,7 +15329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15344,7 +15344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15358,7 +15358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "axum",
@@ -15377,7 +15377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15462,7 +15462,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "regex",
  "serde",
@@ -15477,7 +15477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15501,7 +15501,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15513,7 +15513,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15534,7 +15534,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15570,7 +15570,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15582,7 +15582,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15604,7 +15604,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15616,7 +15616,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15639,7 +15639,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15670,7 +15670,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15702,7 +15702,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "serde",
@@ -15713,7 +15713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15748,7 +15748,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.576.2"
+version = "1.576.3"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index d1cab72381..18bfd888d2 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.576.2"
+version = "1.576.3"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.576.2"
+version = "1.576.3"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 5bcafc5c78..314a34eff3 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.2
+  version: 1.576.3
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index a83713c98a..fe33a51841 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.576.2";
+export const VERSION = "v1.576.3";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index beceeeb120..6d362eee47 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.576.2";
+export const VERSION = "1.576.3";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index bfcb5919b2..30ae14a391 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.2",
+	"version": "1.576.3",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.576.2",
+			"version": "1.576.3",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 0727867786..da4f163db7 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.2",
+	"version": "1.576.3",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index cb35dfaa73..a06a6fb27f 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.576.2"
-wmill_pg = ">=1.576.2"
+wmill = ">=1.576.3"
+wmill_pg = ">=1.576.3"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index e912b1a0a7..a5dae60ac1 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.2
+  version: 1.576.3
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index ba38065bb7..74929769d0 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.576.2'
+    ModuleVersion     = '1.576.3'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index da0f5f1907..0b2e9a3053 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.576.2"
+version = "1.576.3"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index a1ec93bdbd..3be1d00ecc 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.576.2"
+version = "1.576.3"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 92342b4f31..f0fccc57c0 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.576.2",
+  "version": "1.576.3",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index ef0ebfc5d4..4cbcbdca2f 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.576.2",
+  "version": "1.576.3",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index e0426c7b71..49974777a8 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.576.2
+1.576.3

From cf5d58ea43cef6add3da2aa1e24efc83be6df3b9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 16 Nov 2025 12:09:26 +0000
Subject: [PATCH 12/81] fix: create app_themes/groups/components only when
 needed

---
 backend/windmill-api/src/resources.rs  | 25 ++++++++++++++++++++
 backend/windmill-api/src/workspaces.rs | 32 --------------------------
 cli/install_dev.sh                     | 15 ++++++++++++
 3 files changed, 40 insertions(+), 32 deletions(-)
 create mode 100755 cli/install_dev.sh

diff --git a/backend/windmill-api/src/resources.rs b/backend/windmill-api/src/resources.rs
index ec1eafe08a..4aafcb0207 100644
--- a/backend/windmill-api/src/resources.rs
+++ b/backend/windmill-api/src/resources.rs
@@ -738,6 +738,31 @@ async fn create_resource(
     let res_value = resource.value.unwrap_or_default();
     let raw_json = sqlx::types::Json(res_value.as_ref());
 
+    if resource.path.starts_with("f/app_themes/") {
+        sqlx::query!(
+            "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by, edited_at) VALUES ($1, 'app_themes', 'App Themes', ARRAY[]::TEXT[], '{\"g/all\": false}', $2, now()) ON CONFLICT DO NOTHING",
+            w_id,
+            authed.username,
+        )
+        .execute(&db)
+        .await?;
+    } else if resource.path.starts_with("f/app_custom/") {
+        sqlx::query!(
+            "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by, edited_at) VALUES ($1, 'app_custom', 'App Custom Components', ARRAY[]::TEXT[], '{\"g/all\": false}', $2, now()) ON CONFLICT DO NOTHING",
+            w_id,
+            authed.username,
+        )
+        .execute(&db)
+        .await?;
+    } else if resource.path.starts_with("f/app_groups/") {
+        sqlx::query!(
+            "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by, edited_at) VALUES ($1, 'app_groups', 'App Groups', ARRAY[]::TEXT[], '{\"g/all\": false}', $2, now()) ON CONFLICT DO NOTHING",
+            w_id,
+            authed.username,
+        )
+        .execute(&db)
+        .await?;
+    }
     sqlx::query!(
         "INSERT INTO resource
             (workspace_id, path, value, description, resource_type, created_by, edited_at)
diff --git a/backend/windmill-api/src/workspaces.rs b/backend/windmill-api/src/workspaces.rs
index c7053209da..cea6c2ba5c 100644
--- a/backend/windmill-api/src/workspaces.rs
+++ b/backend/windmill-api/src/workspaces.rs
@@ -2455,38 +2455,6 @@ async fn create_workspace(
     .execute(&mut *tx)
     .await?;
 
-    sqlx::query!(
-        "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by, edited_at) VALUES ($1, 'app_themes', 'App Themes', ARRAY[]::TEXT[], '{\"g/all\": false}', $2, now()) ON CONFLICT DO NOTHING",
-        nw.id,
-        username,
-    )
-    .execute(&mut *tx)
-    .await?;
-
-    sqlx::query!(
-        "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by, edited_at) VALUES ($1, 'app_custom', 'App Custom Components', ARRAY[]::TEXT[], '{\"g/all\": false}', $2, now()) ON CONFLICT DO NOTHING",
-        nw.id,
-        username,
-    )
-    .execute(&mut *tx)
-    .await?;
-
-    sqlx::query!(
-        "INSERT INTO folder (workspace_id, name, display_name, owners, extra_perms, created_by, edited_at) VALUES ($1, 'app_groups', 'App Groups', ARRAY[]::TEXT[], '{\"g/all\": false}', $2, now()) ON CONFLICT DO NOTHING",
-        nw.id,
-        username,
-    )
-    .execute(&mut *tx)
-    .await?;
-
-    sqlx::query!(
-        "INSERT INTO resource (workspace_id, path, value, description, resource_type, created_by, edited_at) VALUES ($1, 'f/app_themes/theme_0', '{\"name\": \"Default Theme\", \"value\": \"\"}', 'The default app theme', 'app_theme', $2, now()) ON CONFLICT DO NOTHING",
-        nw.id,
-        username,
-    )
-    .execute(&mut *tx)
-    .await?;
-
     audit_log(
         &mut *tx,
         &authed,
diff --git a/cli/install_dev.sh b/cli/install_dev.sh
new file mode 100755
index 0000000000..e172ac1288
--- /dev/null
+++ b/cli/install_dev.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ -z "$1" ]; then
+    name="wmill"
+else
+    name="$1"
+fi
+
+./gen_wm_client.sh 
+./windmill-utils-internal/gen_wm_client.sh
+
+echo "Installing dev cli as $name (pass arg to override)"
+deno install -f -A -g src/main.ts --name $name --unstable
\ No newline at end of file

From 65a40b6df115532fab8a5dde2d4963791fc4316d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 16 Nov 2025 12:19:52 +0000
Subject: [PATCH 13/81] sqlx

---
 ...697496f44d93b344190a26c8393867b3a268b9aba.json | 15 ---------------
 1 file changed, 15 deletions(-)
 delete mode 100644 backend/.sqlx/query-cccf9e216d84dfbb801b92d697496f44d93b344190a26c8393867b3a268b9aba.json

diff --git a/backend/.sqlx/query-cccf9e216d84dfbb801b92d697496f44d93b344190a26c8393867b3a268b9aba.json b/backend/.sqlx/query-cccf9e216d84dfbb801b92d697496f44d93b344190a26c8393867b3a268b9aba.json
deleted file mode 100644
index 4a34830b0e..0000000000
--- a/backend/.sqlx/query-cccf9e216d84dfbb801b92d697496f44d93b344190a26c8393867b3a268b9aba.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource (workspace_id, path, value, description, resource_type, created_by, edited_at) VALUES ($1, 'f/app_themes/theme_0', '{\"name\": \"Default Theme\", \"value\": \"\"}', 'The default app theme', 'app_theme', $2, now()) ON CONFLICT DO NOTHING",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "cccf9e216d84dfbb801b92d697496f44d93b344190a26c8393867b3a268b9aba"
-}

From 09082de53971d0d2f2a6308bc8ee573458a3b913 Mon Sep 17 00:00:00 2001
From: dieriba <dieriba.pro@gmail.com>
Date: Mon, 17 Nov 2025 09:51:35 +0100
Subject: [PATCH 14/81] feat: allow http trigger to be disabled (#6976)

* done

* update sqlx

* fix

* fix openapi spec

* fix

* Update backend/windmill-api/openapi.yaml

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>

* nits

* nits

* fix

* fix

* update sqlx

* unneeded

* ok

* update sqlx

---------

Co-authored-by: ellipsis-dev[bot] <65095814+ellipsis-dev[bot]@users.noreply.github.com>
---
 ...0530d03548cc5c884c83d7b85d068e738b8e.json} |  5 +-
 ...bff45ff6f9cd1298eae5de40218cbab2eb96.json} |  5 +-
 ...10e008e507610f095ff3936865101c9ba346.json} |  4 +-
 ...213_allow_to_disable_http_trigger.down.sql |  2 +
 ...11213_allow_to_disable_http_trigger.up.sql |  2 +
 backend/windmill-api/openapi.yaml             | 55 ++++++-----
 backend/windmill-api/src/triggers/handler.rs  | 99 ++++++++++++-------
 .../windmill-api/src/triggers/http/handler.rs | 40 +++++---
 backend/windmill-api/src/triggers/http/mod.rs |  3 +-
 backend/windmill-api/src/triggers/listener.rs |  8 +-
 backend/windmill-api/src/triggers/mod.rs      |  2 +-
 .../windmill-api/src/triggers/postgres/mod.rs |  6 +-
 .../triggers/http/RouteEditorInner.svelte     | 20 +++-
 .../src/lib/components/triggers/http/utils.ts |  3 +-
 .../(root)/(logged)/routes/+page.svelte       | 27 ++++-
 15 files changed, 192 insertions(+), 89 deletions(-)
 rename backend/.sqlx/{query-1f6b773ce34fe51d03d6f9a2345481629c62453eebbb08f82dd2da23389bc117.json => query-94e2e899fc0a5134c29217feda1f0530d03548cc5c884c83d7b85d068e738b8e.json} (71%)
 rename backend/.sqlx/{query-465144ea7e2930203618d9814a3e20c77b4363cf9e7c655d395f3fe40c247f61.json => query-b8bcf1fef244395dad802174dfc9bff45ff6f9cd1298eae5de40218cbab2eb96.json} (70%)
 rename backend/.sqlx/{query-1301f873a829db137573b8b39449f6160f2adf44f864f26a99b8eab5818fbd50.json => query-bbc96ae911d4ca0330582340e65c10e008e507610f095ff3936865101c9ba346.json} (95%)
 create mode 100644 backend/migrations/20251028111213_allow_to_disable_http_trigger.down.sql
 create mode 100644 backend/migrations/20251028111213_allow_to_disable_http_trigger.up.sql

diff --git a/backend/.sqlx/query-1f6b773ce34fe51d03d6f9a2345481629c62453eebbb08f82dd2da23389bc117.json b/backend/.sqlx/query-94e2e899fc0a5134c29217feda1f0530d03548cc5c884c83d7b85d068e738b8e.json
similarity index 71%
rename from backend/.sqlx/query-1f6b773ce34fe51d03d6f9a2345481629c62453eebbb08f82dd2da23389bc117.json
rename to backend/.sqlx/query-94e2e899fc0a5134c29217feda1f0530d03548cc5c884c83d7b85d068e738b8e.json
index f69ec4f2a6..ca3310858b 100644
--- a/backend/.sqlx/query-1f6b773ce34fe51d03d6f9a2345481629c62453eebbb08f82dd2da23389bc117.json
+++ b/backend/.sqlx/query-94e2e899fc0a5134c29217feda1f0530d03548cc5c884c83d7b85d068e738b8e.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO http_trigger (\n                workspace_id,\n                path,\n                route_path,\n                route_path_key,\n                workspaced_route,\n                authentication_resource_path,\n                wrap_body,\n                raw_string,\n                script_path,\n                summary,\n                description,\n                is_flow,\n                request_type,\n                authentication_method,\n                http_method,\n                static_asset_config,\n                edited_by,\n                email,\n                edited_at,\n                is_static_website,\n                error_handler_path,\n                error_handler_args,\n                retry\n            )\n            VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, now(), $19, $20, $21, $22\n            )\n            ",
+  "query": "\n            INSERT INTO http_trigger (\n                workspace_id,\n                path,\n                route_path,\n                route_path_key,\n                workspaced_route,\n                authentication_resource_path,\n                wrap_body,\n                raw_string,\n                script_path,\n                summary,\n                description,\n                is_flow,\n                enabled,\n                request_type,\n                authentication_method,\n                http_method,\n                static_asset_config,\n                edited_by,\n                email,\n                edited_at,\n                is_static_website,\n                error_handler_path,\n                error_handler_args,\n                retry\n            )\n            VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, now(), $20, $21, $22, $23\n            )\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -17,6 +17,7 @@
         "Varchar",
         "Text",
         "Bool",
+        "Bool",
         {
           "Custom": {
             "name": "request_type",
@@ -69,5 +70,5 @@
     },
     "nullable": []
   },
-  "hash": "1f6b773ce34fe51d03d6f9a2345481629c62453eebbb08f82dd2da23389bc117"
+  "hash": "94e2e899fc0a5134c29217feda1f0530d03548cc5c884c83d7b85d068e738b8e"
 }
diff --git a/backend/.sqlx/query-465144ea7e2930203618d9814a3e20c77b4363cf9e7c655d395f3fe40c247f61.json b/backend/.sqlx/query-b8bcf1fef244395dad802174dfc9bff45ff6f9cd1298eae5de40218cbab2eb96.json
similarity index 70%
rename from backend/.sqlx/query-465144ea7e2930203618d9814a3e20c77b4363cf9e7c655d395f3fe40c247f61.json
rename to backend/.sqlx/query-b8bcf1fef244395dad802174dfc9bff45ff6f9cd1298eae5de40218cbab2eb96.json
index 7869fe789e..5a0f76fc07 100644
--- a/backend/.sqlx/query-465144ea7e2930203618d9814a3e20c77b4363cf9e7c655d395f3fe40c247f61.json
+++ b/backend/.sqlx/query-b8bcf1fef244395dad802174dfc9bff45ff6f9cd1298eae5de40218cbab2eb96.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            UPDATE\n                http_trigger\n            SET\n                route_path = $1,\n                route_path_key = $2,\n                workspaced_route = $3,\n                wrap_body = $4,\n                raw_string = $5,\n                authentication_resource_path = $6,\n                script_path = $7,\n                path = $8,\n                is_flow = $9,\n                http_method = $10,\n                static_asset_config = $11,\n                edited_by = $12,\n                email = $13,\n                request_type = $14,\n                authentication_method = $15,\n                summary = $16,\n                description = $17,\n                edited_at = now(),\n                is_static_website = $18,\n                error_handler_path = $19,\n                error_handler_args = $20,\n                retry = $21\n            WHERE\n                workspace_id = $22 AND\n                path = $23\n            ",
+  "query": "\n            UPDATE\n                http_trigger\n            SET\n                route_path = $1,\n                route_path_key = $2,\n                workspaced_route = $3,\n                wrap_body = $4,\n                raw_string = $5,\n                authentication_resource_path = $6,\n                script_path = $7,\n                path = $8,\n                is_flow = $9,\n                enabled = $10,\n                http_method = $11,\n                static_asset_config = $12,\n                edited_by = $13,\n                email = $14,\n                request_type = $15,\n                authentication_method = $16,\n                summary = $17,\n                description = $18,\n                edited_at = now(),\n                is_static_website = $19,\n                error_handler_path = $20,\n                error_handler_args = $21,\n                retry = $22\n            WHERE\n                workspace_id = $23 AND\n                path = $24\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -14,6 +14,7 @@
         "Varchar",
         "Varchar",
         "Bool",
+        "Bool",
         {
           "Custom": {
             "name": "http_method",
@@ -70,5 +71,5 @@
     },
     "nullable": []
   },
-  "hash": "465144ea7e2930203618d9814a3e20c77b4363cf9e7c655d395f3fe40c247f61"
+  "hash": "b8bcf1fef244395dad802174dfc9bff45ff6f9cd1298eae5de40218cbab2eb96"
 }
diff --git a/backend/.sqlx/query-1301f873a829db137573b8b39449f6160f2adf44f864f26a99b8eab5818fbd50.json b/backend/.sqlx/query-bbc96ae911d4ca0330582340e65c10e008e507610f095ff3936865101c9ba346.json
similarity index 95%
rename from backend/.sqlx/query-1301f873a829db137573b8b39449f6160f2adf44f864f26a99b8eab5818fbd50.json
rename to backend/.sqlx/query-bbc96ae911d4ca0330582340e65c10e008e507610f095ff3936865101c9ba346.json
index 2999ae4bf2..5b9959ce13 100644
--- a/backend/.sqlx/query-1301f873a829db137573b8b39449f6160f2adf44f864f26a99b8eab5818fbd50.json
+++ b/backend/.sqlx/query-bbc96ae911d4ca0330582340e65c10e008e507610f095ff3936865101c9ba346.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                    SELECT\n                        path,\n                        script_path,\n                        is_flow,\n                        route_path,\n                        authentication_resource_path,\n                        workspace_id,\n                        request_type AS \"request_type: _\",\n                        authentication_method  AS \"authentication_method: _\",\n                        edited_by,\n                        email,\n                        static_asset_config AS \"static_asset_config: _\",\n                        wrap_body,\n                        raw_string,\n                        workspaced_route,\n                        is_static_website,\n                        error_handler_path,\n                        error_handler_args as \"error_handler_args: _\",\n                        retry as \"retry: _\"\n                    FROM\n                        http_trigger\n                    WHERE\n                        http_method = $1\n                    ",
+  "query": "\n                    SELECT\n                        path,\n                        script_path,\n                        is_flow,\n                        route_path,\n                        authentication_resource_path,\n                        workspace_id,\n                        request_type AS \"request_type: _\",\n                        authentication_method  AS \"authentication_method: _\",\n                        edited_by,\n                        email,\n                        static_asset_config AS \"static_asset_config: _\",\n                        wrap_body,\n                        raw_string,\n                        workspaced_route,\n                        is_static_website,\n                        error_handler_path,\n                        error_handler_args as \"error_handler_args: _\",\n                        retry as \"retry: _\"\n                    FROM\n                        http_trigger\n                    WHERE\n                        http_method = $1 AND\n                        enabled is TRUE\n                    ",
   "describe": {
     "columns": [
       {
@@ -158,5 +158,5 @@
       true
     ]
   },
-  "hash": "1301f873a829db137573b8b39449f6160f2adf44f864f26a99b8eab5818fbd50"
+  "hash": "bbc96ae911d4ca0330582340e65c10e008e507610f095ff3936865101c9ba346"
 }
diff --git a/backend/migrations/20251028111213_allow_to_disable_http_trigger.down.sql b/backend/migrations/20251028111213_allow_to_disable_http_trigger.down.sql
new file mode 100644
index 0000000000..f743944360
--- /dev/null
+++ b/backend/migrations/20251028111213_allow_to_disable_http_trigger.down.sql
@@ -0,0 +1,2 @@
+-- Add down migration script here
+ALTER TABLE http_trigger DROP COLUMN enabled;
\ No newline at end of file
diff --git a/backend/migrations/20251028111213_allow_to_disable_http_trigger.up.sql b/backend/migrations/20251028111213_allow_to_disable_http_trigger.up.sql
new file mode 100644
index 0000000000..ad28eeb7f4
--- /dev/null
+++ b/backend/migrations/20251028111213_allow_to_disable_http_trigger.up.sql
@@ -0,0 +1,2 @@
+-- Add up migration script here
+ALTER TABLE http_trigger ADD COLUMN enabled BOOLEAN DEFAULT TRUE NOT NULL;
\ No newline at end of file
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 314a34eff3..80077a1c6f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -10163,6 +10163,34 @@ paths:
               schema:
                 type: boolean
 
+  /w/{workspace}/http_triggers/setenabled/{path}:
+    post:
+      summary: enable/disable http trigger
+      operationId: setHttpTriggerEnabled
+      tags:
+        - http_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                enabled:
+                  type: boolean
+              required:
+                - enabled
+      responses:
+        "200":
+          description: http trigger enable/disable
+          content:
+            text/plain:
+              schema:
+                type: string
+
   /w/{workspace}/websocket_triggers/create:
     post:
       summary: create websocket trigger
@@ -17222,6 +17250,8 @@ components:
           format: date-time
         is_flow:
           type: boolean
+        enabled:
+          type: boolean
       required:
         - path
         - script_path
@@ -17231,6 +17261,7 @@ components:
         - edited_by
         - edited_at
         - is_flow
+        - enabled
 
     AuthenticationMethod:
       type: string
@@ -17456,6 +17487,8 @@ components:
           type: boolean
         wrap_body:
           type: boolean
+        enabled:
+          type: boolean
         raw_string:
           type: boolean
         error_handler_path:
@@ -17581,8 +17614,6 @@ components:
           format: date-time
         error:
           type: string
-        enabled:
-          type: boolean
         filters:
           type: array
           items:
@@ -17613,7 +17644,6 @@ components:
 
       required:
         - url
-        - enabled
         - filters
         - can_return_message
         - can_return_error_result
@@ -17802,17 +17832,13 @@ components:
           format: date-time
         error:
           type: string
-        enabled:
-          type: boolean
         error_handler_path:
           type: string
         error_handler_args:
           $ref: "#/components/schemas/ScriptArgs"
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
-
       required:
-        - enabled
         - subscribe_topics
         - mqtt_resource_path
 
@@ -17934,8 +17960,6 @@ components:
           format: date-time
         error:
           type: string
-        enabled:
-          type: boolean
         error_handler_path:
           type: string
         error_handler_args:
@@ -17946,7 +17970,6 @@ components:
         - gcp_resource_path
         - topic_id
         - subscription_id
-        - enabled
         - delivery_type
         - subscription_mode
 
@@ -18048,8 +18071,6 @@ components:
           format: date-time
         error:
           type: string
-        enabled:
-          type: boolean
         error_handler_path:
           type: string
         error_handler_args:
@@ -18060,7 +18081,6 @@ components:
       required:
         - queue_url
         - aws_resource_path
-        - enabled
         - aws_auth_resource_type
 
     LoggedWizardStatus:
@@ -18257,8 +18277,6 @@ components:
         - $ref: "#/components/schemas/TriggerExtraProperty"
       type: object
       properties:
-        enabled:
-          type: boolean
         postgres_resource_path:
           type: string
         publication_name:
@@ -18279,7 +18297,6 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
       required:
-        - enabled
         - postgres_resource_path
         - replication_slot_name
         - publication_name
@@ -18370,8 +18387,6 @@ components:
           format: date-time
         error:
           type: string
-        enabled:
-          type: boolean
         error_handler_path:
           type: string
         error_handler_args:
@@ -18383,7 +18398,6 @@ components:
         - kafka_resource_path
         - group_id
         - topics
-        - enabled
 
     NewKafkaTrigger:
       type: object
@@ -18475,8 +18489,6 @@ components:
           format: date-time
         error:
           type: string
-        enabled:
-          type: boolean
         error_handler_path:
           type: string
         error_handler_args:
@@ -18488,7 +18500,6 @@ components:
         - nats_resource_path
         - use_jetstream
         - subjects
-        - enabled
 
     NewNatsTrigger:
       type: object
diff --git a/backend/windmill-api/src/triggers/handler.rs b/backend/windmill-api/src/triggers/handler.rs
index 0e22ea2f34..66851aed9e 100644
--- a/backend/windmill-api/src/triggers/handler.rs
+++ b/backend/windmill-api/src/triggers/handler.rs
@@ -146,8 +146,12 @@ pub trait TriggerCrud: Send + Sync + 'static {
             "extra_perms",
         ];
 
+        if Self::SUPPORTS_ENABLED {
+            fields.push("enabled");
+        }
+
         if Self::SUPPORTS_SERVER_STATE {
-            fields.extend_from_slice(&["enabled", "server_id", "last_server_ping", "error"]);
+            fields.extend_from_slice(&["server_id", "last_server_ping", "error"]);
         }
 
         fields.extend_from_slice(&["error_handler_path", "error_handler_args", "retry"]);
@@ -206,6 +210,10 @@ pub trait TriggerCrud: Send + Sync + 'static {
         Ok(deleted > 0)
     }
 
+    async fn set_enabled_extra_action(&self, _: &mut PgConnection) -> Result<()> {
+        Ok(())
+    }
+
     async fn set_enabled(
         &self,
         authed: &ApiAuthed,
@@ -214,38 +222,59 @@ pub trait TriggerCrud: Send + Sync + 'static {
         path: &str,
         enabled: bool,
     ) -> Result<bool> {
-        if !Self::SUPPORTS_SERVER_STATE {
-            return Err(anyhow::anyhow!(
-                "Enable/disable not supported for this trigger type".to_string(),
-            )
-            .into());
-        }
+        let updated = if Self::SUPPORTS_SERVER_STATE {
+            sqlx::query(&format!(
+                r#"
+                UPDATE 
+                    {} 
+                SET 
+                    enabled = $1,
+                    email = $2,
+                    edited_by = $3,
+                    edited_at = now(),
+                    server_id = NULL,
+                    error = NULL
+                WHERE 
+                    workspace_id = $4 AND 
+                    path = $5
+                "#,
+                Self::TABLE_NAME
+            ))
+            .bind(enabled)
+            .bind(&authed.email)
+            .bind(&authed.username)
+            .bind(workspace_id)
+            .bind(path)
+            .execute(&mut *tx)
+            .await?
+            .rows_affected()
+        } else {
+            sqlx::query(&format!(
+                r#"
+                UPDATE 
+                    {} 
+                SET 
+                    enabled = $1,
+                    email = $2,
+                    edited_by = $3,
+                    edited_at = now()
+                WHERE 
+                    workspace_id = $4 AND 
+                    path = $5
+                "#,
+                Self::TABLE_NAME
+            ))
+            .bind(enabled)
+            .bind(&authed.email)
+            .bind(&authed.username)
+            .bind(workspace_id)
+            .bind(path)
+            .execute(&mut *tx)
+            .await?
+            .rows_affected()
+        };
 
-        let updated = sqlx::query(&format!(
-            r#"
-            UPDATE 
-                {} 
-            SET 
-                enabled = $1,
-                email = $2,
-                edited_by = $3,
-                edited_at = now(),
-                server_id = NULL,
-                error = NULL
-            WHERE 
-                workspace_id = $4 AND 
-                path = $5
-            "#,
-            Self::TABLE_NAME
-        ))
-        .bind(enabled)
-        .bind(&authed.email)
-        .bind(&authed.username)
-        .bind(workspace_id)
-        .bind(path)
-        .execute(&mut *tx)
-        .await?
-        .rows_affected();
+        self.set_enabled_extra_action(&mut *tx).await?;
 
         Ok(updated > 0)
     }
@@ -298,8 +327,12 @@ pub trait TriggerCrud: Send + Sync + 'static {
             "extra_perms",
         ];
 
+        if Self::SUPPORTS_ENABLED {
+            fields.push("enabled");
+        }
+
         if Self::SUPPORTS_SERVER_STATE {
-            fields.extend_from_slice(&["enabled", "server_id", "last_server_ping", "error"]);
+            fields.extend_from_slice(&["server_id", "last_server_ping", "error"]);
         }
 
         fields.extend_from_slice(&["error_handler_path", "error_handler_args", "retry"]);
diff --git a/backend/windmill-api/src/triggers/http/handler.rs b/backend/windmill-api/src/triggers/http/handler.rs
index fd051e05be..19fabe40ea 100644
--- a/backend/windmill-api/src/triggers/http/handler.rs
+++ b/backend/windmill-api/src/triggers/http/handler.rs
@@ -196,6 +196,7 @@ pub async fn insert_new_trigger_into_db(
                 summary,
                 description,
                 is_flow,
+                enabled,
                 request_type,
                 authentication_method,
                 http_method,
@@ -209,7 +210,7 @@ pub async fn insert_new_trigger_into_db(
                 retry
             )
             VALUES (
-                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, now(), $19, $20, $21, $22
+                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, now(), $20, $21, $22, $23
             )
             "#,
             w_id,
@@ -224,6 +225,7 @@ pub async fn insert_new_trigger_into_db(
             trigger.config.summary,
             trigger.config.description,
             trigger.base.is_flow,
+            trigger.base.enabled.unwrap_or(true),
             request_type as _,
             trigger.config.authentication_method as _,
             trigger.config.http_method as _,
@@ -356,7 +358,7 @@ impl TriggerCrud for HttpTrigger {
 
     const TABLE_NAME: &'static str = "http_trigger";
     const TRIGGER_TYPE: &'static str = "http";
-    const SUPPORTS_ENABLED: bool = false;
+    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/http_triggers";
@@ -482,22 +484,23 @@ impl TriggerCrud for HttpTrigger {
                 script_path = $7,
                 path = $8,
                 is_flow = $9,
-                http_method = $10,
-                static_asset_config = $11,
-                edited_by = $12,
-                email = $13,
-                request_type = $14,
-                authentication_method = $15,
-                summary = $16,
-                description = $17,
+                enabled = $10,
+                http_method = $11,
+                static_asset_config = $12,
+                edited_by = $13,
+                email = $14,
+                request_type = $15,
+                authentication_method = $16,
+                summary = $17,
+                description = $18,
                 edited_at = now(),
-                is_static_website = $18,
-                error_handler_path = $19,
-                error_handler_args = $20,
-                retry = $21
+                is_static_website = $19,
+                error_handler_path = $20,
+                error_handler_args = $21,
+                retry = $22
             WHERE
-                workspace_id = $22 AND
-                path = $23
+                workspace_id = $23 AND
+                path = $24
             "#,
                 route_path,
                 &route_path_key,
@@ -508,6 +511,7 @@ impl TriggerCrud for HttpTrigger {
                 trigger.base.script_path,
                 trigger.base.path,
                 trigger.base.is_flow,
+                trigger.base.enabled.unwrap_or(true),
                 trigger.config.http_method as _,
                 trigger.config.static_asset_config as _,
                 &authed.username,
@@ -586,6 +590,10 @@ impl TriggerCrud for HttpTrigger {
         Ok(())
     }
 
+    async fn set_enabled_extra_action(&self, tx: &mut PgConnection) -> Result<()> {
+        increase_trigger_version(tx).await
+    }
+
     async fn delete_by_path(
         &self,
         tx: &mut PgConnection,
diff --git a/backend/windmill-api/src/triggers/http/mod.rs b/backend/windmill-api/src/triggers/http/mod.rs
index 55844e0fb1..96944eccad 100644
--- a/backend/windmill-api/src/triggers/http/mod.rs
+++ b/backend/windmill-api/src/triggers/http/mod.rs
@@ -261,7 +261,8 @@ pub async fn refresh_routers(db: &DB) -> Result<(bool, RwLockReadGuard<'_, Route
                     FROM
                         http_trigger
                     WHERE
-                        http_method = $1
+                        http_method = $1 AND
+                        enabled is TRUE
                     "#,
                 &http_method as &HttpMethod
             )
diff --git a/backend/windmill-api/src/triggers/listener.rs b/backend/windmill-api/src/triggers/listener.rs
index af9d0e32ce..23e0dfd936 100644
--- a/backend/windmill-api/src/triggers/listener.rs
+++ b/backend/windmill-api/src/triggers/listener.rs
@@ -69,12 +69,12 @@ pub trait Listener: TriggerCrud + TriggerJobArgs {
             "email",
             "edited_at",
             "extra_perms",
+            "enabled",
+            "error_handler_path",
+            "error_handler_args",
+            "retry",
         ];
 
-        if Self::SUPPORTS_SERVER_STATE {
-            fields.extend_from_slice(&["enabled", "server_id", "last_server_ping", "error"]);
-        }
-        fields.extend_from_slice(&["error_handler_path", "error_handler_args", "retry"]);
         fields.extend_from_slice(Self::ADDITIONAL_SELECT_FIELDS);
 
         let mut sqlb = SqlBuilder::select_from(Self::TABLE_NAME);
diff --git a/backend/windmill-api/src/triggers/mod.rs b/backend/windmill-api/src/triggers/mod.rs
index 9a7f22e3e5..6c7004dac4 100644
--- a/backend/windmill-api/src/triggers/mod.rs
+++ b/backend/windmill-api/src/triggers/mod.rs
@@ -47,6 +47,7 @@ pub struct BaseTrigger {
     pub workspace_id: String,
     pub path: String,
     pub script_path: String,
+    pub enabled: Option<bool>,
     pub is_flow: bool,
     pub edited_by: String,
     pub email: String,
@@ -56,7 +57,6 @@ pub struct BaseTrigger {
 
 #[derive(Debug, FromRow, Clone, Serialize, Deserialize)]
 pub struct ServerState {
-    pub enabled: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub server_id: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
diff --git a/backend/windmill-api/src/triggers/postgres/mod.rs b/backend/windmill-api/src/triggers/postgres/mod.rs
index 191c57b166..ea267721a2 100644
--- a/backend/windmill-api/src/triggers/postgres/mod.rs
+++ b/backend/windmill-api/src/triggers/postgres/mod.rs
@@ -350,14 +350,14 @@ pub async fn get_raw_postgres_connection(
     }
 
     let connector = build_tls_connector(ssl_mode, database.root_certificate_pem.as_ref())?;
-
     let client = if let Some(connector) = connector {
         let (client, connection) = config.connect(connector).await.map_err(to_anyhow)?;
         tokio::spawn(async move {
+            tracing::info!("Successfully connected to PostgreSQL database for trigger execution");
             if let Err(e) = connection.await {
-                tracing::debug!("{:#?}", e);
+                tracing::debug!("Error during PostgreSQL trigger connection: {:#?}", e);
             };
-            tracing::info!("Successfully Connected into database");
+            tracing::info!("PostgreSQL trigger connection closed");
         });
         client
     } else {
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
index 2fb5bfeb26..bb11e620bf 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
@@ -83,6 +83,7 @@
 	let static_asset_config = $state<{ s3: string; storage?: string; filename?: string } | undefined>(
 		undefined
 	)
+	let enabled: boolean = $state(false)
 	let is_static_website = $state(false)
 	let s3FileUploadRawMode = $state(false)
 	let workspaced_route = $state(false)
@@ -235,6 +236,7 @@
 			s3FileUploadRawMode = defaultValues?.s3FileUploadRawMode ?? false
 			path = defaultValues?.path ?? ''
 			initialPath = ''
+			enabled = defaultValues?.enabled ?? true
 			dirtyPath = false
 			is_static_website = defaultValues?.is_static_website ?? false
 			workspaced_route = defaultValues?.workspaced_route ?? false
@@ -268,6 +270,7 @@
 		wrap_body = cfg?.wrap_body ?? false
 		raw_string = cfg?.raw_string ?? false
 		summary = cfg?.summary ?? ''
+		enabled = cfg?.enabled ?? false
 		routeDescription = cfg?.description ?? ''
 		authentication_resource_path = cfg?.authentication_resource_path ?? ''
 		if (cfg?.authentication_method === 'custom_script') {
@@ -344,6 +347,7 @@
 			http_method,
 			request_type,
 			workspaced_route,
+			enabled,
 			wrap_body,
 			raw_string,
 			authentication_resource_path,
@@ -361,6 +365,19 @@
 		return nCfg
 	}
 
+	async function handleToggleEnabled(newEnabled: boolean) {
+		enabled = newEnabled
+		if (!trigger?.draftConfig) {
+			await HttpTriggerService.setHttpTriggerEnabled({
+				path: initialPath,
+				workspace: $workspaceStore ?? '',
+				requestBody: { enabled: newEnabled }
+			})
+			sendUserToast(`${newEnabled ? 'enabled' : 'disabled'} HTTP trigger ${initialPath}`)
+		}
+	}
+
+
 	// Update config for captures
 	function getCaptureConfig() {
 		const newCaptureConfig = {
@@ -829,7 +846,8 @@
 			{trigger}
 			permissions={drawerLoading || !can_write ? 'none' : can_write && isAdmin ? 'create' : 'write'}
 			{saveDisabled}
-			enabled={undefined}
+			{enabled}
+			onToggleEnabled={handleToggleEnabled}
 			{allowDraft}
 			{edit}
 			isLoading={deploymentLoading}
diff --git a/frontend/src/lib/components/triggers/http/utils.ts b/frontend/src/lib/components/triggers/http/utils.ts
index 31c70dc5dd..212201f0b6 100644
--- a/frontend/src/lib/components/triggers/http/utils.ts
+++ b/frontend/src/lib/components/triggers/http/utils.ts
@@ -60,7 +60,8 @@ export async function saveHttpRouteFromCfg(
 		summary: routeCfg.summary,
 		error_handler_path: routeCfg.error_handler_path,
 		error_handler_args: routeCfg.error_handler_path ? routeCfg.error_handler_args : undefined,
-		retry: routeCfg.retry
+		retry: routeCfg.retry,
+		enabled: routeCfg.enabled
 	}
 	try {
 		if (edit) {
diff --git a/frontend/src/routes/(root)/(logged)/routes/+page.svelte b/frontend/src/routes/(root)/(logged)/routes/+page.svelte
index 3312b2741f..c87d1861e1 100644
--- a/frontend/src/routes/(root)/(logged)/routes/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/routes/+page.svelte
@@ -196,6 +196,23 @@
 		}
 	}
 
+	async function setTriggerEnabled(path: string, enabled: boolean): Promise<void> {
+		try {
+			await HttpTriggerService.setHttpTriggerEnabled({
+				path,
+				workspace: $workspaceStore!,
+				requestBody: { enabled }
+			})
+		} catch (err) {
+			sendUserToast(
+				`Cannot ` + (enabled ? 'enable' : 'disable') + ` http trigger: ${err.body}`,
+				true
+			)
+		} finally {
+			loadTriggers()
+		}
+	}
+
 	onMount(() => {
 		loadQueryFilters()
 	})
@@ -297,7 +314,7 @@
 				<div class="text-center text-sm font-semibold text-emphasis mt-2"> No routes </div>
 			{:else if items?.length}
 				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { workspace_id, workspaced_route, path, edited_by, edited_at, script_path, route_path, is_flow, extra_perms, canWrite, marked, http_method, static_asset_config } (path)}
+					{#each items.slice(0, nbDisplayed) as { workspace_id, workspaced_route, enabled, path, edited_by, edited_at, script_path, route_path, is_flow, extra_perms, canWrite, marked, http_method, static_asset_config } (path)}
 						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
 
 						<div
@@ -342,6 +359,14 @@
 									<SharedBadge {canWrite} extraPerms={extra_perms} />
 								</div>
 
+								<Toggle
+									checked={enabled}
+									disabled={!canWrite}
+									on:change={(e) => {
+										setTriggerEnabled(path, e.detail)
+									}}
+								/>
+
 								<div class="flex gap-2 items-center justify-end">
 									<Button
 										on:click={() =>

From 767940c6fa1a5aa4b31b7638a4b72ad403b0cdc3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 17 Nov 2025 10:46:52 +0000
Subject: [PATCH 15/81] avoid utf8 migration encoding

---
 backend/windmill-api/src/db.rs       | 4 ++++
 backend/windmill-api/src/settings.rs | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/windmill-api/src/db.rs b/backend/windmill-api/src/db.rs
index c5d16ebffe..09da5d1b11 100644
--- a/backend/windmill-api/src/db.rs
+++ b/backend/windmill-api/src/db.rs
@@ -53,6 +53,9 @@ lazy_static::lazy_static! {
                     ).to_string()),
                     (20221105003256, "DELETE FROM workspace_invite WHERE workspace_id = 'demo' AND email = 'ruben@windmill.dev';".to_string()),
                     (20221123151919, "".to_string()),
+                    (20251105100125, include_str!(
+                        "../../migrations/20251105100125_legacy_sql_result_flag.up.sql"
+                    ).replace("✅", "")),
                     ].into_iter().collect();
 }
 
@@ -166,6 +169,7 @@ impl Migrate for CustomMigrator {
 
             if let Some(migration_sql) = OVERRIDDEN_MIGRATIONS.get(&migration.version) {
                 tracing::info!("Using custom migration for version {}", migration.version);
+                // tracing::info!("Migration SQL: {}", migration_sql);
 
                 self.inner
                     .execute(&**migration_sql)
diff --git a/backend/windmill-api/src/settings.rs b/backend/windmill-api/src/settings.rs
index 62cb87d391..8fa6a0138b 100644
--- a/backend/windmill-api/src/settings.rs
+++ b/backend/windmill-api/src/settings.rs
@@ -695,7 +695,7 @@ async fn setup_ducklake_catalog_db_inner(
         "postgres://{user}:{password}@{host}:{port}/{dbname}?sslmode={sslmode}",
         user = urlencoding::encode(&pg_creds.username.unwrap_or_else(|| "postgres".to_string())),
         password = urlencoding::encode(&pg_creds.password.as_deref().unwrap_or("")),
-        host = urlencoding::encode(&pg_creds.host),
+        host = &pg_creds.host,
         port = pg_creds.port.unwrap_or(5432),
         dbname = dbname,
         sslmode = ssl_mode

From 2cae72c9db6bd08689e1672be6dda32f6af831fb Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Mon, 17 Nov 2025 12:29:44 +0100
Subject: [PATCH 16/81] fix: fix parse_postgres_uri not decoding password
 (#7157)

* nit overscroll auto

* decode password in parse_postgres_url

* don't encode host in pg_executor

* nit
---
 backend/Cargo.lock                                       | 1 +
 backend/windmill-common/Cargo.toml                       | 1 +
 backend/windmill-common/src/lib.rs                       | 9 ++++++---
 backend/windmill-worker/src/pg_executor.rs               | 2 +-
 .../components/workspaceSettings/DucklakeSettings.svelte | 4 ++--
 5 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 836da4c13c..38aa2aba71 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15452,6 +15452,7 @@ dependencies = [
  "tracing-opentelemetry",
  "tracing-subscriber",
  "url",
+ "urlencoding",
  "uuid",
  "windmill-macros",
  "windmill-parser",
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 8317940079..674c48ffd3 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -86,6 +86,7 @@ openidconnect = { workspace = true, optional = true }
 strum.workspace = true
 strum_macros.workspace = true
 url.workspace = true
+urlencoding.workspace = true
 async-recursion.workspace = true
 
 semver.workspace = true
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index b91dcfaf95..ada171a230 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -341,7 +341,12 @@ pub fn parse_postgres_url(url: &str) -> Result<PostgresUrlComponents, Error> {
 
     let scheme = parsed_url.scheme().to_string();
     let username = parsed_url.username().to_string();
+    let username = urlencoding::decode(&username).map_err(to_anyhow)?.to_string();
     let password = parsed_url.password().map(|p| p.to_string());
+    let password = match password {
+        Some(p) => Some(urlencoding::decode(&p).map_err(to_anyhow)?.to_string()),
+        None => None,
+    };
     let host = parsed_url
         .host_str()
         .ok_or_else(|| Error::BadConfig("Missing host in PostgreSQL URL".to_string()))?
@@ -490,9 +495,7 @@ type Tag = String;
 pub use db::DB;
 
 use crate::{
-    auth::{PermsCache, FLOW_PERMS_CACHE, HASH_PERMS_CACHE},
-    db::{AuthedRef, UserDbWithAuthed},
-    scripts::ScriptHash,
+    auth::{FLOW_PERMS_CACHE, HASH_PERMS_CACHE, PermsCache}, db::{AuthedRef, UserDbWithAuthed}, error::to_anyhow, scripts::ScriptHash
 };
 
 #[derive(Clone)]
diff --git a/backend/windmill-worker/src/pg_executor.rs b/backend/windmill-worker/src/pg_executor.rs
index e240b5d87b..15cc6ccf30 100644
--- a/backend/windmill-worker/src/pg_executor.rs
+++ b/backend/windmill-worker/src/pg_executor.rs
@@ -241,7 +241,7 @@ pub async fn do_postgresql(
         "postgres://{user}:{password}@{host}:{port}/{dbname}?sslmode={sslmode}",
         user = encode(&database.user.unwrap_or("postgres".to_string())),
         password = encode(&database.password.unwrap_or("".to_string())),
-        host = encode(&database.host),
+        host = database.host,
         port = database.port.unwrap_or(5432),
         dbname = database.dbname,
         sslmode = sslmode
diff --git a/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte b/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
index 1910bca0e5..c4ecbf8855 100644
--- a/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
+++ b/frontend/src/lib/components/workspaceSettings/DucklakeSettings.svelte
@@ -295,7 +295,7 @@
 								<Popover
 									class="absolute right-1.5"
 									enableFlyTransition
-									contentClasses="py-5 px-6 w-[34rem] bg-surface-secondary -translate-y-2"
+									contentClasses="py-5 px-6 w-[34rem] bg-surface-secondary -translate-y-2 overflow-y-auto"
 									closeOnOtherPopoverOpen
 									closeOnOutsideClick
 									bind:this={instanceCatalogPopover}
@@ -503,7 +503,7 @@
 					await instanceCatalogStatuses.refresh()
 					if (result.success) {
 						if (!wasAlreadySuccessful) sendUserToast('Setup successful')
-						else sendUserToast('Everything OK')
+						else sendUserToast('Check successful')
 					} else {
 						sendUserToast(result.error ?? 'An error occured', true)
 					}

From b66e038a0f8b6bffe157a83671c8e692c1441f23 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 17 Nov 2025 12:29:58 +0100
Subject: [PATCH 17/81] feat: add support for validateset in pwsh (#7158)

---
 .../parsers/windmill-parser-bash/src/lib.rs   | 383 ++++++++++++++++--
 backend/windmill-worker/src/pwsh_executor.rs  |  11 +-
 cli/wasm/regex/windmill_parser_wasm.d.ts      |  14 +-
 cli/wasm/regex/windmill_parser_wasm.js        | 192 ++++-----
 cli/wasm/regex/windmill_parser_wasm_bg.wasm   | Bin 355438 -> 360222 bytes
 frontend/package-lock.json                    |   8 +-
 frontend/package.json                         |   2 +-
 7 files changed, 466 insertions(+), 144 deletions(-)

diff --git a/backend/parsers/windmill-parser-bash/src/lib.rs b/backend/parsers/windmill-parser-bash/src/lib.rs
index f1652ed5d6..023e41a902 100644
--- a/backend/parsers/windmill-parser-bash/src/lib.rs
+++ b/backend/parsers/windmill-parser-bash/src/lib.rs
@@ -82,6 +82,37 @@ fn parse_bash_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
     Ok(Some(args))
 }
 
+/// Extract a PowerShell param() block with its preceding attributes, handling nested parentheses.
+///
+/// # Arguments
+/// * `code` - The PowerShell code to extract from
+/// * `include_attributes` - If true, includes attributes like [CmdletBinding()] before param
+///
+/// # Returns
+/// A tuple of (param_block_with_attributes, remaining_code) or None if not found.
+/// - `param_block_with_attributes`: The param block including attributes/comments if include_attributes is true
+/// - `remaining_code`: The rest of the code after the param block
+///
+/// This function uses the existing extract_powershell_param_block validation, which already
+/// ensures that only comments, whitespace, and attributes appear before param. So we can
+/// simply return everything from the beginning to the end of the param block.
+pub fn extract_powershell_param_block_with_attributes(code: &str, include_attributes: bool) -> Option<(&str, &str)> {
+    // First, use the existing function to validate and find the param block
+    let param_block = extract_powershell_param_block(code, true)?;
+
+    // Find where the param block ends in the original code
+    let param_end_pos = code.find(param_block)? + param_block.len();
+
+    // If include_attributes is true, we start from the beginning (position 0)
+    // since we know everything before param is valid (comments/whitespace/attributes)
+    // Otherwise, start from where param begins
+    if include_attributes {
+        Some((&code[..param_end_pos], &code[param_end_pos..]))
+    } else {
+        Some((param_block, &code[param_end_pos..]))
+    }
+}
+
 /// Extract a PowerShell param() block, handling nested parentheses.
 ///
 /// # Arguments
@@ -92,51 +123,60 @@ fn parse_bash_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
 /// # Returns
 /// The extracted param block or contents, or None if not found.
 pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Option<&str> {
-    // Find "param" keyword (case-insensitive)
-    let lower_code = code.to_lowercase();
-    let param_start = lower_code.find("param")?;
-
-    // Verify that only comments, whitespace, and [CmdletBinding()] appear before "param"
-    let before_param = &code[..param_start];
-    let mut chars = before_param.chars().peekable();
+    // Scan through the code looking for "param" while validating everything before it
+    let mut chars = code.chars().enumerate().peekable();
     let mut in_block_comment = false;
     let mut in_attribute_bracket = false;
     let mut bracket_depth = 0;
+    let mut in_single_quote = false;
+    let mut in_double_quote = false;
+    let mut param_start = None;
 
-    while let Some(ch) = chars.next() {
+    while let Some((idx, ch)) = chars.next() {
         if in_block_comment {
             // Check for end of block comment: #>
-            if ch == '#' && chars.peek() == Some(&'>') {
+            if ch == '#' && chars.peek().map(|(_, c)| c) == Some(&'>') {
                 chars.next(); // consume '>'
                 in_block_comment = false;
             }
         } else if in_attribute_bracket {
-            // Track bracket depth to handle nested brackets/parens in attributes
-            match ch {
-                '[' => bracket_depth += 1,
-                ']' => {
-                    bracket_depth -= 1;
-                    if bracket_depth == 0 {
-                        in_attribute_bracket = false;
-                    }
+            // Handle quotes inside attributes to avoid counting brackets/parens inside strings
+            if in_single_quote {
+                if ch == '\'' {
+                    in_single_quote = false;
+                }
+            } else if in_double_quote {
+                if ch == '"' {
+                    in_double_quote = false;
+                }
+            } else {
+                // Track bracket depth to handle nested brackets/parens in attributes
+                match ch {
+                    '\'' => in_single_quote = true,
+                    '"' => in_double_quote = true,
+                    '[' => bracket_depth += 1,
+                    ']' => {
+                        bracket_depth -= 1;
+                        if bracket_depth == 0 {
+                            in_attribute_bracket = false;
+                        }
+                    }
+                    _ => {}
                 }
-                // Allow parentheses inside attributes (e.g., [CmdletBinding()])
-                _ => {}
             }
         } else {
             match ch {
                 // Start of block comment: <#
-                '<' if chars.peek() == Some(&'#') => {
+                '<' if chars.peek().map(|(_, c)| c) == Some(&'#') => {
                     chars.next(); // consume '#'
                     in_block_comment = true;
                 }
                 // Single-line comment: consume until end of line
                 '#' => {
-                    while let Some(&next_ch) = chars.peek() {
+                    for (_, next_ch) in chars.by_ref() {
                         if next_ch == '\n' || next_ch == '\r' {
                             break;
                         }
-                        chars.next();
                     }
                 }
                 // Start of attribute bracket (e.g., [CmdletBinding()])
@@ -144,6 +184,30 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
                     in_attribute_bracket = true;
                     bracket_depth = 1;
                 }
+                // Check if we've found "param" (case-insensitive)
+                'p' | 'P' => {
+                    // Check if this is the start of "param" keyword
+                    let remaining = &code[idx..];
+                    if remaining.len() >= 5 {
+                        let next_four = &remaining[1..5];
+                        if next_four.eq_ignore_ascii_case("aram") {
+                            // Check word boundaries
+                            let before_ok = idx == 0 || {
+                                let before = code.as_bytes()[idx - 1];
+                                !before.is_ascii_alphanumeric() && before != b'_'
+                            };
+                            let after_ok = idx + 5 >= code.len() || {
+                                let after = code.as_bytes()[idx + 5];
+                                !after.is_ascii_alphanumeric() && after != b'_'
+                            };
+
+                            if before_ok && after_ok {
+                                param_start = Some(idx);
+                                break;
+                            }
+                        }
+                    }
+                }
                 // Whitespace is allowed
                 c if c.is_whitespace() => {}
                 // Any other character means there's code before param
@@ -157,6 +221,8 @@ pub fn extract_powershell_param_block(code: &str, include_keyword: bool) -> Opti
         return None;
     }
 
+    let param_start = param_start?;
+
     // Skip whitespace and tabs after "param"
     let mut chars = code[param_start + 5..].char_indices();
     let mut paren_offset = param_start + 5;
@@ -244,6 +310,84 @@ fn parse_powershell_single_typ(typ: &str) -> Typ {
     }
 }
 
+/// Parse ValidateSet attribute to extract enum values
+/// Example: ValidateSet('Red', 'Green', 'Blue') -> Some(vec!["Red", "Green", "Blue"])
+fn parse_validate_set(bracket_content: &str) -> Option<Vec<String>> {
+    // Find the opening parenthesis
+    let start = bracket_content.find('(')?;
+    let end = bracket_content.rfind(')')?;
+
+    if start >= end {
+        return None;
+    }
+
+    let values_str = &bracket_content[start + 1..end];
+    let mut values = Vec::new();
+    let mut current_value = String::new();
+    let mut in_single_quote = false;
+    let mut in_double_quote = false;
+    let mut escape_next = false;
+
+    for ch in values_str.chars() {
+        if escape_next {
+            current_value.push(ch);
+            escape_next = false;
+            continue;
+        }
+
+        match ch {
+            '`' if in_double_quote => {
+                escape_next = true;
+            }
+            '\'' if !in_double_quote => {
+                if in_single_quote {
+                    // End of single-quoted string
+                    values.push(current_value.clone());
+                    current_value.clear();
+                    in_single_quote = false;
+                } else {
+                    // Start of single-quoted string
+                    in_single_quote = true;
+                }
+            }
+            '"' if !in_single_quote => {
+                if in_double_quote {
+                    // End of double-quoted string
+                    values.push(current_value.clone());
+                    current_value.clear();
+                    in_double_quote = false;
+                } else {
+                    // Start of double-quoted string
+                    in_double_quote = true;
+                }
+            }
+            ',' if !in_single_quote && !in_double_quote => {
+                // Skip commas outside quotes
+                continue;
+            }
+            c if in_single_quote || in_double_quote => {
+                current_value.push(c);
+            }
+            c if !c.is_whitespace() => {
+                // Handle unquoted values (though PowerShell typically requires quotes)
+                current_value.push(c);
+            }
+            _ => {}
+        }
+    }
+
+    // Handle any remaining unquoted value
+    if !current_value.is_empty() {
+        values.push(current_value.trim().to_string());
+    }
+
+    if values.is_empty() {
+        None
+    } else {
+        Some(values)
+    }
+}
+
 /// Single-pass PowerShell parameter parser.
 /// Parses the content of a param() block and extracts all parameter information.
 ///
@@ -273,6 +417,7 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
     let mut var_name: Option<String> = None;
     let mut default_value: Option<String> = None;
     let mut is_mandatory = false;
+    let mut validate_set: Option<Vec<String>> = None;
 
     // Track position for extracting text
     let mut last_bracket_start = None;
@@ -315,6 +460,14 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
                                     }
                                 }
 
+                                // Check if this is a ValidateSet attribute
+                                if lower.starts_with("validateset(") {
+                                    // Extract values from ValidateSet('val1', 'val2', ...)
+                                    if let Some(values) = parse_validate_set(bracket_content) {
+                                        validate_set = Some(values);
+                                    }
+                                }
+
                                 // Check if this looks like a type (simple word, possibly with [])
                                 let is_type = !bracket_content.contains('(')
                                     && !bracket_content.contains('=')
@@ -404,7 +557,7 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
                     ',' => {
                         // End of parameter, finalize it
                         if let Some(name) = var_name.take() {
-                            args.push(finalize_parameter(name, type_annotation.take(), default_value.take(), is_mandatory)?);
+                            args.push(finalize_parameter(name, type_annotation.take(), default_value.take(), is_mandatory, validate_set.take())?);
                         }
 
                         // Reset for next parameter
@@ -412,6 +565,7 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
                         var_name = None;
                         default_value = None;
                         is_mandatory = false;
+                        validate_set = None;
                         found_dollar = false;
                     }
                     _ => {}
@@ -422,7 +576,7 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
 
     // Finalize last parameter
     if let Some(name) = var_name {
-        args.push(finalize_parameter(name, type_annotation, default_value, is_mandatory)?);
+        args.push(finalize_parameter(name, type_annotation, default_value, is_mandatory, validate_set)?);
     }
 
     Ok(args)
@@ -433,11 +587,15 @@ fn finalize_parameter(
     type_annotation: Option<String>,
     default_value: Option<String>,
     is_mandatory: bool,
+    validate_set: Option<Vec<String>>,
 ) -> anyhow::Result<Arg> {
     // Store the original PowerShell type for use in the executor
     let otyp = type_annotation.clone();
 
-    let mut parsed_typ = if let Some(typ) = type_annotation {
+    // If ValidateSet is present, use it to create an enum type
+    let mut parsed_typ = if let Some(ref enum_values) = validate_set {
+        Some(Typ::Str(Some(enum_values.clone())))
+    } else if let Some(typ) = type_annotation {
         if typ.ends_with("[]") {
             Some(Typ::List(Box::new(parse_powershell_single_typ(
                 typ.strip_suffix("[]").unwrap(),
@@ -653,9 +811,9 @@ non_required="${5:-}"
                         oidx: None
                     },
                     Arg {
-                        otyp: Some("string".to_string()), // [string] (last type bracket with Mandatory)
+                        otyp: Some("string".to_string()), // [string] (last type bracket with Mandatory and ValidateSet)
                         name: "Message".to_string(),
-                        typ: Typ::Str(None),
+                        typ: Typ::Str(Some(vec!["Green".to_string(), "Blue".to_string(), "Red".to_string()])), // ValidateSet enum
                         default: None,
                         has_default: false, // Required (Mandatory attribute)
                         oidx: None
@@ -833,6 +991,33 @@ non_required="${5:-}"
             extract_powershell_param_block("[CmdletBinding(\nparam($Name)", false),
             None
         );
+
+        // Valid: CmdletBinding with DefaultParameterSetName
+        assert_eq!(
+            extract_powershell_param_block(
+                "[CmdletBinding(DefaultParameterSetName='ByName')]\nparam($Name, $Id)",
+                false
+            ),
+            Some("$Name, $Id")
+        );
+
+        // Valid: CmdletBinding with complex parameters
+        assert_eq!(
+            extract_powershell_param_block(
+                "[CmdletBinding(DefaultParameterSetName='ByName', SupportsShouldProcess=$true)]\nparam($Path)",
+                false
+            ),
+            Some("$Path")
+        );
+
+        // Valid: Multiple attributes with parameters
+        assert_eq!(
+            extract_powershell_param_block(
+                "[CmdletBinding(DefaultParameterSetName='Set1')]\n[OutputType([string])]\nparam($Value)",
+                false
+            ),
+            Some("$Value")
+        );
     }
 
     #[test]
@@ -855,7 +1040,7 @@ param(
         assert_eq!(result.args[1].has_default, true);
         assert_eq!(result.args[1].default, Some(json!(25)));
 
-        // Test with complex attributes
+        // Test with complex attributes including ValidateSet
         let code2 = r#"param(
     [Parameter(Mandatory=$true, Position=0)]
     [ValidateSet('Red', 'Green', 'Blue')]
@@ -866,7 +1051,14 @@ param(
         let result2 = parse_powershell_sig(code2)?;
         assert_eq!(result2.args.len(), 2);
         assert_eq!(result2.args[0].name, "Color");
-        assert_eq!(result2.args[0].typ, Typ::Str(None));
+        assert_eq!(
+            result2.args[0].typ,
+            Typ::Str(Some(vec![
+                "Red".to_string(),
+                "Green".to_string(),
+                "Blue".to_string()
+            ]))
+        );
         assert_eq!(result2.args[1].name, "Items");
         assert_eq!(result2.args[1].typ, Typ::List(Box::new(Typ::Str(None))));
 
@@ -914,9 +1106,17 @@ param(
         assert_eq!(result.args[2].typ, Typ::List(Box::new(Typ::Str(None))));
         assert_eq!(result.args[2].has_default, true); // Optional (not mandatory)
 
-        // LogLevel: string with default (ValidateSet is ignored but doesn't break parsing)
+        // LogLevel: string with default and ValidateSet (creates enum type)
         assert_eq!(result.args[3].name, "LogLevel");
-        assert_eq!(result.args[3].typ, Typ::Str(None));
+        assert_eq!(
+            result.args[3].typ,
+            Typ::Str(Some(vec![
+                "Debug".to_string(),
+                "Info".to_string(),
+                "Warning".to_string(),
+                "Error".to_string()
+            ]))
+        );
         assert_eq!(result.args[3].default, Some(json!("Info")));
         assert_eq!(result.args[3].has_default, true);
 
@@ -989,6 +1189,85 @@ param(
         Ok(())
     }
 
+    #[test]
+    fn test_extract_powershell_param_block_with_attributes() {
+        // Test without attributes
+        let code = "param($Name, $Age)";
+        let result = extract_powershell_param_block_with_attributes(code, true);
+        assert_eq!(result, Some(("param($Name, $Age)", "")));
+
+        // Test with simple CmdletBinding
+        let code2 = "[CmdletBinding()]\nparam($Name)";
+        let result2 = extract_powershell_param_block_with_attributes(code2, true);
+        assert_eq!(result2, Some(("[CmdletBinding()]\nparam($Name)", "")));
+
+        // Test with CmdletBinding with parameters
+        let code3 = "[CmdletBinding(DefaultParameterSetName='ByName')]\nparam($Name, $Id)";
+        let result3 = extract_powershell_param_block_with_attributes(code3, true);
+        assert_eq!(result3, Some(("[CmdletBinding(DefaultParameterSetName='ByName')]\nparam($Name, $Id)", "")));
+
+        // Test with multiple attributes
+        let code4 = "[CmdletBinding()]\n[OutputType([string])]\nparam($Value)";
+        let result4 = extract_powershell_param_block_with_attributes(code4, true);
+        assert_eq!(result4, Some(("[CmdletBinding()]\n[OutputType([string])]\nparam($Value)", "")));
+
+        // Test with comment before attributes
+        let code5 = "# My function\n[CmdletBinding()]\nparam($Name)";
+        let result5 = extract_powershell_param_block_with_attributes(code5, true);
+        assert_eq!(result5, Some(("# My function\n[CmdletBinding()]\nparam($Name)", "")));
+
+        // Test with include_attributes = false (should only get param block, not attributes)
+        let code6 = "[CmdletBinding()]\nparam($Name)";
+        let result6 = extract_powershell_param_block_with_attributes(code6, false);
+        assert_eq!(result6, Some(("param($Name)", "")));
+
+        // Test with code after param
+        let code7 = "[CmdletBinding()]\nparam($Name)\nWrite-Host 'Hello'";
+        let result7 = extract_powershell_param_block_with_attributes(code7, true);
+        assert_eq!(result7, Some(("[CmdletBinding()]\nparam($Name)", "\nWrite-Host 'Hello'")));
+
+        // Test with code after param (without attributes)
+        let code8 = "[CmdletBinding()]\nparam($Name)\nWrite-Host 'Hello'";
+        let result8 = extract_powershell_param_block_with_attributes(code8, false);
+        assert_eq!(result8, Some(("param($Name)", "\nWrite-Host 'Hello'")));
+    }
+
+    #[test]
+    fn test_powershell_sig_with_cmdletbinding_paramsetname() -> anyhow::Result<()> {
+        // Test with [CmdletBinding(DefaultParameterSetName='ByName')]
+        let code = r#"[CmdletBinding(DefaultParameterSetName='ByName')]
+param(
+    [Parameter(Mandatory=$true, ParameterSetName='ByName')]
+    [string]$Name,
+
+    [Parameter(Mandatory=$true, ParameterSetName='ById')]
+    [int]$Id,
+
+    [string]$Description = "default description"
+)"#;
+        let result = parse_powershell_sig(code)?;
+
+        assert_eq!(result.args.len(), 3);
+
+        // Name: mandatory string
+        assert_eq!(result.args[0].name, "Name");
+        assert_eq!(result.args[0].typ, Typ::Str(None));
+        assert_eq!(result.args[0].has_default, false);
+
+        // Id: mandatory int
+        assert_eq!(result.args[1].name, "Id");
+        assert_eq!(result.args[1].typ, Typ::Int);
+        assert_eq!(result.args[1].has_default, false);
+
+        // Description: optional with default
+        assert_eq!(result.args[2].name, "Description");
+        assert_eq!(result.args[2].typ, Typ::Str(None));
+        assert_eq!(result.args[2].default, Some(json!("default description")));
+        assert_eq!(result.args[2].has_default, true);
+
+        Ok(())
+    }
+
     #[test]
     fn test_powershell_case_insensitive_parameter() -> anyhow::Result<()> {
         // Test that [parameter(...)] is case-insensitive
@@ -1019,6 +1298,48 @@ param(
         Ok(())
     }
 
+    #[test]
+    fn test_powershell_validateset_enum() -> anyhow::Result<()> {
+        // Test with ValidateSet creating an enum type
+        let code = r#"param(
+    [ValidateSet('Red', 'Green', 'Blue')]
+    [string]$Color,
+
+    [Parameter(Mandatory=$true)]
+    [ValidateSet("Small", "Medium", "Large")]
+    [string]$Size
+)"#;
+        let result = parse_powershell_sig(code)?;
+
+        assert_eq!(result.args.len(), 2);
+
+        // Color: optional with ValidateSet (enum)
+        assert_eq!(result.args[0].name, "Color");
+        assert_eq!(
+            result.args[0].typ,
+            Typ::Str(Some(vec![
+                "Red".to_string(),
+                "Green".to_string(),
+                "Blue".to_string()
+            ]))
+        );
+        assert_eq!(result.args[0].has_default, true); // Optional (not mandatory)
+
+        // Size: mandatory with ValidateSet (enum)
+        assert_eq!(result.args[1].name, "Size");
+        assert_eq!(
+            result.args[1].typ,
+            Typ::Str(Some(vec![
+                "Small".to_string(),
+                "Medium".to_string(),
+                "Large".to_string()
+            ]))
+        );
+        assert_eq!(result.args[1].has_default, false); // Required (mandatory)
+
+        Ok(())
+    }
+
     #[test]
     fn test_parse_bash_sig_with_crlf() -> anyhow::Result<()> {
         // Test with CRLF line endings (Windows-style)
diff --git a/backend/windmill-worker/src/pwsh_executor.rs b/backend/windmill-worker/src/pwsh_executor.rs
index cda448dc31..5c2b6f2e0a 100644
--- a/backend/windmill-worker/src/pwsh_executor.rs
+++ b/backend/windmill-worker/src/pwsh_executor.rs
@@ -447,15 +447,16 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
             exit 1\n\
         }\n";
 
-    // make sure param() is first
-    let param_match = windmill_parser_bash::extract_powershell_param_block(&content, true);
-    let content: String = if let Some(param_match) = param_match {
+    // make sure param() with its attributes is first
+    let content: String = if let Some((param_block, remaining_code)) =
+        windmill_parser_bash::extract_powershell_param_block_with_attributes(&content, true)
+    {
         format!(
             "{}\n{}\n{}\n{}\n{}",
-            param_match,
+            param_block,
             profile,
             strict_termination_start,
-            content.replace(param_match, ""),
+            remaining_code,
             strict_termination_end
         )
     } else {
diff --git a/cli/wasm/regex/windmill_parser_wasm.d.ts b/cli/wasm/regex/windmill_parser_wasm.d.ts
index 7886800b20..c40f0bf2a5 100644
--- a/cli/wasm/regex/windmill_parser_wasm.d.ts
+++ b/cli/wasm/regex/windmill_parser_wasm.d.ts
@@ -1,14 +1,14 @@
 /* tslint:disable */
 /* eslint-disable */
-export function parse_mssql(code: string): string;
 export function parse_powershell(code: string): string;
-export function parse_oracledb(code: string): string;
-export function parse_graphql(code: string): string;
 export function parse_assets_sql(code: string): string;
+export function parse_snowflake(code: string): string;
+export function parse_db_resource(code: string): string | undefined;
+export function parse_graphql(code: string): string;
+export function parse_mssql(code: string): string;
+export function parse_sql(code: string): string;
+export function parse_oracledb(code: string): string;
+export function parse_bigquery(code: string): string;
 export function parse_mysql(code: string): string;
 export function parse_bash(code: string): string;
 export function parse_duckdb(code: string): string;
-export function parse_db_resource(code: string): string | undefined;
-export function parse_bigquery(code: string): string;
-export function parse_snowflake(code: string): string;
-export function parse_sql(code: string): string;
diff --git a/cli/wasm/regex/windmill_parser_wasm.js b/cli/wasm/regex/windmill_parser_wasm.js
index b3b62ebd32..580d3b0334 100644
--- a/cli/wasm/regex/windmill_parser_wasm.js
+++ b/cli/wasm/regex/windmill_parser_wasm.js
@@ -68,6 +68,98 @@ function getStringFromWasm0(ptr, len) {
     ptr = ptr >>> 0;
     return decodeText(ptr, len);
 }
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_powershell(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_powershell(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_assets_sql(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_assets_sql(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_snowflake(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_snowflake(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
+/**
+ * @param {string} code
+ * @returns {string | undefined}
+ */
+export function parse_db_resource(code) {
+    const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+    const len0 = WASM_VECTOR_LEN;
+    const ret = wasm.parse_db_resource(ptr0, len0);
+    let v2;
+    if (ret[0] !== 0) {
+        v2 = getStringFromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+    }
+    return v2;
+}
+
+/**
+ * @param {string} code
+ * @returns {string}
+ */
+export function parse_graphql(code) {
+    let deferred2_0;
+    let deferred2_1;
+    try {
+        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.parse_graphql(ptr0, len0);
+        deferred2_0 = ret[0];
+        deferred2_1 = ret[1];
+        return getStringFromWasm0(ret[0], ret[1]);
+    } finally {
+        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
+    }
+}
+
 /**
  * @param {string} code
  * @returns {string}
@@ -91,13 +183,13 @@ export function parse_mssql(code) {
  * @param {string} code
  * @returns {string}
  */
-export function parse_powershell(code) {
+export function parse_sql(code) {
     let deferred2_0;
     let deferred2_1;
     try {
         const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_powershell(ptr0, len0);
+        const ret = wasm.parse_sql(ptr0, len0);
         deferred2_0 = ret[0];
         deferred2_1 = ret[1];
         return getStringFromWasm0(ret[0], ret[1]);
@@ -129,32 +221,13 @@ export function parse_oracledb(code) {
  * @param {string} code
  * @returns {string}
  */
-export function parse_graphql(code) {
+export function parse_bigquery(code) {
     let deferred2_0;
     let deferred2_1;
     try {
         const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_graphql(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_assets_sql(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_assets_sql(ptr0, len0);
+        const ret = wasm.parse_bigquery(ptr0, len0);
         deferred2_0 = ret[0];
         deferred2_1 = ret[1];
         return getStringFromWasm0(ret[0], ret[1]);
@@ -220,79 +293,6 @@ export function parse_duckdb(code) {
     }
 }
 
-/**
- * @param {string} code
- * @returns {string | undefined}
- */
-export function parse_db_resource(code) {
-    const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-    const len0 = WASM_VECTOR_LEN;
-    const ret = wasm.parse_db_resource(ptr0, len0);
-    let v2;
-    if (ret[0] !== 0) {
-        v2 = getStringFromWasm0(ret[0], ret[1]).slice();
-        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
-    }
-    return v2;
-}
-
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_bigquery(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_bigquery(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_snowflake(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_snowflake(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
-/**
- * @param {string} code
- * @returns {string}
- */
-export function parse_sql(code) {
-    let deferred2_0;
-    let deferred2_1;
-    try {
-        const ptr0 = passStringToWasm0(code, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ret = wasm.parse_sql(ptr0, len0);
-        deferred2_0 = ret[0];
-        deferred2_1 = ret[1];
-        return getStringFromWasm0(ret[0], ret[1]);
-    } finally {
-        wasm.__wbindgen_free(deferred2_0, deferred2_1, 1);
-    }
-}
-
 const imports = {
     __wbindgen_placeholder__: {
         __wbindgen_init_externref_table: function() {
diff --git a/cli/wasm/regex/windmill_parser_wasm_bg.wasm b/cli/wasm/regex/windmill_parser_wasm_bg.wasm
index 34d6284a98f4a78b2f801adbd5ba6b71f666dd54..153645bf9c82e6d98fa23987ebbc9201aa1e5bbe 100644
GIT binary patch
delta 61743
zcmcG131Ae(^7nSl?q-whCYu9t0<%kia3e=RM9F|$BI13bh=O9mQvn~|Zv#d}j0z0W
zs3;MTL!$(UE&@V;sHlKJ@d*+j7*te1P<*0-e81}1-E5F&{Qm#%3%WDiU42zoS5;S6
z_Z->T<fT8FOz)j!58%&svy&hE;+QeCs?%dyv1YT`9roDx*mye;X`1G;#l|L49D?>_
zSBgV(*c^5(*5)FYdA{fzaM^^z2Dmt6wAtNWEj~V;61+C#)S9TW5;U98+%~c~n%eDT
zvkAo7QHd?qfj@we=5mk&)p^Kmi?bs}Py!c#2Bh(i&11Kv+uU}$i##4wL!1~(HlnzG
zNREp|p_*p1Q=Ef1dmQIgE#O%EhyQIhGy!!8p$W8rgbUpyk7je3?Wj#A+NJ&gh!WMG
z3R9d}NE1_Dr-ZvlO_(@l<SlpHKK`F$Cfsj(%{)e_fkouD;z$4U*22-Z*xn$I6~2AK
zsJq9GA7@)k@m9n?CQd|fNhEkb2g}06-Zf#=t>ea^fLF<D!QXw?y<;X!96M&*INJhB
zwBjb-dDp$SjT==s#`X%ua#YNikzCAD^GU5;yQ!2sa^$_Y+;QjV+sE8Fa>AHV<Hp@}
ztL;TfjEcQ&!k96(Kg@kv^S~q8QSk)5C4QvEVk=qi+bD0d_z8ihC@7B87qlnz{xLoL
zqS#CSp<k$mMogy@bnRDSAFUDp7Tc+s%IQb(9Q{h=qFmI{ouANew46Q{kJG0#gI0;(
zX@97Kle8oB7O-kOMQ>3s6!p9ayh$&MJ+zl9XouJ)R?*Y+CH+B1#6ht_d?qGqs{y(P
zrA^k>QXPJawY^kJ>+rUQX44ey8Cs9{XXrQaop^^%h=0=o+ACJjucBIfMqklKVkH#;
zx{?B4Q?a&zcA@=Wh>ekAH_<n$*vVQI9R$Sp!YcM%gt*x4;&b|zwxF2F3OQC|-lOj#
zjd>q$ABGz90pdB=A+ec$7rW?t+K0xR6rYHlJ~~8OQOp#2ly;*LleLfNFe=<aZgF$m
zg3ptR%@-W!Hd*`5Mw|Bsvc>B*BRh{=c${3Z@>|CVA?nO8V@Be)pKH8Wwz9&dQ{1tt
zjW*q7Xx?e&-nbrd$LoX5;xCLVe><GIvM~NWLB*@huiP(o+Y;Pp^V!{*@w(UOIMAN2
zI}PD;4)AD38=u4YJ(B7i;M0tBL_JbrzUi4v`&XI05++jB+ve*DPqeK-;oj5SP%><J
zR4R<4TpbxFZ3Xx(6$Qp|26^5bnb@NF{8g&XCh^8vl<zIlZ1L{wcw@_I6)@)}b`{Ia
zj}t4z&nt_)?FD`GuDLwv3i|GS)0y0vety^NnS38ryk{;?Zbh%WZ|+RKm`dI?Tc>oU
zBk!%eCgnz=iVw`Un)Gm1eSi|@o5z}5lsboW;r&4XgB#F5#^i#{=J2L}&=(cv@U$Dm
zar3pb=CtX}l^>;fNYt#{l~ExO`E=If;%BpI_RygvpP;N$0$mhd^zRSbAWw|Z0|<HC
z!ck%<q2nNr(`b+QnzvLh6GHK=2YDPuN5n6C%Ph+t?mU6v@$NQ7vnd$A;%3`~s4=f-
zF`XWL%lxXv4%)fVT%-4)sc)LU>i2ppKiX(Bni;itcpn3rO+!yJrSB(Nwb3l`H$y{T
z^)IJgE6p2QekY2}!8ty?m@pW*R4n|O_X1rrbZ;?;D_+m^0u`CwAIv9m@=#@E&iz?a
z7gyPG$>z5iz)w~ZSYJG_gr?3}X<pfCAWDCsRcmg_@U$#*Zz~tAtuPO^8bj09n8RDQ
zp><W}eXU2(yiMl6Tc5{|ls5hNaZQ^XDy}jgZZj^aVw0i<MF)5V9sJhjqV&yp1?|Ph
z>zZ!YV?cVVIB~Z*B6p&gW>)9=omJ}*aoRkQn~Mlv+icpg-t6193+UtSww=XKW@+1n
z=<k4bpcV7Cc2m8FKtm`pHr}XVYC3JsY~N8-nU(GHyB+1C<^y@?WukW(zoem$Q>{kW
zd6-O*Y5f}6NGV^vvRj83A%0$YUdMqV?q?tm2(|0Ne9D_?zS8NSv$PsT{;<;QyqE%I
z;koK|@+>H&f*f07ym98p8FoWA&W7-!Ehvkpg6`BEK!(GZ&M~{Won`wr*^Ev`4IW;T
zBMw;+b8ABp6&=mDyDq0wYs_)ois`L2=8xS5P{mgB-0tT%*KXy0n|F8bL8V*F#og!7
z)b*y(V;BbinH~jntkV3w#}x<+&+AC9Rhs|GyMW`?<uQP}XV2L8Rsf|gW7`Vz;+|Jg
z=|(QJ!;+0$D4K$<R@(}UM*(Cwywe4v=u(f{9T!e{W5vu~nQ4z=_8aX1>?$zIH{iV*
zKi<PD&*^mu^Rl9IAENzhR{nABQ9&=RHIJURkam1v&hGP1@6>leIT~jxW#WI{%sPKE
z8usG(SJUDT&7aTLyFB}$s(Kn>eie~hi`Qd}=Q$3HkUVyy$nM5eh%sK|xHvG!0T(>d
zwo!~4@7sLB`1gnAu?z0#+&FZDVP5$}-+2PFx~;KV{JH0qR?mOy_ZCr6rMY6jC?Ftp
z;AnBwyno;Ts(#0;9GIH41>_XMZTULx_{y&arU{z5&irH0TgdR{;Bi#B&TKiv-})#M
zrg7BvUkENlSZ3jne6*=-$cY#+#eC(mJAlQ+%a4kh6<4^ydscd`bn&C<RoVRLc6Adx
z%punt!Edi?ho=|6R%sEVjv+Q|dYp0mRgN*|U3)FnE;4_;wjWh3Fwej4MXFh3)?C+{
zL+RId%{j10F_&Q;mo7YH)LKEmZ2%%{V-32;0N|b1Z)5liZdk;*zrJB8?O14b8_}9W
zH;m|cb*K=(u;&|xtP*@g`9@8sG!1iF7}}(J{EqPh0K@TMDvk+xWJAJz<Bc5)t84{+
z;nSE0hGNWvBic6S;&dnA46a1C<INotuiA+pv-6D?Tob8%fJa2Cx1F{6nCR+b&a7VZ
ziAeS6Zq<!9xTC8#+uw9PqoLrY(R5&uS$)$g4ow^RU<_l8TjRd@;iO1whC*69jDw5J
z=Wp&x#}}E~ZqDv`9Drcu1%3!Qn{k4BWIdR_gS+cuXcng&wcz}Mu~oF#^o>gCT?8?p
z6H?=iV!RrsTQFob5XUmzW^Bfr!jDnKZwzVFa_SCq;OMIYMX%uXIKmvyPvcN1FqKnI
zh64PIfKBI=V*GF(en!CNaG)fV!p{g;DF<eSQut|s1yI7==%gha;217@VRWFJ102IC
zWzm6E9N-vEsfZ3#a)4tvWo>j|GY8hb60nl0tdJF`<^acVrY+HdogCm8PT3J1sO131
zaLPdr)Pw^3jHDdpz=2Q-KLZiC6P$D?l*G>nToIGe@lXmsBVbcG<zy&@pAoR>oKlP*
zZVx{rU~@Q75=tova3~B{%7Iy-Bz{KVmT+KhD21O9uyPJ845jch0=9|+WuX*)M!+gL
zP@z%+)=LC#GbgQ8N!Bw22a4vDs!$3)BVao@uqBkj&j{F#=oFqjiu`rb?M7~)-)4vj
z?efTu$%quj6lNL~7`YsGlCu^S6$wN$XQ^6felt2hhG!ekyiQ{>2~ih~>Bx`!$BYd`
zXHXN>nriiBI}LAvu?6#}E!ldaE+@nz+Q75Yiiw)445nHXHIXCJ7df*Fd^Rl~Od>|L
z+OQXxH{Uifk-G?%G0>wS>Chtc%iBgawHly13jN#_)iV5;*WBJI=a2>N15<>200bF{
z!$Q2;VjkdUOK)%EKEMc4oCAf{+<tCGs3J5!u>gG9FANvw23PAeHoNa%p@JI$G}|pS
zL+)F+(ztEhR4(I*vCVGcD$x}Hq7ng?Y*##7SAeQLp#jqh6rxy|x(cAWaUsk$ZMtKa
z$0`%`{ki+OD?8j#kqDJ^|9zDi!7NG&(7#&RjB-)vcjl;}FS^f{X!?H73P3rs`IDF$
zitZZ({MdYntT4I!F2i<-J)rbUUySa;`b&3t?fw)<OyMw~X1SEcsyk4Cm3^QmhV>d3
zgg^?^Mc2tVsO=5XNq6}YA#bptOJO)e1pW&kbWS6uKzDdI3A|0_*5#3od`&^HSW=3C
z9vf#ZFsQJz&1URgjTp#Lr=b^cymuzcHRI5+O$rQ9evBru{zU*P5)75-of!~DI(n7J
z-AmM+ZK+5w{U(B*0XAI}ga|qj1AvIBkqD=rm`6E?dNkCwcs&V{OLY*MdyHW(WXvWq
z1-YSOyHKV!-k+GIClw6wI1sYwZarzJ(WYQ%mIrGMZ!47-$|CBG?k|Ci&<(ZfMnUOk
z)72?}e{%ad)MWN-vIlJb)X0eH8deBC7e8G77&VL?fiQnzf)hq6wsyr^eeh}Zy&3Fw
zpbv~*QK+B?d4$qg>!aE*zA?F+xfmDK;6WZtHvZSfdgw6;1X~-13q|-fqkUn5MuI{S
zJ}qAUl1R-0F{r~A%VS!ACd3#?LtuAPC_E#6xIG_yA$EX=*JT)=G(D|f-^csKd5@5;
zaVxtN`aMSMP>&M>sipIe*PjlM%Mk;8jEj%8D)YSVPwQv9Tu;~21A5xS{<Nzm4)9>j
z?}#_1Fz$UGuE&Y$LIoSA#dt2-5nYf!mh)h7<>H3>V~xb2Xgd0byjuL9GozXHt*|mv
ze8B1xsIoza(0CX3z!vI(2)D%QB7*fr0ee=5u0)5@^z?_q{b5>SQg?y8uF;(xZAGl`
zK4SHd=Lb3);NAjI_h5pBGWe3gE%FQe?i?mk@Znx~xbmpG?(PTv-oc8@wIXwLH!A6E
z>w_owmJS$HP~`1N>4<R^_~Na?v>Zhqh)XZ<$K+C~KS9SM;PuB1!NkF<+wavA3Yb`$
zSeBm{JpsMUqg3>k=e1$;c49JYf}vI;5(k<<8k*i6572~Hk5hS2b{xMB&GKFkwOcc~
z7w`=5@=vO_1pGc%*ZOHaH9f!uhKd&`9>b>@4(<o6OQ;jg3YQs!7yLg&mB|f4Vd?yn
zjS|5m<GDZ^kO+*qxS;x8hB_H(D!56g<N$ZEVRJ)`Rdd#jqA_~M#F^#mT3b!;r(Nz5
z)@<WnZc8rX)|NmpL8}J1{BZ-o^AKtG$A`F50&^v=;z|htW=jcKdK}nNlAbVtQ3$3q
zYyxJy7bSGG*$oZTpG$E0<59LRPDeon%-$0C$BQwD)4fS-DL{nXpTH5Js=QoP6IGR$
zYw~7ch`A=OVbhyntOAMwqEc_GcrI75%{b1LV0evG6og!HSwlPk!5l@7?!!GWZN)Qu
zn9asBd>nXVHi`gzJm3@X%B#XY!?Qdd=C5u{Rvum82wh<GfeC1V%T)8vhGK?R@E!6%
z1o3(to9W{9Gz>BmNq!+ywC=`C<$}1JWZexSW3XgJ3tR%?z=(QcIw$LCiw*6bw%Wme
z_vbP=b8djr{Ti|&W48Z{{;=2x^+(r$HILOL)UA+)smVxitCpa5x|0ITGm1pGJxXGE
zAGR1gH%76>siG&C4){$^t(Or{3@_df<zp~IFgx~ZOfs$xHesv}T<pQR7SRx)vAi}D
zJ`etPGi)qGr)L19S1dZ<Q7l}KwZuLrxd(V4MmWulR4XCGeOT5gK9m=r!Dvcs9_n!F
z?mX&ag?cd)wdtM^LAZH<K^;Jdn+MpPrN;sxaR{jiXS8B53O>jPN#&fbP|g_68LM)}
zaL$-4Jry})nVaabdTPMJr3*R(va&P-aX9<2$}yGsSfD3#0yHizB;?Q=r*Q&CWGAL6
z$e(pSC)+yk+d-)dU;&I~%IT?%MI;!ow?N@Ol&u)^-34Z4WyXl9+%B+6RyI^_mwFp(
zDLy_}t~6^1VGg%mVE$5y2ehG(u+@xHr%#`bDM)~bWm0IX<wJCE5AJ@%m&P3%3@reU
zJ`iqr^n%n#U+j(vs7~htMM~dO04^Zk8flhpYLsEhvedp<OYH+3=jk#Id@0s=^|M!-
zVDS%(#;9Z_7%su(^QfM4t;tAZa^dI@7>_YlNigQ=u|79w5-JDO3JYnFTFC|8fp~Zd
zF!Z^M;3d$%G=-yh=D$w1<3}REt)0f4sECLT7tRvV;X)CNr2sTO;M`?&DL^yaO#N<%
z_4s}^Uz$-2^xenG2wH5g%q{v6nwYYH3gAVVY{M_%Nf07*m0yu~Ja;etbv>;(G!F5=
z8Fb7%8jXi3WrA>;i)8K%iV(OvAStZ+6iI>7LPUo3f*~e`DPhor-nOyG4xZEt4+!UU
zJTRlZct9Sy@xY|wZ3QM#v;CY-Sx%!@fwxR4a!deh@dB<fHhv+!?~2TT4HJWfC8|O`
z#bbDrqLoFx$b65Y9L@+DR~bXIOygO`nYxU_nue#T#*<CUngDICVTrJd@l2~<H(=QT
zMSr!3&!&7mycE%!jvoMxdIHErtwH=U@U)gSkd<c*)-o*F0IFIjbeo#FSl%dmBN*YI
ztkGxKtIc`$7m4+z{y=Bg@GpI!Eq)((pcQ^gAGj62_6Hxu@3aSR$M5wI<(N$$>aX7J
zz;D$<Q^mBE!ybM_WX^q-O%UmNQa^i7($Sps0%IZKVA}rfU%Xv#Q(!cHbBl7!Zvy%1
z?Kb>AQ-so2Hkmv_I4c->rdc*6Q^c%%e~R7Nb3P(?d(9|~yiJe1{r9+)^hAJiR=pI?
zy*cuBW}NxTlS|Cp=ZeG!E0;dETFb2bVk0`?(o?t-UOfd|$k>cH@BEbyzj(Fg+{y1V
z&0VG4;^w@{{nd?%SIwp`8>tltcC^_rVG=aEfH>oX!k61$Q85=w-H&XbDBYDyIV?$Z
zFtpsB<TB<+q_xLvLp4+Rz34@>`LICl6SG6DM=I*+jt3Uhxp*9%ZGQXm-Gt(AnBTHT
zIpDDL!kpwLcR+ehfpKseGPCtR-r#0p%3zKuBmG<iy&sz^=U-2AUNsXJj1}w5`xe}b
z#qrSv?>Xnr;!4f63ky?tGJ^rdg7(SS%;oJid%x10%4V3?zw(hY6w`ju_ZB3C9@xAm
z4B2+EpCN}WZcbG*%zrHY7FOzOmduJ#EaKf6=8sE$5x=bbZs|n=_4jzKPe+x|xEbFL
zgX+}9=1Z^jp<li<YhIgA+rBi5$_CNiFU=3ix^v{|vK}1Ddwm3L`O=*AdSBnkFO1$c
z=4n_#L4)X*cr||PQ+@GZY=$sOcALjvZ$n$ZG@HF~9+z<a8y|}!X1ir;xtxQ`vbhdt
z`MLZs%A50JRQW@6;!AU1xz6xnc^`)CyF8aecP!86&}+*F&~IOwKQ3>>kXb7(&s`&+
zM!1{6e8G%{j8k83gjL7eA0c<Dip4ZGitEg0SG1+6b!O#?&QVn+t!&Amyp^|cc`vQZ
z;LzJETX0=ptb7U$9$RrC$GuU}waxScDEfSG$Sws&5x-aCN70oI<qG-=FWjE2Gh^Ot
zLnU=)mp5C`^g8phH&f|}I`j57CyEMl_nXb|`|F#R;dkg;?Zunsy>E4+X?14VTdfIM
zcf2)%X4IKogMB#b-NE%3;V!E>X&)}zXpUOdLd-HJuWF^@vdvAa&coa3RX5`I#<yqT
z_nFn%GdDQQl+}i)k;}70wt3TrSo49^sVc1}a=*X2Bi@&-ZEa?)Nz}HY)Q)RfBL1>9
zDOxo`x36iLHj8}ZcE_Wi5M^MbP{WPSkoK~I?6cOYzmv8LaoKCRP2sp~^IvPbsPcPg
zdyx9g+E8h+4NLnHX})(_dQ?p=-kA6fF_*pL*M7uv(mSDCPz$2l@C(w)!?~dI3F9}!
z)V`ChJyO2W{QaHosF`s!1EEpt6t31qaJ8<bN^NPztxwUGBA>p#l_)U>uD=HH3U79E
z-TFjr0Ww#w_r;=VHkL>Zv+vu@!r1Iy3B;O{Dm#dG%mtPC;hbIslQy8^VVt)^$`c!U
zdY)TSX)|(-Dm=WVxphP9xF@j=6kr_QC(TnE+5ij<cFJ<llEZAVHk)SA%#ArJnsMng
z*KK5c{;;u=SZg-l#5IoG)B*1$n<CZi+SD1*Jfxkg61BN#zfr|QI;N^8CeG}>qKUb(
zs+?(f%)351vEQ8f?oB+S4!+Ctan*Y~ALX_of+wUrG(_Z>tKRRJ_DLPuBzPKm-O142
zc$sSRZZJ>2pUZQj_2w(M#0NJwqc7^r=QlUY-p3j2oFN%Af!rzRC`)i*0PfSxei6>Q
zQvcvtk-d$lsh7c_4FMc=)PryT@SJ9Kp$2%cJ_M`v^7@4#F~y#%Gh2LgVLb$V4bFft
zvA6osx%6zEx#pub?IJ~C%l!<%E!+%r)5A&LZ%p@=EM{44x3r|XI`fh(88pAnykpCa
zJSjJC8AA)|%+6cWX<?l?WUB(Xb89z7=7O!4^sVnwj2p&|a7}3N{BU15+WQSUDtLk^
zh!ER40DiHp85cZ!TYzh;-Zq*G&inW!jM8Tx_h)oxRu5+6kFGwy*|%IIG5%m$<NZBY
zEHx~JP#XZ(Ro~L=n+SvhjsaF>%qy)CIe&X57j@nCHeB$O?SsICR(`bI?`VGJCVNA*
zW<`x#tW4Yak=7{O=k`WGR{mUj!Xf6GN4_qFpnT?=T>P&3W+;B`2Oq?5(ZSaEU3~Cz
z{Qh=u4}N!kI|08#zZ-@f-RHiuW3$<O>H9+U+tTcKXtebv$G#{M&8kD&XzJpXvkqfp
zcbd8U2y0hAAGrlu(X~G$3K3(DJ^C?zdmYQg@2F#}jD2%#7JeW4@fZ}PJAbNmh@Vyt
z|Mg08mREz#pE8&J-r8Ady?*w4cW1Trnt1XuXRY;m+sR(JN7XB<8W4>GJh7QdK>D!~
z9D<!+UJw>-SEapovU&EF&-?k}urfik?iz-{bHelqb*H0k%jYvsWz&|=&E}_?^W%b3
zZ3Y1vy16fwJx92pa#awjip~}S!GJT!^au!tO0Am9PPH7tHOI336|3TKjr~|NaSeq%
zKB^i0*bG0>s+Y~i(cs~BV{sCl#ccn_MetFX^v4sTX6EUev8_Jp^v&d~-OK%!?+elF
z=2<oT&P|VlN_$kLa3}%9d4L@^R9Y-jGmN8q5T40;Qxk}T3eI^HA!8xGu^NkIe-fL?
zJqFARUOZOql^2q@%300j&JWHbk!PnlU(3&(q78jgH#-KrZdzTid5kcG^W=U2oeGX|
ziOnFCV5c}SSPL92-4JSn19e717*h|z<u4;uwFv$y2$x2}94g|FYCnsw>5)*wG*@(5
zFis=}V8EP?bzvgxJ@RLd=pkIPeS+vIJ`CQPATATmBG%)72(C^PK9OxL3+~esSv@U+
zXAdv?Lkol8FJAF+Snroxl0{$dQKf-0)<UIZrHG?;F;}|NMFFJ8=~X%Mg>=ykBJAUI
z(L80#qDot?&6WrK4otlOdxw>?GX&(7%*_zjh*`2ILjhN0aCX@uQ```eeo|(leKqo-
zY>_QL%M@Ml?#dG9hof%E5|>z@S940Xm}sS3g~un^sx($y<aN!&6s`94esXU!k)>Wv
zHWUB+Q%t5TYmQN@kw=<~YC7?QtZX4VWx-Ytr5`(yMMpP60u^Gp>rd#1!Sf!GvAXD&
zdyE0Fl!L}<gWX6o0u##~@*|n!vE0|g&=Vo8TPWz-Fti0!9RhNr$khN6$7G!@hPB%{
zr@vnn+K-C;2^K8dZ5&4JoJ}^iBltb26Djg~pXiTlFZo2%L{%|N37nRQv`s$YYp&{r
zn~~K@tE~J&1;f>nU*w2m!8U%;LL{%+w8@4&s`D^n!a&bgZwg-9QuMJ?*%3LrjrbQo
zo92q^`8gq1bm!-iTyZW?_i{UtB~RswAqu-g+KM*nWnx=#9a6Wp6}PK!&vv1NQSC%u
zE88$JEBHe@u}+91!8baHKEkybga(JGY4XR8;;F<{PxAtY$xi5Y?=tyxCoxbQk)L%E
zkBMb+L}&3>^S@r4%<dw_q%1kIiI;?6V6dpC;xXrlyswKGmr{H9jD)Hq@|P}H&+RxO
zJD(%Ex7euwyn0MOycJE4gDDc(0g!`7?O{3P9I=*m9+vrCMLvCTL{8}{9!)u*svB$p
z_Q3-Hncc+sH0y}GuA3OzXsMgJiT-rruyl174^hbxd8E6@kn_5WVWGf4E-9~vm>e@6
z3@^qzKDe%j_+0BgwUj3~#RFZT*R#KQ=Q2i5%v0>(gL5(Z;=SOvy~VwvX+7_B>6x&8
zTf9?F>LV`8i||o!F_>+PBIb^Yi$PK$To&Q89<`Y<SB2%NKH^qqmEyX=+s?<_zOcR$
zScW2%Fe6rbGrS=K6ua>#MiIR3cU$Xz-l#E3xY+sfqYDHpPEb!DjGg;UKUPmFzLv#(
z#UwK8<jKCGkk!&V@<ltWH|4YW;M}Eka$UY?0sTzw%LfaeUnfuHi_uV)<gJFdHG4r=
z%Suzqjt|;9^qnS{4-4z$mxg!}^~t;XiRVCqvHdaP`wz&W{n4Y1@*n+0d;02te7?WP
z;_`z1MQcRw?T?LGXvJw4iVNtKI(f~7qJ#_i>OxgWV1SrROY0;J6n(j{{sUEEV+M-$
zExzLQq0-NIpONw-`WMen)Ua%zs^Q-Q#V9V~+(F`^P)#{<=^$|%_daQ`=*l|a!FSup
zaf8JYtKF^Tc|*huPLERB2UA&{%)3bV(l!cDVtr)>Ys|u!RVVMfNHp*METc#%=^i(G
z=!O+^#6lPMuzIRfZyafeW2KUFK369zFB1Or=Q*d7^-ZO^hH^ezCx5#Lt8U;Zd#LdF
zmok)wl33w{?Q$dFV%@yL3)dt^4i#NH>}9n(18~qlpnr3XSQsgNI06}JlV;A?o*LXf
zROD&mXXzRa7kTv<EL&VEGNIzh^DY%58{s3tRhNn><T<bph2|P1wID$=IOqx?h)VX$
zi>?w^dCOQ2n9nn72cWz^1eaYUwu;p1?-5Ya9L~B%tqRHM*N7(0qv}2Q+BIUPa2`Jl
zu-(D_*NHBI%IoAmuNS>|h?ZS1*xVp%uNQ6k8Gi$&#_~GZ{|3>LR@KR|H;A91lE{%G
z#1$Q?8G9DZ0R6y-QHdC(<Aezas|7Y^d|D^>j=&TFAq~9|HG#k%y%7}j?>f2tM)7R&
z30Rh}bSK_VfiQqeg1ql0aeM1`o&kGy!a-qxrzr+^Q^Q~#*tO2Ej*+5QVA)d^D<_Z3
zc#KWdSY*I=J@ks)-vZo-RfVM@_yHGIAAEdzD2N4~+WkRx*kiD0N84ba;Wi{2%Jz+o
zZDG9eWF$HT!A}BQoCTH=E&%b*H3VA_1%=e3QNhS2kT4dP)RzUQ(uTo>+)}Q|<8dc(
z3tvSYdcgAI2)9rzP>p3=zH+dINhySrr0{k=_hKPu<(ybIBlsQQ!@;Qb6r%y*Xh1#R
zF!+ZmBft%c!|rHQ=Xcc?mxz3O8U{=2>*mz=8wS5_2>e?(6-OS_1_FkMeff>qNZ>BY
zb4Q5|V}Gg7<w4@<hQaB;T&N$MS`<#jQGmxo*a1rs#(pHQRzL%=h7S{iN_jPuBDanb
z89kTRBZ9NN*)TXKTpO(Q!dMsSfKx8NMKqCJZxI={oJ1Bl+W>W1qzT|f!Z^kW@ti=B
z1Z8<T$O%lgaB>Yd8f$4`%net^dym3+Efkcm-y(diRw87$yw8#`HPlf%j&&f?GOSx3
zH1elg#4~hgksLdV{BFUVPWfRSSR_~6Dtgs>n-OLzz<#||bn%3I%CH#@&s>=|THF<=
zS^y_rp9Uq0?(u^OEmF4U@z|pP$>kBxbgX>R!_K=Qzc2Q}h3K)|!x${=9%iM7oMn+W
z+^kT|y5J2!_7GE>I>sSA{K~wVUDIH{8U}9{o6#0dM)1Fr7mmT9IL?6-oePe3I8#+~
zqH;5XSb*jXtpKM4sNR#A&^eGDJejq6S7O+Dlq)e@dEppixiZ^eD}rFRq7-6K+jLRj
zlRu6TyPGKwUj9K#c$bYU(rxU%0M9|$>2}dBGvwrpj)R_C3}e4w)s#@WTRGna7+=MU
z<>=eR3*z`&W5o~7u4g;G@Ym|A^xY-8WL7S>w4hW=3rbbHABck%RCt$Ii$!Pd-O%L4
zmvY#6ag#VM%lH9VF#%0H9_%ndTrUEZA0q>wlQ5=N<LxvHs<KZv+6><3$SyGE^7~Hw
zSo<6cU#pBH&EofJ{8&kL81v57m1?d*m0KHr1Dcyz+k15MV;OS~PJ&g)UH6EVc$~UN
zeAT4lbHfnhVRo|oTj0Oc(N-aU`6pUj6TEzqXeMa-J97NJ5OxRF%GvjdYyNK!6$G>I
z6GO2umt*f20Xz=gFE-%u>H}gL5ZB{Dk>?Oo<hUZNz@`MBEfUWPXBlh8yMtY(;5?kO
zxCX27-9f!rxP)_-73lP+s3My4bMW}%K=j#!<>)8Gb*{<G36sDH-+e;7I3`ML`9V2R
za>$2ZM0$C^J3u+i6hK05zv5$DkYX_qFSZ7|{x){`5XMG^;APYM)5JxAe{)C)Byy*5
zGE0?^*iJ)mPkoS8G?o`C)zYREH|M%DIBQ*`EH!Hs^W{WU?oW|KvLxR$W`+STbHjK`
z9I&VgRn5j37FAKfx9fv0KKl|STNRUz2wo2oZ6Rk2)Xv7?h@=V0$~U+ymaPFkB4LRM
zZYf)ajrE+Ef<&e@#hyRmn5HVm&JF|+w%i*_0f|E}!q{OVWlNVZK4Jit0R!OE5hW6M
z0}0#j!my;rISNAXks4^utOaEu#={D#B_X&~u)zr<tRl(vC8CYD0-z1p|AQT=OR)7*
z;uaxFWcAY`O_n|_I*XDZ-sd1Lc*k@RqdAYWVQ06TWQvVg6`wmxWQ%3Nt7nM}ip(#&
z)tJ!yDxNK_NN;fThPgrLz>EB0w&?CGtH5O5E!#@*WY%2uu0V>aZ1L5x!o$WUI5OJh
z$5Kpc0cll$-q;J^2+PbBHY|&N)6r$!E{8uS(u7^!{+!6~Y{9|-%X<!l7AzKaI8C&*
z9I}ZwjBwB^64vcz*5M5K!*j6tERz>JFNWjs^z))yK5tCw@O0pM2C{r*zb~@9L-20L
zR+>^4*s_hWBRF+vIMif$hY(B&V9VW5SdSM3jKp%p3nC}ru(Gog8Z46z)-~9L2;=5p
zKOqQIE4w4)Qw$1q!*c1ce2L(_Ww;Bx)7SyS%f51O&*O!0d;vUA&`);M3-wcD7a~}V
z7=&%QT3d4UgcqtFD`~D6m3<cO%Da;`&LIPHMS7AQRRQCwK810)WUhcqTU&DXWUmS%
z6^N8O=Zcqs_Xl1SOI=&u-(bVZtZlOWOX3omvsu1APqga^)SygbE*S^6gl&>`19-$R
z%-OubHYlqAt2hS~Y&%@cRSX<z<7JCdk=Cr@L&L8z&hmA;bwbB(EF^Z6fa)c^^F(v!
zPA>Ha*?pd9=~}o!wP2APIZs?nMH{&V-BY9M#o`6^BIW0K!Z3DhGW<{>8Wev*vx@(0
z(*_%xozc_Nw(*ARo(Vqa1+ZJGb{JN*!Fx+#r*ba*8l*fkxO_gS2b^Cl6zi}k4sKW|
zZl(eCdoIu*coM5MBsM~L80!-;^z12r@GB)S2_$Ol<oC_^@gA19Ef(#aC0LU}Qpm-S
zEY7(qAlobz&pOMj_l-+MzH_Yw<a$*MrIdwbmC7*XunbcUV^*2GtxTLtC1vvEGMH}H
z%3WnJD3p{1|5GL&rbhNdf-{zhks{TSsbEPMTsu3ULZk-m%SDQS)J<O@{CJ$VLi{sx
z$1iODf+5+`D|oBas6iY|-d)~=>}#YtIc|lxF!RLeKNnI2Ht~N|$Sg?QGg~s3rSRWu
z$xClTAU|0rN3RyQ^O|<+YOxx|j;U)zDKDbityP<o!NF_AQ6Z!}cb%Au$HsNyE+K<m
z*NgKSL#^DlNwf|w-ylvmhLs>7TQyc(FzG$mqZ-36fKCUm`T&|qBap!tKE$DYD1H;R
zifhwO@`-D;uc6dwZ6G#eY~JH?|5ow7cWwAMwy{Nl$yM7#%dYiVK<MnCRucg`)UY&X
zxHQkl;uX}m@?+7%J2wJdW)*tkV=>TK!ph{#;DyyN!8O)_l21fFcH`vMPtky7GI0m&
zs+&*BtvjIjRh|s~xC5GFgJhp<^SO9IJ36mQZrdUJba0;h_H)o|joh(QJcGyRU1Ad+
zxnGE#p0zL;8h)deEr*Xu&u;OsCvs4SPbNyaTfB^;gR*yxD7KCks<SqT`LG6N*Mo~>
z#vY+3SqGSOM}eP@J7PH$yl9We5OjKdaLis&Mnje?hf7N$SSp0!BqI?sPsOCD7*|wG
zvWjs>#U!a1Zzx7yzh4XyOXR}+;$5rMj6apy>`$d;|EbihhNZ6fl1mMq{8C)1W!KEN
zJi{~yZY7;`2b|vC#{l>svS(;bf)9T!KBS9^4)x<sv8EX6l!{4FF`-VWm}C_b>XeE}
zQZb=U6&;c@z7>NB&)wgOAy&B=e=4`xpUTbtQ@L4ZlzZoQR=KOb6NjDCS74=bD)`#>
zB2_p`RY1ObNXVFS^)6)dpTxKF;v-^zBUCAy{UpAVJ&yiOz~(<T3K&F*A2m9goj*ea
zG-i;z@fTk5Et6ADh;fa;O82kgb5A8UZ;iIbA>P9^<<VcoOPIdT{3dR5p5&-g^7r4w
zb>T^S{qLe%jI(qdFga72L`(G(8}s#y`K(5|^(OsndMZ1K8`aAy)t(e~lSXK`D&)k*
zV1GMpCub$&dZx^bp|73Q>OJUm;eHe`L#~UZd&P`kUL3ukiAwp2hkDY}yXD=9lqnxh
zpjax|EoUTBitL|2&BaN1S0ZIKOn3oM;)Hx9fzCq#`x7Y70@FiTo5<mb)FM=93q%G{
z-n*K!=yM3SnQ}x5&2mmx@4^41&|%@6`ZGJs2ET1WUkYqaZb_rh(w<~vDtmS)(=yaA
zHitsCtV*X_>H9j_EQ79PS#xg&UBO|vdUS=bnVm`LY^cr5q;uhdC9le)-lA4c&!l#E
ztjVOS=#O_~au)gZ=?cB9$U^rhRCWoY2(H-pk5f*`E3>G;S)`~oSd~S;2s%<H-)Tn8
zc@JSvGs@(Oer-l~rbl)_`g!|X1szqEUm0jlX(7!-&TUS0Fbfp5pf?(!nBc`aEfI|X
z$z(tAj&5&1;m!j&)lYCQk{|e~4;Al`F)gV*g56ru(1hZB{e4cT$M#7bZN>X!NlVH?
z(vp^R8CLnfwWQUJO$qr)E9wW>CarNPjkn@619s^I%_hhlZ+x^!HqQl0@Vo$rCipov
zm*(gnEvkeT3&utTFkypXIEH6+u-R}{;3Amt0HwqEouLP|rDvfR*0iNgc*M7(ad_O<
z4n#FgE^CK+u^HKpPMmF-f3iJY=L)YA<&7PvZ(!<7toM|u5(goK@l<_~myBU^CCDk(
zT69L)0kE@d%w%}AbQfyd!+4G(aQy;u#8`{WDC@HmIU<$=-dWLPR!8c5PLy39Hp(+C
z1}^wMpwu&$njc|IHatX^Vgk(R1ZuUs(d52P#GAYso$0LG`tqXA)E4RcAEq2Rr!%C4
zde4@ZJVh?Kr!yraHSl5sxmU~K{pg9{qg`mQpyMvn`?*gZJ%`{GzFGwLbfptoBa|0h
z+l$6WZ>?Yn72aAgdQ)U;Wkhd!UZn0kj>#SJ2hog!DkK%y3H2Vdz^Zr^9Rb^+LKfHo
z>m6Vn<Yj%RwFt`l`hYH;k!$);E1+wCAL=8f%jW0PE#fIT`Ft7}Gi%`nXtX)<SRcxX
zwPmt*I1V7n-_NJ+VwLQ20d7Mok*6-8Q+WK|m#)X->U<g>yrds(5W)BJ=^o*=c4&Fs
zZEfcUj}4+%MewZwG_=vV*<uh?G=@bK_j6-%Mxvn0<<&#!mc~juaS6DwOd3YNGy*9H
zUxp&@yX0>b*|pIIqO`_(Dl;#qi<(Y<e4~<85MHpC-|u%khAV!K$OkT`<_UA^(-0S2
zbU9rq5{_;PpA=6pb{-A7uB59)PRVl180)bXO&(q}%|e{D^@p=7u#E;^x`i|$K9!GM
zO?gd~sUiVl6Y4npu??32=KiTXaw|23{QmZ8u(X=s>CrTV#d*i;AoG^Vi?0KjEtAjO
z1`?9j(KCsgPevM(WI!YCaXsx3m};HxAY6nLoIS$IUV9_4iKNR-w5~~1mKYrR@!ODZ
zlWZ}Lng@L&=|$1vuWipHH(WvICO#HE9FH??J0GhG#$HKR{eQv21bOdhdi<|Yu`&_r
zet1ZdjDz!nm)+h77COrNvB{Yll`n(}WNto=);2niPW*#LLI7NQC&nJ);7-~Or>Dtx
zL2^I@FTRVe%c(aKIGAI@V&V1R@UOBX2xSZT=77w(oBVY6fE;``JxJdjkni42zK9De
zGz_+_vX82=@(>IUlEzajs1w1q;|bft)$D(@TW**DhE@_BF_CU%^IzpXgiZOs_P3O|
zlW2HXYX=BN<giVmMehN@$c5PeRs~ZEUoa5a1d>Z9QDuG&wq39j0?V3!sNwAud-V2-
zU2U(3sO=Sky$zkQqN*0irT5Y!;t|>LKKiYZh6V@RPuGeI8zD+C!$u*N$kQEZ5GDsp
zGxsdD-=ndyC??7mo8?-(yyannU-y3(Zo!Ac!tI=f&e(F#19Xlkmx&KjT1NT1FnJBl
z^7A&_ZfsxiQ@baZ%4OdNsc9fOIV~zRDi@4|kxWt1&a+2rXO9+VkIp<>e5id#9;6(t
z;@y1n<`0_4b`L>UtSyDb?vxz#5S<hB|BD_Xu#<U3l+&^X_ZDG&cr~n|<x4AV#=qG{
zi0cYUIWUzkH99Q6F2e1G8|D1T5MLW*+7x)09g)4K&^fHA{$mPFWUsL=r+~8YjD3W%
z^|B-VLM~^8SgP8M1GaHEG<{kdZ-{$3+W<A-5$c~6f`U5&%$l%QDyR^^f=8f-1Mt)%
z)F#dXjDOs2GiNw+<mJV5dFx&5W>Bw@y;HA|v4XZS6qFwp(}m|oZPG9iN0c+{X29P%
zYRdsT>&k-vK4*tRgdFrJ<(#)Q6e8$qYS%cT?|Gb-I`=6<xOqDuv<<P3BRnWz(WBHQ
zt%5_=76h-iS+(T-ahWia2FdP^VQEphFL=pg)Jr(4l$VJtd7MVWpm*$X$`x<Q%&8E<
zC*{>ssXecS9+?W%V{LWKRBFfJFQ?K(jOW!)K!aE&=RZL&!2c!KcN%UUY)ojMdJ=im
zlxiy{lu(-(YhKx<*iU@E;qE=8%e^IpE74dNRQg}D%vms=vpHPd>DE9Gl#f0|Kfvwp
zpHE{kfcu){%x7qH4D%b@LM2Z<L&L+jH_0oe)3ZHS@J2uH?hH`-{$VczY^zu!6E$+I
zXop8mwwOUVH%7T#fI$~qn-kcz1)$ooQX5u0WFc1u#(iYy*ePBZt0FE47&*0F^k%3<
zvUCPrlNRO75*|4oNFKQ{ft^qgBK`||5P+E)JL{x8r0Sv*4_b+8yXjDL!ZDQq+l;d7
z3gf5f#1m1uPDUq8Ucq$*tnI7NWph9w=I}I?QeR#P!jUG<I3v-FPMmW_;`7mo^Ug?o
znG*wH*NsJ1sy*C^H=?tyv=W`+#P#7sEZ3^6H10ibw86F5_+{@03!Lobpf1{jZ3<~>
z$88(uV;?14KC?sR<J(*??tW`4`im9vv`M#z{3<%I-Ea0R>ij2fiXF4)OmB*$XX%`O
zC@UaK%!d9D;Ihh>0!-5KUO<fvd@(@3Di=qpH_#vMn6e}+oEosf5_Qdv0!7o7Jxk+U
zFaNa3@~LS#o7%Kp$RW$K$z_q^3mjv)W#PIw<F!ywPMl5Wbzfee$bKlnaM0S23{M7&
zMBd@V1duH@B%8_;v#Bu$+u&RY3EASz%|!5W%mRqP@{gbz@0JJVz|3+)e)1g6OPqs!
zAm|i%;QmgdWP>bvo(70R^1bK5J66fe7qA$bFaP-h%m=IF%P&w`_NwKE5r2<Pkg!S%
z0jAIof`DDMTs||8(gAq*1<FW?1`Ma){32z#S1reO5pM}1i|jj>M$nvB<cxCi%k^_9
zH?#O{u3(5&ynRBX_~N&vco94o&m%9?KT|Att3j$B0B}8?;<qF9AnNfK=>{rZ8L7xA
z-7k?}l*!I7QCe2n+W*$8GCArc$^aZcQljBhWo2tsW$v=Ik;=;C)|b$!sjH*vx?&#r
zGZyYRd(Rfir{_@yE!<&sEc8sVz@s{b1cktbJ0f*0l&PgOLi`pSUrO1+|JT|l7O(rH
zcL8Om&U*FCgSfL^mH7*({T0<OU_NYDCvmZJ%O`O$ybVv{;&!XhN!*1vwrjbe)Stu^
zJe#`nwBwVwaN?USZ=6qe6Ds(4KKZjEXK@9u**X9sCwvxHx)+dcUh{Ic9K3*9US2x~
zP08ak!Hu_M&U1geC1Qu%HlJGlWkbd-q)t@&xtzO@zG^XR|EBQq2?uw*1mU(eTTke)
z4x@O#EPaLA(9ZAV2d~hA<|n@E&&O7<kDE)Shw#ql5rB#gcpUvsPFqA%^3SrP+_)ai
zJ|37c@cr2-FJ4UP*#~!mJHYmibu2ENNfI`7Y?dJ&*(Hkrk@w;*K)|M74*^dNRmNMK
z;*L&%UxrHAxJz#1yq_@yb`|RL;^dx!ILIjp(J5e^D&;@BWcCuYtoVyFONW-AAf|sI
zF9k&2OAOJV4CrqPqKs1-)XSH!a<A5ZAz$LWyBOjEjtlo23q1uPcOxY=It9KZD&@7^
z@({OdA47DAhG2IDF8#?GsV_z8%W448pk)wa3gR73Y0xsLQ!1spM&60MbO?6WrPPbc
zcgl@RX-VE@ShbCw(4$xJOA*G)nk;|4W|F0^(mGg%N4`dPHKGRw54{Epma|r^M}w_j
zC+}I9KO0z>`5(2I|5a~L0aVn=H=rn1$h~jSHF!K!NjXqhZ&(Jdzg8|=MrnBLUk1Ks
zJyO;#tmlu4@2y>E@uIa0BfMy>>{bq5v?DmZoTjrm#J2+XMBsEToYWy(arDKzMEC_?
z`NbDY;mQoO>h)zCWncx3VnuZYb#^Xia7{i~Ld_jYsg)a6Pzx(HTmEw;-G%p&6;NqK
z1*K>e$eva~KG^-vt$_JYrCpB4iVC_iVGS3?a{VCco-9+}RP{`HlRCTJQ_b?;A_FCq
ziQJnJsSe&|%hb2%R&D#DeEGmzl%-zgyrrzJpS(r4sqlG0tgIPgWDu+58o4S6qkD;T
zuA+0gKdDx@P6M}Wq(Y>o78uYk__8NxJ$%(%4pb7{%hyo-E?h-DQG1tFe);Yym=kb}
z=WTRxz}u8U#YOV^x5<w-KK!;?A0ufP$s&0a!35xl$q*y#Fy<9W-)d@^Y%K<?xWz@4
zaBY>-*8qvL<fPSvD{~ps{zTZ~d)q)5IwUdtUS-l6RY~_XSW4H(=4(;^lr_{5xyskj
zKdh+ER8k~|uT_8()+&6@SxbBbEWFBa$@q7u3l$Z~^WTXyPw4QL!Ob-C&QKg1B~;v$
zA~_FnsASVSSUQEQ+!wB+jOLA??7?-!ho;Ncq54_!_jRz;sZh4eTMv8rEIDeuiYi)9
zkN!7$f4LHi-*TGWi3TDw3=|#ZCm*QR{O1G40v{!p7k)?`vv}!bKkL$oWK|`x^U{e*
znuJpB+CaVAuPz7S!5N8tf+mM)9##*F<~MOF{Fn?6Q{|2gyz?SQZo-mn;6_T+wv}&`
z*KSla{lG?r<I;_4Q|HJ=y4!*ri3cLH!SN`qPXk(lkjET@VJTeOCtRBwwIvjI$2Lsb
zi<&xB0gq40kyX?r)k3)zqEZ;6;=M<MQ>$nv4Q^DkV67e(W)>K0$}7X-l2}|;ARH2x
zWR%Gz?^AwDWrf8;4x-YiMmqdn9l)+p$?tRV1M@}vX6oa73hV`$hHb`5dYOD;Ge%{(
zT(cRxYnI%#85hzlV*v7wu>7&uwM$6_d~gHO8Ad#q`MZ5UZROJ+(rf9T0xb|5xC#<|
z!&~UOv}N+LkLYzO-Zpy+rDrYK1|_+OeREgwoARMO&Zk(5G<nHZnk*}}&~^EL&BJ+{
z;IAR%u&uQFe_zVjZL~PzR~T<?Nrn6hb3Uf~azk!}XwI37f`$>Y>SMauS@bcwc}ljc
z#svS599B(jytNT*997tm#np5PP$hR%Q%mo3&Y*Br%5SG-%y#OFUEo36A(u|d?b~5T
zgQer8?bwZl<>TS)*a$}Wr|qzHRBn>fKcW8Mn>#+CL3m_;O0#K8t*rQz?&p(0op-=)
za=ccK*g-Qq4d_q)wu8q0+4r~+jL-NC*5m)kW1rEJy^q3z&kIm8V))w*Ak!0w@xJgk
z1}?go6E9n?QuW0Y!H?r_6|?(u=9|HGJ1I_x0}{_o!4tdKlw2W4>{i10f!zS9kRR-(
z+`yZ=_<k0aWw_a}5cj`=eZr%@04v}4DI{XxRRqfRX_RmM<DkoLXFB%@EuU3ro8N&T
zdxrA6Gjt6T@ik1?4aWUTu#=AWQx;rm_{JnMV57yfR5vDdho3oLnZ#a>J{<pKZ+tu7
zdByeE{A^l>=Zd<B&&CBp_!w?;!@rwcgHkx4O2Gy&3W4<d>yc`F5XdGk+E1sXrv?Hl
zbUgW*8p@7a!pzR0+q_HU!!@Y4M7~r54M)ipzf9kQLpZN9NSyZ;%9pk4l<dD~kK(d0
zn(@~8x;=y&LFD&)h<DI&d|8(l?}bo*M_#vAi5$RX%SC%B?F=LIhkFUz;%s}%mTmVD
zACkU(AN7h0a)p{|)6#vaO&{)4ZGs}wHkP-=$$;7;udF3s$Uu&ZvJfvX+n}s@^J-!H
zXu#xUO>KQ$=j|u29P}mCiuYu09X&GYz;4V%_Bk_7;3_5~+nB`>{LKZdOK{JeQOpNG
z`LL*QJOa8f@&<jysNfLqzZzAMcwq=*hl-c(19WFz!yH9y0aZDsD_ba+&N)gW@#U6{
zwEO^dZ@*snpa<cf1D><G6E06UQjAE}N1&0ghd?+|CVquMo+i)#3bu`D^7gNws!o$7
zUqP3vkVn2!GsXQiwg@ZasIMV4-;|GhO*Kx-0aT9phK8or^6^df9zmU#f>g;kv0qkw
zL#=UviahiU*bOY=w;!Zdf#X8B0+#=>X1K@s*ku7X)qQ5OuByYaXY`Bmbvs+_;Fzqo
zS9sz%(SEyi+o7FLM=NA2FJU$Pa9b~KsWWUo2Qp)HBks|7=c{%@?$H5t^n(4P9m>I3
z=jDl27@^$`crcUY;Oyjy2saMg;NV9j*Z@wBz+pS|1}8G*@yuS(xYh~-feWv#`O2q@
z;F8Z*y)hF($QFMH-;@e~amZN*X~F+qD&6}n^yOv2<=@ixLevId{2t#4g7_{xOc&6q
z1@g7Sl$Eky=r&w~=}X{;*OzD@VHXlc&IQe?7Fv6{PGce8C#KGFuENnNK3|H{{&>?9
zaSNZZgx?bQK0ce$TlhN4T)vl2!^7CQZ6k{3>;DuWe&iKL=;p-gaJ&w<@&$6^5!&l4
zw`AC&AJFVCgENmp6Qtvx%HT2THuO(xc0Sl`$G<-%ApWn}o9yu;UDU|RPQLgf4W{ZH
z@|z#2H&y>zw)~0uW^dUAOsI*?p7cs3J%o$jKj)bz|Me676h19;?{RX7_8*9|Ofp3N
zd6In~7ynH2+JAVq42b-5h7aZV|Im$@YuPPWHE7EjZ}Q-OXeMp>T|V>+W&TeNTW$V@
zW@^QcRLO^bp^X1Y0ZUGxfTN}V^8%*+N{`X>L(=;jwWONEvd3?9ZpxfPOr5!4Ay8i7
z3uypgatL4%p8g#Gz@ndwz6C}VznAb~;=_C&3d>-l{E+<qH!7j3ALRYN(`C-hKS1x8
zDXV{{sZA|)0&~*%0ry1UK!s8!<eevBW`II8=Ok_T-%rjv|Dbfa{1iR>|D>pA|6lA8
zuaeirXrn}xTzZ<S#mQ$M(0ou6pM6m?Ss&~wwBD=--YK-sRI^pi6IzGl{m{rEREh61
z*}~fSt8$OfdV%|YY}c|N3%<8&=h4oC@-71OR|f&jau(2=@qRXFy{RNYe3nKp^gD8F
z#vB|x#E<NyY0a}|A%I<Lk1f;SSBncx=eOyL<pfRZ-f|8Y5e68Fm2EIKJ2(hY%Xd**
z0b}k0`GKZ&>pa&2v{pQ&RsdH_<C9e?6BCIj#O*=xoO9M<+1{?T*LMD~NtOz&ee#|^
zHbpwV8SiK7%6VGt<SGmNtI23$2v5~`KRfsi83NzM7c7RrtML9O@F$&GFUyGrnhZV<
z;TK9W!o;ym?s95_;Ai8D(V9Ay0CdQ^-CC-=EJnKngS#e13l5s96mJ$h?6nP55Q^vj
zgopkSqvgwAU0U}+Wl9JC-<Nn#tTv8Lu8?2GY8~Jlni!`&^*>=d+v2qQ8e{IG<27E+
zmd0!U!lQ*->z)pe_OmZd3*FjJVvii@(dM&*tCpaBbLlUS@+k498q`W-O7sruZ=7VE
zHbhc*KS^z_9^)iyUrO1igfaOs#PC7I-ig}$#v1*QS4)@4UhU$)0XVubm_NK)9!R1`
zk~RSQOAjV#H#U~zKS|ovjlmQoYnL?!vnyHai)BGZiq^L=&`G#k5cI64YU~@9*hITr
zbHP_EI;=McU)ca!m&clFJ<f=_DGd{1dZK2R&6{dnbN*UWfM!;JBQk+Rt%(9}tig9S
z)gF<k;iA7+?x-|vP-8`&ldiSHe&C37U~Rsfo30HCG}`93NW?N9_2O3W9F}JG0w~hf
zLJ^znc!9ob;CgxrfGI;ay~i)`un)`fyRh$CuW$PhX*n=K6&KJ?`CkD4>8uThSFjFs
zT{oD!dmLP&cp>ZHg{&hB%UG->umFukqFR9R@<(`ws4^`L-rB<U+T;CjUckB*T#1io
z{)Gy66L_v#OF^Ch7&<+^hl4E$sN7HqcsUotkF(BZwJL!24~+`?I)h<F!g{#nmJvTT
zYP3D__YAFNW8)(-v@|(6L+k#x0QaP6Nq?)@KABn;-=TD!^$bqR)Nqs7Uyr;j%hI~Q
z__HTV8!WcS*4bKDF+X@+wzflbJ;_3MH+LV#1FTrWzTXJxxHAu<U-E4T!Z^gRKgf~I
zwQtf6eFwqa9)6nfI1R_|bG}F7;oyxew4pc-u1b|}=vq3JeH+}YYp>9S(*XvL4nCaS
z86tIKsk#ASM#I=oN>uF3hOt|gs95tmxxA&8nm_A|RI8+C8^(T8DhA<tirH2yHp!gE
zCL7<mAitB29Id<asOp&Po1-;pxfxJ~;7=a#h8-Ve##Of<7{tXGOOS}&`FnF9hc<sF
zzsk|tp;t1gm6o5rN~JOW!q8h(Oz@6Ynkk%ftN^vqo)PIqe}b)5O$aW{)rJXYrPZF3
zZMEz2s>4VJhS@JjxACfiClK!^lt)r|y$Gv{G1tobWIOFnST~w=(AvvZ?X_E))_|TB
zSu1-G=5&Fv1Qv}K+iN+jxNd5%T?ZQ%;D?3`drf4ZgXW<Fwesl>+7uXblR9eU*qPnf
zQR@dj<LIR2VC$(}Cl&e!LNsT+xuN|9Y(bijE5}rPdS@-0%ggJm-Hhd??5xEI_d%={
zF^}EYRQ^J~+C|G!XAi6szG_{mu6SPi-6m#CfLaSochTBr9@@=5;^?Tg?8K%CKKF_^
zRF`{>)*8ZU_&J)d?b~GJV0o_A>vkjOY^n>GP1SFkWb>}tK)LT6t!eJx%QI)1Y}Qq~
zk!#3B4eFzIIF5bR8iY}U8oGDWE|))dwQBeqdCI2+yLHo?A}|MQ4qlC5px6`v#TNbU
zXp8mk<YfvFW0?k&EdiH=;0m?>3jIz2<pjjPEN<U2$7ZR|EkH^wKvBNt2-j-r8&a4U
zdVwz!5djE>R3<jiiLZ%n!<Pvr7ggDOFsx9%mJg2V(eS3*eR24WSBdJzcUUqspF@vV
zb{Bx*i%@zK*i|49n4|b{O(!2vj^}f>I5dvStkqW(@G&7_^c|1f@kWdBK6`IGN8-y~
zAQR_3ddvg`N?}l}+{R-zI&q4bGu*AdG{Y2yh*;UONVE*#x;3<SAOr?J8BxHO^<%=o
z&VoH1*fT<@U;$_$L`_I;p+}*A0o-bddp6L3Bs{@9&|w4T{PY-~BZLVAlOpi>C^EJ%
zVQdWl*=)8H{2%>?IL#c@E8QH~E7eW)DPBaT2Ea5>K@vAh4Dlper6S~-<aZcN3lp+z
zO~QX7{1SQ+T<g##Jq~R{_KpKRNqp;5eU!D;fNMi&JZ=_-cR_tpQ7sUZ=uYl#)vg9A
zDLhc<G7prd1`1ZKGX@IlhN1S<fMWvccEQb*<uwLTjf_K$4Bw2aMuzX<<dI=OO##}C
z<a;naM{VOdkH({^@=QQ?tzk=!8n%{$JQxIg-vT_i0Q)B(xCA!afk_9LMDPTGsr!BL
z6&g!yU5xvM6-vXs1yG?s843(e8NnD;;Lqq_6S!!APdB;X$f#&K$s$%KYKSIQ?mGy`
zqFME|nJ~EqLiEa?a8cyy36U$1!H4VB_kzM`u?W^4CRjU2jM2iNT0N)+l4g=cg`Rpe
z#W0R|E=-t!DP-XYw2Uhl&@_jdf^mfj_88o=3-(|^;LBb7?JHc&fU{ExF!eGDBjg*R
z7$7%JmB;PinacB7b>40fK&bQTV7z5a4R;>n8sN#AjE1SsCv)dP5j?HW?7T%22>?|z
zk)S7Av-Ql*b6(Z?@W3V4BO#WNkYFLfn!$mAe2;Xjnvr;1Fv#!8LPwZT;z4gQK8?G{
zeyW&WOrmK#n?-oq>R#3`F^_qAN8tuRe8>pj^+0BzBUXJ^P4nQ7#d|D#)^VCnbKBkc
z%nA|*0op1gjSFE<RpCpsuJrS=UvnIflARrz@rGR)!!`)b!Lc%nr*buX$4acxW)MD4
zVzHW}sP-rTjAXLmU?vOFb*NAH2-F|KlcBQ`ZEUbvpU}!2f=}s8F!tl?;dYgjfw>8C
zKO-H?!T2#6Mmsx9gK}U)50?`#LKSgAhq<5-?@D0AI()G}1Ya)a#2397MNnPPJ$#hL
zm%z8zWB?nm*kE3Uzx*`>eH=MHTs%rwp9)DZaD*JE{f2{`CmZ_|_Ar?E%v3lY*u$mB
z!`LE^3c)TW`Z7?9LLy^N&(MJ$z5&A@g8~Ll0FCsvQ1!DIIsx~msY{`aedq^9mzkdN
zHR@Ad=v?JM{#1@Hg~8NNp;L!`+7z(%Q&2kYU^g5_4ctL39ooih2|!ySF=2v^<-&2r
zgu2NIe9ImW6888&CcxHsC2zRXs`V*2qsSOVSNRaV#r5nK)3bx=$&(jrDFG-`_#PWK
zP08eVzk?^T4V>J;BDVo2x8xvC1xG~WYCMbMz^>ISjtj9chP3!PAR9>B5MRef)6^Ue
zFr>xU<LW0XGAYKcxZVUMe_0Om)QDjg1953MhM<+`o(k)Q39%Ykf2`xU6kCGBGJ7dQ
zxbX~9<iq@t<zy%;xwtfl$~f6|h}QB3Bz7F=i{V^&g^0sDH0C%sT(}~rM;uU4ABJ=^
z#3WV^;1W`ZJ7~bfz(pXRjM#zv(KL(_b|b&JSj!DyK{OCnohHC9W8SYZlCeT!aT%w?
zCHwGOdJSAWLV8UcBN=kqLNc>MR%;m2LNXv5AUQ6q*1$tWNeO&<M+r~)^>|9b_Z3+d
zsQf^y-!TwOKX=dsv<n-*1>ngLzlFXS5Cszk>n~t^z7!2#V}i<t4@+9KfvGqc&90|~
zSZ*dh>t)=`N)=Op5=5%CjK&Zx;0vGJ0LZG?kdRk044Yj_s4--e^lC^8U>_j?hVpr(
ziA!xAg$1f~Zad$NizxyXQYGMq_IRHMBm&Y=8kq;R23(9w>pN6RY(WNwHJ1iMaW)n6
z>_cHmt!O<a+{HNKuA!hF-f34FCWs<gW2E!f(F&nds_7&<7Kx0A-pR@i`W6A<QD~rM
zqLcVqr;8l;6PjJgm0ISY(4Uo;h^D8hYv9wElEVSDrNq}`q)osT+CWHw(qF9zh_(SX
zHPRSyeDnvRCIxyD-+#w*4k(1q!EH)blSfas_(`(GPm%}WXb2{SO;46<@gXG8xr6m8
z3?){U5xoi!d<lE9a&U-YXf~f)83jIuhs%-pl&~@+q+${6%h2&~f%mg2qBl`m33|i~
z5{nz7Bmy0dIcc%XfQ@km8$qU?!Hb<tzI2{@!>eG6Yp6b9dsg?SGRMRRJCP%f+k(g(
zkTKYL9(BQo-(Y_&D#G2uxrpLd+!e>xsnF}i^{?F{uNTm@s0{R&hG9-E@HIusQ3Nxr
zT)s@y6=O+oO;6=@kkTPt>er#kbBd`M?+~$!XQ>?nDU=S<#l{J@Fivl3EsNrqeW0rr
z`#=R6C>`{#fI{qpl}5}<!Xw0^F)w)!0Q1s5K|#t<L+nj2!FLrof%j2Bsw#oiDF%(G
z+;Jh!Y^js+C>5N%5RNKnpvIr2i(!=xEhYKraII4eBNYyaa`kYnUq4vs28DG<4a*6G
zA|cQds_}yfCBuf-G>;C!Z9q@Wqk}knVDL`MLEM#-EHAiJ%h1pwdHtpMP-mi^?8^pg
za`FAhkfM-e7H(qoc%NPIt8_Km0bOAVt%+cYml$VYioXv9Oz{EtdQ3Sm*(?smh;P7X
z1N?mxHN6$;&`-bub&QsDMvKFm--=}ckLip~mV9_{v46rUj|r4?QW-$(x&ssm;f{wQ
zS0o75hIopSu{0o{w7`L2HooDC@CwK^4$k4-V>FgnGm0C6=RRE9#o8NGA|Iv?M-0Su
zov471kfH*`_hG8joAMM3wHLaIsx{LhTBbv%v039Qi~6Wf&|&S#{w8gydrz&Bzu&l1
zCDukhP^S{F?Wt9BA`hSwAEv}lrGn$n+2Qu_@rbC_3cLW$#jvAmcpencwP+xJxYyW;
zgNSPSz|WVxBRIW_A0A5qTtUIEeonXocz;2Uk<bBsIcginoJyHFpvd#gXU~4CsBj^w
z%Wy+M7OP5p0+g}Fg=730#B=D{Xe{i6!|`g?ppkGfzUHiW!GtJ?T)Gshy5%vYzBdVJ
zW$-5ht?x~`VY`OD55jf;1<H2a6mBK0RDs>Y1rF5R19*^7Nw2e&20>n5T+@cdfkAR{
zygpO6_ObRbnP0IW1~=u!JXU9geiwZA6G2e?Kfbc&!-B7&s7cl_!wUS(EVkc_*}g|_
z#%$jc(3^$$eyZLqiphgLD)Hdam3Y7-Bny(k3&F9h^#}T@K6A-={rpkXX84?_SB?IC
z&^y&9fZbRTIaPa%YJ6vrF~J9_`HBuqgTNOYX9cZKeS^j@@L)y80VLr}AU<=+#Dz-*
zZ{W<;8pCm^IN1iHJh}n)!K}c`i=D$(d3-_<%Piduy8}xeMZ2ML83fm_t8xR;1p^^m
zF2FS-86rPaE+nJfIAxWa%v*ZuhMQEzAvjhg5-f2ST?d03$<b|Bg{k)A`b(<==tlq+
zPE7fD;~7Xj;6WXAg_P5?3w&N6G`rB3fFb42Xd(}kBQ>34b$21Yzv}`c!9d|dd|>;=
zL-<xBPjEYw5+6G6(~t?@cjr})k&6Wkc$>y_fDivd-5?zW6bAf>U_h*5a7d95H%^CP
zkR@5slw!Cpp$v?sP)><<V@Y-C2AWt1!DA(BSex*!dUVQoqiFJ!;`>4mP#72%3Lzb}
zSs(007obHOfj>1f+{k)W0WD=ip4BL<s@#Q;RK%j9K@Yj_R{wN6FB_n;bGVS%C2o)`
z0K$;P4TQz&{9RKZv`IlgA!iU+5gIgnJgTunhmQ3TaL3=^QicH3=5sTjh2ji^qXc}v
zml3YVWA^F9Gl`wzT!lsq2BDCFbvtu%s3Z{WI->Z)#b^ue1!J26O1CotL;%l3eEx)+
z#?}#l*ttn<)fl;9wZgK;`s}#w_S;!02NOaK7Ve=K6yS68E_UlQmVUDE1Dfb}73!|g
z&?H*yt3gV`p@9WO08gRjswSfA++^IsjcZtV&+Lp=u|~)pBx4Sa30h8yfJb<0BrM{=
zkiG0cV8??U*m&xuvj)!}7Un><pD+m6C*&@)Qhf$Na8t032aVtrL&Bepw;I?4u@?5N
z5dgu0mP6|=w&MXcO5fWI{-YGWN_=xw$uuZ|JHwIqf;mJP`h{Ci4V&*S{$a+6PigoP
zuzn8cYCQ-04=;?u>o>w@H=tIy@K6gQ7wZ!=0YXNt-++<u`c27y#CxrE5!;`6(ZGOM
zzmYVa)0*^cpd|2hth@oslFO^skJc1m6oLRI_?m>e&BUh&&`kP0^HQ*UwH{K~AYM$w
zJ7e+Z;2*&g+~D<ui_H~4m0CJ!dMoDk8SzF3Xra&z0@y_&UQPR55?48A1^ix%$AV;s
z;T}XgoLm(1#W2FcA-vc|!r1M^;NY<XI%5iEgA3X>is=i|3QT~}1>KtjT%lkuf65)Y
z=p+!nD-57gitL;OTTO2p)+)NIw~g=!B!+<a+zU=}8Of83yYW$68<T?qW+(u2YNAmq
zR2tB)(l`>g#aNNRCJIm<+3@@XL*q*bK?cCVKu@|t2}r+w#6bj?*t_JTRH&3{yc#ay
z!MiLHNVGIdiv;BU$0#*BJm`sM8FYEUb6R@fj1k8N<}u<t!en$%M;%nFnACw!HJVP%
zi9a?t@<4(}AeX|_iMBSR&Pdb#3w5?RlRVGX(lB|Ry|GN5(YUc153+L#JN|62&9Lo_
zwL#2rqYXq5U&*B+!QND)Uqyl-E!u?G6Ce!EqJ+2`S72ir2HfbdPjQ)q2}o1hFF5e0
zOh&K)@)>SbqEe%g8`i}C)7_VcS5ahr_wA}qZthJ&Cm|#xNNyJP9a#bhq-7NqQ53<2
zRS*FY5z$ffMnpx88WpTKgJW1UK@reFFKC3IaX?`dUm3|LGlE793IZA=YLM@Ds=7O!
z0Kz=a_kDl77b;b!wyr*P>YP)js;gpyWL}jIm$694QN+O@QNM15NYuEL9%rQKdFmh1
zU^$9ai!6To7xw#{pzZ6#m*nb7l&TOUqD**LRguRVAl2z4Xnbg+Gy-D|PUXm0MbpJ3
zi@0XKDM1hb0r~u*^q^<d;W{|FJe(As#$ygzkvr_L^b|_M0K#CS(Sg2k$6qpn?)W2t
zkq}Cz0fW^I&)7KKpu{;MB+A0F0Ip(I11+I`py4qxjj1%s;vKLw@|^)oHajR0@~Ci~
zhLmISgh`V+ITqx626TjjI1L)?1$>&%l-J|g=s>4>SdbSTW+NU1F-tgrm?CuJoy<@Z
z!hs1AQTzeTi=RPUMIwUk2)Ef+EN&v96IBQkvJ`lEC{`8r+Z@L&EHjX#Lk7y{@Hmyd
z9vi9vNZOSBr9fa)s*IUBI#YIe7QT$~XN94}k0j<xyKtb*k!^#h8O8lrcCJ5I+i&kX
zr{l3fOlrG|AMK9C1N>?ix{Q@q#BXQNzkt?qoN!Ce!wk+mNo{DWR}deH#f%FxvUYm7
z8kQ1BbeeB9hhib6H!{#h$?eS2FfT_3O0^WFNytMUAO>65q<~Qh9*J+F@IqHV=9qWj
zVcVIS+eXo+V1ReihXuKW0&KB_7O92l<pG#rk8&5kFEd0hPuurHP^x%l$nqIzM<}Ea
zK;O`W@N8~xyr*ZJ{aultb`!8rh_ELiv=1!~la5TUiuVDrs;)7QK=MhPy(!OZNBhbd
zdI$KbV41D!Guel^!vIh3aGEJ6;jDFU{W^uZv1)=IV?`6e#b9)V!o*sY3JSI@b$7bI
zo%CJm1>7)1`g@~H{mCZXI1}*&TU7;%2||}7wif~!4$W#pLOTWXjF5@x0#(PPzJtYo
zIa#Q$3wk>}Fa~NS1||-MS4x?TkYoTv$q9=)W1v|FxT=~l=<bX`x7E^Ed&b~R@u;Q3
ze>IB_$CDOF6cs~?Jq$Y3O4!D1t^bUOQTROb+W}EDS#+>zzZ|We<Mm=`G6YhKvBFZx
z)-u6z8@?Mx7RuP~#;mu0tvSFj8)Ejm>Gr#MQ#|j6NfG8Ia%^F+;c@hicsP*@#tXe8
z>GYW_?DPiOtMox{@5{M1t?{5U$$kj!m8@d1N_Uan?wSr`No|2DsniyxY=+7R8SJFV
zMF(jL1Tn`d{e|?=u+&<qCd`GM)q3QYi#qm7v<~q_n=I4@3ee^kC+T!~Wv0Rl>DEiI
zbwR}^^Oi4!(i&_f(z=ONwqc=kDcz+xG@ax;)dSQ^<`<5^XwN~Zn9Lk|wCAYN9)lOn
z0S(8vqrHc+kSOa`j~N)MG{*4t%mwgrdg-|e>Os|GOwP%QMHL9lqs@r&i#Sdj6d{pe
z-{EAC;pt(_7%#$QcHGiHb+&;A(i|2Ui)IXR=@w^5fG@`f>COzbP)^I5wy}-+O<K<e
z_tvK)l-5hX0c-;IhT^ZXzR|P@rngLDA295YSsDgta0fPrlmKO@+g)#qYo}l0%?rCV
z<t@kD=8x@mcHLu<PnqzlWFzRFOl8R<#R)-=4KECm0g7P6!y=HvY(A`i%^lkt(z+@h
zdm8&4jxr$o9q5QyD^4II5hCRY-V-~|93vpHGYFNgB!^L<msy4_WuTJ@b_YwIYN-xJ
zCj`*qwllKgNK8`KBH+(T<#`x6WHpmbh#@N;3{4>ft~{Lq&auDg=xw^|lFWH9a?c1~
zoF12?3~(rVoiyl@6%OBl$u((2PW*4`^HgW$&M=!0rDH}66X^rg@pAmrLJcis(Z4X(
z&(R#&bGK2uMyAIb(6fCsBS6Wvl86z=0deZ{X!j*Z*nn{Gnk<2O(6NOt&>9#o@vf=z
zUFmQ*X}V02luZ?fRK+mNwvhIBZeD?|%Y*E|gCKnHfjn52Y&&cOV9zv_$JeQH9LbHo
zU}0b~gd7Yfd!z4MGL{-cXyR?PnS1G6XvocA6eqh8PAJ2iA4^3IY7u{ajWr2VuQa1_
zq)D`yfpR|Dk7=0LXhLPt0&s}NWkHwR>N@L`79`VN7_cR3!;FjLXrGiautMMmLaAhO
z!MY{YYk*?#;lnKXQquTKm;yyL#3SA+u^}E4@Iij7U@TSC(izfPsHGeTv_%P2-s2Qn
zLS$|h6HmOx(!>vGJTOGPEl4I_evS(|w?}aO@)QvX)pm(f8{`iWk{qf;^r}9IK@)9P
z78=>tzDAXTjWis4&d^geW~S9Ye=LSwy3P9#jK!pju3m@8!uQA|IEjx_9!vpkG7iy7
z7tk5VRN?}Bg_gqNvJAO!Dsz$9MXv6E+tS1qYcz7%94fvNUR;@7r0~KHBW&xz$}~OC
zS<RsZb=qRaX)%Wm%wW>&!p0+~S~pian5ZN+2Z2Ip(TnCMkQJa_TKtlWIwWgdd57A)
zyVDpDg2g<LP#ny}B(21zSAA`LhFCkEWrq!E$ni{dfD&n=mQzD{+L~Oia%YZG)j*}4
zpb}srf|VP|ys-ABa2L`^wgV?5+nx3k%cMr@jd66Hy$!1#Njf1(WtC#S0g|x1>mUhZ
zi`KIPz=_@nC*USCXm5y^v_@|}tN{Y3N9q0GffN}g+4v)Ob<lzbvSQj>|FJvv^g6p4
zed5qW);x^!8$t$Fhdel;xjxPA2`3Pr$`bD)R3{q(y$_Pfv_+FQwc6z@ciB`WO%ce3
zhDU?UQbUGgxRs-ZS{a`sR!n4Vn$!M>5WQgI=87*TvW~FMyH6(z24)BJKsl+k8$nie
zM9Eu|Jh^3CRgy#!y%BP$7-?@uF{wF0J)&NQRzZ|+_bOH@XvMcP_LYFH5uONZGR(2I
zz9u^odE^Ehq|TA40qUgGFkwjQSg`UDt<v@v3`zN(w78p&-lB(NR!QV6Cu0zq9C!-Y
z;>T`NKvACB)FS5|4mruuNh3zCwc49n<RUAF1(32fq&%fy(%_S8t&kdOc)FCAT2FaI
za>R~R405`|5w9<YBT+ckSb<YD9PRfYN{rRBY>KoQi<G9JpqfJ~nqcDSWY)1GlsC{A
zX4bSzk`QDQ0XV%{tF?&*bQ>csnt}ly6GzL-UW$;2oQu;-v1UX#r7AjM1w2X(d^an|
z!Om((n}eMdR6JL$CP^Za{Gid&Ie0IrY%rZ;tp*(ecA9!=y4jIzf@rx;HbF^1Qg0^p
z84vaF2Vj!+^nkvIkYX?ifGx@;BuQS#5~S`xDhLUw!BbIA8N+kuf}~)Hl-QC>+Cgk-
zzyW7!6x!V&g#c}j0V763oX&{`ePQbkDQeLqg|StLEWq&W1<2@zD~k}-#G+&-cwmuX
zV)%xeYXmV(T7{#HIqO|3Lll`Us4irUp6M7CNV$;n3Wz$|I~1)50?R?91n{g(JS;jh
z)1GN$s+mSK+LuYy$eD(oVGCT^zXVC!Sl|Xl=4h4{j)BU8%gkg?VMpf-NO4SkNYB7o
z0KN1p;br#HM=9tM&>d|oOvms8^TqNt)^)LUSq)4~%H?+FAmIy|3E>N#jW4{scO_P;
zLOc|fxgcL@2@EgC-CQod5NQ=V_(FF;ddp3z(&nV_k|m1*FIi|j&&;y%l2vbS$wEu$
z(lmvdJZI7~H>{9jt099ycV5lVs}hFNfGKn_Fr}lo#1z<`!W2w1!-1l#Uix5ofbu+;
zN&{KpN4SCvAU$ibNuQ6j#OGdNm~@o71uuYk2k>s~W7snUr3_y@U_Gm)x!Q-<_5qvt
z<hWkNYoH?I!v{KIMNJ6o!%^^I9JMZkNJx|10YQ#w4!qbb10ySBh?54-h~p?sr{EHq
zbCJ-4r;G0_Y}KTA?!>ECW+9X^FUrEVMxf_xnk#X5((0BW&r6^|1UxC+XG1*=;Sci2
zolvltAN&Gq&7G}f``%Tby`A!9+-qI1W01Z85zU`q*Qb=Ppd)cYV8(4{;7@1<EDu3*
zTja4PSSO$U)e2Eo$cF2OSBShPSsT&mNtU1=Ul9Q?%onw2CB8WRJo4C6EK#=s@xl^z
zM9*It5liuPx4wTx<l|@XQDyqa@-cKfJ@`46Z?T%11;Y?dso5qni&)2mPwfn3){)VX
z@kMNjp7M?zA4i=PM|UMcprBC9U)ac$4^Byp4JDxQv;V^G)b)R?5Y^AI&Ay)^C4Xf}
zbbZ}h&$IIZ9)6zPLI+$-Sk6N5@|UwMNX%QoZiV;S3Kou9kBaeaSMQaqGcrtD$@202
zlt10qQW&ck9shOpDt0}*1uc9n6928i>JEy;0Hetz4&f4Ctzx&u3mlAv!*+XVplNG~
zxZwp>H+das5dCMLI06GOaPJ(cWdi%^NUcREsm>rsq8`Q{jxBulNzi}%Ri7@t_=Q~<
ztXxgqy4YvctQH^jV0lez5YY+E^kKI;_d(sFl>A>=2hX{kurbpKqL`#NJVBHu>(*lW
z)Vv(WjW#|(l&cd&u`o;rEnv6KGorXBo1>%tTYh8NJ>3&T<yCpKpT|8x6vzl#)Kt7B
zzAVzMy$G8h`9jG!2Z&A3D_4t?ds!dBd$TUS&Em;A^w2uNPO!g6?R*+J4~vgZuxUwz
zR4@i?+C=5sal<*fF5?S)Y}LOHix$g&XG>73*GYCDZm%pw*#n^@aU_fnb-(C~Z!E8`
zVX;fc^UkU&*b=Z@$n2_?KF^2w>2`Md7<=gtykGsLHQju?>1CeNw832#=0h5Q(~!(>
zQhyFMcw3Y@ADhy^sG4}MV#nDi?o~8miI4x_J1(9%#vTxU#`odH>wab<KyAa0vr@5_
z^8s<&sW}O_0UPpaxoBgc!|-8UH;X0rjlre}zuj~qwzH56P?11GE7n{smK*$7cS)gV
zFNA%Z*qK6v*;JH#!_E)XmJr3^@S;*t^$qJUX8p=qi2mQQ>~VXEa<b`QSe%PN1crYN
z35@oGC<4pJA+n7LOjiV^D*}T#=^1)b4({vO>F1f^vv0wm@YK8BV%b?PvFYl#TD=jm
z)s~2xs@W7B{)g3UczbF!-Xsej_x1qs)Bz;=qt%uyXeJm8M4E<${CNl1B{+}lu>-6c
z-u&-aMZ3x;i3kbHWF<Z2Xc;<lrjp3<u$b~an*t)-_B|_#vMF@xLDn@@9U+p7N5l5c
zVGObl5sAEV5MTcFl9UaThDLS`GE1Km4-m)iVnc$JvO|i%0!qZNyO|~K_yIk#>TZ@j
zx*8`-;Imii5?D^CON@|VcgZSB>i|iNE?Gk1H4B|CSp-nNF3D*^7_=1{^M+NIFVYs!
zm@g3p3s|;ZmM>miz>?y2;S2+L77!3oB0gTgn&(xaSztsk08mIC%z>w4;qn%xq=O6i
zpfFfRkV-wHOSNFHf~<WdqWwLrPlsLi6AeIE%A;2ds}is}$BoKS9WZ_&gLSY(Jbn*r
z-tLsnLEp#*5c9@(m#b#DyRk&<x`)lz(c0nnvYRmWUb~k~MbD*%*^a2i4-x{zfw04L
zumcc{XI44A=jV~h`K*c0UnFzk%(Kg9;$!c^`&fUJ|L{JxplKOWdf~_v+!~5iHEf^2
zov&j2LiP{bsn_v-R%ohvBtcoJASki(el{M79TqXV(&maqsOvzaa1l!;`Ss!hY^LH^
z&`oHAgVT<j2U&9;?gtp~5G#Z)K3dGG(!YV`Nk&l}CL7x}gq0pBE9Sb$hYzzXA71w8
zBP{IuM%?-+%C8fTKFXG+DooS1G90}}XI9y`7P$p%E;7Abz_LR}@c!sjLZuwb)qvZn
zGnaL1-vbrmhXR&LAJ)=muTi8{p6OHBD68}V(fKiUOH!$g#vqIU_V^+Wmy}Hk0(5`-
zWeHi}EJ`7gtjq)}`{prrw6`2R9!7O;qemADdq9E~l~P|pf^I045>)J1j)USB|H`tj
zD5R6F2h!*{yTsge8isZTiHTEiX8*==y1P8=3<8r{MqG&m<}!rMkHn3=*krv3cegZ@
zmL0{!-fRd_N^kb}xSfSWy}%dAO0oYagx}-2Y=k2|F*gJ~+RW+uTyVK{Vs{@Bnr=Dl
zqH%@hWvU!iRxc}s)sKB0_FNhg0LlD^gq6BOguovi5Hn?%3;mWOTX8%JSw;Pp=Q;=i
zk5d78gS))u9Ouu_<q<e&-@YltZ#_d1xCca+-)OZ!8TZn5?8v}=Xk>X5S#So6*m?oW
z2)p-Ffc1IgGWLh~t@`^eNM<i`<T)%+{)RH!Z>^-~s>=kplJ1#U5wtv)%+Ys7?mg^M
zsVDPoWI}(Y`#eIvpU4`>UQm)gTYNu|wNc_eB+k!6&z(`+r}t3(MT6k%GP{AGmxsEZ
zrI6SZ#YfW-aPiSx9s#G*5pZoGzHtOxJ30dH0wjb>AEKdxom}c$d~U5r#A%O!Yv-Ko
z7HUgJ!0B>IL$;Q@nN~TD#cp`^n}oC4UFcgtnVGfG$&m|yj+B$xM`d72fQpABvPi1E
zg|4L$GsO+7MLD)oi1YkBrRj!Kv|uC;_wx={l>ZrB89Fy5WgqgMT}ct|`S~0j_4kh9
z*_rmB##A~eTS)_$%*&}WtYuQ^6?ez*S$ffGaUh1z2PI4l@Eb4!-wW_Bf*W!EKQ>li
zljX}|U65N%i(anR=5_8v?<0lB^3LIPf2FKrf!cJkFJR&!BSs;F1F9~8_ppo@j!-I1
zsCDb;b5tY`Axy0=fOkkn<RXL*H+sO^BO|&Z6h%kl>(<9I0)${CK@)?wSw@6HLuD2^
zXl<j6f#J@=bi66NQW=3Mj|Iy|EWG710%T+1V;)-ND3lR6G~{J*JeFs-Q8@DhXIA}%
z1(JEDf>S~Dz}6O;Zdh?VDXN+jtrg;$INm*2_R?TjP;hL=#+M=@ju$ZJUT<kocE0oz
zy%YHL{VIT4+Omut*6~)k1H{NxNKA+|4B$GNHOP;cqA+j3Cu&xKx>D?;1isr*=T;~3
zse19_!c5`=e9w!^l6Y$J^Kv;GYhN?6U@bNmfuWeoBMXvvH(#a{PFSOWHjKqxYP@^`
z%^+Jq(R=Dq@nKVbnQu;{WimH(_&F*3F`dsT$!aC?K4i@zJDT(BeWdocPv==_<+!<q
z#$bvXgDE7aw<8X>fKN;3I5>4PR(jg%)74&R@I)n5=|IHDfR;SyORRm2$Y6Sik!~^%
zq`6I8o58R09gn=4!7nC#<3xzJSBHt=>;tr$)+D!T7lmR>f24mVAMNYf_|`?@OX~hb
zglL>sN~v1NFkR+WO(_k{flX@=3GKl<H!T%O*%+0jxF^Euc5b6`?`iIoICbhE3bQdP
z@#F@hGMeV0wpgV_2q15-lB`2>_;|gtRJ@qOZ^fugZN-=3?2@&u_`|-aQV1rfgZ<m^
zk*O8Ho~;{0BI=+KTavD9!>0pxv2FQx@Q%0T)0@by$A)NYHx)V|X1C+hQ0YJ0@dBSZ
zYugW1g_PfTtXyUqAWR&xMBCIsjxha*MICrMRJOJQf75%dAJ*fakKECbCmCqzquoF~
zd&TG7_@^HEp<}wZxjR2EsY*T?oP+G$nDLXc`9pW!cfvu3*vaa5+F8_Dga#=X*eMLk
zj`q-XOPXY+t4U^4@t5=Y{&NyQ&-dWT;;HFuSg=;Ic1&k*GfD9rmL+man3+tmG<b=@
z;6U;^#Y(R)VYBqw)nZ2pn+{a;C}nhWS7|A$h+3oU26;2tOho->H9G`v=S%EBRGCV7
z>t(M}O`mPs9oc6MYb83)W)&C_M`xpA)LgKZrO^;9UCT0p8zpU{g}Y0sg>925LU9(U
z6qhNAYO;=v!KFJNlrX4gw?d)cEOxDvh7EHr8d#v35&Noa;GM6^22Ohode}0VLg>YI
zMbg7si&3|;0ZI>}5s3w2r?Ja#X9v*Ew>Pk9)XtnYFn8T6ZheDQd5A#+F?9VCYfW$P
zNQAW*TF-{?T{SiidKl9=bb1nXaT9d$!3aAxoQV7!3MB(UA^hRkgsmpGcsm#X>tE%-
zAvP$uQT9Hx@!is%WhDV_$TE;1%~?lCkoP|~<$V1)o3n29DQnhQm2+ySLy%>P8b3M=
z<$R+wWf3*Pij^eR9l^YAorpgQQ`SM;TXz;y77?lS6Nt1<<?UMI5GmQJ66=w*wuXI+
zeuwdBD)oE4;piJrzmv_VZ!J?cqp#V2r$n06%Rx1eEpe=tZRmcEUG1@Dih}9v(*IjS
zx<FcC#A$}~GL`a2Lz+g(|HILIP|lsiX-0FMJF7aU(cDVZ{!Ox;{|!UB-6q!Ao>nwZ
zX6Am(-)UmeK}{?=x)Y0yxJB4Av4EWg5vQG4baW>c9lR3@1FIU=E__vfx`{;xdtzZ&
z+npRCm=)ZKMJ~1og-~5rL~evtsTZ!vv3BG9vNv&-X%9bdA)a~@#<YEO!t49en0AVN
za~Y-KwMd~TpzxZLc!5Ktu-BbH=rD2f#!5=f3E_W>%@I9gc%pdZEtZtE0ePWkH<ZV<
z4lZ!>MTyw*7Hn%3XeGEJ4ppI$vaMk|RlRKur;3nmZ5L9(q_Se-fO)G-K~{N*NG*eH
zO<lG?voku@7>BRBS1nLE=%%o(VLzp2?JN-s%FbY0lMRptA($=Y#y>nqY%XI9bhP$@
zx20fy;cc>tMq)OzsVu6R-sf{MZ!3FFuR1D{-eGy2|0=J`VOUE8YGDf`VSzu~L;@Db
zq-IU)LC~z3Ssc0V9UT3suiq`6eV28KD&I}&ulVp?HZiJz!k>#C6$~exi`f<Idp!4=
z_t=&I3BUARY=EmlH&+^TbB_jn+b-6Rft{}V1Sc0FKbfJ#-cOj{Zgk|kPuO-nb=6U)
zOKEpH4yd%KjnLOV_>{ef$KJY!J%maBFMAlNf>o8UjTfT`dQ2J4puiLXb`57BnnEwU
zxE{dU>X<(!!I+@d8_4_zG-KKVYgi1PIq_etBZSst|6)h+u<&OrCF`sff*Nt?5E~e*
zm5L06?Gk(OXvrzk7AYicM;{~w9dCV3wy^c5nKz%o7N+9?w0d+_c}s0|<ZYc&u%x`L
zmBz5s%G+us75-@H$d$LXD(@f3+g9TF{p_9p-$HlDe=l^Ueigh@3u%~RYEW!J$y<By
z4r$e;<&w>M&r&>sI1HYso_s(|(GM4ffaFC#h)a8d>lO9nA#qJl-lb(L)CJ^&fML=_
zg{$^%B}?BRd4BO~@o7)qs_*@JFaz0WG;P45bUPg%ViLT@1>E!sHwx)x`$W%Pyj{<7
z*m=|gEDB1dh7&_*`mebqcOCN7y#3I-VtFo46R-5*!SJ$LPtp<>aEq>SqfqH87jV<d
z+$f}PZ~-@cryGUz3KwwFyIHG#^E6<Y3pg394Q>=FSo7PvVta4iE_`qy%v%nws$9S=
zRkX;HUg!dDdZ`<QT8mx4O+WIGr+l>wIO(IT{KcLOwWnmT3ccxzUBIcpDt4pLfTG2s
zIG48^;ZVZ%Vo&AeF5nifbfZvsmkR`&gKR-?u%L;$T%L+^zxU_z=K8X=64a|d5zYGW
z&g|)L-VrBqd5XU6keJwqr#3IFgzUv042TXac;GD8U^Ak@s#@`6AD-+h7KMFyGrfF~
z*aA@BxLEl$i^ZWn{3l<f*x#4uAy-yE{<faKS?uq}fA$>~l^5_4XhL>>o{vLNSM}#}
z*@naKiv0t4YR<vqB(k+&5<O?{F9dKJbZ%S`P6VZ#y=#8;<ZLUmS!L*OH>Vv}eZMEJ
zZjsnGfH%)BN5{As*FQ`^!^a$aSZ36Vip6gO_;Z2XTgpiz!R8RLVjypeGhBBJ#A?(E
z5ue8=g!5OIqmAa6AS5mjzs3tKdBuhTNDD!6P}zJ|(R-*e)f_~HaCdzLppb%a9{#GW
zs=`<lBI)fjzxJt&+xEYs;VLj$3@F023!&!jqnBVCOMOGCz7*Jx(*Xxtce8l+7IeAD
zr9NLcTf>PcS-u>4th5H=95%|4CZ4rG94o|Y7EGzTMY{`OO5H0SzmVUJDguMB>E@W|
zFbFo3-Quc2yfq>h4C3Q6YF@_GXBcxZHXGJK2bc~37ZO?(;+H|ZKW>)oJ(!PdS@0Do
z3M()!MP<qzR-~a=%fAvU2lGWa1tm%y!@))fDRm6@YxmWnsloKkc|nP|cnBXE-uWfb
zfWN_Mw!0B0bzRt!kcbVL>Lml#B9)u$q6L&mYLS5p!C0Gy0vFx~jex#(k41r1I5(H-
z4bb9UfOzm4#K?tG<iv%pri_iY>g2;j#!x;aa|2#Ye#uWg<_~6KGn|DwX<I`qg0)|X
z2Zr*_dVW>p^`U%_PcQvm{5p*P7PbC+(y=1H4d?N`sB#I2CL?%GU<uBB#@-!Ted#}f
z4~r^N=RiL)f?t|iD#Ped?A`NO*pFjvlrfRRBY2nveynnf-Z_%DO05N~45gGEcN$nl
zUrWvI^^tr`)M6QqBwWTP!8)fB?i|Itr4*u=)gRlAGO)l-;f<7dC{jL(S25p_$O~8U
zzCK@#*mo7rjQe>l2p#L<*Wp|c+(AADoS|r)2oB;cbn}=PJceHtSB;TjwYOHSgOGeW
z^5Ph7_)_XXFbZv^Rg45$88@xv;+?C(C8{EEWBKEBbJ((R{0%5%qp#tgBeu)6{B|7+
ze=l6mv*2yNp5Kzb9M8A9S{r2Lgc-TaJ`3J%am9Gv2gF-2o{tG1p<^vD6q9Jner$pc
zD;TMN6)1<r<Gob;K@_)qh{vw6-59^P>BOM5mI?|N;5l+Gf;fDLgJDGFX@3<AKknO{
z(T3B~-D4KSQ}91{{8>Ix1F4j2!ROkE>+axP#Fi;MFLL7~eu9g6lljc3o2TA9W%^uk
z->tkwWWh8(I!?^2;kBI;qD<|2P1EkvHLX4TDU;?*nsU>;KZS0YKXvZ3S-0GQxGS5Q
z8ZO<?isQw{xA9IsD0sK=X}YG18|U%9*QO?$T2mx<gr5R`5PTneKU^#vhl_y=z!`8W
zxv9;9|2#4c^uWb{&&Sc(=*{56KB^%onv65L=tE4=>2}^;Pi`W{-OgJko6SrO&4shp
zf*gWA17sx%Zs$)%?F4#*e-qjBxupkU#I*T*yl=XAZ$9tP^1&4K7Nb$}X5G}r!N(3U
zEknX0{tn(+Hx1E?{J)vv@jF0$@L#-xe|g0%z)~3b7Q@k@!VbJ1;gAR3hHxtnJO<%5
z9=HbKWC=$;yOXaqvYd);#p`-2o&`7^83zW$OZW2bF<moEtr_5<;_G{PznB{UngHjC
zc43|#QwlIqf|rJQ8QZ$GT(tav=jtc7ilO;@+<7NMrq&witujrm1N>3&3BNwg`u!bI
zmd`guk?;tXMee?jf7dDeMuMp=K)TK}?L7F0@%p#HzcETR-+`Alf}d#w&qH^&^^_-=
z+SxZm&sM+kQK~av@&$a{XQcQte37bkyfnI-Hp?)zdB{}^M+D@+ix6%J*R@;s^LzB{
z)jPM(q{&lmm^v-;T!asgYX0x>rWTLn@8J{e9fnWHIw^jCn-9wjO)#|}zz*<R!@nFp
zk?J`3Xg{(|+src(oNS8`O_)C^p4kk{Zv+?uSSdc+%m*bzPgHfMz$e=8EIM!D+3lU^
zQFih~`1A&yZNCn+{0^s0jNHA2zhfk(2Tkoy$dCp{M429pT=pK{$$dYI79a4wLpJQ$
zieavf<&=LRw<*f6(?F0z;ps}iK8%S?GJw9_?F2Ub3rSU-#GD$wT};`*=d}Op&8Bt<
z%GGM7c0c^<(9`G~ZBMMJ-2#6-1}h<FPi*AG4!$TkT=LL6sJ&RTA~LXDv$n~=ubTBK
z1@ydSn)Qtgje>msS%z|IH0y!INM-rY6lvB{84Q(e)~pv~u<gtrH0yO4{6$|1C7yy{
zTZ7(2<7L=<VRtpO#l>MtX#ee^CpGIQN-*+kLf^cO8@wMTpt#%W314Z}(-PoY-cNsA
zvsOyrz0PGTUe&DE2#Cs?-*;y4Ke*{YLe&rR>}`)|*8fOo@|yR)zw;H%+D}k){#_}N
z)_W>7>!<_^*PJ)I`<)Lyq*?bpLdhGh4h(EIeYIviN#Hw!Bg?+zA0;UC4x7mT-gfw;
z+op%+O`1GwYUnf!b#{@dwE%MOh!xKs<Lv{hTsZQNWBdwV;--M9O+tnN7$npSn*xz;
z$05Y@O#!jBmj6utreF8~@_+e-k8un983nqk0+W8_BkOD0g-BJC*!mlvO9gw@@u$dt
zzYeSw{;@j#p<B@w44f{qBJs}?d}Lr>v8fGEaHrq-<COpH-+5p1fBBs+gde%*B;dpw
zRw=?-4<C&|)5ZHf<1@G75a^Xg0^(oSjn3VjSFJ=`a~ZE*y(<dSfO68mM3^`y$|W;n
zMPS^Ergp7@w=$!3;`xaR9%1J@KT-U`jP7A4ei5GA4rvYy`7Bw{N&7dv#MCUh!!@{x
zJ9++$Je@pc{sK6)5lrmV$-lPIGuA<)mAu2rkcpQf{^!7i419Iu!fgN(zeMBrbEC7{
z_$<T|4~oQ@+64Glp&n|81205+wg<i+aAyxpFYC=;&<Ms2ms)pE{$~}O?LMHmQHBy1
z7Oxsc->}n={b(5Vt^*$hOjvhd0odEH9e}Bqo%D|ZU+96~1x!8Qq!SE_oeOUVj2`IT
zAcFX(Q{Z<rG#7Ak6H}W5KPLzWYr`jES(MR-G>bh^MtA+L7!iy%vNBt|WJ)pI1wN|Q
z?us$B@$mOWYg!1?vVV$^(Z)mi-cQAzXy~aA?GZk|k=*@xTr3z&%0bOkJN=xnMRyJc
z<DLL@UWe$r;nHwX#2##YF)ojxYYKy}2A)V1EBwaDz}_`#kQFoWtKUdV>+y<`8Vh`i
zNfT|8wz9w{I>!L(mC>qo2hmi*dT+ma$_#{w9GvvukWT!@3x^uPgjH`k4R!}Ug7U;w
z9QZI`q@V9b<RO9vr;}kV;NBki9>6^$EYbqTfc96eH6<B1`Dq~23pnsfg!`!c3j;>?
zEGK>wdXpr(1MdP%bX^%OK1ID@bDb&M(F(rl$u|+w&0GJifJ2`2xqwys6hc2idsV&l
zuor=pPE_W!gJ2*qMPlh7`kDr5OGI{qe=t$J6f}CpIq}^P-%RW~!8?hxSYv2bi}j{_
z*{k4#>uTfRXTiT4K55-3zcAJqd7)GO5yZvGc=enusE??^NpA_HwDiE)fT=#zlNe_#
z)Zsr9XLL?*@*l!OJ89P9D)G-a<5Eh_i8oqLa*~NJkY?(@Bo(|cF+eYT4PfG7PX3D#
zraqejVkKqnML6i|`@R-0#~T;vhoi*L@px?AH)2Q=BPaYm-ntB~9Ighg0`4dr{r(NV
z67HZ4e+d6exZQBoaJ6t&)wdW^Z}S}pe*w1*?iV=veGLC=xZ`k3Kp;~PHw})ucEU9y
zDK0}s_D2L5g`0^6hk`}438CT?CQXUddk3C_FzL$<JQv|i4@^3A8eCsg=;XN<u(!+x
zz$B@i^w$yg)`9L%(Ju02cobpk|0SCE$TXVuatc0&xSpPT3lSz^<D@S_xD_1nW0Xx#
zFh*SCq*23%Q`)Rq^KV9mt1uy$2zWAFI-CRFgfMl!Ga>jII%LyEFf|^%yd}Ztrms0D
zeoQc?>Q^O*af!w>>iw;WMpn~hZ<yM0xL4pd!o3S8)v2&%J#+*e3Jz!q8EC3mB{I-l
zv)-V9o|mCnf0v=fNzg`RXhy1LeN7>jzo?~V9h1RbiAaCoD8(+?lLCEI2B-exJO~5|
z^3a6hM3|aoxO)C@WC>SDV8xO&Wcq}{M&8%Ux+2$C5-4n0QPvDPsRVkoJ~p!jt{MCh
z*`o6I_5Rbl37Ykkgo-O4xVi^2u8`37kvHDFH63cHg!(@@v1%-GZY3x>ui*7N&s&$Q
zSsxP^8$Igqm!DRpA@lwpBkwmgPA2N#7DYa2V_cgY{r7j@)q*RN#MXTNTI4_dji3CX
z+D{SH9~?pc9)#2zkI>7AAew%#i8wmcXr-6$5vjwBAv8mtFwE#2N<OHjKI!mjDwGXB
z0KXG_s!Qw}W;Bg#r6R$7|Hc!1*Wt><FGRu!<9hw;CSuMAV*vT<M;I^aMMuP%vBrSF
z&LgH2y-S0l_+r2<jw+_V#4oBZHd^b5H!m@I=~1y_IQ)bPq!Z&H0ScC-9gIA2iP44y
ze8<#`D}#yh%Z%=UO90bgy!x1^yUcha-1J9N%Yo|&Hw^A-xEtZ_f-8V~7On)Y3~oEz
zCveqpC*Wd#GPN|gPH>~)9)(*4_ZHkXxLt6c!F>nkt1-1EaOc6bhZ_Jlw8m_$O+w%n
zxG>yOxR>BwhuZ;H3HKG;58~>}jbVBI;|igHz9ETNyoQ#HIC@{q++M>4Qb8Zb5)1{p
zg*2@?)Tusa-f{7t%Z<#aT1x#&7*`mVcS?yjrB&ia^ix;V@-JvCQ{fX^A?e}3#3d5M
zD}H0pfLc6o0Kj5qYQz*~!jV96RN+yz7;LmA9Q=wo3Q%^GQq;O=!o0?4@yuu=KCu&+
z0&%|~aKuD9C5X^yXss0}PaN&q>nTp<8HYEd&UN4$0cU&Q!Dv2lJtv(oLa*b%9RL$E
zbKtGWKM?SoNpmONJayjGxozE$czd+bF?Rl>SvTD<Y2MV^rp{|C4vaRshTXE8QLeqG
zu5yIW_rTjJ?18^Rn5HJqvwuXGxVQsnp)KC}GHe)GT%6|pdI6AHiQNvta^Kmxr82kt
z3*0mlm4HibywWISpZ$!>(qPw#F2WK=@MS|B2^#H1-0$2k%C0g3$wj}J+6Bm;4Fg*k
zJ|Qeoq~B!p3k|k9Er?$hUb(kP?Z6$usy2NN^=leBw&$|tUku&Zw)b~~#K^0S9{QDa
zV$~R<uU=Ru_Kh)`g^4m~I6^~^7CSF|vmLjy&eUcjOtO&V->q;YK1kM4k2__(uv6B5
zLX{=Gz+3iq!1Kvqcn1P^!u?5HJl4n%EpIZ0i+jfyImu-xc^?uM!rc!?B)>>R#u#n7
z*4jxA*hw=e366daiRb=~-q?lR6~RXXV!&ivh%gE<A>_!wpvZ?$QY}W@Jr?H2#lI_t
zR)#DzmjL6+A8(|I_;JRPIEM&`SQn61*HiUH*~!!O1=WWKU?7e)`UeJMgnBCUEhckk
zKi|V*<#h%Q*u>BwvLe}jkL<+@9zie`j&Mo?+6x!har1l$+G7Ym4)+9HA>5O2>NVFR
zH3X>PYZ8fs8<U8)@-scGtDc}eh3cM$TLMQ9TMG9KoYVQD5nKeA;%1@jv+(~6_ZLKM
zy4E<a*-8MX=Q+Kua}Yv&g2uiBlTt%u@4%EsDjo5kT$UgiZ6Di5v`Yk|5NB0CSfK?!
zi4*JnMqXe#Viac-ZO0hB#L%0Jkm!81VTR8yd${-dNm~!BezJDhJx6!<dja)0J@F#K
zUbqA>#kJ)LS}FY1a4*5V47Uc3ettOW#a9Tx&w<w>OmR2ZW!E8$vSDpK0#x`_xEwet
z{8}UUZ+2WU3X>Z7I@}v@5x9+To8X*Yp|W1sDZAG$`zF%s%LX;=Eku;Ty)AZ3H`-)1
z?xe<Z&n{Y|XtFWFchTpjGPBl!gHta#unBmO2TlS^z2>Ah155&pUbZF*y(l`2HnP*S
z=maTToNV#P)<YJHOuxa<eUqJp?o8A2WP*A=%^is{ob<N=$9v#8zJ~3Y2RPA_J`S)d
zFLq8f`er%x(9nQ7@79Z}9GrY@ry1?_&rNaVG-GJk$v@dmSM9<&N`rP}Hfl$!M(qf=
z?NH_80ejzLS)=-kRsCVNf!z_&)YIVJfV+6$et?^K;DPo75#<h@t^o|4?f4WUxH33x
z(yZHv{SJe1iiCg##3#ewhBcO};m=3;0Ldc<0|p)tLV_3W3HaulZU_ws&6+wJ;X*us
zX6&b$K9nhBFw#=s&RLW;H5^&0Wa~{BKsl1XGaj`0ac;07Ki;nR@%v)Wc!&XXq<?}j
zlKim~jG^QgPcSYdziNVU1^KxXjn3pxpJ<FsbY8C-&Aby1@!KaFlPSI9B;y+L7f&+Y
zIM2y<TC~(ll<?Rl38zYT)Y}lx4bd8s&sBs%^%I)u=g7f*sMDfPM}p6?KWqp1^LaNJ
z7lpli?o51dqM4w5fQRgW+X+W}?;mjVbNJku_}((R?1#upWr^)k*(sA|&%R||NDP^5
mH1Au9Od&)z5MqGO@&?*|Lkyo`T#?WaW7d+D;=!3l_5T6PRdp!<

delta 56758
zcmb?^34ByV^8a+bnaL!XNhTx^NCLbW0)!g`0R<%w<q}VHy)RVM4PJoPuE&H+qJn@A
zX%G}p(5L|dK_+q;4mBtUDoW%If*T+pBD>;p{lC@k&13@X#^3Mv4<F{e?yj!Bs;jE2
ztNXourv8zN`jakAafSHLaj(;QxI>c%u4_M98>u-QPM0$=!IS7DB2Clc9SI33#6f4h
z_*9qXa=4sYf+L>d&C5iGP`pF99Dws6qr>U-Yl(@8l;rRur&eF#O41xcb9l+&YT$H|
z!yypsL?Mm@7ybZ7TD*%~D9%R?kJpJ90Suf#l#c%npVQIM>vYDG&xb;YlM={5<RR)s
zo&=!OG>4NsF5=7{&dD$w$^V_m<aH1V5JD3uo<uy_NIuOGZ?>bB844+W91bp0{izUn
z%*SX%=sik$V({=0L+-inuMZ7-YRK@vIX<8iE9Qaw?ioI0#N$s5zki6Mki2%}Q}+*j
z;6BIu<g>yL4Ili(!^0kNyi18z#G@ldAUHc3{2K@7MM`;m_~82=83F|Fke}h(54q=w
z$DbK8e8j^;9(lwuhmtKMBOZJFnFk*kJamZTLyEVffaW9fHLZ1MEY-W`o@eg+>thc*
zG~_W<aquILJbu69O-hc5eQ@}YA&yhR9}_j=$-%>)bU5PQ(uBhhiC>F+?TC1ZmWp5K
zeeoq(?_W{Z&&5#$UZJq~mA2A0`+Wnw@Rrz4ztQm!{YZCCpnuY>KZzZ*LTnLV(?*(4
zN5xe77Zr<Qv6CL#M8DGl`d*Bo&GZ_TiW9WUF5wUQ#(uL({5O@*5<BKi5n4=h#5USa
zi|AXiL3~WF(r!9Q)#7KdSbQhWP?$nT0I-YB&@$SC-;vsO+DV__?F_A?N`#kFDVcPZ
z#?vZ<$J6hkO01xNitlJI?GVNEFY&ebmVTo3Vj-OtTTy*(q=oZS+NW@yq1Ch>xDE&l
zQyD^xX_MIUSNfU0MAkE+Lad=5k$n{EyA#<yqkpK(7P57CUvF1rEmAo9LGd|l7C+Dd
z`U)7%ia*5nR7E>csehww<#Z55enDPwZ^G7+l#%A!u1o6AU9raDuO>&L?l7{tk_V4{
zi%P0pCxoap_s89X-#(sUqNpV7(JA4_wQC%@$I$%a%*up|6L!=D^~5U^rj<rgOCC#n
zR#0`RS>=7J^OB`&908{{BT@Go?fN=%b+;h`?mj-vXc=%BKSfjBeFB=%5K)H~o29;y
zv_5S1NE$&!rDk!`%MZ>3a{no=C>f5fG+P)ITpSsv9C`SiE%J;V3?dmsGsLA1Jh{Mt
zOBa4q_#BBwFCc#<tZGv~(U^;p{igx$%}O+ue4+y8tmKPCk@;=%67gHfIDZ>KCF{&3
zDL2x$pPTXZI?&E_=B4$XrJ0|ZOX@YJ37?zW>s?L9*P5+TJJ1iGmE4|s7tzde^OO1)
zyNk+!ah7?!{#9vj5UOxkpl?^B>fFb#eqj!3aE8{Dn1j;q5XZ~~=}qXPB_&^{`$%jn
z+0kf;K;-1iapE_#QP#lB<C}r&q(F;=A1y!Q=;w<wE=Fs9`Pd9)HON@^v1(M3o!+9K
z&t<ejvi#Uwn01|d55~z~VLBU+!a$B|{Iw9<%$u7|qQgtfs-|10Y_+*c?@32X%v1U^
zzQQlpIE=<dIUfGeCHVoLpxLX<iNVIG(fr^dTD{o3x7k54(j1r_&_@!+BZtO_pyt0E
z-LCsbg1!><3_seO;XiDS&+dxC)@J{W3g?-ZH&3Vh#pW%|`vTY7&0BDhpEqwtb4$!a
z&4<v5Ps~9rTGD%K&F5O&N#oX-Kep(>j|MG!^W*lG*;Kv8%y0Qf%FH!t=+&U()i2G{
zEw5@=j8_m^BF0~L>T#g6*_>Em-jg#zj5EK>3A&3`A>x#IGAF0$I0|ZdvhE(LYnef<
z59m@bVRbaJ&~YnPnY~+e1SO1U)j|AfzT0Xp8r;7%sKPwmy1>5$)Pj=Y6ODCDH>b=u
z+O(s&A4*Rr?eYwxf(w}i!ZL)O>@VV%bl^O?+RSR(kfwc7(zR`z5WkgN-mb4m_zk^<
z9(3x$oaE0i3)@$@3pOEtb;;BY?^9?>WPW<xO!>1ZFWZrvXw(`cF2HH%M&Z15jvR6X
z9Vpk4nF2YKXjJhqGLh?U-Gx4J87DZVg7Zw-wbo&@H`d|dpTrSctcWqY?T97q%oP_c
zqW#Ov$2*Uqx0jj!?A(WDZZLax>Excffg5R#=yEX?d}V&vWf~n_X<m8pH5l#JFV3SM
zKQ+%>d?Nyby0#<pQ*&h3%Q<d!R|ZJ#)-8U)B6Ok0Sh~o(uG?RzU^OGXYtm{)%C#k9
zvm?(qTnt)t`6mhPqU(KLZ$czxDzew4^zp^(q*E)psT+BW!<gbm8=&yy8Pm$}UWy<8
zp^`4$uVt<_`jY2q{jw5q=}|#rmz%%!m`f|l&FMX#@*ib>rg63c?j&h8xojk=JNvSm
zY2teG#ASNN)0osKb{t`X<&#%S)Z>g%>k$W*NIs{L@AP6u#2I5bE&*(^|K+1w)!EO+
z7mk21R;@RWU;ft)bwk%0{F3p#W(iE|w#G7%eqPH9t(Kqey_BeGmHBa>!RUbWz7L2a
z=JS2~v@8X61vIaRdlj^QJs!D3jU|Y+2VmMt?uU}9zUhLFt}sRarO02}{}C!&X|@;;
zY;lCC*Es6<4^(MWpZVB;TvT!4fD>_;Muj*06`fjd&{1$Y?M5${QHlR14?i0HC5s<j
zZ?2DrdG#%jbY_oRuWPvP!!nCxbr6E#&=ZU;D#m>0)>|omo_Xrl-n4IynS0w?bZV}-
z`?gCtlzIC_*<-93agEQT3m+NzkqOcV5srrqdeQ*ku-m_8c;k-uIQM}&2Ga3&%&vE~
z;LzQ7cFVAl1cfu#7;j++5ak+3UU+AN7N_Q}1JUTN;a$lA7V_*c<M=!49C<;3jz#a-
zG3KE=TQ%X_x*Ko?<J6sa^Ts8rYT?Jc=&s9ei5Aw!C!(b}RB6`ahG+v$?dd0jal^p0
zPzzOj+_}YT0TC@8t^4AxJG`;Qo9*wuj9dNa-4D>1dFFR_mvU&rJ<r8)Cvk0(?|mU9
zTAP7jk1nHNp83|j7txe?<~R3dg{D}2krxEzIE-oBBJ06C2pmWk12Z{gk_8tOT;17r
zz=2@|kzJD+iPQ<O5Xwk5&Nk(IN70Q;l@6l{Z>qP9ef-9dMt<mBBy(4DsDJ~f>;ONb
zDU&#541O4lpHZ-B92jq>@G}ZFn*&qq6n;j*3OO)SrG%`PC|ofo%~eU((}n~4;gljf
zg`ZKdG7c=UQ}`JLTM?U5&H;|$HmtJ)Ar;!pA&%mt4Y7d=4sZ;oY>5r*;Q+^Q%8uAT
z6$dzmQ})FMj&guwIHj5cp-AWihd7Fpj>iV_L7OUuQwlh6$_C?SG-VQ}jKL3s@iPiG
zjRWKD6n;j*X3q^FG{sKhXB4iG12gRuen!EHIWX5w;b#=AlmkU}3O}P@WgJ*yr|>fZ
zcArtsp%r!#KcjG)Ik3)7;b#=Af&&}u6n;j*_HbZ}ox)FJgE?&QUy_gWYqcFeX`VU%
zf%FyyYO<lbcn;+mIbF$V%;cGqpPw%f&0J;QJLbU$a^rZyVb+<QhGY<;t{KvfAI}eY
z`2N@oYLZ$Ls|L5*@aGxTm`tt6(G6v}AsK_9f@n<4#AGmC4Pec*MLGQ*oS1CS|GqvA
z{9*h&bN_?)G_VTMT|<LhT~#`M%-bJopB-VbV0vKpfFL9J8k_Z6>;U|#=%JQg#X}V@
z0MgwLUD7DRXdFgz9{6xj7#_|IuGQ(`tX}`Exm*c!rPJz4h;^$!G_D(0m2r%JxbfXK
zKLjB9L4f5t6_3^xpsEjd0WfKKsxw$Pdh(#JF%qSk>8@*h7EVB&-~61C4u4&e483#T
zvt{O8<6ac2%pK!8Kza2Rw8C%Kg68<Wv*3RGmKBV}Z{L?6!tVn6H`~1Ql|BgPzfvH^
zmBha~T4ao$!}F@4p3>XdjdVT5XqabAK^%0q_r|kYoH5}6{D$n`Y}4~vZ-fWF2J9u@
zyf#?`<}&m|FlVS`kiB_&5_B!ruv5@B-R*amjGp9lcY6s?)y%?YN8ctz-~Mx4$*QR#
z$}XH4$z2+KJ2%c8JiRdVV<SoqX)iW&7{y{}(3P!7KL6Q3GUZ18v99O{#_?Rpf3}~q
zR=g*eY&foUhLp-3@aV}bencRZHMwNJGnfjgD_jOzYANn|G6Y|$4!~2e6(#DSWJC1z
zVGXQ<#As*-hr`&u3^5S&E<?}bc>n7xc#S1T*D5eT1u;d5^+N(szF;T<l+h3c64t@!
zPFE|+7d*!Za}H3GM4mnAn1ERHS`i_DxOkpsBW^4=uq)|MI2nt_a1P~`6VtvMD*_Z_
zXv2b(smJ9F@F5#yt{ci}%e;Y^KBw;SH|J)fFdGk4SECfwwuaGZG(3Mr;dUfah(glX
zCDKBat7}}KKibtCcA{JH@L)~Fm1>7B3Jy(j!_LO$x<sqi0qzRB{{6i!Ua>*z7DE+u
zKc8SNIwq<m_b`fc<&bVwx1Y~}@@xL-S`xunn5YUw7ql6gq>&&yB0$Jp^AA07Rt!@x
z4gjGj6diD*2SpxgrWq*%eB^arApSaMt_A}}A0JjyAs(tUJ*{`IalI4#hp_(O+IJip
zOfcdH`mo$;r8VRqf3N{S1|fzl{IGv;X$kX#^?N%8=?(C&{tLmhzl`VuBLzCc7{vn;
zNZ@kZD9*;K>I}?0kX+9Y8&ZY_-JA)FLl4&+<DNVabw|6|!jgD?Zd9|T7FK3rFo0uB
zYPAP-_izIob^}DDCRPhW2-l#BHs~g9j^5z;NQ0QdETY%^x9F~Rj(k?dM_WzgnPRsV
zaC(BGW(6OphdG{`7xZO2bRRR=?s#~*QWxFV8`7w)?hA2jjuo4&`%uWGj-Gge-RS^A
z0r~!J;Cw#Jpg@v^Ek4`9WPrGac|mUur3K@3Jp94L0hs7`^TH?)mxqA_4Jl)l7ZXP0
zb)_^to+r51aQNFZb&?V4I8+Tu0*C^MKCW9l(}cz|5}ATLHSvEyrvG+59%)_j^mr7;
zKWYA#F^hBb_}*GKO=pBQdI9tpy?DdL&4@=mRkbdFGGt`|vWAQ?3m8EHNsQ3JJQ|iJ
z#-v(FRx34bWwfebEZkz$m&XycWlp47wYBT&Va#4&*1i5;L~Zm~YU}Z>G`+Vr2sWbV
z^x_;j+_#P-f^}V0z!L<AQgv_!lgvdwG`TuOr#>i;nb9@FG2i`wYv*tp8YVy2$`eci
zhCrg8WH|Gf$tX@ks6M(hMRQ<og4G1$ID!#|fY9J|n9bh&dZNF%%3Z?~HN$VD0Zj44
z0X{#f09LLUU9R&b1C-&tu{;#kNF%ET9$m^M7(K7c^!d;q&Apg-JXC0JAVjJ!Fr&2_
zP^Sy^mo*$o4BxgZy4@NgJnCb>c*JvuGIi=cOuGo4db$q;!#2ZuYFxQI#DS@F!`!T=
z*MHy8o@}LU{yzN*M#8y44#7lJ0WVp>IP^_MC=u-6XZKH{#r{Fo++Lq56b;c`;3t^t
z`68HRH9^T7{|gqE=5k$}ULd-GS%6P;)4E$TH!%oG>(2npMOmPc?rG}~#;2jHeOM>!
zT8L$!+mf^ikhXCQ?1u15=mRn2MqLvW>($+skmV%M3#0<4#Ua&7u$cyn4#hrDENX)F
zG*>9DEA_NO-I<rMk-!p%aYiS|L$;84KpYtRxJ=!R4oN`B0cz5W<}456^#tw^KWFvG
z9-S#8<Oftd(phTyt#0$M)I?W64h690?>!Psrhqw3s2c=0H`W$Us5ne*FipEKlR&?$
z7QzImBHAk1j!DWrO4;4Chmiyp>CaQ$Y-bx2!kh%j*3Qk=Db@^BZcV*CY;Y}}4PdH~
zHCiyTTQ7kWd-&pP`3H#8XV0FE%S(dX<56#=<$~6@1y76)q;bRg2U7UaGZ0GPXLm66
z`tM^w!GT=J7o|Qa09aV<L1p=)1{7v7OMP-HyJsX%$43HwNUIOO|FAwR3FuJ2N=ASA
z8G|Q~pjytQdXUDH;mi$Tz$`dxK;3~j4H@(lC<9i9L6J(y^Y;aTq~u|QbGWw)p(tsp
ze-fEryLe|H8UbeNGN#2uM3t>bmZ-9&IYQjYs*9kS;WfqRn1{XrXCE4jgV0Sh#;ATz
z>Fr=$0a}m260w{$C}m$2=#wJWh$AmHt)t%*q1*I~{E6s#cjA0KZHzqziGeuX96UB%
zxXize&ACfa4z~hSgms~!A`q8NS6H|hVnk%{`whR;@vsg?#Uc~6X64_(^VN?B1gsYi
z%o*N=V5+2C^VHb(nJ%Myp1(-xT|DTlyrGjZAVD%mZprARVJ<j1i!RVkr9nbkfCn;T
z;Ji;NVu6td^M~`vq0K3$7vQn?VZkG#nmf?kmAMdH=RAw^IW}oC?#)r+i;`E~T&86d
z{<sG9_2{X*kn!uOm<UEO;{3Bp?tc4b&0WUt6U}9FIwzDC@|s6CwiKGb&oSiV?@*R`
z(>u*>+%q0axvw1lwL<sgP&P9v-P4M4*l4_N9Mal=4*~5GelMDUCCMRyO3p>l+9UID
zmvv!g#j@LD%p7Na`OXuBa(ceojCQ<a4t_UPUojEjvoP+^rcn_VV{zy+;9Y^Bf1^3&
z-P@_O&^-F?!(yd*+uUcc-1}zk=kBA^xES-Tc|%i~YQXs7vB)B0CgZCxGv8}M`BTjv
z?|tRAW4!MlvLKy+bc2`M@d<@NhHPKhgr-e3uPr<PGivt_ro<^)oIch3?t|aOiIT5A
zyh@<_21PyFsf4=i&Q6|Q^UP3DPug8+t}J?omR6dB=l7$}E6oq*cj3rA^DpL5`hq)Y
zNu~MJf?k2@Z3edDxXXrOZYTCmz8OExf<Pi~$O+@rHuL)hE$QP*^UQ)CjG@QEP2!N5
zSiFMqtS`>uGX7C~NpNZ98i(QcUjh2^rtm@(+Md(v1<zxOBLiT)7d=mVD$TM*IwRV<
zs3)V)7w2&3s>Qh+8o#&??X5JwTilW%Pc0r)Zv`lpy!90xp1%7l&3jAIsJha8x}+5y
ztu*J9boeucA1i6bRZU;=AY%?KX~dy7mo(*4moJ%sHVydrN{*ZO@kK39>_uZP!?f*~
zXH@Zf=}#bDCN^CIKNJBM2<Ep+v+CoPbiC3`S=zMW32wjO_G@ar#9~%6eyue7FC8J~
znk$wz#_zVJH{iEzxQ&=+-Wu*q$12SU;T8l;ABXRxKPt`C(w=mp(!8PcQ_w`pC+*z_
zN0wpp;`NnT?#a*|y~*a$Qe7ownR7qsfww)M+=buEmrcR%6U(#AUzYV1+vMZBF{OH~
zi8t?9o~9DIiOFW+@^*Niw6cYHYI(ADcx0KGw4zzM!s|;!W5HVmm;tOTN0HV)l7=yi
zP5UR(My+TDe2rH&2R_tN`vY;OS2T@@%QEj-*-@2tv344%<ty!y;%j3YHLA>{Rn2^=
z7TD(y#w&=qXjM>q9nV`<*|{LUV(TE0HaU_DdWbOIM9k_{4Yhai+_9>QRWJ9VQRqE)
zwD+`_-n(a|%lzQeCJL~bdFazrZ9S?f%9@Lp&6Z`iAf9`3Mp>%17AO~$1>#XfhhnFu
zzN~SikL#~C0D8;nwqm(CW_7Ne?U!XPFRXLCii9@gUv3^-jn0USN^3ynt?A}_YavJ`
z$0*0cKgnFMrbR*l))@i}$zNdZTGJ9>OaftUgbR(J$z)cp$yU+azixBZTJGb`Yuk%u
z=GnDedhWWmcz<+VOmQyr({)@V54``gWNii76a0(^u<vKxF!y9-FHzr|@>wxcf8Wmo
zv}cd`*U#_fS-Jjmp6t`V;K?o*UL|<8%Z*owY;$^fyYyu|GZe}Dz4f4A@LI^>FEe+R
z=kTnGTYn>CymNhHTC>-DZhhmdFF1pf=SV%wA@Zi8wags^bB87CgCdf*M11*%$f{u}
zUImUaYQPtN)v57Ub_IM`oq&(~gVyBai8pfZ>l?1D0l?1tIRGcY8aG@*rz_2w8(OxG
zV#4P1Ie<&-iS6Sg|9<oEhD>IM2^*WyS9{G48ynFpd(Eph-o?}RgN;Mz)xD<w>xMLb
zui5%*1#;cjow+Z^e0^=Nnij=*G36p9p}wy~n!?fk{b;9P=BXgSL7DSy*lVV2YRrf`
zZVGW}i#9#Lh|@Q}jX_$v`3mmslbic<-}m|Evc}&qN>UsNoE*Dd&=H|FFzW)~tZ(jX
zyeSId!d|&m7_(bzK$?7;!Kg0%wk0FJ|J#0GS0zQ?23<|g-G{EN6_ix&@QRWX6<=v}
z18#NJ1@lAY3742|Zu-Y;h~X!ya_~F7Y9N01S3QT{!3SF4x8T4a{BA$66ThDv9FE_%
zhpxen=HCxFvG;0*s)wrIW@ggi2dp=F_gf;_oOk$Z_&t<7bp-pG<ILB8xdOjG{Bj>G
ztCt*27Q$@~_;nM08y(BRZ|`Gl&@DeU1;2Ow_N#E0Tz7nrOZ-~W@!vO*d)g+<;*;hp
zr&_oRt=FZey0}ZN*Q2LyaF<)J{Z4n!sZg)1x<K$^Z#+YZ-(b8RHvk)-co<a{@cXBm
zWG(rjcOb!V1Q4xzuEFrZ4#ozMc8(=Kn3boq2#>R;oA9IQnU?(k4rMbC&u$isY1(G4
z7fY^~d^QNioIy@Rs-r>$DuX%UOtU+==y;Z9ZaqFyWN%h{JOg2(jm5_%*%4N`Smx9M
zk5pU$drTJ7d-f`LZrpPAWw55ov-gT^ANLmblDm8-*H;#jXngOfZIQZT1z}XE6mCfp
z2y_GcH>h@DWvDkYDs~{uR&W@%u-UR5p~DCn<N2+c<9)1avmpwaw;zw$J7sfC{KZ|$
zcxQ$4HPO{c`TJ#QoM=hQ_R7jQ@VjG`;j?kDIlK4m0o2KG-*{0DS_vm7ivC(Cf6i*V
z5-t=P4PjV)2$ylHsuHY`2p31g9GVo(%d%~DG*mmy6Pp%J5Xm7J$|hljlMGvg{2@tP
zEaId$S#%TS;VYBH4Z?kNHmj-O8GaEES=R2tvwAWs<@s=T;l-=HzYwlSfkT_y+CGr;
zQ$;WT9+j87&Bk&nRUCDS>GE(xk%w{G^GUXRzLDq*SytRgG)dh&e~lx@;phql5{y01
z*fM{OtZXD8xnz8XxJ68sgEJKL8yTE`YNoiOMhv>-3z;Gd;TLyOmRy=CF2Z~ANUe#C
z%Mwi^@mFMtYpp!GT%0A~tt1a*i4l?Hzcm(@;Ju_V<5vP!UfM*A((?0jC8T?%dfC}T
zJat}7hMdq81G`ObYAQC<o+EOOF4||pOpGlHYzR~xSp&f|6pOlGQg4i>|ByVWi{9dh
zY!?veY);0u9rg+$i8lpAPSYbCy9cp}$l|qtHrqf5${7FxhIIjPP3tmwMNonDrZK@J
z3)Zqfl*_daUK0mlNrl<#kn9l@S0Gy`C>kWIg0U>-v}B~s4T?Y$RW2NIV$01Ps$jU-
zpMoM=90_}xp<C<CUbEJLeUTm*Ghv{i@2m-5k}Y~VY06>wOpbVwpTFmb+xdB8E766Y
zFSk;?ytb8iK=otm)}p0)xv90d4PCgPwRlK{8@90%dbbh1kT9x^xJFD4Z*C)232`Vq
zv7P8CJkzFQ`35H)`CWT4A$h#X%O|Eep*#IW^6?I$uQ()^b`UR#B6(Ry@luojzVwlm
z9mSB;Nr%_+niA{`=B_k6@(;_~I*CV8%d5{xC^{@FI$?ph;;{5zB)T*$QviNFt~cKD
zCndmghU@^y#-qGi-hUDNN6V^ZptH!OHHYQ>oyFMH4XU{Q7GO_20C2LixQtF!%S*e6
zfpub?+eKVKd#dGuF5-DQUM)9WEE>uDi^Vl|pf6)e?<z*dJpq0f=YJwRtE<?mbtxOm
z)0?o_XV|Y7e)CV~E-hBj;SVpx$cuI1FMEh*M1vaE>CrP_IkQ-&yyY@+L)R!91rKw;
z=2;bGs}NNPPl<+M^oJ%fMup|B%f$WeBE@vW{VoURxw57ZST&-BFdv4Ao^2k`>Dbue
zHL8(~4F_J!aNy;Y_;E%xOBVGKtUIxW`ds{&pL?^4GIPHik}IC3la+F3t{4gxMP6ly
z)>zNVrwwrKg1vH<A(}!*lVt`t_$zzmE<-#3g-Kr7Til=ZYDCjYR|-!61`_Bz^)VU7
z@0DwN3%DFt%ImKX(?Ns>ufUM6|4FvJ5=~kyuf0;Vp^ZPu=dKi)jBnbNq6MNqy%Jl4
zP>fGpDK4i8du8`NVmu@HypKY1Z(lKzChwI$^%cDsS$02#tZzTjrs+nkD=i(3_p>NB
zs)O<5L<y7nsS?8d#9&5|(O+C;my|7E=`SAS)*tIHE@C}!{pT&^H3LMURqqxu>nbss
z(_{4Z{xoH;Odlu$>8ph=xu!6vhphCSs+89a6ivFEW|ddz={_&}tVVQn#A1c-V--~=
zUfw6LV#zs2?v--}ieST0+_`SnIhFcq=R930w-1C0i#|Gy!h@3;N&_ZVI`w$}YQV*_
zms_+XnR_)Fg~~s9waOQsdbJp&iQnXb>)^hv9{s1@ATpr6NpZ23Dm&aDuC9Ymgs0yi
zMv-sBE)<?)9LK{yDV%eY5Jbm!%QiQQzxb!HkZ047v4WGU!;@|n8%0{_K?Ibpfo*l8
zT!rMYTSa|$g?bN<zg4_0+&iiPRuRs=U33&QZLhrf4$+<4FzF7_f!n_N4$+FA)pvmM
zr|*^7cZy~-d#@aDr}!r;9JzOi8{3w0-zcpeyS;4hGYS!-G?)l^*cO%Ld*!EhVFG|m
z+TM+lK)w&&4f<HMS1!I=yisoh>{3|JQ_T*yyzL(GP>ab^z<%A>@9yJkfT5GMgJG~^
z7!JqDpYIXfL!)1}ST*@P#!HqJ8@8CpD{`*{xDl_Ar6KqhBdZB+j|6>QW0aje4a01F
zjk+0eDqB6<OsgS!)TC&1DuVBYIKKs!8bN^g!!@}X?02q%4Ta#k*i56XQW1T!HtyrK
zgC`=Hd_Fc`!H1iBFJ!p|L~6*ZTw#o6P~}fb(S(%9HYvB_1ZU-(eXxfGzfr(Pg0@MS
zp(;>;NHl^+Y6rhn!4Q!660rFe)A;!{=#r6dQSIRInzA`{Mh#XDE~^dvbtDzO{&q)s
zvC}4ugWSPrqRhBYw0-!inp{34epfrVuXb>YO+Vyw8{_OD2g4A?$AD9=x!5|0G=~?#
z=xQE6)&~~cCmMAbJ2~1focMC>V0EN4Y~Tpvb-Mxb<b9&keVYLarww$O7A+baMi`%Q
zLLw(nG(p*#R&WB7E8I#VmBlJq7)K+;@D7+T&e}ow+WjKXeB2wz<?+7`*Co4wPB<hX
zQq59qWU*t09M+D~WYzuRIT}Ateq>TmwizPgAu;Dk^8wMl#_fuC`~kA<0nyQCJ6B<o
zmEqEdh{r?w=D=Gup!P1F3}TTnPnoQT!FK~x#M@S|+e4m4yi`@H?qqjUNEFLYioukN
zQ^e0nhyN>NF6V^>C+a5!%abm6bBbN1)b4{ZUXQ$jRVyDh09^xL35U@NJ}YoGlg%H*
zSuxJR*%@&RMpZ-0n^u(v{IC(B<YWjt<r|AkL4xWBdV|lbR^u}ZD~|G+br>h$3u5`~
zI$$({ytblL$DlO$;soS(4~p%L=W<>72S|Ar$SRUIzu_h)lOGnXGZe_#rf4`uwdpnN
z0IRBEr+bwbT8R5=?mXG&VKGA-3s*iYesNz^XyN7NMZNdyP)z9w(J`a2*ivuOEcGUh
z)th3(LA|;939$le$@pPV&&3|uez>?>9Fr6Hu}4-9M;(uaeIvx}B2@S_GMr|?bb{ab
zoQ*N%+cge@cSN%Cj4}LPh97H3WXwlp(WK*W#Wso&VI^Th_k6b@U@MK{EswmRpBq~n
zQB?7@ta?&>Bj(CwPl;xD?0QP<uRnLIVTfTcDY1Wq#?BV)9CKyG)2Q*baOY=4V?igD
z%R$dV%xzdMpLtf?@;~*S51)Qk48(d{4*0tW;j#YjVl^JGJ||v5$2E9fbajc5@|uxY
zR*eilJyN_O+y!s*dLo=M8po~N$G2k%UJ({!g-5u@>`;N^m&7`v!r#K*7oejrBqsa3
zB5w11&pa>%T<N`6#9KpR1Xd8F6C;5F2u9_W58MMzu*?=fL*Ag`U|>=fli_`lT3gZ%
zug(xt8G;#L;j7}R(1#piafW@5bWUb@Vhika1Q&6-CBIqqVo9Nbydm$f_&Ar{h_i;H
zxYV>!GMEz;-Y=qwWXZf;91-$!(TSEIU?F9f#YPtvQZc~^%s#D}c=+gtFrrdbvFE7B
z^&v5)YHat7${1Tpj$&LaRYUCiZwUylsS>#+C#E8iX-zTc_c*43igEJpHpDE~%~CxQ
z5R9^RdqYMTvlxJ-Kp*%P#0Ul6U&8*dFf94eNkIs9y%R<i7n6w?A1K^m$q23$jB8K?
zY~@JKo*-KK3lKV20CWt;y(aDx;$^vLqDYq`CyEZ@<uKl-AufE?WD%#i^Iu|mmA6b0
zYp~wUfZbaZg}c2W8WE=14N|1yF+_?R8`e5j!VJJZy&*SC(ZxNb1e3o)CQK8rW{y$s
z43eL}&XKr0QTW(w1lKp0ES@Hw4!K~e$8I0*^#tLK>47V*_mKcgI=BFQ@34FTuowpl
zD4kB0*iOp_fR939yVPm>02oeQvjfal-2<cnUU$O<02$+yo1x{AfOjWMfg0lqi9n)a
z8NiYVQD?a%Xci*a@G&U>X*rw38Qwe;2zR_Z7)T-McvXs>D*Md|n+M0a8BBTb!Nr9)
z|FK$y*u(xY@2SI?Qb{6fH#|Svnx73Zr0n6*up0mzmX`+OasZd^l6OrPxgEHtcuU6V
z?*uWe+!1olasAYzVPx7cT|9(g?DD3#&dL2^UR&K*&V3W3SR_l|6uO-8gNT=vZ;JYe
z`29^7$BJZ|8Cc{M$w4zjc6Vn?Z+Wer7qG#C`nb#Eqn%~<x)YrhuLDpnm?6?T^NAHS
zH4(mZ%Fzv#Z)N$0YkEAdwy}OuOKlylDIWG#@X8Z2u(pK0a>q>3s5SPpRkvgC&}c8{
z2b>H(y4YDppMXm8{I95UD=zu=Oc6{%?|Hki%Yu={UH0`%F-N%M6K{zRJS)Cf?ch^W
zGVnGmcm?u_x5dTHD>g(-qE3TgVsIJ-<*Ob2GTE)u1&<vkD6v3(`8LcIbLGLeMW&c1
z-Lpg!cR6RQmaS)rW}Ydl73Qh(FSEqebab^G_O@s(H_j3XX|edRi~@cnADRUcTPNGi
z2D;DWfZ0)W;YVk~zU3ajA5&*y`2Bapbu4Ore^;!+dO94Q3wt!L*BZSqGIMISZh(wE
z&^PZ>;+NpXVwCZFF@9idyYqd~#(kU@k`>_z??X<x$6z^)soD4g@rHYf^<Mgc$aT+E
z@8L5ah=G(krl<_+ijIy}_A8fh{3Cg1k+_7aKa#Qt_T8CsQxVJ#)gOhci^L05$G%B;
z+(L1WNV6m~7#w7S(-zR-e;0!s(Z5NHMG%ipi^WqJ`~JyRGFY1}ErmB*jcUZfFkZG8
zlC+NEWc#qVGGose_UovPqzZBWBP5exgFY9@G{pT`BvU?tc>k?Z-o8vc#B1ZV%fvF6
zL|$AjX7gfPU!is}!<VlRM}?RoJFF4~c$BUZkBcecoKHoMI=gn{YSFwdAPJxrvfbxm
zO}J>CxJ>B(eb0;>^72o`>9G3?Xfk#5b@=LXn7Qf#n*62sfuK!3yiwemzV91QU^TO8
zrKD?pv3=w4ACp@*iZA?gIgza!#u5c47kn+6T~w0=^p0Z$#=0ojmfG0d5p3EfF%Knv
zut{9(9}|V1Vj(@UN%VCe=l6->OE<$_*R+lv3IF|jn2^C2m;Hbm6v<ORh=6RdMa<9&
ze_1P+ZxunB{Y$uN3$)T&Kr5(ltX#I0O)F#N?yaERZSu<sF%gg3e-vx+XtGUI_~ycJ
zX#|aOwqK5x+II1RFM1G$Pxi?P+r=Cly^|exh%wgDJWNdJcJpM}4p?am=E>xpLQmmL
zyvd&zWaf(nRycR3Xe4N2S@@1!qKF2_MR2f5=Ea)feA-BcimYN%Rg5Plrk;xN#>Awk
z7{47OudfsXgp_Yqiq9;pjn2c`_&lsx=V8sPjkRzuV+|kME3VhlXU?)tqiE0!pwY8G
z9*(qs7QXFgv5&5*I@p_=!dj=@6cv-IV(g}<n0hM4Zi<S5`!90YO{qF4#~l#;3D0j1
zhyfPfM(5#ed>&qS`?3(SIz-{kJO}Rs2Q9n{4vNF>*^9C2IT@aFNTdmOu?ooL)k4OV
zsdpjU{3;H}-bX}bU9-vfMSNA)yp#YsDASJBiOm8${ac-Y;Zw&U0O~Sp-uSz~^07!h
zdqO-?2dtz&#8zM7W{`d>V+$VsN%H4E#M_v)WB)B4bnoM+lk(Spi`yb|_4<>dbDX<)
z6?$@_e3|G2y<lyw-sm0HkG*>R-f&%HA7^9F!ZNjK1qnDv!*v-2Yr~f~aoLA^GxzmG
z>5rqI-Fwt~_*5LO7s0x1NjyD+bz9p6nxTnLWx0>K(V1;hBvCUuwN182qE1v@6Miv?
zvP6}fkwiTJy)_B*(Mrvb`N`zsEFF`ni;bdIWc~2WWGdF&Ro_FTO_YODX^Q)VdJk8p
z(qZAA_8WVJhIiMey(}8nq|^85zp)t{{w+RrXdKH1Hl{+NENDpg(|3DiY9qRpCCsCZ
z=td5&X+#%gea@L0DGRs(JHJ{+MC|9%pFx+vze^6xpi9M3`BDb8#$!<i{e@mzB|VuG
zbkDYWx??7#xhL`aNqJQ!<+&#*k_|7*#62RH|6m)5;XA|3CytAQv4?$Xu##~YyX~4I
ztg!|UuJ5;8KiSnr{?eEpyEwX?(%XN9GOHLB5koU(en+@~>I7q;8ytYW94(DTzTSj>
zf^p*MrnI0AS_}8qsZi7bBt1dm-Qtcx!o>sf#UR0nNq!ono>aYEo(@tQ1Y0$ufvu}|
zUIG0+4veRrgWu!SF)|#{Gh8@*h)!@BZulz-|2BEF87yy$o6%*kLg0N_ofEgbIrRo?
zVhc=<j&r{^U@_;LjmVp5Y$`0{9tJl=3D;$|bvTUNYhkt2uyxAYADaqg7o0C3Jnzn-
zY5Y6^$9{e`fbTdzd$yuCpjLj{irV7=$@d5zkF}<*c+6{!lE=xa)^y@RhKOTr=r&Je
zB`a@iOT9unreZ}3TLH+Cjj@$AL0;5GOsPnXx0b~*mWp@){LJvmxFFPqi*cAEa1#P@
z#97PW=o%iUn~)=F+u%JNO{TP?4xM853}8n+*QVitl?qtTT?~JPp}ed;T@SB-*V=>d
z?d|&S+Y|5LcY2O4>`#!}fm$JbVFx$~ywrhmtoMs*d(VZBbij2(^nQZ*>(+q$xf69u
z;)Sg<AVB?i@yPL=sYfp?l(6XFn@5y~v=6>{&3V3H?Z_ubU^3Ly+7UT$O$W#df-dHK
ziZnhE4H_n3HUJvg6cQ|bfdtOdVf`XHq18d~;j`UnnCMWmqr?XotQ{rxY|*fKi-!qS
zM*#yMs119AY1Sq5rsz<03{1-QdC`m$(a?Fh3YeRn3|qN2kHuI-bM1+S&dYUFB}wFJ
zE2s3J7UB!Jya(uWmORsgnu9B5_oSX;wjA7(?h|jxbv>ysA`>s8ix7GFWz<EK%Mq8+
z2ADf?FUQ?VFU!k&(d~Fl??uDHU*S3jkz#E~LlcecUWYxov{r-%T|vj{l611)RWwL0
z=}Y(3)ydagK_80nuKtAG%sOnez`3Ljm~fA4A#vnQSJUrxK+0FIM-7)>Q+Ex4@}fH1
z3v6}OP2P0_UDY6e+!`f(A&s${@VB7rCEWLONUpqrnj{s}q#-VR;0C%$B%NLxIW(SR
zRGbbEype7e*~b@JmTI512IO;j#wo;EJE9)Un!<VE%E6=w@r_*n7cj7*sW(#^0-f%s
z2GBs--V6r1E!^T38o&z46Sq<mJSN@>QYw;5Z>5rCsP2)1Qw*r@&)$aXuP~!;zJo@=
z?DgXvR?c2|bRFl+qjqxkT{Jl@CSRP<miHKtxzF9Wf2^(%X?ibR;;+E^(Kdu68JlOX
z3txRB{pJ5pgNMsy_tUul*6M8euOT$iUx?Xd*8xo*yH5V?Hfj<sd63{4^Itk(Ra#8O
zNZZGT2M_%dZSV0Y-2>?|<57(6IC<<*`Ub9C>mGwxf_K8f$LKb;ZuEH^B(v!!`OxDO
zr0;){uRc!C(YHTI&l41gy5K?uVgoX(5fBuhGFBt{JVDK|qz*sw1Y!641TXX}q;ohp
z)yv^o!|8suacWP}RdveWp-<6usn$Lh4x|~_(6V;A<i@9{VdTOSS^X51;m#Mi;Av`*
zb84<ycBy?XaOs*YB8pt=!cqI?$m*wQw8)oFJVXDkOUW;ImTncf|D9hj=lbsu^2_I_
zQ>g4S2#<l8IJ8Md7zf4psXduPvGLonS$3iL_7{#$zi>2+edi;Qe}A5Q4Py(_V!-6A
z=P_T))FU|xWYte@f1a|%x~VTvd$<z9=yp<ed4W2~W`C#tpi^6bul&0b#C*&^f?V1o
zg#~!#1snq5sOrE86GKkuKmouhL0<SA)jvmq-}eGeu4B^g#dQPCR$$W#a`k2yizj_h
z<}iL>Qz4G@=X0P6Kj3by@@YA|Z}#UyuB?`~kE9^XJTHvIngO&~Jd#GR=UVeopiw-p
z9tEWg&pi8CFp93=@WxS;&d;AmL6^rfcQmz(pK`c2+~X3*In6nx0rTi*E;)5H-Oysb
zy-#hcUXx`lO>C+il)f=^<s~uuMZ8rI)xxl`0=Mp%-4AT<tIdQNoE>{9@|7`^-D8d&
zA}D2Q3p=XV`P`P?_C7;+p|?eLL`pcq2LuPkP{;HF4q3Y)ykuq_Qh9aUFq!(vXU0-P
zD%=&GJeIl(cad^+k(*wk2O!S7jKj#zlXs1S$g7sq$59(zSA9N?I*BvUVDkbRfuWjS
z00CPh_ZQF%wjg82J2m{q%QT@*rkwjKGAd$fB|m-@D}c#z=d08VQSh8%-%b!owwykm
z>Ss(=TZ?|{0;^glCS>_|`UOsfr4uMq5T^R~uh9c>%own-EORH)by3zabt1jd^CfKJ
zs~x63%IhHF<G|Z&YDi*+j8*BHA;SpCiDRhgT``^?dd)7M@|aLtXKLq+2h8@S;GT~T
z9Ja0y9M6@o)OQ>aVM=(}u9p0165Wy><4+SAHy%cbaT^jUE5_PVWyZYt3<0b!vFsz|
zg7sBw;$|xmR$pOkiB0%XC8(96O57fsxF;spzSx8VDj~#HWOPhy$}yEvgYS53;veTE
zo{UY*U&QsV$vFz)XyeA6llU?xh9XUW%}RA**{W(}Up9v|4Ekk;mFSKnzRy`XC!9Zu
ztTcO_Ea19q{Jv}byKeTkP#4}o-$y>R^|zGs@#ZG(gIS^SC0o7+LAFjij5Uj7Z<8Lf
zy*t{nsqjaWI-KX%kv@ga_3OB43M7Ow9KzClj%NmBh4ShE`?LHgP*g3i5YUgx#gXa_
z^v7mN%m0G2$NFC=P)@XbMex8j4hl__&Nt|G&&FTZT8=&szCkTpZRU{WNaeAJ^9zo#
zcX&~ut#(i@eS>;**;$jwTZcbIg4SN?n8+r$8lnT7m;^$`UTFi_V=C3<)f?VD73;pH
z=Wcppg@kzlVLI(gD5e#%<uq7t4$1n{X;yLp_Jy!;>q=QrRZo@4wbQAO*dgQJq#H${
zyz5P@MP^|Wj@mRTTx1xDPY%co3e?+;F2jQ$oeSluH>pvkm8=uww@Qfx=s1HKrN#nS
z85hY;vnaz`xM($;bzHpUER>^W(48oF_Y4}?<#=gKiO%8C60P`}qGD5Iry1bW$4k{S
zH5O8p$q6Xacf2%OCZfKaNq5lk#d6OK%8}Q-MZt`jD`JX<ojTIknJeV!H&Fndsv!HB
zYQbAoQU!4WH*V&NXhAcj|82SxH-cK_OnsYzjizjgDJQ0hQ{*>qQzM$P#VW>r*0aE4
zikTui&Z123lr7OxrpQ}np_GFgxRjvWI*b0OLx+<`W|J;IDblj!tM5>=8&AE8N%D<4
zQH=deK2eO;*FI5<Td3?4#hY>b*m9DoIZ-Tligf{bVAAB^F%uL#2Yx+E<gj<CS>}$H
z*j}Cuw#aLywgAY+F=F^@z`N(VcSuh={@yxPfM8lk(wqWUKp4m0lcV3EHiO2$jH-3z
zv(9zbY#m_#WX%Zp>%Bw4|5~+$?^1gz_(AS|m-aV3h3iD^LmV#di{l8layYs<usLp2
z@0LH!rIu87KzirVyG`~SxPnj5;BJK+Dma99>?w2Kv}Iex0l9G=jmrI>drE;Hu}cb@
zU5wJLa^ic`u<Pcn;21FP!-|8Q=oH~lhkzO45T|6srog9E<sDlgcOq}r+ZBND#zMf2
zL_vI5AyeK5_LU5Qjf)!WI76r)HggK@{-{X-gH<WJD&#$!xB5KnP$(3{iSzP8vrs87
z{V3-nZ`PC_&n=g)OyyR+|D&vA?5i2#a*m6%8zwddah6kXK}t;uTwzp-xlMK`MBXp9
z0itaz1emXa_>EJtV^d%#Rw;73d;xj0=4}T=tsa5qr65YT%SC{oE!*W+h18v<ZI!MM
zsIY7C56ICCiur7Qslty%qjjv0e)<4Q-aYc259#qb7VqH>AHk^PF2Kqew)wvnk^ce$
zflVGP5GpKzFl|2NL5&^oDdE7i3@o5q@c8sotZC-Sw-?Zj85`!tuqmvHBJ6MjcEXw8
z+Rs!AE`~pG0<*ylbE6DugM4}+7!-6*W>DdOEu=?zG5^3K+{=LD#BidAXvVo5|A!(d
zd=ARh-R&G+wSL|>vP`a7M1ui7b1_y?xr-^){f#>9Emyq?!^vd%>|&)7Bl%T8<&;nd
zZ3}YUUP1w+K3@WxoQlqpt4d&u*(U#4LN_ICXB?~&RH58a@|Gp4j8B#z_s__EXbIt*
zwoLq(I;b<jS@M>T>3;3|`Mu@Jk112VZ2wr9Wa}@b2UYmRrC3!n#5+r|Lf$4%E`_!J
zWjP>Bow^iQmsuI`vcVl0a04-*mGD(Zuot-D8-Z;EfeZF(Ywioe)D5Mld=iwNQWy%h
z$wx}5163`QZ<SII)hjDiO-F3j)K9RYJGoGH{)Cz(O(u4Q;Q_}TGsW@&I}T-8ajzE3
zHxLI5pL{~N#x~lw?qpc(FLi)Wu%AIj^+I{mGF8$u%doQ9CI>Ia7<{&j+9B(2%P@>8
zszbt2Y-_=3>^{nscP^t0q<*|y_51ea#OKn~Lgm^O)RFcrl=&;7RTON&HTEx*i|ja5
z(Te+dq1=l&U~;d-ip#cwk6THNn$*#2t5y;p>;7dWN}en)Uj-sjp)C2gRn%HX-=Gli
zWls>C8!QE$yl5<B5C6ly$l6sj_JUI*ao&%72?Q(mLM~W9nX<=f^h%L@bTvJVGWM;e
zOWSPYW9aedclZE}5;i$&5pw>CQ~9b99~0exHFN{=%~%7XJ2I+FZd?O;m@I!;qq?sC
zTD948|60gV1*FU4Yl)AGby-K9d)6WqNCp%Ii%_JXV_c9I1tsPAAFiEr1|_|_jykrs
zXi~FiQmajqnoX1Fn?(PS@ac6_LH)O!bFub$CLZot+;f>{d{tZ)5thWlavj39uq0!J
zY+O#c&Die?9S^DKH})XiXoKqFs?N>)UW6YQFY?Q&r~55%5@cFat~NB!l%vmA%Z}?6
z=el-1*5;qeaqB_Yvt{9WY9-^#A|{x2GE}BW=-o1=UcRb8{#r)uGI_P^L|N(*^4c9K
zH?61nu+>iXX>6;V@+HmhQjJ5jSPZBY1iyf2;l<#@e4Vrr>a}t>p3QH{;dlohxjii>
zZJ<%|_pj)-|GTLSsJ8##v3#_V-jDhsCt90WwlDHSU(>TWwx1+)uX9%uwIgKQCc4*M
z#qB*QAKe7@a9mE>L@oX0(axw)ogu&2MAuUF2ARH@n)y#eQwzT4u98=61~GpsU)c=d
zRV_c=4D%dJD3zPBPjV(Um?{T+Lj_d0Mt=7VT>*xg{w?*x<DPG6DlOS9fB%;FT7K(*
z)7bAIn|AD$v%aIrzFPDuFWW*7pYK>*hZO$fd)S7L%iDgSS1-+nRh}2MWW-^glgYXO
zG5%?w<MU=h?JI#~ESfRUduyW^&zkU`LDOU_bJOsnTPZ<^y%Nv0;T}IiGJs#r+NLJN
z%54CdE4|w(CnLhISRK-avVSLQ0UE9Wl-KTL!NzBbyC;-0uW;!O|A(?{C+5-1vT`T%
z0mX84dD|{Z);5A?4Be%;(}Z1$JHY~_%kOqU62Ka@n{cs*Y`>d$TN>6*4$a)H*f8L-
z<bmCkUfYf-eR~L-$!y5Vk}vM1I5}dE63!p)L5;R@jWkuG>OHDPzDiXi$mdq_wMuep
z&;g{ZR5kjfQdwE|R>Fc%Yck8GdutWqmpAR8Q}VUFv<HrkkN-rY2XElB^X&3v?7_uL
zMwW4k?_c822tavvLo`=20H01bc0@tPN8cdCjhP%$j$uX7cmY|mLdDA)_t9frYv-tn
z9MLyU@S7^0a}=<NQDK^985@7!M_n4M64-SW_~(L60(ZWlVov`mY3#?I(kglLehk4l
zIc7i105}@79~vA^4DYAGP3Qh-@abhYw%~cY)Y#{E1UEgN)rJ}3$qqPxaO2O|;+iW9
ze?}+HlVAQ!J8XYUS@aJYm{!hbF4?UEg<lUbK*pXuGO>zU5T2c@Fy~-DUQk8N<@y8k
z(f^%2Ejb8nswjNqARQ87S9n`BZRFjt!XtEfr~-$3)bbEMw#^)djx#Gzm~gr%FX;B~
zhQffm1_Md_@CTBO2sE)|#|Wvb!>nVpumE9vm1WA>y>lDmdBA7!0CPU|#T8>S-t^>d
zn!_mPw>C+51twP0_)g3m_6pbVFv`HxTB%Fd6eND+q+jUX<kCpI4!F&8<k??nmwTGU
z_kKEx7VZge`W2#yc6=+3AEVB<p0^m}lgm#0J1+t8|D9){DU?eXFqYkN^0T6YT<{wu
z)v<_>+kT_|RQjFFK2DcX>G$&9<J2o_Nkx=Cv0<d7W;M?I{J?Z7mmjC!BIih!{F7Xw
z!50@I)h{ek{X*{h7tLx=ej$)@3#42w_?_;`C}cNQH7QEZd6Ugg(CgP0{my)tnHl>M
zf-r4C?lipri|&%HKY;W2+5fLN_cP8NZ!x3)|5ne>{!K5@iG%W*lkodmS1pI1q)Srs
z4>39Cpc9}+@hzVKSY-qJglBLC0I>QbqgS3$#P7%PqZXiSP{EfD4#}KT`0P^A5xMjf
z-QX@h0+BXR`c6|p14~k|hW-mKP0$QWPRWl>W4&t$+%$RMG|lf<CqdRtvfl~el$WPy
z>GJp)dglMmPChzIZ~ULJypgXB5o_M~S=$T^B`mZ6Ybe`<X0qP#IBA!%s__wN9cbMK
zxr4N}_0~iAgXAK<=3@yff*;5XP3sPadaql{WT~TRJ=|sg0F+PeAuXrgMt*14G2|%5
z`*}HfIkgT(DVwqR2V;iYEBPv42WEK)E;eq%(ckCDfc#j3bg)Sd@T<kkiutX0o?PhE
zx-=^VJF_rw9)p9(udu0rv0{#NyR^<7R#<?RMqXwGaNRGy#-reva>P(vvcsoJP?&t!
zrM1zjPpy?ZNo!N@*Hdewy|4rC=e3D@K`S4<&H~>!8dbDAtrYJU2G1|B!N(TVfFB)q
zVQ^hm#c2&8KZHk1!=r&m>j$m=ZjaLHpYmv<#2R_RqlKyJceyBDOa0#*T<j6A<;t!J
zT9<yaYfW`53~(~wf5VFwC1{V(zD2TWqSjXIl2<2c6aF_9OY~~b*2VAVc(oqrn4Mnj
zMLh2GX<fwj$f~E%r~QV|%p~m{_T0=(*8Xw*)-yb&ywL;2EPC)v?domgB<m<1lE&CO
z8Y<}<PO^4J)Vdq4cpQU`Ci#qCd#A2Sc1zJ7s0-$kKLOLDp4L@tk;Ch0eRy-Do_1GV
zSUaa`H`fL8eyVmuT`&#Ov|iAtZ^ol8(2_Lm1JLN428u@a)Yk@S9)E23rgKuAwNiE2
zCtbU$u0rOgYuD5T)3Bj7T09~}1FeJGgWG=3FD6YcY^Zgu3lGXl|5JdEHPTvR3u<~J
z^wli+V<W9!U8r|w0`-JUt;?SP9QY?-(&ar_bt7AprDgKnHeXxM@S!a5n7XhBnrI!d
z&K=Z5>yI|hXrf&tW`)0QqHV!#S<LS%WTCEQ`H!o2)<d`OTeaMxYyU{!asbky4Yc<}
z7*Y5={~!_%g})7G1BG7wGv`Mh_#X4>ATPkDwD~&<xQfY`QWd_enKqBwpQu`cJ!Ey?
zXa_LxHM7;}^*?IIemh>p{<}*0TWD!FpRAqwMWISPRXcWrh3Rzd*l%Zxez;rUj1`Lw
z1Gll3t!&2GD*5*oT9?KZNU^HzG5(2<0Q&huFRT~(jN$|Gs}@?OdlK4;o~dpDeu%i+
zTWYOoN|k)6rIy=pwo0>F9cKtA<V#dccvnl!6z+U0@JuUhqG(tZEy@WvhAmey;U;ag
zYlOQ{1>~@{+HLMq>wR-utzpAy(QMemR@T8WDrRas?J-{Bw$mmw*oJintcYyE#S>e*
zc}6)FrS;lt*{mIPZ?D~kH9A1s$d&CO-E0#Dj(D(AsIDX6Ma72QQtJS5G#75WTCvzC
zyLHsqne^`+wQR9L&ay&#IaDa)I;pg)tjB~-S{9>aj}p166B<+$_FkmL3GZesYGC2=
z!kYG@Y}#4N)Y(JZI@*W_uU=rjn0sI?D|djJi!Sc0waVCmgWxf%BVJ({`}lD9EcsSv
ztp#M}y3Sgl<x(=Tan4dX5;%?Q3rRXCG}Y4EMZ3Gzp97vWbDd1;qV<(OcF`KtL!KNI
zpuV-`#5FXwwyBLdxmJE~u{KENUHqS+=){b0;l-L;Q2r5F+*M0Y|AC!`(Nx<6!m9>+
z0O+tvq#uNATcq_)EPapF^#XW;yeE(TTQgD-uDvITgpEa7n?WmB0qMnilGuCV-BKLy
zt-V{S4hE|Gmrnuq+&xLBwOfkou32@*HGJdb>XX_q@t#~UU*ijyW#xP=wXwB93OdKN
z1E>phu0VZs>k7R4H_DU++I>{|o~%BlT>@*g)<LY4yA}XTk-UDP_PKkux@kjZ6>AS#
z*DK>}Fb=_@G`2QX$Ty0$D!{(DNIT#zwqPG!tl5_~^MM8&y^6pdTCD94#rSpcMfZzq
z+`KsWc_au|EbQ}n489@9atzVfamW*U2M!0n;&gSXh&mMSF?MhSd>?FQE{}1LBjBoq
zJ5u1xm4!UfBmVH_g1;9)&=yuo<j^Hr(@@lj2t(qoIpUA)KTphcG_avWbrg2r@WfuT
zgLA>L7v(r@7bTpGt~s>NCtN(S7v+EhxN!zJ9RIOKLY$D-k#np}ouKuQ8<uMGFfMOj
z;cO<~2x~aQG1ckR<<7A7xo;*nF9r9b;9$zzvbYpyjX~zyOSQ}{)(~Oj>s~kMDSQUa
z>o1i4e`sm4Y@${fD*AId(?C%=ew=!mT0$rOG>`%z@nSRFUo|w?INO02m|8Nj9eM@;
z0u2!^)`kW>h~Nvx15FWe)G^fhxCx(vgQ>``=^-D^#RQ$!ryF#B=*I8t*y8f1gT-g(
z!G3jzGEpEY+kmj(rA#gZ=J3Z9*xHrAr&aL433)a<;BvG)K2*XVV_<%ZAlrKa8jho{
za|B#ku7RsRwOozyXcUN(liQGvPeG`3buv4kd~-EDsV}HQ12WvFf{y?I9P6I|uRdT5
z2M|ibE{ZUE4PyrtqbcI>xQFZGG~Bo!emEldT#IE80W8+m!%&j@$>A!;6Z~}&zMj$>
zLJY%dHmuXA_ax}#sACuxp+&P<P)<Pcwgg{BfMzG^kcq?iqEmjrJQyImv3QL~a~U>%
zXwr>w{AYc$JN6e*SW$m7+1XHNQtWUx4pB1N7Oy7`XN2|i1Or|!_)rASyXgLbC<u?f
zI1l4vSsZVdrN^OItE}w~IA>@+C(`+vRa8_A@TKs`q0hnao<@f@7@CynNQ?Z5$cuW0
z($WY%oIuEV+x7J&@y*6o(AtN<Jt;H{H%q|_!G_v{p726(Q6;Le^Wy^_v7=`Xn;J#l
zeu|8p_q?$SVeq_>!Lvct(0SF+aRxPXeEP*39XSTPz__VA!}+2iHCi}=ifNb_(9m^}
z$~Wr^FIImdlca(QfjU$Z92aZ?UpOq(r!yi=_)p}=kT_OlHTFLepQ1*ly+{i}7bZQ%
zrmD_;&i#zhbQuXllbrbM36A+7z-{aYic~FQW)4jXR}t`CCV0b55{9E6ZeM@{22ikH
zCpsa9e$ao-`uW^kKF?LF6Wk~!b{x6!F|+W$j%4gWT7K;4vY4U7xms%|>!IlAP=<IG
zT6nbp`{VG0;~E1fIxoFEDeEyo)C?}<hf_5NkIVZ76Eo2UZYX4jL-$Ad5+5mK6+BJF
zs=mbF>jX}i2A)G9e6EezPMpPd;uOE(F}6nCX)_)E_79j2q=LnCh?$PYti@@MIv`bJ
zHAS}!ujrOp7&n#ytx>0%b|FtlF&vf20^(6e>47*5g$u02a1HP|?D^~h=TC~)Y=*+>
zQ<MzYnG|1`$qV?|tCqhC!JmDJW>v_*3^a=wI3s_WygFA)#hogc`uKJZSRGz5zwyp2
z7c$jl-@LHZu)eKR69!u_#M1!`1cqWLz7@%n3|tIZ;`<H<kuvSU-<%KYDR!j3e*=DI
zNfEF$TZ;JajSd$+*~M&3F+C4vBoAd!4Up3sARZVHh`JAg>4u_G!N~)J+g&09#IgYO
zQNlq!_Yq}=aEgKBKqovTDz{B;HA4b?F(Lrped&jpk%s2rdof&e5`r`|fZ8Zp;>+C|
zfu3-~41c@MnmkDC4{1}wF|4X(qHg!H7_uvc?oup+J6h&{L=8i#UMd=-g6O!KdI4EX
zy@J;5IN)VKfqQW9bu;WGsywP^6b_M>7)ih<UqAtb!GV{t9tZiy7nUU0Bg!)&0V9OD
z;EEB!787TRu;v0jucibrlk|B47;}LkEe;6CT62Mn#|MIxc-VL@FrbFYVR&!`HqX)l
zFx|~9*ZVOa)HIJYFafY=U=)<;gRJRbPl`kXp8)ib3x7g$VoqS!5RB2Od%+Db{k?j!
zy4^dOsXG$za`!gk;BX^^<Y9S%MobXiYdHpz*nx7A@!yN<xxq{uskJ+%m!>Eg2Q*Q4
zkfw7WPfn(C2Z)v|%BFsB%Lg)tPO@?wF8FNF3;GvY56a=i4or2JEm-eZK*)!VDdH26
z%4z_OD=lDsoD2LL>>LCLZA?ukE`{%9oEe3-SY=dHvsMBgh(8o!!H!q3ZFp&pDA=YG
zj8jnjtb2<w+tlPFrRg;c^8S=AXLi9SstBLu!D0#-a9-IuFG{-3hfbU7^|&2P`CcBj
z58&$OY;=R_8hrf56ZEk&J3bnS4pa&rBE9(Lp!&oOmJGf5Y99V3Wg4RR6&H@Rt$FRP
zUawHm&{TQaH3EVAU`Rm<?xYShwQ>dQuR{isP*9vD+(`EYoRq6{Pp|CIM{C}JR0`{x
zaiIECK7Ji=bKg7lWH2F2TW2iU%gsNFM#+lCnbeh%smT*Ri$I1g!Q7a2OvrBZj>Xh9
z+4CQwVL-)zgDdiIg0z7k02+(~&1)#vEdzbE_Ho=VFw@JM`)a-K#(Ca;0ZSzY!KU(&
zh)76J?1ME-u-|YfhWPqtR~%2p6CVRChs!s{#bcDiB_5J}sJ|_UzAt1T)HFk@LEx7E
z>I>SduO|jF4H5A2mAHV<V^xtGk1q!XG>tnZRgGWmuE1JYIfSzaQ2k|d0Hz0U0KT%y
zR>8q+(I95Faf-1<q#?7q;einNw8a9rzW~WgGjw1gP^7Z#aN(LP6kzEhgzqmw3t(1`
z2cwND0zj*{V4}q&czwr85R5^fGps%FP(+9X++oGb4_<SA5E9pblHLBP_&OxQiy;>|
zIE~LzfDGKYUCc-rfah+<Fk`i2sF5*XcmNE7Bl_wDS*G)m3>2VokMK-R<{4?%7ltxb
zYRtDvvCp7kgCD!mSk83~VV0<`LFwJJ**LnahRuVspm?3F;JW8w$tZ^T0hNPMMz!%Q
z7m(M~7bn?0Mk)IXFzv%Nl5e@<^eiYbc%<=;x(A+O{u5{nA{wISjyfL63u2sjp2po}
z-8dG9<)MWtf<z54&?ApkWLk8-W?^h<#p_Adq#JHMcse1yXE07a{sFi}61YVJ^bf`Y
zkm_`KeXOCuEdZrMzf$wOFU+9aorudu<E#VfF8-)2KB;Hmi=g}wJ(u-S+4=~9SwRXa
zY>*#}jg@<FhQ4?isa}S|?2wWe;`Irn@z5X}I_je@G5GcIA2)UfTsSqQ$QvvQw1=6H
z7p$jrBfTDT?gYIab8b9r&h69d#i%5l$pTBXz!GiM1>a?efQ5K%hylWuEN6z`#m5v;
z8LYg~)|;Sz;&CgK@&tVT)hGb}#rmGFE&!FjUK7G+Re=Sw8WN8`CpnW>=<!&gTZE$d
z?_fN$@hKEOH>or!JU{>;Jq63dc@`!<%Y`FbYRSkVFcu?&;3n+zFe-%gAf~}4;(;4o
zp&1`r`06Qq>THpZdkHM$MC40!HgbqJt}kaW>cwJL=<GV9i%?5zvUrU+?o9L&I#YLn
z{Ja4-I1v;uhmpe{^d_EbJYO-W{2|(Nfi8;$3PqrJLbG~dJU=W53L0ulY?ofYZ%}9L
zr;(nSr`PAt8==sc0xhNADi9tlTp+G<9~#6eGD!T*ULfX(Knf@d%)tjdTw^1D)EEzL
zTZR)*Fn}s!!Uuy!;pW+^X~a-Hi0Q)V0j%peB@j&s3?F9Xj~q4TS^I&t9GVR08PZem
z9d8J5bP3NgFDsntV@&9dm<reGp^&Pv)wTb*ndq_$G*h!0S|3c3)gskMo;sjK)kqX-
zHG<vL)IK-2B*j?y@8btFv@r#3Oyfqn?MAxoB>C*SqHzd#xiu(-ziy2+9=8T+cuZ?h
zFQ(_(<IU>|5C;^C3#g?^en&J?7DSLoHPV^|ksI=v$1D`lMp-<u%sy9$GmuszV*svX
zi~=8y=CX_djaq#Rk#P2GR7#*d4bbWjA#CtX8I~^~We_krIgy2?vE9)xG~A+{1_}jw
zSAFEt3qyJnKzjpC3;{lus5h~$ko022n}COUtt%ukb99U2DTWJgC;t)D7hfDuUkTKk
z@TVSBNJj;kIb5%FxHOx$YKC+^OZ7wWH8dc_(0H4frh%DajO$0VruaY#lmp(50vFAL
zrU1p$7HB*;N_=(fM*Z=IZ^mAUX<q?e=dmRm3%FLK2bv*9@n^mc(4#l&rd^MiLM_Cg
zxqKZ7Ym5Nx9t#SEk3nbGh(=r+jSS39Eyj02;fUpi)hT-b*EAy2&;?oGo_NFv#t`=z
zOGeF-jOYlKjNk!WAGakKfhLLsfb4*gWwj=d#ES<Yu*ZT4*<+6dI*|?0Y2f*=+A>>V
z4LH@Ai>b;AqLRcRTp@Zrf8vYp6}^dtow}MOo+V$3l6>(j`QmYH3gl=#m>2PNP1HdR
zR;u;+SmeADGSe1+TA$%+Etf<0{t0yKl5!qC{<LN?hz5uo0>@Y-PSG;f6D+pLLes$F
z(kgTWUL4nECb?ie5WJi~#+*o_vQb-ll6OQ|m=6uc+f7X2a1vI=unrrz9tJ`maz2Gy
zn~<q=1|Y>(LhQDt<C6-I^1!SI6RhsaQW~n}9|V|O@N?7x5+Ok`6;*XeL#z*Z*m1>@
z>emD=ly9eT<63SmFoaC1#Nh+*xr~H9u(+bY;rKi>c^hE*Gec8C6==NYpivdJv#a4r
ziz2YTFO3g8YWPNJ1PS&t&qEU8@;W|Zx4xz>7+TgWRBiGG`fwIZsZ6Yw1)X{-E13{y
zTsyuk)onK~j+@7;Y0ws|o!p`J*N4$Od<+I1%BhNYQoxs*Ctj4O<Cb+EV5awmiu%<C
z5ce}hXo@VF0-ZxSlZn4lhHSqNUO4z%3J*$jYR9bAbkNWFieb9?G&HM(xN%R_##RZ1
zp3Zzn)dZjIjbiMMS=7LePO@1NqEcWw;%eds*a7%9C4^H02E>J7mO7^vG3XdfJ7k6(
zlk|k3ORXg+H>6-{Ry1sr!2%-IhQY#6nPhmQfbDs_5{C@~1pzX~hQS&UY#8_uH<Sxr
z`Y~X{o(D#+!fbHCHD6fJVETAPPYfonV0b9-0Ar{TGQh5cOgzh^;c5h|g-imLa4c$M
z{l}d-*eZDHKCM~E32TP3#^8!_b!|EN0%{$`jZN`NFN;ZrwO+|_B)4M&F}P4N_@oAl
z6q|wY53(wD!K-YZO3_kgX}8@+TqdNd3%ZT9%u}7@<hHZ>GK)=ss!rlPnBhuoRED0K
zPI9A@5<$sW`dXb5?Gw;4EI+Y*0%RBNlWyn~9%61Y9-uff^uG8})=^$gps85XDccM;
z5MkIlopR&-s`FUt#TrO7HWG91aNoK3HJVDe5nfp=RNq1cwtA1JVQm6~d}lp54%C*)
z-#1tN%6*H%F(t7Dlr8wrVUF&e(n>g-4*aQ~IIJ7>fD?4gM0HNR<wyUox+?*XqS)3w
zUDXN6B%wnRvXV>|ke#r|5(LvAyCMprD7&n(1q8$kIsu|AA_N2~U=WZkXaw%N=qLmU
ziW;w=@re*6NW_Q;5rPDb3fK3a>gi^Ppxp1h@4MfN9;!}lT~l@HoKvT^QLHK2+pZ8@
zQI8$(G~bkWg?sCTSuq94=URPI%j%m^()L9^5~<7(d7mG$NnOTE0;mQJ3vZW$Ws<4V
zog~-I;2(~Oa*W-}l30;OjsV1F$XFk$zP<;EK%_O&X*BIYVg<v>`sE;l#1OO<RR=R5
zbL=96BvLnQ0*RVz(SM6lsVAj9g3JSWM&hP~S{Df=q1MGr#vIKSp@xA_$H?JJ(|=eV
z!G%rQMN-=iVg1m$HHNQ6BSfskLx@;?|8oV9VN6c2K%NC-SktCB(+4u7Fp#1TQILt&
z%jGPBc8c(^AZTYW*<XAqL^k6ztnq`GsYQvdn!#!$M~qKWkcT&^M*57E6z0-tpe|Gx
zA>bI~t6^>erzTTV7$mQoR+ca~3A-oOv^vQvzAc^tf}-VH+dgkm7Lh^%WHL1vyu&aj
zxJFpgoRfrQQ0ffCg0K)9@W=M1gzjn6Kv3Q3&PXy|QZqSW)C(~ykHKXU6JA<`5QPOC
zTpNUC^$ZMMF4(<ESC$*H{9S=C6oEeldZ+&W*XH!ZJ7GG2N^d5DgVu3V^JsRe-js@F
z#kAsb=Gv?ncre{S>pwwnkB>p7@+6ok`(mO1Kk1AiCM`r#c_Ek%MB+;!iILvvK%_Yx
z2tnl{T}W(QZC=YwPpEsXAb+sMcohU`QGo{LV^QG{#<(*OT}Ol5I|(rDGp>-fR6|!}
zTlEe&z(^d!?4JmO4p}W>6w;h@V<a`L8^a1lLu$bQQ+JUqh?gwAEf`?8jocOhwTevt
zG7%gveK9+c-GHP7l~@gk(joM5r=i(o^6Gs@VjS8Esw5gKjtWhT^EOu8wd?oe@cYp4
z<_-KP#XE<&zNJzzt@E)xUEfkVS_*wGTS_-u3hY)YKx9XA<BfJ#Tw6624$!7PO{Ig-
z@CP|XeM$<~Ld=zdpl|un{w-7Of<q@HNS)fnU^mA|B>Mcz-TK(>fjuQrIyRhPQ;Crj
zL)+XGDRJP%wk#K%AlyYt@{pzm3Yqca14#V<^L05ySvMXlHnmYBVXW|mnLkf1Na($i
z6m*r-g{zBcZdA`D=V~#S=EzE7pPnk4`4*~L4;1dgKPbiA#Bw^t5$;ZwTUa7e6w&7l
z>)_1Eqpe*z*dd=MmYrd(A}D}{1{soY<TMv3wp1NGgWZNXd19kK$D8)zHJBW*Ln`qs
zJLs1wU$qzK&N94_D;_+@et^@h0(+;j&6wp*?%g{@3rO?|h<Be=?I2!X9Q%PCbX0qC
z&$Drkdi(J6$n*+P4+49gge8<u0|!NDpIc%jOK_HK^;Q_yRG`91v5KCHo}*x@wvK9J
zXI?2#RC{418>p6SrD`{UD$P2f?!7L`onU(}qV8q5<O=&qpZQVN{o;?Z?k6vy?v-ZD
z$5qz8FH)aqg5<6H-Iv+-sCL_**cb;2UH3D)8@nIR{>;jKb}uQ|y>z^qHK5%~!y|cI
zcYF5|3WL1>!p#o3g$^Z)Jf7^#6Qh4&m*pYhzsMw>`jsX4d21Yz!@4=EapXaE_sXqe
zbPi57uS7#NQxu34>v|Ey?8#wG`WMf~CM>K_VJ{!%KD3ulqqi;^wo_{vODL`hh9{c(
z$~^d2W}zX^Il%ZUfXX9EG<fOe6R<F{lHjGMd7}LqmZ9PUudHFoNt=;UUVWmOSD$Ef
z^~o;mftP2_VBOpzF05hE=~-qK6Y*FYeDdf9s)DolQ%tFj9(O>sHnI^562R*n#5k_t
zmjW{~w~C%?S%)SIQ7}!rG<jl2GqUMJIbZ=YAC-aK8c1L)*(&navgk%PI$kC#K$p=$
z&cXIWPa$2|BF?X6GgZ`f%!_P1XrcH;HX1{qZ7%yL_zZo84s4;uwN_Q~2ywQGg^D)o
zSO;_KAtsH8V#WqaSmMcC$7<syM43yhdWj80K@~5tIpMkT6jm{o0=r<zu9TJp7m7LS
z*<r_bqW1=tt(yhV@9{n#c6I|BipX9Y8C{;4u@S`oooB~J7U2MT@MVjxX-wkM4yyuP
zHnC`WXm#*rmJL_@u!WV!mOETdvZtt~wV&)gDuo2;`JRfcEQv-yZP=HvMR!>q^5=`~
zd2Cgb+2k-<(WzkC7UykrF>pJ>6Wij$?JU_<jNb|Zq&Af!w+MJ6^YR$gDE!yEBIp$s
z)zG`^)sLjLx$D*JYmkHWmKOS=Y_7Qb6*eVoAsS1zI_4N)9*mgB$FH#1*lUes@lhB-
zFsO74D*h_F*p~JO(#F5*cK_kf%AX4car;CzUd>!DHcZ5kn)f`fPh`y;>ZbLgd=l%a
z?p!aLPiE~^k92SIESt<+4!?uAC?6gE`V>}2^&;Z%R92}LuJ`PphI3Ks#`T_G9%r{Z
z)aC0%>I`hB$I~M-Skute-YfQD2nG}J!{z$V&R{Fm$a&uIVERSDwCNDGSp7ZGau(~W
zE?zI@&XSc|J&Vm!)#uj>eKvdBanbY1Y!*hZmV7gZwFVmb6q`a6vfydd5{FEmX8RF2
z&JCuyKz!+DZof+TK9(4k$(kd<(oB{K&R2UbvVAGsbJ-9$@<HZb=CV*cI_#Xs9uL`u
zOAEYL1gXYmv1A^*GE(lv1R<Mh0~j~VmDY6!Is~41-N8zE-2pg@D~!4Y|6np8<=J0$
ziz+&vVZHtjL|mD<3HSyguF{P8GZ9B(;y)wZ3eC#hK)My1F@GlA>Wh!VI7#OJM<VX`
zDBfHx*(h2>^Vl#Pepc!5a}#p(#HKjJEQTP$UGS6lvI6s*Gcyh%;D+a%o3>-tIcNC5
zpUh*<8l7)0!-kIQ&o|?CUZx~9>Ef6}i8Z6dO5p-R=cZ-y_E-;dHEG9EDTS2A*?9GA
ziwKJ0>ETrfxLz6~W_S#5(!Yw%4Sp!4F*GES#`w=GjdxKTekO6)4dgGx?aZb$&ZZ-V
zQvRr>G=`ir55+FLBEE{@87e-|Zv{*4QS=+NN(!d$rZiSb8W&#hwhR<3Q=Y<*Mp8eK
zCz~6b)f5~TFl&va&+;u|Pb`m%sx%YRb5p2Rsfih75S6jKgWJ3<g4&Y~&tf5#z9L02
z<-?Q{qL?<d7!_tlgs9VL;SQ5rsCwMMLF*eyXR3!GB?+fZF*tf4KTT3!g_RZ>G?|C{
ziLG(`F|}lis8dfWv$N~*M{zvlWIaBb1?-}_&<-GR(Z$2Xh(!LZnqMitPvq&%UzB$T
zF;eYO8M+=``nZk=X=agoq*OhNR>{|S9!%nO@r>_hVoEY^;g|Orj_s@$o0Iu)zbblX
z5l^k9aGdKGcct)i_<m}AzCVyO#fvR?XZz8|Xp=~zsc+3kA3eQNc}ErtRT*ko9u~W3
zrxBTGrJ}5otXtoj$NHJS#8cRs7pYMd^s^)#&?{hclO<IckEL&D%eSHqJ=*aF*q;AM
zJAM|}p7uPs;~8YJ1v6#>Wx#F0jM|j=;>Fhx{B#l3f!9MhZ9DL$0eKEg03A>nMD`PE
zg2;Hy;U}^?@PnqT#dHaK=!vP*MtXVc%wNdb#c8~&GiMv=jyRFBdmEidNe|zRfa^yN
zV(3Up|D4633jF$8I+Ie0#OBD^yui|9F-s#o7Rv#?XHqg$eBfq>QmA@FuX6VQ{FsVN
zy@QWbbGFf;6q-SG?!@Ul%C1iQeZK<v)`6JQncL@40wCG#^C&^T%X!JKzhho<NTyx&
zy)~r@geHo2f2?UqKZAb<o{eJ`qe&^l>5AU+V8v;lSqYt~D7_2EazH8Z8vpmsROqB!
zIDO7kG!r{CzPpta=6~LEq+0pNaPe6-YaN)gl{zxc*u7Qg%UP%J-N0+~<5n?ZIgS=B
z#Bm`bnY!^04DcZO%3^@>Xi+}W*6hZb3=l_)zFLmy2);}VFv-4&(U$=h(21b+sJYX~
z*(z48V2`SBe_g?PHl~^r8>nRxM=ntPFw_|`1Hh_<**#H!M)@YbfZ1V{c<Tk6E2<JN
zuVe=s<zIW>Lh7eA)LFXYBA>opA(pLTU{B)GDwbnS<(98zsZr(?1nog4aX2=DWkl~K
z1fDNe<A4`(lnEA@^p{<7Ni0p{cREWzrE)-3nFC5}&A}CzpXamW`*Z0E%ucsBevr0i
z!{2QD;7d0fKU5oQ{FM5PpOPDnpF(r4eoN!0Sf>56@l#(caqxHk6N4!2-ycM#Vdq@5
zNX=)Roz+$+uFR8MQQWiK>cnf8h5q%yyoy`zL_B=A_cfgAyuradstolZ9n8C8_TeYb
z;9y?0>_gv!c}+#pvp9X8FG3d3={(bF^k=<!zu2;ny@(9PB08dHW=LJk#+q|#;)y;-
z^j=xadepMc+=*WnvyKz27jfvszW0@JXbEJwuWcWkgOEhrJgkz+mv~{{u6^w;?qE79
zH{Xhb8Nc@RN9AhUuil9D&$079C*R6^*>axvZYk?rgEw2}-G(gtU!QloB_mOnJ*>Z1
zYmScKbZL;(n{jgr>CKHSy}4xx=6z&AmHbf$%PFIYATh_9_X9OD^=1*emqql+UgOn#
zO;y^UdxIK5QEuc_l$o*6O3@yy&{mZDVfu=KdLryiN!Qs-7%@CdWbMVV&bwoHocLld
z*i!|`ch{}Sg(Wwj>>J31z6FpAN4AN=0+yWUl?yN?<FKihrZM%#{Mslm$(rwjarDh?
zV%k176TSQWJ~j%p+4pUB(pduYX<J+nXuP>ywBHYV+nd|3$v2gg!3;6a?`O^3$Cpyl
zhcH_3ruYCjg)*QYe7H*FZaA;YfS&M0(dHl3SSJJ0;e#>z4mfLMKzsP=l2lTS`7$6C
zJ{Z57!nyi9eFc4MgwduY)i^5yT(0gi3Eh)ZE<<1^H()m>4d#dpAj_&h8PZkbunYht
z7@?$Q<KV3fzy&DVMP?yOPB+`E7TV0Hp+~{)PI?rbB+FeO=?QwMspDdy#J>9Yn?lyg
zS(<kj7Cu56swH_I*8#SKh1(17@^GrT`X&kwvLPMI(a>^=pkv9Y%t8Xp6*k)3f{jeX
zC*<aSI`4~TeT_01A|85=9kE1ftM}PxwQ7Y}^FHewlPeW|>_V)m@aKw)@55^Hl1KZ1
zwR9vB-*#bj9CI=si>|z83M(PT>1E=<B6hE1s%Kjf(^R;x{gXYf@~PXB>WhrStgdIk
zVVF%wAN$A0EXmgWBh7Y+^wIq<e9YcfL1Q~UWsykl`QTIL#0%tjIl8Sn&c(<!h%FSx
zHc|fH>;cHIw9gn`KhGD>9>Fyd`Qq<KU;^^@ynlrCcclK|B_$AJ;WMOjkiLUbs-e=f
zRkN}BlgN#g+wcM^Ybd53Ws%`4LHO5eX^74}3N7sjT}s{Z)<)yP8z|d17>&`#$Y@++
zH2PySQvFE6&`AK0&K0SFiBFEPp=$M3(V_$<t9@c)30sBPRl6_PB8T4<`NXz(|4Y_4
zD#v<m8$E~32_Ofrp}gsFXz2N3)p161q0CY?uD0x8VtIL#={NCnDI0@Ahn`?dsCCbM
z#S-BJpJa{Tv^&Z6)b@FECmN6Syivx&G}I>iThIaS_x+X~_2K#|H1Zy&S-r3~W%1w&
zv<yx2SC9l24#LHAr&)txg%$zR!qyG7)W5J(nq-Roa4!FA3lFY%Qt4w&mHu+KThu`k
z(eN((!?CHB=55Xaic7&HPr>pIDxKY(H;LIWzYz3O3(vdZYI7ZHIOwEeT(*E|@aNrm
z=YY%~y13AR6%`_`2e|pz9ytHqs0VK$7WCkH$jZ_KbS}E9yewyp*wTa7Ps>!D3HS~b
zlzS4>QS)hPEI-(Y9iMLpA^ql)g7@T&+LS@|fNsf(OkTN`fCD+ikrX@Un-xAK@2U_Z
zdh!PDEZnSSf9?tlMkZosTIn0V#76A+gVk0Re6GMo?D!*g5aJKnh!yWP%Iz>DD76tQ
zfl*}#A-=*!?D$gH#O)t&#76A+Vyr6L@kKV`jjx0Gza54Tlw=+h?RxP>?qZVNRyP#c
zh+S-%9Ynco#E!4DgAjklM(p^^wLaxn{~<orsLu6CP-!D}0Sj^elwHBhb)rRY9-kZy
zG6ew})u2WL7wv+Mv6_J^;+<AZq1e@%N5@@x?Pdvz|66?9n>Ua9t^A#v6tS~HwCKa5
zqN|U>BzN6M>Jkkv`9%!x!z0up(`D6Y(h+@lILldUdekFpML{2a36J9Kx|^pvvc<)_
z`98IBpV)N|{|VQwZR?BKeX;nlFVDoSD39OEr?K4g?}}ahcvSl%(#WYe!{}2DNlIgs
zfGUX4Wmwj)gdo^_%|nJ2{%Yn<&If(iDZRNjp#SZ#-E+mxempvP9eTtL%zlxO>x(?}
zqD-h3<%)my<Ld&;_oG3Zxai&3srO-XUAb6$AC|P%ixc<pVeT^YhYPPZIU#a!qe8wf
zR%Ky<h;u<nHIsqeyoVyA^sbZ%H-!@BGBFJN%?Hc^gOG_>mP7x>VJ6&(7uF5cN_ep1
z9mN%GfBMP^oDH$DLtl#{_wy!>E35nSR&k{9-s5n%VF68@kmP_>5yv%1rEwUPAV!Sq
zkDCRs-qN4X#4``o{rM<IffzD?&&H)SUku<bJeK?G0Nx03DG%@l2<-C!ADVFF)j~<A
z(sq2vLdL<|ihJ0xW>WM3@8nn_{08#A@l{`gq%g6v={C{aY)CY{=#-c?kY}aj!x{=+
zm*_CaXD*xKS)w!ryATWqw(cNY#5~CRx_6_rntZwdVN$n;Tts9P9QhjqjfygvnsmD=
zculKfU>AiB5(ajei#bst{6WaD1efSgxq-C)7f4KdB|@a77b&GopiqCKTz*WPe~@=e
z%squ9%h1HsU$vZx*vN}59C8vC1aH|XG2kIs`Olp4WIe>YI@Ij5;=@7wH@}>-WK;G0
z^I;x>%Znr;zIueG1YS9fo(+~)p#%-)J^V7ilg8IUgZVvC+0suRqo+`@;AL!(A)dDf
zb2kh85*NLCv-TLy>qnIV_Z|;LQry04WMcHglAAT05A>^)v7WNwe1yX<+l=TjlDCYk
zrpI<WVM~7kwziXh14W+mEE~zond7`?`WT+(z#VKm$MVFKqdP$Ku<Q=T`Je?jKm<Fj
zTu7e<2R$$mPBl?cJr&QdhmGS81Q%go7>$jrosg{Ao*Cn~=7=l>{g|zYtv84um0vgJ
zisj?MGER9)$MdChP4a{Z{0(R<NfY^Tg#K$HpP}NmrRh_!k!7<GQ}~qFxu}kjYOIun
zQ$yLc*ewz>V88xRJd(i&y3f-?QW%%mr$?Mrh3yl%x3L-dj3}dkvd>3$!+~(v@OKkm
zZHL0rCm5T_Ux9z5;Rs=w4k#2Z%1<kpP^s--b5s2$J`3VrUQX=9SMa}cbq*h{fN}~I
z=hcQ{eHJegb^NvWqaPiSG2+qj)1P!rnK^pen2A%KP?kD$1-Cbfucvauvu`TD%7tSd
zkMi_*g7*(rH`f-0&+ulBh2s1(e2n@e69b>+X`$8Ox)QD^cvD1IBH<>BjnDFg#5g})
znFw^fLs9O8YvCJ!x5l$#uZXXo<sH;sp(1VpZ>&b^qUQo0A5n=?R3yjnU5egxIy78A
zDrPU>%Y*XKFwSqnkY9-siw0>O)sR5(z(PLM(NpYR$eYBEiImk>`Xj|@rYnQswgn_e
zTwGnq8>ox?MEym)f#^Gxw}@3dp}KM#V&4HY2K1UdbHv2)qYy4eFXE@}f81YJ+z4L?
z2m@I7F8EzO_y_RU_rV9kPvu(atKg52xM$5`zC%m0BBtWk_!c}7cq|fjb&B!Xyj4JY
zg09pBK2U7V<{g_&2dV?jf|~?)+K9<xN4p-MK4RK**Z9e!M$d97%A1I*Luo|Na$ex~
z=>fD_Yk9egs8`CP)Mf7oZ3Q1xuXduYG(fuB;WmLg94@u311<lqn7x9(<wp|4nd?b=
zfuC(QX-^$pnS*$hDM~%Km(Vtk!yW5q{x%C=RRdpL1D~!bv;c1BC!Fe==Av(#f5o2V
z2lyWU(A1W#TDQ5qZM*gzMvQ!P)aWsaXU>Pbr(g8pp}G=+q{rdXF6NVPsa-CJ6QA%N
ziTW^IaRQBnOFz+oTMKS4xTp=1bt~oxp;oe42&P89AZ8TvjsbZ<T|kS(TgAL<=+8i@
zZ2#dVeaDO7PkC}<D>xm&6x|PQ0Ni-5TY+rn0hPl%4}Z$v(dr}w>B^Hx5Cf1@8RThx
zj345Dr;i@Eu7|p9K866N_gW2dpa)Y>E%@jU`1}&!4tTap5Blt&<=OlNqRN|@1HH=$
zp3!*eBwe{1`KGG6G9T_>^dK5tIUcMlQ{e6jRAe(95B8Lv;8_uFvEUt)z5x&ENKcVs
zc%<i7#dx1QYI-i-k(9oE5WlCTFQrN`E|ZUCuFg@6XBLvzRq(cAtdib_6V5Bf7U}&(
zU4;u_$;;C{UH72!(ywnhaz-(ZEOb*u<L|PTE5<hzp=DONPQR`gmn5>G<@RCUpam9D
z4B!7@>{7*eK_c%pFL?Ryit#cbe(5vQCOE%RjQ^6@nMFMLgT=VkP+}wV-#a(!HN0j;
zn1ANqB0UX`l_<v763x!9H@VfUXBQ~OMTzfzF!0X0<F+ft+{H+}r>kdn75^kutj*%p
z!4Vh(L(qbA(J_sMvzC?+SR!;K4nebnSJ%=S2L|O>sHaUW?S4m{eNJ5&f%wj#b)wCE
zPESsNw$!2SbBcye?I&_wL0V^WhX-i`?F?&?A=S)K6r}aNR#Gtn&5}gJ5N#S|%ni|2
zkegatYfSFo+S<o<LHjXcTF8RL9lF*xu;&I{>1^UFb!{o7PYKo1$Q>T4&4cSHC%n#~
zO(q>hZ8kXteIQ)>(k|GAR-hq(@VE%Ac`NIumLM!zhMPY<6~BZeg%y7ae&UYEHzz`S
zIq<+1U3tXB8`jkt)M*!H;=R4;+J%YXb+uM*D?AI|ZG<=re-=1#l;6F7ySD1ExE@CD
zy~V9GYmo*zp`GVN;88Vj;)+)K9W}nO6Ei)@G^_-P_)+vx3#Z1wsTLc*4LGqqRK91V
z*4(aq62gi3><!VCVQ?QnIaCn~pNIHl9~`=a(%c89AM2ZbNez4j@K!$Q*O+*+{ecZN
z5^S?^5f!DSxvh$Pjfzq4TKGla)an*4fcsYLBjD7_R{W>HyZGSm0;e9Z;t9vzHybYk
zjvlz<x&UIFR)&9}qV0i4>$;KwHw7#|1+z(PDR6FgAh*&`^qr)&ARVJ~wAM;}I#5iD
z){+vlw(C;p3b>T)=|Ei>3b)K(QCu+H9ucocYYWtapNq~hTEplIpQFIq)W&8@o363o
zsBp(<(UEk~y)*a)(CA>q%m&0@Bgj#)Ge)~FfbPb3{yp%8FcA=op>|ikIn<&xF(Our
ziOB^{ZF<?unTf(lTe+-?Rk3LM(pqNCDo{;I*D=8S%46^oQCRVK4?;2>U))tAp4!$o
zo`$@IS0X?077M=s9PzE~fOG`V5VaEQ0FGDfZ2T$UZ6q${#%Y}!7rdrRVzAQFaHbz%
z;hW&^V5a{*PHUB9g};S9CBbgt#lWfMOKXWv^|a3JSvz!DkLTg)KIw)-r1_RV6}ZbM
zej0GIerAJyhWeW2Uc-rNTi>O4qBUO}4Hzj~sS<rnLp2_WTEeXi6QS`qxeK>fy!Lcb
z)=pjixP5R*J2?P13GO#=p<Yw^@8h+;U955zBP>{ko8|6DxkLq4d^{Q<-Um+xPUWGT
zClkP+;a*M9nul8Hf51nZVN=p6afeI0hoYZzX$>Y=(Zmf%=d^H=1->}3JzxA`;KaGC
z^nKu`J{k++oDO#@09txcIY@oE9Cxi~+%*@y6SYwFlD`;|h+33?EAkVy6nD#Ax{?BD
z2p9}#3K#^Szix2T0Ry~vTe!UecL4eUh69X4r}3SAyfyqi04)F`0QA=Z?md8EfM5)%
zM-es#Ks`I`;l31>AOkxg0Nlb(L}SCm#pEPN7ArGpN2JGFcn18W`&#%k_!E6_(uZRJ
zX(-T2^E7bZJiCFDxVGY7hu^mhP=j0P<&)q!_=y~>41`mkr8jPHN9Tr(np)xO5O%vy
zx_R)E1hV3@;HOCnF=;Dofj10}WQCwSj1%!vveq1{zT)F#t!|e=Q2d7@d?X+iVBzE8
zCpxhd|8JpFhS$L9hk*hbq-ZVGmFL8u6m7IRsE#O1(Z&#EG_0>Bh4VMS1OX8M7oZ71
zYOij^xNshw?Le>pE<NFjvFrkcL@UNi<WbWT6k~_<EeunPx25l~D8)ETK9-pkuNWt!
zx3~`Ce~{j+W08t+ReDDst_O)xiL~4`Y(pJ9)Fb_8X7)r9cfLekUKxW#d&#e*f18_%
zR3AwsJN{rnUBx&qkv0u3Pl!{DvxN9%mbH8G-B88&Rbm@To_Vkh5-z?-aYcQ{PC5{)
z7;7cgY5DN-hmdkRVgBh$UY}KOXM|$BMQD(JzYC|1md7CRhZjAmw`srEQ9lu$mTB4}
z5$cY2JWKD@UI}oOeg3ZE>_i<$e~WdKp}mR#qVmPMcxaGTU(JKG8l-ijDf9b-wB|8S
zoinFG^WoCe=sCE7a95r4ggmSbQ=LVnDAq9;_J|W=)?jUj`n@iW4TfF{H*$!!)uD*D
zhiG>OwyD&m6kZb~{D*3t1G9h=h2;c@dxvTbRD?e<6wEO&SnPxw+VmpEKH^gV;A6@F
z&rd_O+gRZED)c_^94>AfskI8+4V;GL{wne4NbL>x9OPR9SO?e%*bn#wa0*ZbaQvt%
zwE-!BR6s{SKfq|fbih2oD!^XAB|y+6T}cMC0JH~m0o)H54|oFb3}6LdD`3YZy@B!}
zJjVdv0j>h-pn~-PtpVwPK7fJZ?MJm9=@~znibY_WOO7i14CN_=(eK5aZS4=#v>Y~B
z^0ag*${AO)Ybo=765U2=iGF1i`>vQcO1m#Lwze*f5M$A;sVL<HRF=_jiMfzSv2fxI
zgo~?>X|B%0f416GS27Vwqm`tjr5NWR-k{x)&R3bG1SR{KYFnN|xTk1wV!>!Fq)y8^
zrk$i4GE?WatRuFK)|x*MRE;(O{>TstGt=xv6{&+Q{6pZ$KDhN0toRj(C$?qbsUmHR
z)?F+aqouktMob$q$%+_-MD#HW-v~cVD=d5${KR}MybS)vKKKbQ4##eRe!rjv&R~18
zv(WKJKISql9K_fXk;zK%g^i0R#%kGqXRDCk$Hd~FcNqcys3j8OwT9wcgcc}T%+Ug)
z@_vOVLpiycX;q?MO;ZLDnxUl!UO_B$E(N;bBN<v-SBD=uhPy5wyLaQs?uQz-JKNQB
z@22J7u9(pB=MlXwraThxjhOV9mZIkVCYp@b(jrQJ(<Or@rc4d>7+{Q8J5FmNHfCrp
z{SUb>kJH*j%(<c~6OeKuU=n~xYO?4&Uc1fxrZ<X2AVpDulK~_GY3y>q)EYR6Lkg=x
zUJ`|*9n1jC1Uvzl1t8L}^7`Ud-qfoyZ-}&&*qMdjV_HJ^T;wIGHXo1$cm^Pr57C;c
zxmU&hA>cm6$lV^H;5rGjv>5T;1Z`!CMG!P_<^U}6Fa8&GK6Z#Z_xj5L)A$TRTu70_
zuOBcs9vp2AKhQjp7|HWH0TxbTmwMX5DUOs78Yelwo6KPixzs})J1jy}5P;fcF~Aq6
z5lvy`NWKK_^MIv*Wq@qi!S1_^W^+Pv-J42lSKs-Ov;4N2eeGM^&59ofwy_*Vt^mB?
zEq*23RRF8YR@cA<aD>%THY0Nmx*~mw)=2gTt5!lq;SjA;U{gn^Z-+QGk!sixHuc4m
zw0ncC_96A=DG?VBYPE-pJ4Fq>;c)4LnKDtO!OS^HIy&n?;4>YH6k%5P<{-a8TRWV`
z!%l{pmOu?G*oCydI1NK<X#40e_ec`H`Per}d_4LrrAC1_`heLisW|Z_n`IQczFD@I
z&9YU@oP`PN$xyLvme!ZtpJ!>^$-VPQtqZyHpVaOr_t=xr(BS(2P3v37`ZZ@z5gJnn
zANx0LB*lO9H|=3^Z=0>XA!$5qlz-?g(Rj_dW}d?nHcjj8=x%-O3fhv0+`@I>U48H{
z;6(IRd|luqo2a>Z28d0MYYk!s1cXYSZlwu9nl>_z=bOi|L1?5E(F&cNE+fp2q=_Pp
zDl2{;@DLw71H|B4nd!iZ*IMZZ0XOrD9y7GGBrBYT8_fnR+--kHY?=XM8k+Kx8CrL@
z6+hCBH|sT~Mm-X1)T4fldIZ|_F!P51_x&BYHOk*$mjAF_!Bz+$t=p<lJK!`su<(w+
z>-yk#dOv85lFT5Ck{m2vg9(lqG4b)yV%<2cA!!P&3l_E8HR8bc+m~1Oc<SPjj$(NR
zL^2|z!brR-j}ZLT0ua6(Kw-6lLzP$Hz6!_(yaw0-*a@)s97$_m{O`ai>@IKK|AL?L
z{sTaHcLP8<Zuz0tuLVf_4d4`(iOe3jZvx%|>;dcr6aX3msFIY<7q{{jc=PT<yl>vO
zf$s+t0uCtR_*AWK{0HzC0X_s+4SkKZh*#%m18=FJvO_|Zf1-?!0EYn7P=^7&4Rf=G
zI^@m!u{SR@6y^1@!vLEfO7$Wps&=SXy?`!^WD@|vfN%Z8XHRMO2VciUYqH`a$V@}M
zrsnd;-+qnF5?i&1tfvklE874fyYH{EOd3DR)!8+1^kihuM7999iGQ?@nJXE0Arcd{
M-5W*Qr?oTx1D}}%c>n+a

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 30ae14a391..614cf04e3c 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -79,7 +79,7 @@
 				"windmill-parser-wasm-nu": "1.510.1",
 				"windmill-parser-wasm-php": "1.574.1",
 				"windmill-parser-wasm-py": "1.538.0",
-				"windmill-parser-wasm-regex": "1.575.4",
+				"windmill-parser-wasm-regex": "1.576.3",
 				"windmill-parser-wasm-ruby": "1.526.1",
 				"windmill-parser-wasm-rust": "1.558.1",
 				"windmill-parser-wasm-ts": "1.565.0",
@@ -13759,9 +13759,9 @@
 			"integrity": "sha512-s+bdIgT/fA5em3zYUwF8D14uA/dZh7iu0krZYZQqZUO7txN37hwSCVfovbMkIwm4zPbsJ50mU8DRLt7UpAPZIw=="
 		},
 		"node_modules/windmill-parser-wasm-regex": {
-			"version": "1.575.4",
-			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.575.4.tgz",
-			"integrity": "sha512-G7Ni8XxdSKLNew50B1KRmwn/z9qq3obpEDaaDFS7Z74MeUdaBB/TD69SY6RxDL8SZrh0Tl7SCbS/GGLnt1AzkQ=="
+			"version": "1.576.3",
+			"resolved": "https://registry.npmjs.org/windmill-parser-wasm-regex/-/windmill-parser-wasm-regex-1.576.3.tgz",
+			"integrity": "sha512-+5or2Gzi2W+DXU3cDqUB2sn3t3t1ZJ5BGpEh94r30fbm9yGxSy9QvxsURqv59ubKCjmm3oKwqApSyn+OqXSLjg=="
 		},
 		"node_modules/windmill-parser-wasm-ruby": {
 			"version": "1.526.1",
diff --git a/frontend/package.json b/frontend/package.json
index da4f163db7..e6e2b33daa 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -144,7 +144,7 @@
 		"windmill-parser-wasm-nu": "1.510.1",
 		"windmill-parser-wasm-php": "1.574.1",
 		"windmill-parser-wasm-py": "1.538.0",
-		"windmill-parser-wasm-regex": "1.575.4",
+		"windmill-parser-wasm-regex": "1.576.3",
 		"windmill-parser-wasm-ruby": "1.526.1",
 		"windmill-parser-wasm-rust": "1.558.1",
 		"windmill-parser-wasm-ts": "1.565.0",

From 9add8770479a63496eb6a425a08df9ec8e33237e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 17 Nov 2025 12:34:02 +0100
Subject: [PATCH 18/81] chore(main): release 1.577.0 (#7152)

* chore(main): release 1.577.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  | 14 +++++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 58 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f32cb9c377..d293788b49 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.577.0](https://github.com/windmill-labs/windmill/compare/v1.576.3...v1.577.0) (2025-11-17)
+
+
+### Features
+
+* add support for validateset in pwsh ([#7158](https://github.com/windmill-labs/windmill/issues/7158)) ([b66e038](https://github.com/windmill-labs/windmill/commit/b66e038a0f8b6bffe157a83671c8e692c1441f23))
+* allow http trigger to be disabled ([#6976](https://github.com/windmill-labs/windmill/issues/6976)) ([09082de](https://github.com/windmill-labs/windmill/commit/09082de53971d0d2f2a6308bc8ee573458a3b913))
+
+
+### Bug Fixes
+
+* create app_themes/groups/components only when needed ([cf5d58e](https://github.com/windmill-labs/windmill/commit/cf5d58ea43cef6add3da2aa1e24efc83be6df3b9))
+* fix parse_postgres_uri not decoding password ([#7157](https://github.com/windmill-labs/windmill/issues/7157)) ([2cae72c](https://github.com/windmill-labs/windmill/commit/2cae72c9db6bd08689e1672be6dda32f6af831fb))
+
 ## [1.576.3](https://github.com/windmill-labs/windmill/compare/v1.576.2...v1.576.3) (2025-11-15)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 38aa2aba71..629070a7fa 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15148,7 +15148,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15208,7 +15208,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15329,7 +15329,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15344,7 +15344,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15358,7 +15358,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15377,7 +15377,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15463,7 +15463,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "regex",
  "serde",
@@ -15478,7 +15478,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15502,7 +15502,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15514,7 +15514,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15523,7 +15523,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15535,7 +15535,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15547,7 +15547,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15559,7 +15559,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15571,7 +15571,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15583,7 +15583,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15594,7 +15594,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15640,7 +15640,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15654,7 +15654,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15671,7 +15671,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15685,7 +15685,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15703,7 +15703,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15714,7 +15714,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15749,7 +15749,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15759,7 +15759,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.576.3"
+version = "1.577.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 18bfd888d2..dd68fe3e9d 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.576.3"
+version = "1.577.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.576.3"
+version = "1.577.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 80077a1c6f..55bb63276b 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.3
+  version: 1.577.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index fe33a51841..08d5968875 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.576.3";
+export const VERSION = "v1.577.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 6d362eee47..a7bf98c188 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.576.3";
+export const VERSION = "1.577.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 614cf04e3c..47c108ab0e 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.3",
+	"version": "1.577.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.576.3",
+			"version": "1.577.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index e6e2b33daa..66a343ec9c 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.576.3",
+	"version": "1.577.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index a06a6fb27f..05db205527 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.576.3"
-wmill_pg = ">=1.576.3"
+wmill = ">=1.577.0"
+wmill_pg = ">=1.577.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index a5dae60ac1..93c2128859 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.576.3
+  version: 1.577.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 74929769d0..3109cee8a7 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.576.3'
+    ModuleVersion     = '1.577.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 0b2e9a3053..d7fe97e881 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.576.3"
+version = "1.577.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 3be1d00ecc..29d41469e1 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.576.3"
+version = "1.577.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index f0fccc57c0..8df04858e0 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.576.3",
+  "version": "1.577.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 4cbcbdca2f..282125533a 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.576.3",
+  "version": "1.577.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 49974777a8..1b5e7d09b6 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.576.3
+1.577.0

From ceeff5f76c69d98319bb3fb7f7779b6046478d6b Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Mon, 17 Nov 2025 06:48:31 -0500
Subject: [PATCH 19/81] feat: support to run windows binary as service (#7153)

* feat: support to run windows binary as service

* ee ref

* ee ref

* flags

* Update backend/src/main.rs

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

* fix ai commit

* fix

* ee ref

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 backend/Cargo.lock      | 13 +++++++++++++
 backend/Cargo.toml      |  4 ++++
 backend/ee-repo-ref.txt |  2 +-
 backend/src/main.rs     | 15 +++++++++++++++
 4 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 629070a7fa..7bd5cf2334 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15204,6 +15204,8 @@ dependencies = [
  "windmill-indexer",
  "windmill-queue",
  "windmill-worker",
+ "windows-service",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -16089,6 +16091,17 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "windows-service"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24d6bcc7f734a4091ecf8d7a64c5f7d7066f45585c1861eba06449909609c8a"
+dependencies = [
+ "bitflags 2.9.4",
+ "widestring",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "windows-strings"
 version = "0.4.2"
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index dd68fe3e9d..15377a4a23 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -161,6 +161,10 @@ nom.workspace = true
 globset.workspace = true
 
 
+[target.'cfg(windows)'.dependencies]
+windows-service = "0.7"
+windows-sys = { version = "0.52", features = ["Win32_System_Services", "Win32_System_Console", "Win32_Foundation"] }
+
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 tikv-jemallocator = { optional = true, workspace = true }
 tikv-jemalloc-sys = { optional = true, workspace = true }
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 7d5311398e..beac4ec475 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-423c3c2d175b15b7c0f010e08f1848a7710e31be
\ No newline at end of file
+41e693c08aa096a0d2e9a76a4ebe9b4149bdde24
\ No newline at end of file
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 70f428d4ca..26e1755fea 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -113,6 +113,10 @@ pub mod ee;
 mod ee_oss;
 mod monitor;
 
+// Windows service support - EE feature
+#[cfg(all(windows, feature = "enterprise", feature = "private"))]
+mod windows_service_ee;
+
 pub fn setup_deno_runtime() -> anyhow::Result<()> {
     // https://github.com/denoland/deno/blob/main/cli/main.rs#L477
     #[cfg(feature = "deno_core")]
@@ -207,6 +211,17 @@ lazy_static::lazy_static! {
 }
 
 pub fn main() -> anyhow::Result<()> {
+    // On Windows with enterprise feature, check if running as a service
+    #[cfg(all(windows, feature = "enterprise", feature = "private"))]
+    {
+        if windows_service_ee::is_running_as_service() {
+            // Run as Windows service with SCM handlers
+            return windows_service_ee::run_as_windows_service()
+                .map_err(|e| anyhow::anyhow!("Failed to run as Windows service: {}", e));
+        }
+    }
+
+    // Normal execution (console/foreground mode)
     setup_deno_runtime()?;
     create_and_run_current_thread_inner(windmill_main())
 }

From da4f57ae590c64b575f580e42a28f973f1c35939 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 17 Nov 2025 12:54:32 +0100
Subject: [PATCH 20/81] chore(main): release 1.578.0 (#7159)

* chore(main): release 1.578.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d293788b49..54b4a82ee4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.578.0](https://github.com/windmill-labs/windmill/compare/v1.577.0...v1.578.0) (2025-11-17)
+
+
+### Features
+
+* support to run windows binary as service ([#7153](https://github.com/windmill-labs/windmill/issues/7153)) ([ceeff5f](https://github.com/windmill-labs/windmill/commit/ceeff5f76c69d98319bb3fb7f7779b6046478d6b))
+
 ## [1.577.0](https://github.com/windmill-labs/windmill/compare/v1.576.3...v1.577.0) (2025-11-17)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 7bd5cf2334..f402f4dc20 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15148,7 +15148,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15210,7 +15210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15331,7 +15331,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15346,7 +15346,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15360,7 +15360,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15379,7 +15379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15465,7 +15465,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "regex",
  "serde",
@@ -15480,7 +15480,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15504,7 +15504,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15516,7 +15516,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15525,7 +15525,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15537,7 +15537,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15549,7 +15549,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15561,7 +15561,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15573,7 +15573,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15585,7 +15585,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15596,7 +15596,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15607,7 +15607,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15619,7 +15619,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15642,7 +15642,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15656,7 +15656,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15673,7 +15673,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15705,7 +15705,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15716,7 +15716,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15751,7 +15751,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15761,7 +15761,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.577.0"
+version = "1.578.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 15377a4a23..2192e17055 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.577.0"
+version = "1.578.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.577.0"
+version = "1.578.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 55bb63276b..02423978cb 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.577.0
+  version: 1.578.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 08d5968875..ecee3e3434 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.577.0";
+export const VERSION = "v1.578.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index a7bf98c188..682fedd85f 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.577.0";
+export const VERSION = "1.578.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 47c108ab0e..f404b4910e 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.577.0",
+	"version": "1.578.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.577.0",
+			"version": "1.578.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 66a343ec9c..09d94af50d 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.577.0",
+	"version": "1.578.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 05db205527..97c0e43736 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.577.0"
-wmill_pg = ">=1.577.0"
+wmill = ">=1.578.0"
+wmill_pg = ">=1.578.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 93c2128859..3c43d04b63 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.577.0
+  version: 1.578.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 3109cee8a7..f475c8d0e0 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.577.0'
+    ModuleVersion     = '1.578.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index d7fe97e881..92d46d3330 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.577.0"
+version = "1.578.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 29d41469e1..ea146232cd 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.577.0"
+version = "1.578.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 8df04858e0..f38e455c56 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.577.0",
+  "version": "1.578.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 282125533a..564c31c948 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.577.0",
+  "version": "1.578.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 1b5e7d09b6..8e8031afb2 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.577.0
+1.578.0

From 79ac6312e87afa3646bddc0f7e66fc4367dbff7c Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Mon, 17 Nov 2025 19:57:59 +0100
Subject: [PATCH 21/81] feat(ai): handle aws bedrock as provider (#7155)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* backend draft

* fix for tool and streaming

* do frontend side

* working

* working tools

* rm

* handle list endpoint

* handle for ai agents

* fix for models requiring inference id

* cleaning

* fix desc issue

* fix tool usage

* fix structured output

* cleaning

* fix for api

* rm

* fix input images

* cleaning

* chore: use aws sdk (#7156)

* feat(ai): Add AWS SDK dependencies for Bedrock integration

- Add aws-sdk-bedrockruntime v1.113.0
- Add aws-credential-types for bearer token authentication
- Update rustls to v0.23.35 for compatibility
- Dependencies added to windmill-common for AI features

* feat(ai): Add bearer token provider for Bedrock authentication

- Implement BearerTokenProvider using aws_credential_types
- Simple token-based auth using API keys from Windmill resources
- Add basic unit tests for provider creation
- Export bedrock_auth module in lib.rs

* feat(ai): Add Bedrock client wrapper with region extraction

- Implement BedrockClient wrapper around AWS SDK client
- Bearer token authentication integration
- Extract AWS region from Bedrock base URL automatically
- Comprehensive unit tests for region extraction
- Make aws-config non-optional dependency for AI features
- Update feature flags to reflect new dependency structure

* cargo

* feat(ai): Implement non-streaming Bedrock via AWS SDK

Use official AWS SDK instead of manual HTTP requests for better type safety and maintainability. Implements the Bedrock converse() API for non-streaming requests with proper bearer token authentication and message format conversion between OpenAI and Bedrock formats.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(ai): Eliminate Simple* conversion types for Bedrock SDK

- Move AI types to windmill-common/src/ai_types.rs for shared access
- Update bedrock_converters to work directly with OpenAI types
- Remove ~200 lines of conversion boilerplate from ai_executor.rs and bedrock.rs
- Remove unused imports to clean compilation warnings
- Benefits: 50% fewer conversion steps, no information loss, easier maintenance

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat(ai): Add streaming support for AWS Bedrock SDK

- Implement converse_stream() for Bedrock streaming responses
- Use EventReceiver.recv() to process stream events
- Extract text deltas using bedrock_stream_event_to_text()
- Send TokenDelta events to StreamEventProcessor for real-time updates
- Refactor request building to eliminate duplication between streaming and non-streaming
- Clean, minimal implementation following AWS SDK patterns

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* revert flake change

* fix

* feat(ai): Add tool calls and image support for Bedrock streaming

**Phase 1: Streaming Tool Call Support**
- Add stream event processing functions in bedrock_converters.rs:
  - bedrock_stream_event_to_tool_start() - Extract tool use start from ContentBlockStart
  - bedrock_stream_event_to_tool_delta() - Extract tool input deltas from ContentBlockDelta
  - bedrock_stream_event_is_block_stop() - Detect ContentBlockStop events
  - streaming_tool_calls_to_openai() - Convert accumulated tool calls to OpenAI format
- Update ai_executor.rs streaming loop with tool call accumulator (HashMap)
- Track current tool use ID during streaming
- Send ToolCallArguments events to StreamEventProcessor
- Return accumulated tool calls instead of empty vector

**Phase 2: Image Input Support**
- Add parse_image_data_url() to extract format and base64 data from data URLs
- Add content_part_to_block() to convert ContentPart to Bedrock ContentBlock
- Refactor convert_message() to handle multi-part content with images
- Support ImageUrl conversion to Bedrock ImageBlock with proper format (png/jpeg/gif/webp)
- Import AWS SDK image types: ImageBlock, ImageSource, ImageFormat
- Keep content_to_text() helper for system message text extraction

**Benefits**:
- ✅ Tool calling now works in both streaming and non-streaming modes
- ✅ Images are properly converted instead of being silently dropped
- ✅ Structured output works in streaming (uses tool calling)
- ✅ Full feature parity with manual HTTP implementation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* cleaning

* fix(ai): Add S3 image support and structured output for Bedrock

**Fixes:**
1. **S3 Image Support**: Call prepare_messages_for_api() before Bedrock SDK path to convert S3Objects to ImageUrls
   - Downloads images from S3 and encodes as base64 data URLs
   - Ensures images are properly handled in both streaming and non-streaming modes

2. **Structured Output**: Add ToolChoice::Any when structured output tool is present
   - Forces Bedrock to call the structured_output tool
   - Ensures JSON schema compliance for structured output
   - Works in both streaming and non-streaming modes

**Changes:**
- ai_executor.rs: Call prepare_messages_for_api() for Bedrock SDK path
- ai_executor.rs: Set tool_choice to Any when structured_output_tool_name is present
- aws_bedrock.rs: Remove unused ToolChoice imports (used via full path in worker)

**Testing:**
- ✅ S3 images are now downloaded and converted before API call
- ✅ Structured output now forces tool usage with ToolChoice::Any
- ✅ Both work in streaming and non-streaming modes

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* cleaning

* cleaning

* cleaning

* better error

* cleaning

* cleaning

* rm

* rename

* apply region

---------

Co-authored-by: Claude <noreply@anthropic.com>

* fix default

* no panic

* no print

* use utils file

* cleaning

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 backend/CLAUDE.md                             |  13 +
 backend/Cargo.lock                            |  90 +-
 backend/Cargo.toml                            |   5 +-
 backend/windmill-api/openapi.yaml             |  59 +-
 backend/windmill-api/src/ai.rs                | 101 ++-
 backend/windmill-api/src/bedrock.rs           | 602 +++++++++++++
 backend/windmill-api/src/lib.rs               |   1 +
 backend/windmill-common/Cargo.toml            |   2 +
 backend/windmill-common/src/ai_providers.rs   |  13 +-
 backend/windmill-worker/Cargo.toml            |   4 +
 .../windmill-worker/src/ai/image_handler.rs   |  52 ++
 .../src/ai/providers/bedrock.rs               | 804 ++++++++++++++++++
 .../src/ai/providers/google_ai.rs             |   8 +-
 .../windmill-worker/src/ai/providers/mod.rs   |   1 +
 .../src/ai/providers/openai.rs                |  79 +-
 .../src/ai/providers/openrouter.rs            |  17 +-
 .../windmill-worker/src/ai/query_builder.rs   |   8 +-
 backend/windmill-worker/src/ai/types.rs       |  11 +-
 backend/windmill-worker/src/ai/utils.rs       |   7 +-
 backend/windmill-worker/src/ai_executor.rs    | 520 +++++------
 frontend/src/lib/components/copilot/lib.ts    | 103 ++-
 21 files changed, 2109 insertions(+), 391 deletions(-)
 create mode 100644 backend/windmill-api/src/bedrock.rs
 create mode 100644 backend/windmill-worker/src/ai/providers/bedrock.rs

diff --git a/backend/CLAUDE.md b/backend/CLAUDE.md
index 1fe509a0d6..78faa0bf77 100644
--- a/backend/CLAUDE.md
+++ b/backend/CLAUDE.md
@@ -10,3 +10,16 @@
 
 1. Update database schema with migration if necessary
 2. Update backend/windmill-api/openapi.yaml after modifying API endpoints
+
+## Querying the Database
+
+To query the database directly, use psql with the following connection string:
+
+```bash
+psql postgres://postgres:changeme@localhost:5432/windmill
+```
+
+This can be helpful for:
+- Inspecting database state during development
+- Testing queries before implementing them in Rust
+- Debugging data-related issues
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index f402f4dc20..d55a6487c9 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -823,13 +823,14 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.5.10"
+version = "1.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c034a1bc1d70e16e7f4e4caf7e9f7693e4c9c24cd91cf17c2a0b21abaebc7c8b"
+checksum = "8fe0fd441565b0b318c76e7206c8d1d0b0166b3e986cf30e890b61feb6192045"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
  "aws-smithy-async",
+ "aws-smithy-eventstream",
  "aws-smithy-http",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -845,6 +846,31 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "aws-sdk-bedrockruntime"
+version = "1.113.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5d2b8f081b9e8ff455b8dd7387b6b02263c3dac73172d188d2b523ff1e775e9"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "http 0.2.12",
+ "hyper 0.14.32",
+ "regex-lite",
+ "tracing",
+]
+
 [[package]]
 name = "aws-sdk-config"
 version = "1.68.0"
@@ -964,6 +990,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c35452ec3f001e1f2f6db107b6373f1f48f05ec63ba2c5c9fa91f07dad32af11"
 dependencies = [
  "aws-credential-types",
+ "aws-smithy-eventstream",
  "aws-smithy-http",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -990,12 +1017,24 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "aws-smithy-eventstream"
+version = "0.60.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e29a304f8319781a39808847efb39561351b1bb76e933da7aa90232673638658"
+dependencies = [
+ "aws-smithy-types",
+ "bytes",
+ "crc32fast",
+]
+
 [[package]]
 name = "aws-smithy-http"
 version = "0.62.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "445d5d720c99eed0b4aa674ed00d835d9b1427dd73e04adaf2f94c6b2d6f9fca"
 dependencies = [
+ "aws-smithy-eventstream",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
@@ -1013,9 +1052,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.0.6"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f108f1ca850f3feef3009bdcc977be201bca9a91058864d9de0684e64514bee0"
+checksum = "623254723e8dfd535f566ee7b2381645f8981da086b5c4aa26c0c41582bb1d2c"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -1032,10 +1071,11 @@ dependencies = [
  "hyper-util",
  "pin-project-lite",
  "rustls 0.21.12",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-native-certs 0.8.2",
  "rustls-pki-types",
  "tokio",
+ "tokio-rustls 0.26.4",
  "tower 0.5.2",
  "tracing",
 ]
@@ -1070,9 +1110,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.8.6"
+version = "1.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e107ce0783019dbff59b3a244aa0c114e4a8c9d93498af9162608cd5474e796"
+checksum = "0bbe9d018d646b96c7be063dd07987849862b0e6d07c778aad7d93d1be6c1ef0"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -4266,7 +4306,7 @@ dependencies = [
  "deno_core",
  "deno_error",
  "deno_native_certs",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-pemfile 2.2.0",
  "rustls-tokio-stream",
  "rustls-webpki 0.102.8",
@@ -6686,7 +6726,7 @@ dependencies = [
  "hyper 1.8.1",
  "hyper-util",
  "log",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-native-certs 0.8.2",
  "rustls-pki-types",
  "tokio",
@@ -7428,7 +7468,7 @@ dependencies = [
  "k8s-openapi",
  "kube-core",
  "pem 3.0.5",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "secrecy",
  "serde",
  "serde_json",
@@ -7913,7 +7953,7 @@ dependencies = [
  "base64 0.22.1",
  "gethostname",
  "mail-builder",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-pki-types",
  "smtp-proto",
  "tokio",
@@ -10262,7 +10302,7 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.1",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "socket2 0.6.1",
  "thiserror 2.0.17",
  "tokio",
@@ -10282,7 +10322,7 @@ dependencies = [
  "rand 0.9.0",
  "ring 0.17.14",
  "rustc-hash 2.1.1",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.17",
@@ -10724,7 +10764,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-native-certs 0.8.2",
  "rustls-pki-types",
  "serde",
@@ -11146,9 +11186,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.29"
+version = "0.23.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2491382039b29b9b11ff08b76ff6c97cf287671dbb74f0be44bda389fffe9bd1"
+checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -11232,7 +11272,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22557157d7395bc30727745b365d923f1ecc230c4c80b176545f3f4f08c46e33"
 dependencies = [
  "futures",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "socket2 0.5.10",
  "tokio",
 ]
@@ -12297,7 +12337,7 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -13771,7 +13811,7 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "tokio",
 ]
 
@@ -14603,7 +14643,7 @@ dependencies = [
  "log",
  "native-tls",
  "once_cell",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -15177,7 +15217,7 @@ dependencies = [
  "quote",
  "rand 0.9.0",
  "reqwest 0.12.24",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "serde",
  "serde_json",
  "serde_yml",
@@ -15283,7 +15323,7 @@ dependencies = [
  "rumqttc",
  "rust-embed",
  "rust_decimal",
- "rustls 0.23.29",
+ "rustls 0.23.35",
  "samael",
  "serde",
  "serde_json",
@@ -15386,7 +15426,9 @@ dependencies = [
  "async-stream",
  "async-trait",
  "aws-config",
+ "aws-credential-types",
  "aws-sdk-sts",
+ "aws-smithy-types",
  "aws-smithy-types-convert",
  "axum",
  "backon",
@@ -15768,6 +15810,10 @@ dependencies = [
  "async-recursion",
  "async-stream",
  "async-trait",
+ "aws-config",
+ "aws-credential-types",
+ "aws-sdk-bedrockruntime",
+ "aws-smithy-types",
  "backon",
  "base64 0.22.1",
  "bit-vec 0.6.3",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 2192e17055..b196852f58 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -384,11 +384,14 @@ datafusion = "47.0.0"
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7", features = ["aws", "azure", "gcp"] }
 openidconnect = { version = "4.0.0-rc.1" }
 aws-config = "^1"
+aws-sdk-bedrockruntime = "=1.113.0"
+aws-credential-types = "^1"
+aws-smithy-types = "^1"
 aws-sdk-sqs = "=1.77.0"
 aws-sdk-sts = "=1.79.0"
 aws-sdk-sso = "=1.77.0"
 aws-sdk-ssooidc = "=1.78.0"
-rustls = "=0.23.29"
+rustls = "=0.23.35"
 async-once-cell = "0.5.4"
 
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 02423978cb..c8345e4b38 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -572,12 +572,12 @@ paths:
                 use_case:
                   type: string
       responses:
-        '200':
+        "200":
           description: Onboarding data submitted successfully
           content:
             application/json:
               schema:
-                type: string                
+                type: string
 
   /w/{workspace}/users/delete/{username}:
     delete:
@@ -15294,8 +15294,7 @@ components:
 
     CreatedAfterQueue:
       name: created_after_queue
-      description:
-        filter on jobs created after X for jobs in the queue only
+      description: filter on jobs created after X for jobs in the queue only
       in: query
       schema:
         type: string
@@ -15303,8 +15302,7 @@ components:
 
     CreatedBeforeQueue:
       name: created_before_queue
-      description:
-        filter on jobs created before X for jobs in the queue only
+      description: filter on jobs created before X for jobs in the queue only
       in: query
       schema:
         type: string
@@ -15599,6 +15597,7 @@ components:
           groq,
           openrouter,
           togetherai,
+          aws_bedrock,
           customai,
         ]
 
@@ -16750,30 +16749,30 @@ components:
     ScriptLang:
       type: string
       enum: [
-        python3,
-        deno,
-        go,
-        bash,
-        powershell,
-        postgresql,
-        mysql,
-        bigquery,
-        snowflake,
-        mssql,
-        oracledb,
-        graphql,
-        nativets,
-        bun,
-        php,
-        rust,
-        ansible,
-        csharp,
-        nu,
-        java,
-        ruby,
-        duckdb,
-        # for related places search: ADD_NEW_LANG
-      ]
+          python3,
+          deno,
+          go,
+          bash,
+          powershell,
+          postgresql,
+          mysql,
+          bigquery,
+          snowflake,
+          mssql,
+          oracledb,
+          graphql,
+          nativets,
+          bun,
+          php,
+          rust,
+          ansible,
+          csharp,
+          nu,
+          java,
+          ruby,
+          duckdb,
+          # for related places search: ADD_NEW_LANG
+        ]
 
     Preview:
       type: object
diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index e4d07cfdc6..4b18a67ec9 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -1,3 +1,4 @@
+use crate::bedrock;
 use crate::db::{ApiAuthed, DB};
 
 use axum::{body::Bytes, extract::Path, response::IntoResponse, routing::post, Extension, Router};
@@ -6,12 +7,12 @@ use quick_cache::sync::Cache;
 use reqwest::{Client, RequestBuilder};
 use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
-use windmill_common::variables::get_variable_or_self;
 use std::collections::HashMap;
 use windmill_audit::{audit_oss::audit_log, ActionKind};
 use windmill_common::ai_providers::{AIProvider, ProviderConfig, ProviderModel, AZURE_API_VERSION};
 use windmill_common::error::{to_anyhow, Error, Result};
 use windmill_common::utils::configure_client;
+use windmill_common::variables::get_variable_or_self;
 
 lazy_static::lazy_static! {
     static ref HTTP_CLIENT: Client = configure_client(reqwest::ClientBuilder::new()
@@ -66,6 +67,7 @@ struct AIStandardResource {
     #[serde(alias = "apiKey")]
     api_key: Option<String>,
     organization_id: Option<String>,
+    region: Option<String>,
 }
 
 #[derive(Deserialize, Debug)]
@@ -98,7 +100,9 @@ impl AIRequestConfig {
     ) -> Result<Self> {
         let (api_key, access_token, organization_id, base_url, user) = match resource {
             AIResource::Standard(resource) => {
-                let base_url = provider.get_base_url(resource.base_url, db).await?;
+                let base_url = provider
+                    .get_base_url(resource.base_url, resource.region, db)
+                    .await?;
                 let api_key = if let Some(api_key) = resource.api_key {
                     Some(get_variable_or_self(api_key, db, w_id).await?)
                 } else {
@@ -119,7 +123,7 @@ impl AIRequestConfig {
                     None
                 };
                 let token = Self::get_token_using_oauth(resource, db, w_id).await?;
-                let base_url = provider.get_base_url(None, db).await?;
+                let base_url = provider.get_base_url(None, None, db).await?;
 
                 (None, Some(token), None, base_url, user)
             }
@@ -180,15 +184,35 @@ impl AIRequestConfig {
         let is_azure = provider.is_azure_openai(base_url);
         let is_anthropic = matches!(provider, AIProvider::Anthropic);
         let is_anthropic_sdk = headers.get("X-Anthropic-SDK").is_some();
+        let is_bedrock = matches!(provider, AIProvider::AWSBedrock);
 
-        let url = if is_azure && method != Method::GET {
+        // Handle AWS Bedrock transformation
+        let (url, body) = if is_bedrock && method != Method::GET {
+            let (model, transformed_body, is_streaming) =
+                bedrock::transform_openai_to_bedrock(&body)?;
+            let endpoint = if is_streaming {
+                "converse-stream"
+            } else {
+                "converse"
+            };
+            let bedrock_url = format!("{}/model/{}/{}", base_url, model, endpoint);
+            (bedrock_url, transformed_body)
+        } else if is_bedrock && (path == "foundation-models" || path == "inference-profiles") {
+            // AWS Bedrock foundation-models and inference-profiles endpoints use different base URL (without -runtime)
+            let bedrock_base_url = base_url.replace("bedrock-runtime.", "bedrock.");
+            let bedrock_url = format!("{}/{}", bedrock_base_url, path);
+            (bedrock_url, body)
+        } else if is_azure && method != Method::GET {
             let model = AIProvider::extract_model_from_body(&body)?;
-            AIProvider::build_azure_openai_url(base_url, &model, path)
+            let azure_url = AIProvider::build_azure_openai_url(base_url, &model, path);
+            (azure_url, body)
         } else if is_anthropic_sdk {
             let truncated_base_url = base_url.trim_end_matches("/v1");
-            format!("{}/{}", truncated_base_url, path)
+            let anthropic_url = format!("{}/{}", truncated_base_url, path);
+            (anthropic_url, body)
         } else {
-            format!("{}/{}", base_url, path)
+            let default_url = format!("{}/{}", base_url, path);
+            (default_url, body)
         };
 
         tracing::debug!("AI request URL: {}", url);
@@ -316,7 +340,7 @@ async fn global_proxy(
         return Err(Error::BadRequest("API key is required".to_string()));
     };
 
-    let base_url = provider.get_base_url(None, &db).await?;
+    let base_url = provider.get_base_url(None, None, &db).await?;
 
     let url = format!("{}/{}", base_url, ai_path);
 
@@ -446,6 +470,21 @@ async fn proxy(
         }
     };
 
+    // Extract model and streaming flag for Bedrock transformation (only for POST requests)
+    let (model, is_streaming) =
+        if matches!(provider, AIProvider::AWSBedrock) && method == Method::POST {
+            #[derive(Deserialize, Debug)]
+            struct BedrockRequest {
+                model: String,
+                stream: bool,
+            }
+            let parsed: BedrockRequest = serde_json::from_slice(&body)
+                .map_err(|e| Error::internal_err(format!("Failed to parse request body: {}", e)))?;
+            (Some(parsed.model), parsed.stream)
+        } else {
+            (None, false)
+        };
+
     let request = request_config.prepare_request(&provider, &ai_path, method, headers, body)?;
 
     let response = request.send().await.map_err(to_anyhow)?;
@@ -469,8 +508,46 @@ async fn proxy(
         return Err(Error::AIError(err_msg));
     }
 
-    let status_code = response.status();
-    let headers = response.headers().clone();
-    let stream = response.bytes_stream();
-    Ok((status_code, headers, axum::body::Body::from_stream(stream)))
+    // Transform Bedrock responses back to OpenAI format
+    if matches!(provider, AIProvider::AWSBedrock) {
+        let Some(model) = model else {
+            return Err(Error::BadRequest("Model is required".to_string()));
+        };
+        if is_streaming {
+            // Transform streaming response
+            use http::StatusCode;
+
+            let mut response_headers = HeaderMap::new();
+            response_headers.insert("content-type", "text/event-stream".parse().unwrap());
+            response_headers.insert("cache-control", "no-cache".parse().unwrap());
+            response_headers.insert("connection", "keep-alive".parse().unwrap());
+
+            let stream = response.bytes_stream();
+            let transformed_stream = bedrock::transform_bedrock_stream_to_openai(stream, model);
+
+            Ok((
+                StatusCode::OK,
+                response_headers,
+                axum::body::Body::from_stream(transformed_stream),
+            ))
+        } else {
+            // Transform non-streaming response
+            let transformed_body = bedrock::transform_bedrock_to_openai(response, model).await?;
+
+            let mut response_headers = HeaderMap::new();
+            response_headers.insert("content-type", "application/json".parse().unwrap());
+
+            Ok((
+                http::StatusCode::OK,
+                response_headers,
+                axum::body::Body::from(transformed_body),
+            ))
+        }
+    } else {
+        // Pass through for other providers
+        let status_code = response.status();
+        let headers = response.headers().clone();
+        let stream = response.bytes_stream();
+        Ok((status_code, headers, axum::body::Body::from_stream(stream)))
+    }
 }
diff --git a/backend/windmill-api/src/bedrock.rs b/backend/windmill-api/src/bedrock.rs
new file mode 100644
index 0000000000..ea93b5b3ea
--- /dev/null
+++ b/backend/windmill-api/src/bedrock.rs
@@ -0,0 +1,602 @@
+use axum::body::Bytes;
+use bytes;
+use futures;
+use uuid;
+use windmill_common::error::{Error, Result};
+
+/// Transform OpenAI format request to AWS Bedrock Converse format
+/// Returns: (model_id, transformed_body, is_streaming)
+pub fn transform_openai_to_bedrock(body: &[u8]) -> Result<(String, Bytes, bool)> {
+    use serde_json::Value;
+
+    // Parse the OpenAI request
+    let openai_req: Value = serde_json::from_slice(body)
+        .map_err(|e| Error::internal_err(format!("Failed to parse OpenAI request: {}", e)))?;
+
+    // Extract model and streaming flag
+    let model = openai_req["model"]
+        .as_str()
+        .ok_or_else(|| Error::BadRequest("Missing 'model' field in request".to_string()))?
+        .to_string();
+
+    let is_streaming = openai_req["stream"].as_bool().unwrap_or(false);
+
+    // Build Bedrock request
+    let mut bedrock_req = serde_json::json!({});
+
+    // Transform messages
+    if let Some(messages) = openai_req["messages"].as_array() {
+        let mut system_messages = Vec::new();
+        let mut conversation_messages = Vec::new();
+
+        for msg in messages {
+            let role = msg["role"].as_str().unwrap_or("");
+
+            match role {
+                "system" => {
+                    // Extract system messages to separate array
+                    if let Some(content) = msg["content"].as_str() {
+                        system_messages.push(serde_json::json!({"text": content}));
+                    }
+                }
+                "user" | "assistant" => {
+                    // Normalize content to array format
+                    let mut content = if let Some(text) = msg["content"].as_str() {
+                        // Simple string → array of content blocks
+                        vec![serde_json::json!({"text": text})]
+                    } else if let Some(content_array) = msg["content"].as_array() {
+                        // Already an array - transform each item
+                        content_array
+                            .iter()
+                            .filter_map(|item| {
+                                if let Some(text) = item["text"].as_str() {
+                                    Some(serde_json::json!({"text": text}))
+                                } else if item["type"].as_str() == Some("text") {
+                                    Some(serde_json::json!({"text": item["text"]}))
+                                } else if item["type"].as_str() == Some("image_url") {
+                                    // Transform image_url format if needed
+                                    // For now, pass through - may need more sophisticated handling
+                                    Some(item.clone())
+                                } else {
+                                    None
+                                }
+                            })
+                            .collect()
+                    } else {
+                        vec![]
+                    };
+
+                    // Handle tool_calls for assistant messages (OpenAI → Bedrock toolUse)
+                    if role == "assistant" {
+                        if let Some(tool_calls) = msg["tool_calls"].as_array() {
+                            for tool_call in tool_calls {
+                                if tool_call["type"].as_str() == Some("function") {
+                                    let tool_use_id = tool_call["id"].as_str().unwrap_or("");
+                                    let function_name =
+                                        tool_call["function"]["name"].as_str().unwrap_or("");
+                                    let arguments_str =
+                                        tool_call["function"]["arguments"].as_str().unwrap_or("{}");
+
+                                    // Parse arguments JSON string to object
+                                    let input = serde_json::from_str::<Value>(arguments_str)
+                                        .map_err(|e| {
+                                            Error::internal_err(format!(
+                                                "Failed to parse tool call arguments: {}",
+                                                e
+                                            ))
+                                        })?;
+
+                                    content.push(serde_json::json!({
+                                        "toolUse": {
+                                            "toolUseId": tool_use_id,
+                                            "name": function_name,
+                                            "input": input
+                                        }
+                                    }));
+                                }
+                            }
+                        }
+                    }
+
+                    // Only add message if it has content
+                    if !content.is_empty() {
+                        conversation_messages.push(serde_json::json!({
+                            "role": role,
+                            "content": content
+                        }));
+                    }
+                }
+                "tool" => {
+                    // Transform tool response to Bedrock format
+                    let tool_call_id = msg["tool_call_id"].as_str().unwrap_or("");
+                    let content = msg["content"].as_str().unwrap_or("");
+
+                    // Try to parse content as JSON
+                    // Bedrock requires json field to be an object, not a primitive or array
+                    let tool_result_content =
+                        if let Ok(json_content) = serde_json::from_str::<Value>(content) {
+                            if json_content.is_object() {
+                                vec![serde_json::json!({"json": json_content})]
+                            } else {
+                                // Wrap primitives and arrays in an object
+                                vec![serde_json::json!({"json": {"result": json_content}})]
+                            }
+                        } else {
+                            vec![serde_json::json!({"text": content})]
+                        };
+
+                    conversation_messages.push(serde_json::json!({
+                        "role": "user",
+                        "content": [{
+                            "toolResult": {
+                                "toolUseId": tool_call_id,
+                                "content": tool_result_content
+                            }
+                        }]
+                    }));
+                }
+                _ => {}
+            }
+        }
+
+        if !system_messages.is_empty() {
+            bedrock_req["system"] = Value::Array(system_messages);
+        }
+        bedrock_req["messages"] = Value::Array(conversation_messages);
+    }
+
+    // Transform inference parameters
+    let mut inference_config = serde_json::json!({});
+    if let Some(max_tokens) = openai_req["max_tokens"].as_i64() {
+        inference_config["maxTokens"] = Value::Number(max_tokens.into());
+    }
+    if let Some(temperature) = openai_req["temperature"].as_f64() {
+        inference_config["temperature"] = serde_json::json!(temperature);
+    }
+    if let Some(top_p) = openai_req["top_p"].as_f64() {
+        inference_config["topP"] = serde_json::json!(top_p);
+    }
+    if let Some(stop) = openai_req["stop"].as_array() {
+        let stop_sequences: Vec<String> = stop
+            .iter()
+            .filter_map(|s| s.as_str().map(|s| s.to_string()))
+            .collect();
+        if !stop_sequences.is_empty() {
+            inference_config["stopSequences"] =
+                Value::Array(stop_sequences.into_iter().map(Value::String).collect());
+        }
+    }
+    if !inference_config.as_object().unwrap().is_empty() {
+        bedrock_req["inferenceConfig"] = inference_config;
+    }
+
+    // Transform tools if present
+    if let Some(tools) = openai_req["tools"].as_array() {
+        let mut bedrock_tools = Vec::new();
+
+        for tool in tools {
+            if tool["type"].as_str() == Some("function") {
+                if let Some(function) = tool["function"].as_object() {
+                    bedrock_tools.push(serde_json::json!({
+                        "toolSpec": {
+                            "name": function.get("name"),
+                            "description": function.get("description")
+                                .and_then(|v| v.as_str())
+                                .filter(|s| !s.is_empty())
+                                .unwrap_or("Tool function"),
+                            "inputSchema": {
+                                "json": function.get("parameters")
+                            }
+                        }
+                    }));
+                }
+            }
+        }
+
+        if !bedrock_tools.is_empty() {
+            let mut tool_config = serde_json::json!({
+                "tools": bedrock_tools
+            });
+
+            // Transform tool_choice
+            if let Some(tool_choice) = openai_req.get("tool_choice") {
+                if tool_choice == "auto" {
+                    tool_config["toolChoice"] = serde_json::json!({"auto": {}});
+                } else if tool_choice == "required" {
+                    tool_config["toolChoice"] = serde_json::json!({"any": {}});
+                } else if let Some(obj) = tool_choice.as_object() {
+                    if obj.get("type").and_then(|v| v.as_str()) == Some("function") {
+                        if let Some(function) = obj.get("function").and_then(|v| v.as_object()) {
+                            if let Some(name) = function.get("name").and_then(|v| v.as_str()) {
+                                tool_config["toolChoice"] = serde_json::json!({
+                                    "tool": {"name": name}
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+
+            bedrock_req["toolConfig"] = tool_config;
+        }
+    }
+
+    let transformed_body = serde_json::to_vec(&bedrock_req)
+        .map_err(|e| Error::internal_err(format!("Failed to serialize Bedrock request: {}", e)))?
+        .into();
+
+    Ok((model, transformed_body, is_streaming))
+}
+
+/// Transform AWS Bedrock Converse response to OpenAI format
+pub async fn transform_bedrock_to_openai(
+    response: reqwest::Response,
+    model: String,
+) -> Result<Bytes> {
+    use serde_json::Value;
+
+    let bedrock_resp: Value = response
+        .json()
+        .await
+        .map_err(|e| Error::internal_err(format!("Failed to parse Bedrock response: {}", e)))?;
+
+    // Generate unique ID and timestamp
+    let id = format!("chatcmpl-{}", uuid::Uuid::new_v4().simple());
+    let created = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+
+    // Extract stop reason and map to finish_reason
+    let stop_reason = bedrock_resp["stopReason"].as_str().unwrap_or("end_turn");
+    let finish_reason = match stop_reason {
+        "end_turn" => "stop",
+        "max_tokens" => "length",
+        "tool_use" => "tool_calls",
+        "stop_sequence" => "stop",
+        "guardrail_intervened" | "content_filtered" => "content_filter",
+        _ => "stop",
+    };
+
+    // Extract message content
+    let message_content = &bedrock_resp["output"]["message"]["content"];
+    let mut text_content = String::new();
+    let mut tool_calls = Vec::new();
+
+    if let Some(content_array) = message_content.as_array() {
+        for (_index, block) in content_array.iter().enumerate() {
+            if let Some(text) = block["text"].as_str() {
+                text_content.push_str(text);
+            } else if let Some(tool_use) = block.get("toolUse") {
+                // Transform tool use to OpenAI tool_calls format
+                let tool_call_id = tool_use["toolUseId"].as_str().unwrap_or("");
+                let name = tool_use["name"].as_str().unwrap_or("");
+                let input = &tool_use["input"];
+
+                tool_calls.push(serde_json::json!({
+                    "id": tool_call_id,
+                    "type": "function",
+                    "function": {
+                        "name": name,
+                        "arguments": serde_json::to_string(input).unwrap_or_default()
+                    }
+                }));
+            }
+        }
+    }
+
+    // Build the message
+    let message = if !tool_calls.is_empty() {
+        serde_json::json!({
+            "role": "assistant",
+            "content": if text_content.is_empty() { Value::Null } else { Value::String(text_content) },
+            "tool_calls": tool_calls
+        })
+    } else {
+        serde_json::json!({
+            "role": "assistant",
+            "content": text_content
+        })
+    };
+
+    // Extract usage information
+    let usage = if let Some(usage_data) = bedrock_resp.get("usage") {
+        serde_json::json!({
+            "prompt_tokens": usage_data["inputTokens"].as_i64().unwrap_or(0),
+            "completion_tokens": usage_data["outputTokens"].as_i64().unwrap_or(0),
+            "total_tokens": usage_data["totalTokens"].as_i64().unwrap_or(0)
+        })
+    } else {
+        serde_json::json!({
+            "prompt_tokens": 0,
+            "completion_tokens": 0,
+            "total_tokens": 0
+        })
+    };
+
+    // Build OpenAI-format response
+    let openai_resp = serde_json::json!({
+        "id": id,
+        "object": "chat.completion",
+        "created": created,
+        "model": model,
+        "choices": [{
+            "index": 0,
+            "message": message,
+            "finish_reason": finish_reason
+        }],
+        "usage": usage
+    });
+
+    let response_body = serde_json::to_vec(&openai_resp)
+        .map_err(|e| Error::internal_err(format!("Failed to serialize OpenAI response: {}", e)))?
+        .into();
+
+    Ok(response_body)
+}
+
+/// Transform AWS Bedrock streaming response to OpenAI SSE format
+/// Bedrock uses AWS event stream binary format, not SSE
+pub fn transform_bedrock_stream_to_openai(
+    stream: impl futures::Stream<Item = std::result::Result<bytes::Bytes, reqwest::Error>>
+        + Send
+        + 'static,
+    model: String,
+) -> impl futures::Stream<Item = std::result::Result<bytes::Bytes, std::io::Error>> + Send {
+    use futures::stream::StreamExt;
+    use serde_json::Value;
+    use std::collections::HashMap;
+
+    let id = format!("chatcmpl-{}", uuid::Uuid::new_v4().simple());
+    let created = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+
+    // State to track partial tool calls and binary buffer
+    struct StreamState {
+        id: String,
+        model: String,
+        created: u64,
+        tool_calls: HashMap<usize, (String, String, String)>, // index -> (id, name, args)
+        buffer: Vec<u8>,                                      // Binary buffer for AWS event stream
+    }
+
+    let state = std::sync::Arc::new(tokio::sync::Mutex::new(StreamState {
+        id: id.clone(),
+        model: model.clone(),
+        created,
+        tool_calls: HashMap::new(),
+        buffer: Vec::new(),
+    }));
+
+    stream
+        .then(move |chunk_result| {
+            let state = state.clone();
+            async move {
+                match chunk_result {
+                    Ok(chunk) => {
+                        let mut state = state.lock().await;
+                        state.buffer.extend_from_slice(&chunk);
+
+                        let mut events = Vec::new();
+
+                        // Parse AWS event stream messages from buffer
+                        loop {
+                            // Need at least 12 bytes for prelude (8) + prelude CRC (4)
+                            if state.buffer.len() < 12 {
+                                break;
+                            }
+
+                            // Read prelude: total_length (4 bytes) + headers_length (4 bytes)
+                            let total_length = u32::from_be_bytes([
+                                state.buffer[0],
+                                state.buffer[1],
+                                state.buffer[2],
+                                state.buffer[3],
+                            ]) as usize;
+
+                            // Check if we have the complete message
+                            if state.buffer.len() < total_length {
+                                break;
+                            }
+
+                            let headers_length = u32::from_be_bytes([
+                                state.buffer[4],
+                                state.buffer[5],
+                                state.buffer[6],
+                                state.buffer[7],
+                            ]) as usize;
+
+                            // Skip prelude CRC (4 bytes after prelude)
+                            let headers_start = 12;
+                            let payload_start = headers_start + headers_length;
+                            let payload_end = total_length - 4; // Exclude message CRC
+
+                            // Parse headers to extract event type
+                            let mut event_type = None;
+                            let mut pos = headers_start;
+                            while pos < payload_start {
+                                if pos + 1 > state.buffer.len() {
+                                    break;
+                                }
+                                let name_len = state.buffer[pos] as usize;
+                                pos += 1;
+
+                                if pos + name_len > state.buffer.len() {
+                                    break;
+                                }
+                                let name = String::from_utf8_lossy(&state.buffer[pos..pos + name_len]).to_string();
+                                pos += name_len;
+
+                                if pos + 3 > state.buffer.len() {
+                                    break;
+                                }
+                                let value_type = state.buffer[pos];
+                                pos += 1;
+                                let value_len = u16::from_be_bytes([state.buffer[pos], state.buffer[pos + 1]]) as usize;
+                                pos += 2;
+
+                                if pos + value_len > state.buffer.len() {
+                                    break;
+                                }
+
+                                if value_type == 7 && name == ":event-type" {
+                                    event_type = Some(String::from_utf8_lossy(&state.buffer[pos..pos + value_len]).to_string());
+                                }
+                                pos += value_len;
+                            }
+
+                            // Extract JSON payload (copy to avoid borrow issues)
+                            let payload = state.buffer[payload_start..payload_end].to_vec();
+
+                            // Remove processed message from buffer
+                            state.buffer.drain(0..total_length);
+
+                            // Process the event
+                            if let Some(evt_type) = event_type {
+                                if let Ok(payload_str) = std::str::from_utf8(&payload) {
+                                    if let Ok(parsed_data) = serde_json::from_str::<Value>(payload_str) {
+                                    // Transform based on event type
+                                    match evt_type.as_str() {
+                                        "messageStart" => {
+                                            // No output for messageStart
+                                        }
+                                        "contentBlockStart" => {
+                                            let index = parsed_data["contentBlockIndex"].as_u64().unwrap_or(0) as usize;
+
+                                            if let Some(tool_use) = parsed_data["start"].get("toolUse") {
+                                                let tool_id = tool_use["toolUseId"].as_str().unwrap_or("").to_string();
+                                                let name = tool_use["name"].as_str().unwrap_or("").to_string();
+
+                                                state.tool_calls.insert(index, (tool_id.clone(), name.clone(), String::new()));
+
+                                                // Send initial tool call chunk
+                                                let chunk = serde_json::json!({
+                                                    "id": state.id,
+                                                    "object": "chat.completion.chunk",
+                                                    "created": state.created,
+                                                    "model": state.model,
+                                                    "choices": [{
+                                                        "index": 0,
+                                                        "delta": {
+                                                            "tool_calls": [{
+                                                                "index": index,
+                                                                "id": tool_id,
+                                                                "type": "function",
+                                                                "function": {
+                                                                    "name": name,
+                                                                    "arguments": ""
+                                                                }
+                                                            }]
+                                                        },
+                                                        "finish_reason": Value::Null
+                                                    }]
+                                                });
+
+                                                events.push(Ok(bytes::Bytes::from(format!("data: {}\n\n", chunk))));
+                                            }
+                                        }
+                                        "contentBlockDelta" => {
+                                            let index = parsed_data["contentBlockIndex"].as_u64().unwrap_or(0) as usize;
+
+                                            if let Some(text) = parsed_data["delta"]["text"].as_str() {
+                                                // Text content delta
+                                                let chunk = serde_json::json!({
+                                                    "id": state.id,
+                                                    "object": "chat.completion.chunk",
+                                                    "created": state.created,
+                                                    "model": state.model,
+                                                    "choices": [{
+                                                        "index": 0,
+                                                        "delta": {
+                                                            "content": text
+                                                        },
+                                                        "finish_reason": Value::Null
+                                                    }]
+                                                });
+
+                                                events.push(Ok(bytes::Bytes::from(format!("data: {}\n\n", chunk))));
+                                            } else if let Some(tool_use_input) = parsed_data["delta"]["toolUse"]["input"].as_str() {
+                                                // Tool use arguments delta
+                                                if let Some((_tool_id, _name, ref mut args)) = state.tool_calls.get_mut(&index) {
+                                                    args.push_str(tool_use_input);
+
+                                                    let chunk = serde_json::json!({
+                                                        "id": state.id,
+                                                        "object": "chat.completion.chunk",
+                                                        "created": state.created,
+                                                        "model": state.model,
+                                                        "choices": [{
+                                                            "index": 0,
+                                                            "delta": {
+                                                                "tool_calls": [{
+                                                                    "index": index,
+                                                                    "function": {
+                                                                        "arguments": tool_use_input
+                                                                    }
+                                                                }]
+                                                            },
+                                                            "finish_reason": Value::Null
+                                                        }]
+                                                    });
+
+                                                    events.push(Ok(bytes::Bytes::from(format!("data: {}\n\n", chunk))));
+                                                }
+                                            }
+                                        }
+                                        "contentBlockStop" => {
+                                            // No output needed
+                                        }
+                                        "messageStop" => {
+                                            let stop_reason = parsed_data["stopReason"].as_str().unwrap_or("end_turn");
+                                            let finish_reason = match stop_reason {
+                                                "end_turn" => "stop",
+                                                "max_tokens" => "length",
+                                                "tool_use" => "tool_calls",
+                                                "stop_sequence" => "stop",
+                                                "guardrail_intervened" | "content_filtered" => "content_filter",
+                                                _ => "stop",
+                                            };
+
+                                            let chunk = serde_json::json!({
+                                                "id": state.id,
+                                                "object": "chat.completion.chunk",
+                                                "created": state.created,
+                                                "model": state.model,
+                                                "choices": [{
+                                                    "index": 0,
+                                                    "delta": {},
+                                                    "finish_reason": finish_reason
+                                                }]
+                                            });
+
+                                            events.push(Ok(bytes::Bytes::from(format!("data: {}\n\n", chunk))));
+                                        }
+                                        "metadata" => {
+                                            // Could include usage info here if needed
+                                        }
+                                        _ => {}
+                                    }
+                                    }
+                                }
+                            }
+                        } // end loop
+
+                        events
+                    }
+                    Err(e) => {
+                        vec![Err(std::io::Error::new(
+                            std::io::ErrorKind::Other,
+                            e.to_string(),
+                        ))]
+                    }
+                }
+            }
+        })
+        .flat_map(|events| futures::stream::iter(events))
+        .chain(futures::stream::iter(vec![
+            // Send [DONE] at the end
+            Ok(bytes::Bytes::from("data: [DONE]\n\n"))
+        ]))
+}
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index cd2f963680..3a83b11ce8 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -75,6 +75,7 @@ pub mod agent_workers_ee;
 #[cfg(feature = "agent_worker_server")]
 mod agent_workers_oss;
 mod ai;
+mod bedrock;
 mod apps;
 pub mod args;
 mod assets;
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 674c48ffd3..123d1a5ea4 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -64,6 +64,8 @@ object_store = { workspace = true, optional = true }
 prometheus = { workspace = true, optional = true }
 aws-config = { workspace = true, optional = true }
 aws-sdk-sts = { workspace = true, optional = true }
+aws-credential-types.workspace = true
+aws-smithy-types.workspace = true
 base64.workspace = true
 bitflags.workspace = true
 
diff --git a/backend/windmill-common/src/ai_providers.rs b/backend/windmill-common/src/ai_providers.rs
index 46d5d687c3..58d2e041e4 100644
--- a/backend/windmill-common/src/ai_providers.rs
+++ b/backend/windmill-common/src/ai_providers.rs
@@ -27,11 +27,18 @@ pub enum AIProvider {
     OpenRouter,
     TogetherAI,
     CustomAI,
+    #[serde(rename = "aws_bedrock")]
+    AWSBedrock,
 }
 
 impl AIProvider {
     /// Get the base URL for the AI provider
-    pub async fn get_base_url(&self, resource_base_url: Option<String>, db: &DB) -> Result<String> {
+    pub async fn get_base_url(
+        &self,
+        resource_base_url: Option<String>,
+        region: Option<String>,
+        db: &DB,
+    ) -> Result<String> {
         match self {
             AIProvider::OpenAI => {
                 // Check for Azure base path override
@@ -74,6 +81,10 @@ impl AIProvider {
                     )))
                 }
             }
+            AIProvider::AWSBedrock => Ok(format!(
+                "https://bedrock-runtime.{}.amazonaws.com",
+                region.unwrap_or_else(|| "us-east-1".to_string())
+            )),
         }
     }
 
diff --git a/backend/windmill-worker/Cargo.toml b/backend/windmill-worker/Cargo.toml
index d7e0f66685..19ebb88db5 100644
--- a/backend/windmill-worker/Cargo.toml
+++ b/backend/windmill-worker/Cargo.toml
@@ -58,6 +58,10 @@ windmill-parser-graphql.workspace = true
 windmill-parser-php = { workspace = true, optional = true }
 windmill-git-sync.workspace = true
 rmcp = { version = "0.8.1", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
+aws-sdk-bedrockruntime.workspace = true
+aws-config.workspace = true
+aws-credential-types.workspace = true
+aws-smithy-types.workspace = true
 flume.workspace = true
 sqlx.workspace = true
 uuid.workspace = true
diff --git a/backend/windmill-worker/src/ai/image_handler.rs b/backend/windmill-worker/src/ai/image_handler.rs
index c668ded17f..946c922fed 100644
--- a/backend/windmill-worker/src/ai/image_handler.rs
+++ b/backend/windmill-worker/src/ai/image_handler.rs
@@ -4,6 +4,8 @@ use ulid;
 use windmill_common::{client::AuthedClient, error::Error, s3_helpers::S3Object};
 use windmill_queue::MiniPulledJob;
 
+use crate::ai::types::*;
+
 /// Upload image to S3 and return S3Object
 pub async fn upload_image_to_s3(
     base64_image: &str,
@@ -66,3 +68,53 @@ pub async fn download_and_encode_s3_image(
 
     Ok((mime_type.to_string(), base64_data))
 }
+
+/// Prepare messages for API by converting S3Objects to base64 ImageUrls
+pub async fn prepare_messages_for_api(
+    messages: &[OpenAIMessage],
+    client: &AuthedClient,
+    workspace_id: &str,
+) -> Result<Vec<OpenAIMessage>, Error> {
+    let mut prepared_messages = Vec::new();
+
+    for message in messages {
+        let mut prepared_message = message.clone();
+
+        if let Some(content) = &message.content {
+            match content {
+                OpenAIContent::Text(text) => {
+                    prepared_message.content = Some(OpenAIContent::Text(text.clone()));
+                }
+                OpenAIContent::Parts(parts) => {
+                    let mut prepared_content = Vec::new();
+
+                    for part in parts {
+                        match part {
+                            ContentPart::S3Object { s3_object } => {
+                                // Convert S3Object to base64 image URL
+                                let (mime_type, image_bytes) =
+                                    download_and_encode_s3_image(s3_object, client, workspace_id)
+                                        .await?;
+                                prepared_content.push(ContentPart::ImageUrl {
+                                    image_url: ImageUrlData {
+                                        url: format!("data:{};base64,{}", mime_type, image_bytes),
+                                    },
+                                });
+                            }
+                            other => {
+                                // Keep Text and ImageUrl as-is
+                                prepared_content.push(other.clone());
+                            }
+                        }
+                    }
+
+                    prepared_message.content = Some(OpenAIContent::Parts(prepared_content));
+                }
+            }
+        }
+
+        prepared_messages.push(prepared_message);
+    }
+
+    Ok(prepared_messages)
+}
diff --git a/backend/windmill-worker/src/ai/providers/bedrock.rs b/backend/windmill-worker/src/ai/providers/bedrock.rs
new file mode 100644
index 0000000000..18d08d0a41
--- /dev/null
+++ b/backend/windmill-worker/src/ai/providers/bedrock.rs
@@ -0,0 +1,804 @@
+use crate::ai::{
+    image_handler::prepare_messages_for_api,
+    providers::openai::{OpenAIFunction, OpenAIToolCall},
+    query_builder::{ParsedResponse, StreamEventProcessor},
+    types::StreamingEvent,
+    types::{ContentPart, OpenAIContent, OpenAIMessage, ToolDef},
+};
+use aws_config::BehaviorVersion;
+use aws_credential_types::provider::token::ProvideToken;
+use aws_sdk_bedrockruntime::types::{
+    ContentBlock, ConversationRole, ConverseStreamOutput, ImageBlock, ImageFormat, ImageSource,
+    InferenceConfiguration, Message, SystemContentBlock, Tool, ToolInputSchema, ToolSpecification,
+};
+use aws_sdk_bedrockruntime::Client as BedrockRuntimeClient;
+use std::collections::HashMap;
+use windmill_common::{client::AuthedClient, error::Error};
+
+/// Constants for commonly used strings to avoid allocations
+const FUNCTION_TYPE: &str = "function";
+const EMPTY_JSON: &str = "{}";
+
+#[derive(Debug, Clone)]
+pub struct BearerTokenProvider {
+    token: String,
+}
+
+impl BearerTokenProvider {
+    pub fn new(token: String) -> Self {
+        Self { token }
+    }
+}
+
+impl ProvideToken for BearerTokenProvider {
+    fn provide_token<'a>(&'a self) -> aws_credential_types::provider::future::ProvideToken<'a>
+    where
+        Self: 'a,
+    {
+        aws_credential_types::provider::future::ProvideToken::ready(Ok(
+            aws_credential_types::Token::new(self.token.clone(), None),
+        ))
+    }
+}
+
+pub struct BedrockClient {
+    client: BedrockRuntimeClient,
+}
+
+impl BedrockClient {
+    pub async fn from_bearer_token(bearer_token: String, region: &str) -> Result<Self, Error> {
+        let config = aws_sdk_bedrockruntime::config::Builder::new()
+            .region(aws_config::Region::new(region.to_string()))
+            .behavior_version(BehaviorVersion::latest())
+            .token_provider(BearerTokenProvider::new(bearer_token))
+            .build();
+
+        Ok(Self { client: BedrockRuntimeClient::from_conf(config) })
+    }
+
+    pub fn client(&self) -> &BedrockRuntimeClient {
+        &self.client
+    }
+}
+
+/// Format AWS SDK errors with detailed information
+fn format_bedrock_error<E, R>(error: &aws_sdk_bedrockruntime::error::SdkError<E, R>) -> String
+where
+    E: std::fmt::Debug + std::fmt::Display,
+    R: std::fmt::Debug,
+{
+    use aws_sdk_bedrockruntime::error::SdkError;
+
+    match error {
+        SdkError::ServiceError(err) => {
+            // Include both the display and debug representations for maximum detail
+            format!("Service error: {} (details: {:?})", err.err(), err)
+        }
+        SdkError::ConstructionFailure(err) => {
+            format!("Request construction failed: {:?}", err)
+        }
+        SdkError::DispatchFailure(err) => {
+            format!("Request dispatch failed: {:?}", err)
+        }
+        SdkError::ResponseError(err) => {
+            format!("Response error: {:?}", err)
+        }
+        SdkError::TimeoutError(err) => {
+            format!("Request timeout: {:?}", err)
+        }
+        _ => format!("{:?}", error),
+    }
+}
+
+/// Convert AWS Smithy Document to serde_json::Value
+fn document_to_json(doc: &aws_smithy_types::Document) -> serde_json::Value {
+    use aws_smithy_types::Document;
+
+    match doc {
+        Document::Object(map) => {
+            let mut obj = serde_json::Map::new();
+            for (k, v) in map {
+                obj.insert(k.clone(), document_to_json(v));
+            }
+            serde_json::Value::Object(obj)
+        }
+        Document::Array(arr) => {
+            serde_json::Value::Array(arr.iter().map(document_to_json).collect())
+        }
+        Document::Number(num) => {
+            // Try to parse as different number types
+            serde_json::Value::Number(
+                serde_json::Number::from_f64(num.to_f64_lossy())
+                    .unwrap_or(serde_json::Number::from(0)),
+            )
+        }
+        Document::String(s) => serde_json::Value::String(s.clone()),
+        Document::Bool(b) => serde_json::Value::Bool(*b),
+        Document::Null => serde_json::Value::Null,
+    }
+}
+
+/// Convert serde_json::Value to AWS Smithy Document
+fn json_to_document(value: serde_json::Value) -> aws_smithy_types::Document {
+    use aws_smithy_types::Document;
+    use serde_json::Value;
+
+    match value {
+        Value::Object(map) => {
+            let mut doc_map = std::collections::HashMap::new();
+            for (k, v) in map {
+                doc_map.insert(k, json_to_document(v));
+            }
+            Document::Object(doc_map)
+        }
+        Value::Array(arr) => Document::Array(arr.into_iter().map(json_to_document).collect()),
+        Value::Number(num) => {
+            if let Some(i) = num.as_i64() {
+                Document::Number(aws_smithy_types::Number::PosInt(i as u64))
+            } else if let Some(f) = num.as_f64() {
+                Document::Number(aws_smithy_types::Number::Float(f))
+            } else {
+                Document::Number(aws_smithy_types::Number::PosInt(0))
+            }
+        }
+        Value::String(s) => Document::String(s),
+        Value::Bool(b) => Document::Bool(b),
+        Value::Null => Document::Null,
+    }
+}
+
+/// Convert OpenAI-style messages to Bedrock format
+///
+/// Separates system messages from conversation messages as required by Bedrock API.
+///
+/// # Returns
+/// Tuple of (conversation_messages, system_prompts)
+pub fn openai_messages_to_bedrock(
+    messages: &[OpenAIMessage],
+) -> Result<(Vec<Message>, Vec<SystemContentBlock>), Error> {
+    let mut bedrock_messages = Vec::new();
+    let mut system_prompts = Vec::new();
+
+    for msg in messages {
+        match msg.role.as_str() {
+            "system" => {
+                // Extract system messages separately
+                if let Some(ref content) = msg.content {
+                    let text = content_to_text(content);
+                    if !text.is_empty() {
+                        system_prompts.push(SystemContentBlock::Text(text));
+                    }
+                }
+            }
+            "user" | "assistant" => {
+                bedrock_messages.push(convert_message(msg)?);
+            }
+            "tool" => {
+                // Tool results are handled as user messages with ToolResult content
+                bedrock_messages.push(convert_tool_message(msg)?);
+            }
+            _ => {
+                return Err(Error::BadRequest(format!("Unsupported role: {}", msg.role)));
+            }
+        }
+    }
+
+    Ok((bedrock_messages, system_prompts))
+}
+
+/// Helper to extract text from OpenAIContent (ignoring images)
+fn content_to_text(content: &OpenAIContent) -> String {
+    match content {
+        OpenAIContent::Text(text) => text.to_string(),
+        OpenAIContent::Parts(parts) => {
+            // Extract only text parts and join them
+            let text_parts: Vec<&str> = parts
+                .iter()
+                .filter_map(|part| match part {
+                    ContentPart::Text { text } => Some(text.as_str()),
+                    _ => None,
+                })
+                .collect();
+            text_parts.join(" ")
+        }
+    }
+}
+
+/// Parse image data URL and extract format and base64 data
+fn parse_image_data_url(url: &str) -> Result<(ImageFormat, Vec<u8>), Error> {
+    if !url.starts_with("data:") {
+        return Err(Error::internal_err("Image URL must be a data URL"));
+    }
+
+    // Parse data:image/png;base64,<data>
+    let base64_start = url
+        .find("base64,")
+        .ok_or_else(|| Error::internal_err("Invalid data URL format"))?;
+
+    let base64_data = &url[base64_start + 7..];
+    let mime_type = url
+        .split(';')
+        .next()
+        .and_then(|s| s.strip_prefix("data:"))
+        .unwrap_or("image/png");
+
+    // Extract format from MIME type (e.g., "image/png" -> "png")
+    let format_str = mime_type
+        .rsplit_once('/')
+        .map(|(_, format)| format)
+        .unwrap_or("png");
+
+    // Map to ImageFormat enum
+    let format = match format_str {
+        "png" => ImageFormat::Png,
+        "jpeg" | "jpg" => ImageFormat::Jpeg,
+        "gif" => ImageFormat::Gif,
+        "webp" => ImageFormat::Webp,
+        _ => ImageFormat::Png, // Default to PNG
+    };
+
+    // Decode base64
+    let bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, base64_data)
+        .map_err(|e| Error::internal_err(format!("Failed to decode base64 image: {}", e)))?;
+
+    Ok((format, bytes))
+}
+
+/// Convert a ContentPart to Bedrock ContentBlock
+fn content_part_to_block(part: &ContentPart) -> Result<Option<ContentBlock>, Error> {
+    match part {
+        ContentPart::Text { text } => {
+            if text.is_empty() {
+                Ok(None)
+            } else {
+                Ok(Some(ContentBlock::Text(text.clone())))
+            }
+        }
+        ContentPart::ImageUrl { image_url } => {
+            let (format, bytes) = parse_image_data_url(&image_url.url)?;
+
+            let image_source = ImageSource::Bytes(bytes.into());
+            let image_block = ImageBlock::builder()
+                .format(format)
+                .source(image_source)
+                .build()
+                .map_err(|e| Error::internal_err(format!("Failed to build image block: {}", e)))?;
+
+            Ok(Some(ContentBlock::Image(image_block)))
+        }
+        ContentPart::S3Object { .. } => {
+            // S3Objects are already converted to ImageUrl by prepare_messages_for_api
+            // If we somehow get here, skip it
+            Ok(None)
+        }
+    }
+}
+
+/// Convert a single OpenAI message to Bedrock Message
+fn convert_message(msg: &OpenAIMessage) -> Result<Message, Error> {
+    let role = match msg.role.as_str() {
+        "user" => ConversationRole::User,
+        "assistant" => ConversationRole::Assistant,
+        _ => {
+            return Err(Error::internal_err(format!(
+                "Unsupported role: {}",
+                msg.role
+            )));
+        }
+    };
+
+    let mut content_blocks = Vec::new();
+
+    // Handle content (text and/or images)
+    if let Some(ref content) = msg.content {
+        match content {
+            OpenAIContent::Text(text) => {
+                if !text.is_empty() {
+                    content_blocks.push(ContentBlock::Text(text.clone()));
+                }
+            }
+            OpenAIContent::Parts(parts) => {
+                for part in parts {
+                    if let Some(block) = content_part_to_block(part)? {
+                        content_blocks.push(block);
+                    }
+                }
+            }
+        }
+    }
+
+    // Handle tool calls (for assistant messages)
+    if let Some(ref tool_calls) = msg.tool_calls {
+        for tc in tool_calls {
+            content_blocks.push(convert_tool_call_to_content(tc)?);
+        }
+    }
+
+    // Bedrock requires at least one content block
+    if content_blocks.is_empty() {
+        content_blocks.push(ContentBlock::Text(String::new()));
+    }
+
+    Message::builder()
+        .role(role)
+        .set_content(Some(content_blocks))
+        .build()
+        .map_err(|e| Error::internal_err(format!("Failed to build message: {}", e)))
+}
+
+/// Convert OpenAI tool call to Bedrock ToolUse content block
+fn convert_tool_call_to_content(tool_call: &OpenAIToolCall) -> Result<ContentBlock, Error> {
+    let input = json_to_document(
+        serde_json::from_str(&tool_call.function.arguments)
+            .unwrap_or_else(|_| serde_json::json!({})),
+    );
+    Ok(ContentBlock::ToolUse(
+        aws_sdk_bedrockruntime::types::ToolUseBlock::builder()
+            .tool_use_id(&tool_call.id)
+            .name(&tool_call.function.name)
+            .input(input)
+            .build()
+            .map_err(|e| Error::internal_err(format!("Failed to build tool use: {}", e)))?,
+    ))
+}
+
+/// Convert tool result message to Bedrock format
+fn convert_tool_message(msg: &OpenAIMessage) -> Result<Message, Error> {
+    let tool_call_id = msg
+        .tool_call_id
+        .as_ref()
+        .ok_or_else(|| Error::internal_err("Tool message missing tool_call_id"))?;
+
+    let content_str = msg
+        .content
+        .as_ref()
+        .map(|c| content_to_text(c))
+        .unwrap_or_default();
+
+    // Try to parse as JSON, otherwise use text
+    let tool_result_content =
+        if let Ok(json_val) = serde_json::from_str::<serde_json::Value>(&content_str) {
+            if json_val.is_object() {
+                vec![aws_sdk_bedrockruntime::types::ToolResultContentBlock::Json(
+                    json_to_document(json_val),
+                )]
+            } else {
+                // Wrap primitives and arrays in an object
+                vec![aws_sdk_bedrockruntime::types::ToolResultContentBlock::Json(
+                    json_to_document(serde_json::json!({"result": json_val})),
+                )]
+            }
+        } else {
+            vec![aws_sdk_bedrockruntime::types::ToolResultContentBlock::Text(
+                content_str.to_string(),
+            )]
+        };
+
+    let tool_result = ContentBlock::ToolResult(
+        aws_sdk_bedrockruntime::types::ToolResultBlock::builder()
+            .tool_use_id(tool_call_id)
+            .set_content(Some(tool_result_content))
+            .build()
+            .map_err(|e| Error::internal_err(format!("Failed to build tool result: {}", e)))?,
+    );
+
+    Message::builder()
+        .role(ConversationRole::User)
+        .content(tool_result)
+        .build()
+        .map_err(|e| Error::internal_err(format!("Failed to build tool result message: {}", e)))
+}
+
+/// Convert OpenAI tool definitions to Bedrock format
+pub fn openai_tools_to_bedrock(tools: &[ToolDef]) -> Result<Vec<Tool>, Error> {
+    tools
+        .iter()
+        .map(|tool_def| {
+            let spec = &tool_def.function;
+
+            // Convert parameters (RawValue) to Document via serde_json::Value
+            let param_value: serde_json::Value = serde_json::from_str(spec.parameters.get())
+                .map_err(|e| Error::internal_err(format!("Invalid tool schema: {}", e)))?;
+            let input_schema = ToolInputSchema::Json(json_to_document(param_value));
+
+            let tool_spec = ToolSpecification::builder()
+                .name(&spec.name)
+                .set_description(spec.description.clone())
+                .input_schema(input_schema)
+                .build()
+                .map_err(|e| Error::internal_err(format!("Failed to build tool spec: {}", e)))?;
+
+            Ok(Tool::ToolSpec(tool_spec))
+        })
+        .collect()
+}
+
+/// Create inference configuration from parameters
+pub fn create_inference_config(
+    temperature: Option<f32>,
+    max_tokens: Option<i32>,
+) -> Option<InferenceConfiguration> {
+    if temperature.is_none() && max_tokens.is_none() {
+        return None;
+    }
+
+    let mut builder = InferenceConfiguration::builder();
+
+    if let Some(temp) = temperature {
+        builder = builder.temperature(temp);
+    }
+
+    if let Some(max_tok) = max_tokens {
+        builder = builder.max_tokens(max_tok);
+    }
+
+    Some(builder.build())
+}
+
+/// Extract text content and tool calls from Bedrock Converse response
+pub fn bedrock_response_to_openai(
+    output: &aws_sdk_bedrockruntime::operation::converse::ConverseOutput,
+) -> Result<(Option<String>, Vec<OpenAIToolCall>), Error> {
+    let mut text_content = String::new();
+    let mut tool_calls = Vec::new();
+
+    if let Some(message) = output.output().and_then(|o| o.as_message().ok()) {
+        let content_blocks = message.content();
+        if !content_blocks.is_empty() {
+            for block in content_blocks {
+                match block {
+                    ContentBlock::Text(text) => {
+                        text_content.push_str(&text);
+                    }
+                    ContentBlock::ToolUse(tool_use) => {
+                        // Convert to OpenAI tool call format
+                        // Convert aws_smithy_types::Document to serde_json::Value
+                        let input_value = document_to_json(tool_use.input());
+                        let arguments = serde_json::to_string(&input_value)
+                            .unwrap_or_else(|_| EMPTY_JSON.to_string());
+
+                        tool_calls.push(OpenAIToolCall {
+                            id: tool_use.tool_use_id().to_string(),
+                            r#type: FUNCTION_TYPE.to_string(),
+                            function: OpenAIFunction {
+                                name: tool_use.name().to_string(),
+                                arguments,
+                            },
+                        });
+                    }
+                    _ => {}
+                }
+            }
+        }
+    }
+
+    let content = if text_content.is_empty() {
+        None
+    } else {
+        Some(text_content)
+    };
+
+    Ok((content, tool_calls))
+}
+
+/// Extract text delta from Bedrock stream event
+pub fn bedrock_stream_event_to_text(event: &ConverseStreamOutput) -> Option<String> {
+    match event {
+        ConverseStreamOutput::ContentBlockDelta(delta) => delta
+            .delta()
+            .and_then(|d| d.as_text().ok())
+            .map(|s| s.to_string()),
+        _ => None,
+    }
+}
+
+/// Represents a streaming tool call being accumulated
+#[derive(Debug, Clone)]
+pub struct StreamingToolCall {
+    pub id: String,
+    pub name: String,
+    pub arguments: String,
+}
+
+/// Extract tool use start event from stream
+pub fn bedrock_stream_event_to_tool_start(
+    event: &ConverseStreamOutput,
+) -> Option<StreamingToolCall> {
+    match event {
+        ConverseStreamOutput::ContentBlockStart(start) => {
+            if let Some(tool_use) = start.start().and_then(|s| s.as_tool_use().ok()) {
+                Some(StreamingToolCall {
+                    id: tool_use.tool_use_id().to_string(),
+                    name: tool_use.name().to_string(),
+                    arguments: String::new(),
+                })
+            } else {
+                None
+            }
+        }
+        _ => None,
+    }
+}
+
+/// Extract tool use input delta from stream
+pub fn bedrock_stream_event_to_tool_delta(event: &ConverseStreamOutput) -> Option<String> {
+    match event {
+        ConverseStreamOutput::ContentBlockDelta(delta) => delta
+            .delta()
+            .and_then(|d| d.as_tool_use().ok())
+            .map(|tool_use| tool_use.input().to_string()),
+        _ => None,
+    }
+}
+
+/// Check if stream event indicates content block stop
+pub fn bedrock_stream_event_is_block_stop(event: &ConverseStreamOutput) -> bool {
+    matches!(event, ConverseStreamOutput::ContentBlockStop(_))
+}
+
+/// Convert accumulated streaming tool calls to OpenAI format
+pub fn streaming_tool_calls_to_openai(tool_calls: Vec<StreamingToolCall>) -> Vec<OpenAIToolCall> {
+    tool_calls
+        .into_iter()
+        .map(|tc| OpenAIToolCall {
+            id: tc.id,
+            function: OpenAIFunction { name: tc.name, arguments: tc.arguments },
+            r#type: FUNCTION_TYPE.to_string(),
+        })
+        .collect()
+}
+
+#[derive(Default)]
+pub struct BedrockQueryBuilder;
+
+impl BedrockQueryBuilder {
+    /// Execute Bedrock request (streaming or non-streaming)
+    pub async fn execute_request(
+        &self,
+        messages: &[OpenAIMessage],
+        tools: Option<&[ToolDef]>,
+        model: &str,
+        temperature: Option<f32>,
+        max_tokens: Option<u32>,
+        api_key: &str,
+        region: &str,
+        should_stream: bool,
+        stream_event_processor: Option<StreamEventProcessor>,
+        client: &AuthedClient,
+        workspace_id: &str,
+        structured_output_tool_name: Option<&str>,
+    ) -> Result<ParsedResponse, Error> {
+        // Create Bedrock client with bearer token authentication
+        let bedrock_client = BedrockClient::from_bearer_token(api_key.to_string(), region).await?;
+
+        // Prepare messages: convert S3Objects to ImageUrls by downloading from S3
+        let prepared_messages = prepare_messages_for_api(messages, client, workspace_id).await?;
+
+        // Convert messages to Bedrock format (separates system prompts)
+        let (bedrock_messages, system_prompts) = openai_messages_to_bedrock(&prepared_messages)?;
+
+        // Build inference configuration
+        let inference_config = create_inference_config(temperature, max_tokens.map(|t| t as i32));
+
+        // Build tool configuration with optional ToolChoice
+        let tool_config = self.build_tool_config(tools, structured_output_tool_name.is_some())?;
+
+        if should_stream {
+            self.execute_converse_stream(
+                &bedrock_client,
+                model,
+                bedrock_messages,
+                system_prompts,
+                inference_config,
+                tool_config,
+                stream_event_processor,
+            )
+            .await
+        } else {
+            self.execute_converse(
+                &bedrock_client,
+                model,
+                bedrock_messages,
+                system_prompts,
+                inference_config,
+                tool_config,
+            )
+            .await
+        }
+    }
+
+    /// Build tool configuration with optional ToolChoice for structured output
+    fn build_tool_config(
+        &self,
+        tools: Option<&[ToolDef]>,
+        force_tool_use: bool,
+    ) -> Result<Option<aws_sdk_bedrockruntime::types::ToolConfiguration>, Error> {
+        if let Some(tools) = tools {
+            let bedrock_tools = openai_tools_to_bedrock(tools)?;
+            let mut tool_config_builder =
+                aws_sdk_bedrockruntime::types::ToolConfiguration::builder()
+                    .set_tools(Some(bedrock_tools));
+
+            // For structured output, force the model to use the tool
+            if force_tool_use {
+                tool_config_builder = tool_config_builder.tool_choice(
+                    aws_sdk_bedrockruntime::types::ToolChoice::Any(
+                        aws_sdk_bedrockruntime::types::AnyToolChoice::builder().build(),
+                    ),
+                );
+            }
+
+            Ok(Some(tool_config_builder.build().map_err(|e| {
+                Error::internal_err(format!("Failed to build tool configuration: {}", e))
+            })?))
+        } else {
+            Ok(None)
+        }
+    }
+
+    /// Execute non-streaming Bedrock request
+    async fn execute_converse(
+        &self,
+        bedrock_client: &BedrockClient,
+        model: &str,
+        bedrock_messages: Vec<aws_sdk_bedrockruntime::types::Message>,
+        system_prompts: Vec<aws_sdk_bedrockruntime::types::SystemContentBlock>,
+        inference_config: Option<aws_sdk_bedrockruntime::types::InferenceConfiguration>,
+        tool_config: Option<aws_sdk_bedrockruntime::types::ToolConfiguration>,
+    ) -> Result<ParsedResponse, Error> {
+        let mut request_builder = bedrock_client
+            .client()
+            .converse()
+            .model_id(model)
+            .set_messages(Some(bedrock_messages));
+
+        if !system_prompts.is_empty() {
+            request_builder = request_builder.set_system(Some(system_prompts));
+        }
+
+        if let Some(config) = inference_config {
+            request_builder = request_builder.inference_config(config);
+        }
+
+        if let Some(config) = tool_config {
+            request_builder = request_builder.set_tool_config(Some(config));
+        }
+
+        // Execute the request
+        let response = request_builder.send().await.map_err(|e| {
+            let error_msg = format!("Bedrock API error: {}", format_bedrock_error(&e));
+            Error::internal_err(error_msg)
+        })?;
+
+        // Convert response back to OpenAI format
+        let (content, tool_calls) = bedrock_response_to_openai(&response)?;
+
+        Ok(ParsedResponse::Text { content, tool_calls, events_str: None })
+    }
+
+    /// Execute streaming Bedrock request
+    async fn execute_converse_stream(
+        &self,
+        bedrock_client: &BedrockClient,
+        model: &str,
+        bedrock_messages: Vec<aws_sdk_bedrockruntime::types::Message>,
+        system_prompts: Vec<aws_sdk_bedrockruntime::types::SystemContentBlock>,
+        inference_config: Option<aws_sdk_bedrockruntime::types::InferenceConfiguration>,
+        tool_config: Option<aws_sdk_bedrockruntime::types::ToolConfiguration>,
+        stream_event_processor: Option<StreamEventProcessor>,
+    ) -> Result<ParsedResponse, Error> {
+        // Build streaming request
+        let mut request_builder = bedrock_client
+            .client()
+            .converse_stream()
+            .model_id(model)
+            .set_messages(Some(bedrock_messages));
+
+        if !system_prompts.is_empty() {
+            request_builder = request_builder.set_system(Some(system_prompts));
+        }
+
+        if let Some(config) = inference_config {
+            request_builder = request_builder.inference_config(config);
+        }
+
+        if let Some(config) = tool_config {
+            request_builder = request_builder.set_tool_config(Some(config));
+        }
+
+        // Execute streaming request
+        let mut stream = request_builder
+            .send()
+            .await
+            .map_err(|e| {
+                let error_msg =
+                    format!("Bedrock streaming API error: {}", format_bedrock_error(&e));
+                Error::internal_err(error_msg)
+            })?
+            .stream;
+
+        let mut accumulated_text = String::new();
+        let mut events_str = String::new();
+        let mut accumulated_tool_calls: HashMap<String, StreamingToolCall> = HashMap::new();
+        let mut current_tool_use_id: Option<String> = None;
+
+        // Process stream events
+        loop {
+            match stream.recv().await {
+                Ok(Some(event)) => {
+                    // Handle tool use start
+                    if let Some(tool_call) = bedrock_stream_event_to_tool_start(&event) {
+                        current_tool_use_id = Some(tool_call.id.clone());
+                        accumulated_tool_calls.insert(tool_call.id.clone(), tool_call);
+                    }
+
+                    // Handle text delta
+                    if let Some(text_delta) = bedrock_stream_event_to_text(&event) {
+                        accumulated_text.push_str(&text_delta);
+                        if let Some(processor) = stream_event_processor.as_ref() {
+                            processor
+                                .send(
+                                    StreamingEvent::TokenDelta { content: text_delta },
+                                    &mut events_str,
+                                )
+                                .await?;
+                        }
+                    }
+
+                    // Handle tool use input delta
+                    if let Some(input_delta) = bedrock_stream_event_to_tool_delta(&event) {
+                        if let Some(tool_id) = &current_tool_use_id {
+                            if let Some(tool_call) = accumulated_tool_calls.get_mut(tool_id) {
+                                tool_call.arguments.push_str(&input_delta);
+                            }
+                        }
+                    }
+
+                    // Handle content block stop
+                    if bedrock_stream_event_is_block_stop(&event) {
+                        current_tool_use_id = None;
+                    }
+                }
+                Ok(None) => break, // Stream ended
+                Err(e) => {
+                    return Err(Error::internal_err(format!("Bedrock stream error: {}", e)));
+                }
+            }
+        }
+
+        // Send tool call events to stream processor
+        if let Some(processor) = stream_event_processor.as_ref() {
+            for tool_call in accumulated_tool_calls.values() {
+                processor
+                    .send(
+                        StreamingEvent::ToolCallArguments {
+                            call_id: tool_call.id.clone(),
+                            function_name: tool_call.name.clone(),
+                            arguments: tool_call.arguments.clone(),
+                        },
+                        &mut events_str,
+                    )
+                    .await?;
+            }
+        }
+
+        let content = if accumulated_text.is_empty() {
+            None
+        } else {
+            Some(accumulated_text)
+        };
+
+        let tool_calls =
+            streaming_tool_calls_to_openai(accumulated_tool_calls.into_values().collect());
+
+        Ok(ParsedResponse::Text {
+            content,
+            tool_calls,
+            events_str: if events_str.is_empty() {
+                None
+            } else {
+                Some(events_str)
+            },
+        })
+    }
+}
diff --git a/backend/windmill-worker/src/ai/providers/google_ai.rs b/backend/windmill-worker/src/ai/providers/google_ai.rs
index b94d4f29e5..0248c8d7e4 100644
--- a/backend/windmill-worker/src/ai/providers/google_ai.rs
+++ b/backend/windmill-worker/src/ai/providers/google_ai.rs
@@ -255,7 +255,13 @@ impl QueryBuilder for GoogleAIQueryBuilder {
             .await
     }
 
-    fn get_endpoint(&self, base_url: &str, model: &str, output_type: &OutputType) -> String {
+    fn get_endpoint(
+        &self,
+        base_url: &str,
+        model: &str,
+        output_type: &OutputType,
+        _stream: bool,
+    ) -> String {
         match output_type {
             OutputType::Text => format!("{}/chat/completions", base_url), // Use OpenAI-compatible endpoint
             OutputType::Image => {
diff --git a/backend/windmill-worker/src/ai/providers/mod.rs b/backend/windmill-worker/src/ai/providers/mod.rs
index 13cf766e28..e86d70650a 100644
--- a/backend/windmill-worker/src/ai/providers/mod.rs
+++ b/backend/windmill-worker/src/ai/providers/mod.rs
@@ -1,3 +1,4 @@
+pub mod bedrock;
 pub mod google_ai;
 pub mod openai;
 pub mod openrouter;
diff --git a/backend/windmill-worker/src/ai/providers/openai.rs b/backend/windmill-worker/src/ai/providers/openai.rs
index d764cc11ad..64a6e4a1b8 100644
--- a/backend/windmill-worker/src/ai/providers/openai.rs
+++ b/backend/windmill-worker/src/ai/providers/openai.rs
@@ -4,14 +4,13 @@ use serde_json;
 use windmill_common::{ai_providers::AIProvider, client::AuthedClient, error::Error};
 
 use crate::ai::{
-    image_handler::download_and_encode_s3_image,
+    image_handler::{download_and_encode_s3_image, prepare_messages_for_api},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventProcessor},
     sse::{OpenAISSEParser, SSEParser},
     types::*,
-    utils::is_claude_model,
+    utils::should_use_structured_output_tool,
 };
 
-// OpenAI-specific types
 #[derive(Deserialize, Serialize, Clone, Debug)]
 pub struct OpenAIFunction {
     pub name: String,
@@ -114,62 +113,6 @@ impl OpenAIQueryBuilder {
         Self { provider_kind }
     }
 
-    pub async fn prepare_messages_for_api(
-        &self,
-        messages: &[OpenAIMessage],
-        client: &AuthedClient,
-        workspace_id: &str,
-    ) -> Result<Vec<OpenAIMessage>, Error> {
-        let mut prepared_messages = Vec::new();
-
-        for message in messages {
-            let mut prepared_message = message.clone();
-
-            if let Some(content) = &message.content {
-                match content {
-                    OpenAIContent::Text(text) => {
-                        prepared_message.content = Some(OpenAIContent::Text(text.clone()));
-                    }
-                    OpenAIContent::Parts(parts) => {
-                        let mut prepared_content = Vec::new();
-
-                        for part in parts {
-                            match part {
-                                ContentPart::S3Object { s3_object } => {
-                                    // Convert S3Object to base64 image URL
-                                    let (mime_type, image_bytes) = download_and_encode_s3_image(
-                                        s3_object,
-                                        client,
-                                        workspace_id,
-                                    )
-                                    .await?;
-                                    prepared_content.push(ContentPart::ImageUrl {
-                                        image_url: ImageUrlData {
-                                            url: format!(
-                                                "data:{};base64,{}",
-                                                mime_type, image_bytes
-                                            ),
-                                        },
-                                    });
-                                }
-                                other => {
-                                    // Keep Text and ImageUrl as-is
-                                    prepared_content.push(other.clone());
-                                }
-                            }
-                        }
-
-                        prepared_message.content = Some(OpenAIContent::Parts(prepared_content));
-                    }
-                }
-            }
-
-            prepared_messages.push(prepared_message);
-        }
-
-        Ok(prepared_messages)
-    }
-
     async fn build_text_request(
         &self,
         args: &BuildRequestArgs<'_>,
@@ -177,9 +120,8 @@ impl OpenAIQueryBuilder {
         workspace_id: &str,
         stream: bool,
     ) -> Result<String, Error> {
-        let prepared_messages = self
-            .prepare_messages_for_api(args.messages, client, workspace_id)
-            .await?;
+        let prepared_messages =
+            prepare_messages_for_api(args.messages, client, workspace_id).await?;
 
         // Check if we need to add response_format for structured output
         let has_output_properties = args
@@ -203,9 +145,10 @@ impl OpenAIQueryBuilder {
             None
         };
 
-        let is_claude_model = is_claude_model(&args.model);
+        let should_use_structured_output_tool =
+            should_use_structured_output_tool(&self.provider_kind, args.model);
         // Force usage of structured output tool for Claude models when structured output provided
-        let tool_choice = if is_claude_model && response_format.is_some() {
+        let tool_choice = if should_use_structured_output_tool && response_format.is_some() {
             Some(ToolChoice::Required)
         } else {
             None
@@ -405,7 +348,13 @@ impl QueryBuilder for OpenAIQueryBuilder {
         })
     }
 
-    fn get_endpoint(&self, base_url: &str, model: &str, output_type: &OutputType) -> String {
+    fn get_endpoint(
+        &self,
+        base_url: &str,
+        model: &str,
+        output_type: &OutputType,
+        _stream: bool,
+    ) -> String {
         let path = match output_type {
             OutputType::Text => "chat/completions",
             OutputType::Image => "responses",
diff --git a/backend/windmill-worker/src/ai/providers/openrouter.rs b/backend/windmill-worker/src/ai/providers/openrouter.rs
index 9e22a63552..f3e215cada 100644
--- a/backend/windmill-worker/src/ai/providers/openrouter.rs
+++ b/backend/windmill-worker/src/ai/providers/openrouter.rs
@@ -4,6 +4,7 @@ use serde_json;
 use windmill_common::{ai_providers::AIProvider, client::AuthedClient, error::Error};
 
 use crate::ai::{
+    image_handler::prepare_messages_for_api,
     providers::openai::{OpenAIQueryBuilder, OpenAIResponse},
     query_builder::{BuildRequestArgs, ParsedResponse, QueryBuilder, StreamEventProcessor},
     types::*,
@@ -91,11 +92,9 @@ impl QueryBuilder for OpenRouterQueryBuilder {
             }
             OutputType::Image => {
                 // For image generation, we need to add modalities field
-                // First, prepare the messages using the OpenAI builder's logic
-                let openai_builder = &self.openai_builder;
-                let prepared_messages = openai_builder
-                    .prepare_messages_for_api(args.messages, client, workspace_id)
-                    .await?;
+                // First, prepare the messages
+                let prepared_messages =
+                    prepare_messages_for_api(args.messages, client, workspace_id).await?;
 
                 // Check if we need to add response_format for structured output
                 let has_output_properties = args
@@ -204,7 +203,13 @@ impl QueryBuilder for OpenRouterQueryBuilder {
             .await
     }
 
-    fn get_endpoint(&self, base_url: &str, _model: &str, _output_type: &OutputType) -> String {
+    fn get_endpoint(
+        &self,
+        base_url: &str,
+        _model: &str,
+        _output_type: &OutputType,
+        _stream: bool,
+    ) -> String {
         // OpenRouter uses the same endpoint for both text and image generation
         format!("{}/chat/completions", base_url)
     }
diff --git a/backend/windmill-worker/src/ai/query_builder.rs b/backend/windmill-worker/src/ai/query_builder.rs
index e332c21f73..603f428c2e 100644
--- a/backend/windmill-worker/src/ai/query_builder.rs
+++ b/backend/windmill-worker/src/ai/query_builder.rs
@@ -69,7 +69,13 @@ pub trait QueryBuilder: Send + Sync {
     }
 
     /// Get the API endpoint for this provider
-    fn get_endpoint(&self, base_url: &str, model: &str, output_type: &OutputType) -> String;
+    fn get_endpoint(
+        &self,
+        base_url: &str,
+        model: &str,
+        output_type: &OutputType,
+        stream: bool,
+    ) -> String;
 
     /// Get the authentication headers for this provider
     fn get_auth_headers(
diff --git a/backend/windmill-worker/src/ai/types.rs b/backend/windmill-worker/src/ai/types.rs
index 457eb3b215..eb22066436 100644
--- a/backend/windmill-worker/src/ai/types.rs
+++ b/backend/windmill-worker/src/ai/types.rs
@@ -126,6 +126,7 @@ pub struct ProviderResource {
     pub api_key: String,
     #[serde(alias = "baseUrl")]
     pub base_url: Option<String>,
+    pub region: Option<String>,
 }
 
 #[derive(Deserialize, Debug)]
@@ -146,9 +147,17 @@ impl ProviderWithResource {
 
     pub async fn get_base_url(&self, db: &DB) -> Result<String, Error> {
         self.kind
-            .get_base_url(self.resource.base_url.clone(), db)
+            .get_base_url(
+                self.resource.base_url.clone(),
+                self.resource.region.clone(),
+                db,
+            )
             .await
     }
+
+    pub fn get_region(&self) -> Option<&str> {
+        self.resource.region.as_deref()
+    }
 }
 
 #[derive(Serialize)]
diff --git a/backend/windmill-worker/src/ai/utils.rs b/backend/windmill-worker/src/ai/utils.rs
index 947b56f549..34b1ad69c4 100644
--- a/backend/windmill-worker/src/ai/utils.rs
+++ b/backend/windmill-worker/src/ai/utils.rs
@@ -8,6 +8,7 @@ use std::{
 };
 use uuid::Uuid;
 use windmill_common::{
+    ai_providers::AIProvider,
     db::DB,
     error::Error,
     flow_conversations::{add_message_to_conversation_tx, MessageType},
@@ -311,9 +312,9 @@ pub fn get_step_name_from_flow(
     )
 }
 
-/// Claude models starts with claude if provider is anthropic, or anthropic for openrouter and other providers
-pub fn is_claude_model(model: &str) -> bool {
-    model.starts_with("claude") || model.starts_with("anthropic")
+/// AWS Bedrock do not handle structured output query param, so we use a tool for structured output. Same for every Claude models.
+pub fn should_use_structured_output_tool(provider: &AIProvider, model: &str) -> bool {
+    model.contains("claude") || provider == &AIProvider::AWSBedrock
 }
 
 /// Cleanup MCP clients by gracefully shutting down connections
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index 481717a207..aff089b82b 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -2,9 +2,9 @@ use crate::ai::tools::{execute_tool_calls, ToolExecutionContext};
 use crate::ai::utils::{
     add_message_to_conversation, any_tool_needs_previous_result, cleanup_mcp_clients,
     filter_schema_by_input_transforms, find_unique_tool_name, get_flow_context,
-    get_flow_job_runnable_and_raw_flow, get_step_name_from_flow, is_claude_model, load_mcp_tools,
-    parse_raw_script_schema, update_flow_status_module_with_actions,
-    update_flow_status_module_with_actions_success,
+    get_flow_job_runnable_and_raw_flow, get_step_name_from_flow, load_mcp_tools,
+    parse_raw_script_schema, should_use_structured_output_tool,
+    update_flow_status_module_with_actions, update_flow_status_module_with_actions_success,
 };
 use crate::memory_oss::{read_from_memory, write_to_memory};
 use crate::worker_flow::{get_previous_job_result, get_transform_context};
@@ -15,7 +15,7 @@ use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
 use windmill_common::mcp_client::McpClient;
 use windmill_common::{
-    ai_providers::AZURE_API_VERSION,
+    ai_providers::{AIProvider, AZURE_API_VERSION},
     cache,
     client::AuthedClient,
     db::DB,
@@ -376,6 +376,7 @@ pub async fn run_agent(
     let output_type = args.output_type.as_ref().unwrap_or(&OutputType::Text);
     let base_url = args.provider.get_base_url(db).await?;
     let api_key = args.provider.get_api_key();
+    let region = args.provider.get_region();
 
     // Create the query builder for the provider
     let query_builder = create_query_builder(&args.provider);
@@ -498,14 +499,15 @@ pub async fn run_agent(
         .map(|props| !props.is_empty())
         .unwrap_or(false);
 
-    let is_claude_model = is_claude_model(&args.provider.model);
+    let should_use_structured_output_tool =
+        should_use_structured_output_tool(&args.provider.kind, &args.provider.model);
     let mut used_structured_output_tool = false;
     let mut structured_output_tool_name: Option<String> = None;
 
     // For text output with schema, handle structured output
     if has_output_properties && output_type == &OutputType::Text {
         let schema = args.output_schema.as_ref().unwrap();
-        if is_claude_model {
+        if should_use_structured_output_tool {
             // Anthropic uses a tool for structured output
             let unique_tool_name = find_unique_tool_name("structured_output", tool_defs.as_deref());
             structured_output_tool_name = Some(unique_tool_name.clone());
@@ -551,253 +553,289 @@ pub async fn run_agent(
             break;
         }
 
-        // For text output or image output with tools
-        let build_args = BuildRequestArgs {
-            messages: &messages,
-            tools: tool_defs.as_deref(),
-            model: args.provider.get_model(),
-            temperature: args.temperature,
-            max_tokens: args.max_completion_tokens,
-            output_schema: args.output_schema.as_ref(),
-            output_type,
-            system_prompt: args.system_prompt.as_deref(),
-            user_message: &args.user_message,
-            images: args.user_images.as_deref(),
-        };
+        // Special handling for AWS Bedrock using the official SDK
+        let parsed = if args.provider.kind == AIProvider::AWSBedrock {
+            let Some(region) = region else {
+                return Err(Error::internal_err(
+                    "AWS Bedrock region is required".to_string(),
+                ));
+            };
+            // Use Bedrock SDK via dedicated query builder
+            crate::ai::providers::bedrock::BedrockQueryBuilder::default()
+                .execute_request(
+                    &messages,
+                    tool_defs.as_deref(),
+                    args.provider.get_model(),
+                    args.temperature,
+                    args.max_completion_tokens,
+                    api_key,
+                    region,
+                    should_stream,
+                    stream_event_processor.clone(),
+                    client,
+                    &job.workspace_id,
+                    structured_output_tool_name.as_deref(),
+                )
+                .await?
+        } else {
+            // For non-Bedrock providers, use HTTP client
+            let build_args = BuildRequestArgs {
+                messages: &messages,
+                tools: tool_defs.as_deref(),
+                model: args.provider.get_model(),
+                temperature: args.temperature,
+                max_tokens: args.max_completion_tokens,
+                output_schema: args.output_schema.as_ref(),
+                output_type,
+                system_prompt: args.system_prompt.as_deref(),
+                user_message: &args.user_message,
+                images: args.user_images.as_deref(),
+            };
 
-        let request_body = query_builder
-            .build_request(&build_args, client, &job.workspace_id, should_stream)
-            .await?;
+            let request_body = query_builder
+                .build_request(&build_args, client, &job.workspace_id, should_stream)
+                .await?;
 
-        let endpoint =
-            query_builder.get_endpoint(&base_url, args.provider.get_model(), output_type);
-        let auth_headers = query_builder.get_auth_headers(api_key, &base_url, output_type);
+            let endpoint = query_builder.get_endpoint(
+                &base_url,
+                args.provider.get_model(),
+                output_type,
+                should_stream,
+            );
+            let auth_headers = query_builder.get_auth_headers(api_key, &base_url, output_type);
 
-        let timeout = resolve_job_timeout(conn, &job.workspace_id, job.id, job.timeout)
-            .await
-            .0;
+            let timeout = resolve_job_timeout(conn, &job.workspace_id, job.id, job.timeout)
+                .await
+                .0;
 
-        let mut request = HTTP_CLIENT
-            .post(&endpoint)
-            .timeout(timeout)
-            .header("Content-Type", "application/json");
+            let mut request = HTTP_CLIENT
+                .post(&endpoint)
+                .timeout(timeout)
+                .header("Content-Type", "application/json");
 
-        // Apply authentication headers
-        for (header_name, header_value) in &auth_headers {
-            request = request.header(*header_name, header_value.clone());
-        }
+            // Apply authentication headers
+            for (header_name, header_value) in &auth_headers {
+                request = request.header(*header_name, header_value.clone());
+            }
 
-        // Apply custom headers from AI_HTTP_HEADERS environment variable
-        for (header_name, header_value) in AI_HTTP_HEADERS.iter() {
-            request = request.header(header_name.as_str(), header_value.as_str());
-        }
+            // Apply custom headers from AI_HTTP_HEADERS environment variable
+            for (header_name, header_value) in AI_HTTP_HEADERS.iter() {
+                request = request.header(header_name.as_str(), header_value.as_str());
+            }
 
-        if args.provider.kind.is_azure_openai(&base_url) {
-            request = request.query(&[("api-version", AZURE_API_VERSION)])
-        }
+            if args.provider.kind.is_azure_openai(&base_url) {
+                request = request.query(&[("api-version", AZURE_API_VERSION)])
+            }
 
-        let resp = request
-            .body(request_body)
-            .send()
-            .await
-            .map_err(|e| Error::internal_err(format!("Failed to call API: {}", e)))?;
+            let resp = request
+                .body(request_body)
+                .send()
+                .await
+                .map_err(|e| Error::internal_err(format!("Failed to call API: {}", e)))?;
 
-        match resp.error_for_status_ref() {
-            Ok(_) => {
-                let parsed = if let Some(stream_event_processor) = stream_event_processor.clone() {
-                    query_builder
-                        .parse_streaming_response(resp, stream_event_processor)
-                        .await?
-                } else {
-                    // Handle non-streaming response
-                    query_builder.parse_response(resp).await?
-                };
-
-                match parsed {
-                    ParsedResponse::Text { content: response_content, tool_calls, events_str } => {
-                        if let Some(events_str) = events_str {
-                            final_events_str.push_str(&events_str);
-                        }
-
-                        if let Some(ref response_content) = response_content {
-                            actions.push(AgentAction::Message {});
-                            messages.push(OpenAIMessage {
-                                role: "assistant".to_string(),
-                                content: Some(OpenAIContent::Text(response_content.clone())),
-                                agent_action: Some(AgentAction::Message {}),
-                                ..Default::default()
-                            });
-
-                            update_flow_status_module_with_actions(db, parent_job, &actions)
-                                .await?;
-                            update_flow_status_module_with_actions_success(db, parent_job, true)
-                                .await?;
-
-                            content = Some(OpenAIContent::Text(response_content.clone()));
-
-                            // Add assistant message to conversation if chat_input_enabled
-                            let chat_enabled = flow_context
-                                .flow_status
-                                .as_ref()
-                                .and_then(|fs| fs.chat_input_enabled)
-                                .unwrap_or(false);
-                            if chat_enabled && !response_content.is_empty() {
-                                if let Some(memory_id) = flow_context
-                                    .flow_status
-                                    .as_ref()
-                                    .and_then(|fs| fs.memory_id)
-                                {
-                                    let agent_job_id = job.id;
-                                    let db_clone = db.clone();
-                                    let message_content = response_content.clone();
-                                    let step_name = get_step_name_from_flow(
-                                        summary.as_deref(),
-                                        job.flow_step_id.as_deref(),
-                                    );
-
-                                    // Spawn task because we do not need to wait for the result
-                                    tokio::spawn(async move {
-                                        if let Err(e) = add_message_to_conversation(
-                                            &db_clone,
-                                            &memory_id,
-                                            Some(agent_job_id),
-                                            &message_content,
-                                            MessageType::Assistant,
-                                            &step_name,
-                                            true,
-                                        )
-                                        .await
-                                        {
-                                            tracing::warn!("Failed to add assistant message to conversation {}: {}", memory_id, e);
-                                        }
-                                    });
-                                }
-                            }
-                        }
-
-                        if tool_calls.is_empty() {
-                            break;
-                        } else if i == MAX_AGENT_ITERATIONS - 1 {
-                            return Err(Error::internal_err(
-                                "AI agent reached max iterations, but there are still tool calls"
-                                    .to_string(),
-                            ));
-                        }
-
-                        messages.push(OpenAIMessage {
-                            role: "assistant".to_string(),
-                            tool_calls: Some(tool_calls.clone()),
-                            ..Default::default()
-                        });
-
-                        // Handle tool calls using extracted tools module
-                        let tool_execution_ctx = ToolExecutionContext {
-                            db,
-                            conn,
-                            job,
-                            parent_job,
-                            summary: &summary,
-                            client,
-                            worker_dir,
-                            base_internal_url,
-                            worker_name,
-                            hostname,
-                            occupancy_metrics,
-                            job_completed_tx,
-                            killpill_rx,
-                            stream_event_processor: stream_event_processor.as_ref(),
-                            flow_context: &mut flow_context,
-                            previous_result: &previous_result,
-                            id_context: &id_context,
-                        };
-
-                        let (tool_messages, tool_content, tool_used_structured_output) =
-                            execute_tool_calls(
-                                tool_execution_ctx,
-                                &tool_calls,
-                                &tools,
-                                mcp_clients,
-                                &mut actions,
-                                &mut final_events_str,
-                                &structured_output_tool_name,
-                            )
-                            .await?;
-
-                        messages.extend(tool_messages);
-                        if let Some(tc) = tool_content {
-                            content = Some(tc);
-                        }
-                        used_structured_output_tool = tool_used_structured_output;
-                    }
-                    ParsedResponse::Image { base64_data } => {
-                        // For image output, upload to S3 and track in conversation
-                        let s3_object = upload_image_to_s3(&base64_data, job, client).await?;
-
-                        let content = to_raw_value(&s3_object);
-
-                        // Add assistant message to conversation if chat_input_enabled
-                        let chat_enabled = flow_context
-                            .flow_status
-                            .as_ref()
-                            .and_then(|fs| fs.chat_input_enabled)
-                            .unwrap_or(false);
-                        if chat_enabled {
-                            if let Some(memory_id) = flow_context
-                                .flow_status
-                                .as_ref()
-                                .and_then(|fs| fs.memory_id)
-                            {
-                                let agent_job_id = job.id;
-                                let db_clone = db.clone();
-                                let flow_step_id_owned = job.flow_step_id.clone();
-                                let summary_owned = summary.map(|s| s.to_string());
-
-                                // Create extended version with type discriminator for conversation storage
-                                // This avoids conflicts with outputs that are of the same format as S3 objects
-                                let s3_with_type = S3ObjectWithType {
-                                    s3_object: s3_object.clone(),
-                                    r#type: "windmill_s3_object".to_string(),
-                                };
-
-                                let message_content = serde_json::to_string(&s3_with_type)
-                                    .unwrap_or_else(|_| content.get().to_string());
-
-                                // Spawn task because we do not need to wait for the result
-                                tokio::spawn(async move {
-                                    let step_name = get_step_name_from_flow(
-                                        summary_owned.as_deref(),
-                                        flow_step_id_owned.as_deref(),
-                                    );
-
-                                    if let Err(e) = add_message_to_conversation(
-                                        &db_clone,
-                                        &memory_id,
-                                        Some(agent_job_id),
-                                        &message_content,
-                                        MessageType::Assistant,
-                                        &step_name,
-                                        true,
-                                    )
-                                    .await
-                                    {
-                                        tracing::warn!("Failed to add assistant message to conversation {}: {}", memory_id, e);
-                                    }
-                                });
-                            }
-                        }
-
-                        // Return early since image generation is complete
-                        return Ok(content);
+            match resp.error_for_status_ref() {
+                Ok(_) => {
+                    if let Some(stream_event_processor) = stream_event_processor.clone() {
+                        query_builder
+                            .parse_streaming_response(resp, stream_event_processor)
+                            .await?
+                    } else {
+                        // Handle non-streaming response
+                        query_builder.parse_response(resp).await?
                     }
                 }
+                Err(e) => {
+                    let _status = resp.status();
+                    let text = resp
+                        .text()
+                        .await
+                        .unwrap_or_else(|_| "<failed to read body>".to_string());
+                    return Err(Error::internal_err(format!("API error: {} - {}", e, text)));
+                }
             }
-            Err(e) => {
-                let _status = resp.status();
-                let text = resp
-                    .text()
-                    .await
-                    .unwrap_or_else(|_| "<failed to read body>".to_string());
-                return Err(Error::internal_err(format!("API error: {} - {}", e, text)));
+        };
+
+        match parsed {
+            ParsedResponse::Text { content: response_content, tool_calls, events_str } => {
+                if let Some(events_str) = events_str {
+                    final_events_str.push_str(&events_str);
+                }
+
+                if let Some(ref response_content) = response_content {
+                    actions.push(AgentAction::Message {});
+                    messages.push(OpenAIMessage {
+                        role: "assistant".to_string(),
+                        content: Some(OpenAIContent::Text(response_content.clone())),
+                        agent_action: Some(AgentAction::Message {}),
+                        ..Default::default()
+                    });
+
+                    update_flow_status_module_with_actions(db, parent_job, &actions).await?;
+                    update_flow_status_module_with_actions_success(db, parent_job, true).await?;
+
+                    content = Some(OpenAIContent::Text(response_content.clone()));
+
+                    // Add assistant message to conversation if chat_input_enabled
+                    let chat_enabled = flow_context
+                        .flow_status
+                        .as_ref()
+                        .and_then(|fs| fs.chat_input_enabled)
+                        .unwrap_or(false);
+                    if chat_enabled && !response_content.is_empty() {
+                        if let Some(memory_id) = flow_context
+                            .flow_status
+                            .as_ref()
+                            .and_then(|fs| fs.memory_id)
+                        {
+                            let agent_job_id = job.id;
+                            let db_clone = db.clone();
+                            let message_content = response_content.clone();
+                            let step_name = get_step_name_from_flow(
+                                summary.as_deref(),
+                                job.flow_step_id.as_deref(),
+                            );
+
+                            // Spawn task because we do not need to wait for the result
+                            tokio::spawn(async move {
+                                if let Err(e) = add_message_to_conversation(
+                                    &db_clone,
+                                    &memory_id,
+                                    Some(agent_job_id),
+                                    &message_content,
+                                    MessageType::Assistant,
+                                    &step_name,
+                                    true,
+                                )
+                                .await
+                                {
+                                    tracing::warn!(
+                                        "Failed to add assistant message to conversation {}: {}",
+                                        memory_id,
+                                        e
+                                    );
+                                }
+                            });
+                        }
+                    }
+                }
+
+                if tool_calls.is_empty() {
+                    break;
+                } else if i == MAX_AGENT_ITERATIONS - 1 {
+                    return Err(Error::internal_err(
+                        "AI agent reached max iterations, but there are still tool calls"
+                            .to_string(),
+                    ));
+                }
+
+                messages.push(OpenAIMessage {
+                    role: "assistant".to_string(),
+                    tool_calls: Some(tool_calls.clone()),
+                    ..Default::default()
+                });
+
+                // Handle tool calls using extracted tools module
+                let tool_execution_ctx = ToolExecutionContext {
+                    db,
+                    conn,
+                    job,
+                    parent_job,
+                    summary: &summary,
+                    client,
+                    worker_dir,
+                    base_internal_url,
+                    worker_name,
+                    hostname,
+                    occupancy_metrics,
+                    job_completed_tx,
+                    killpill_rx,
+                    stream_event_processor: stream_event_processor.as_ref(),
+                    flow_context: &mut flow_context,
+                    previous_result: &previous_result,
+                    id_context: &id_context,
+                };
+
+                let (tool_messages, tool_content, tool_used_structured_output) =
+                    execute_tool_calls(
+                        tool_execution_ctx,
+                        &tool_calls,
+                        &tools,
+                        mcp_clients,
+                        &mut actions,
+                        &mut final_events_str,
+                        &structured_output_tool_name,
+                    )
+                    .await?;
+
+                messages.extend(tool_messages);
+                if let Some(tc) = tool_content {
+                    content = Some(tc);
+                }
+                used_structured_output_tool = tool_used_structured_output;
+            }
+            ParsedResponse::Image { base64_data } => {
+                // For image output, upload to S3 and track in conversation
+                let s3_object = upload_image_to_s3(&base64_data, job, client).await?;
+
+                let content = to_raw_value(&s3_object);
+
+                // Add assistant message to conversation if chat_input_enabled
+                let chat_enabled = flow_context
+                    .flow_status
+                    .as_ref()
+                    .and_then(|fs| fs.chat_input_enabled)
+                    .unwrap_or(false);
+                if chat_enabled {
+                    if let Some(memory_id) = flow_context
+                        .flow_status
+                        .as_ref()
+                        .and_then(|fs| fs.memory_id)
+                    {
+                        let agent_job_id = job.id;
+                        let db_clone = db.clone();
+                        let flow_step_id_owned = job.flow_step_id.clone();
+                        let summary_owned = summary.map(|s| s.to_string());
+
+                        // Create extended version with type discriminator for conversation storage
+                        // This avoids conflicts with outputs that are of the same format as S3 objects
+                        let s3_with_type = S3ObjectWithType {
+                            s3_object: s3_object.clone(),
+                            r#type: "windmill_s3_object".to_string(),
+                        };
+
+                        let message_content = serde_json::to_string(&s3_with_type)
+                            .unwrap_or_else(|_| content.get().to_string());
+
+                        // Spawn task because we do not need to wait for the result
+                        tokio::spawn(async move {
+                            let step_name = get_step_name_from_flow(
+                                summary_owned.as_deref(),
+                                flow_step_id_owned.as_deref(),
+                            );
+
+                            if let Err(e) = add_message_to_conversation(
+                                &db_clone,
+                                &memory_id,
+                                Some(agent_job_id),
+                                &message_content,
+                                MessageType::Assistant,
+                                &step_name,
+                                true,
+                            )
+                            .await
+                            {
+                                tracing::warn!(
+                                    "Failed to add assistant message to conversation {}: {}",
+                                    memory_id,
+                                    e
+                                );
+                            }
+                        });
+                    }
+                }
+
+                // Return early since image generation is complete
+                return Ok(content);
             }
         }
     }
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index e589f2d751..4914e538c5 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -76,6 +76,10 @@ export const AI_PROVIDERS: Record<AIProvider, AIProviderDetails> = {
 		label: 'Together AI',
 		defaultModels: ['meta-llama/Llama-3.3-70B-Instruct-Turbo']
 	},
+	aws_bedrock: {
+		label: 'AWS Bedrock',
+		defaultModels: ['global.anthropic.claude-haiku-4-5-20251001-v1:0']
+	},
 	customai: {
 		label: 'Custom AI',
 		defaultModels: []
@@ -100,18 +104,102 @@ export async function fetchAvailableModels(
 	provider: AIProvider,
 	signal?: AbortSignal
 ): Promise<string[]> {
-	const models = await fetch(`${location.origin}${OpenAPI.BASE}/w/${workspace}/ai/proxy/models`, {
-		signal,
-		headers: {
+	// Handle AWS Bedrock separately (needs both foundation-models and inference-profiles)
+	if (provider === 'aws_bedrock') {
+		const headers = {
 			'X-Resource-Path': resourcePath,
-			'X-Provider': provider,
-			...(provider === 'anthropic' ? { 'anthropic-version': '2023-06-01' } : {})
+			'X-Provider': provider
 		}
-	})
+
+		// Fetch both foundation models and inference profiles
+		const [foundationModelsResp, inferenceProfilesResp] = await Promise.all([
+			fetch(`${location.origin}${OpenAPI.BASE}/w/${workspace}/ai/proxy/foundation-models`, {
+				signal,
+				headers
+			}),
+			fetch(`${location.origin}${OpenAPI.BASE}/w/${workspace}/ai/proxy/inference-profiles`, {
+				signal,
+				headers
+			})
+		])
+
+		if (!foundationModelsResp.ok) {
+			console.error('Failed to fetch foundation models', foundationModelsResp)
+			throw new Error('Failed to fetch foundation models for AWS Bedrock')
+		}
+
+		const foundationModelsData = (await foundationModelsResp.json()) as {
+			modelSummaries: Array<{
+				modelId: string
+				modelArn: string
+				inputModalities: string[]
+				outputModalities: string[]
+				inferenceTypesSupported: string[]
+			}>
+		}
+
+		// Inference profiles fetch might fail in some regions/accounts
+		let inferenceProfiles: Array<{
+			inferenceProfileId: string
+			models: Array<{ modelArn: string }>
+		}> = []
+
+		if (inferenceProfilesResp.ok) {
+			const inferenceProfilesData = (await inferenceProfilesResp.json()) as {
+				inferenceProfileSummaries: Array<{
+					inferenceProfileId: string
+					models: Array<{ modelArn: string }>
+				}>
+			}
+			inferenceProfiles = inferenceProfilesData.inferenceProfileSummaries || []
+		} else {
+			console.warn('Failed to fetch inference profiles, will use direct model IDs only')
+		}
+
+		// Filter to TEXT-capable models
+		const textModels = foundationModelsData.modelSummaries.filter(
+			(m) => m.inputModalities?.includes('TEXT') && m.outputModalities?.includes('TEXT')
+		)
+
+		const onDemandModels = textModels
+			.filter(
+				(model) =>
+					model.inferenceTypesSupported?.includes('ON_DEMAND') &&
+					!model.inferenceTypesSupported?.includes('INFERENCE_PROFILE')
+			)
+			.map((model) => model.modelId)
+		const inferenceModels = inferenceProfiles.map((profile) => profile.inferenceProfileId)
+		const modelIds = [...onDemandModels, ...inferenceModels]
+
+		// Sort by default models
+		const defaultModels = AI_PROVIDERS[provider]?.defaultModels || []
+		return modelIds.sort((a, b) => {
+			const aInDefault = defaultModels.includes(a)
+			const bInDefault = defaultModels.includes(b)
+			if (aInDefault && !bInDefault) return -1
+			if (!aInDefault && bInDefault) return 1
+			return 0
+		})
+	}
+
+	// Standard provider handling
+	const endpoint = 'models'
+	const models = await fetch(
+		`${location.origin}${OpenAPI.BASE}/w/${workspace}/ai/proxy/${endpoint}`,
+		{
+			signal,
+			headers: {
+				'X-Resource-Path': resourcePath,
+				'X-Provider': provider,
+				...(provider === 'anthropic' ? { 'anthropic-version': '2023-06-01' } : {})
+			}
+		}
+	)
 	if (!models.ok) {
 		console.error('Failed to fetch models for provider', provider, models)
 		throw new Error(`Failed to fetch models for provider ${provider}`)
 	}
+
 	const data = (await models.json()) as { data: ModelResponse[] }
 	if (data.data.length > 0) {
 		const sortFunc = (provider: AIProvider) => (a: string, b: string) => {
@@ -271,7 +359,8 @@ export const PROVIDER_COMPLETION_CONFIG_MAP: Record<AIProvider, ChatCompletionCr
 		...DEFAULT_COMPLETION_CONFIG,
 		seed: undefined
 	},
-	anthropic: DEFAULT_COMPLETION_CONFIG
+	anthropic: DEFAULT_COMPLETION_CONFIG,
+	aws_bedrock: DEFAULT_COMPLETION_CONFIG
 } as const
 
 class WorkspacedAIClients {

From abcfb2b3b8d3336be94350fb2799d991f5a98919 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Mon, 17 Nov 2025 21:51:29 +0100
Subject: [PATCH 22/81] fix breaking error (#7162)

---
 backend/windmill-api/src/ai.rs | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index 4b18a67ec9..2df04beb7a 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -509,10 +509,7 @@ async fn proxy(
     }
 
     // Transform Bedrock responses back to OpenAI format
-    if matches!(provider, AIProvider::AWSBedrock) {
-        let Some(model) = model else {
-            return Err(Error::BadRequest("Model is required".to_string()));
-        };
+    if matches!(provider, AIProvider::AWSBedrock) && model.is_some() {
         if is_streaming {
             // Transform streaming response
             use http::StatusCode;
@@ -523,7 +520,8 @@ async fn proxy(
             response_headers.insert("connection", "keep-alive".parse().unwrap());
 
             let stream = response.bytes_stream();
-            let transformed_stream = bedrock::transform_bedrock_stream_to_openai(stream, model);
+            let transformed_stream =
+                bedrock::transform_bedrock_stream_to_openai(stream, model.unwrap());
 
             Ok((
                 StatusCode::OK,
@@ -532,7 +530,8 @@ async fn proxy(
             ))
         } else {
             // Transform non-streaming response
-            let transformed_body = bedrock::transform_bedrock_to_openai(response, model).await?;
+            let transformed_body =
+                bedrock::transform_bedrock_to_openai(response, model.unwrap()).await?;
 
             let mut response_headers = HeaderMap::new();
             response_headers.insert("content-type", "application/json".parse().unwrap());

From 90b5569c911f9025b0e6b5318f57705efbd9bd17 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 17 Nov 2025 23:26:47 +0100
Subject: [PATCH 23/81] fix: fix custom email triggers enabled (#7164)

---
 backend/migrations/20251117222148_email_enabled.down.sql | 1 +
 backend/migrations/20251117222148_email_enabled.up.sql   | 3 +++
 backend/windmill-api/src/triggers/email/handler_oss.rs   | 2 +-
 backend/windmill-api/src/triggers/handler.rs             | 1 +
 4 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 backend/migrations/20251117222148_email_enabled.down.sql
 create mode 100644 backend/migrations/20251117222148_email_enabled.up.sql

diff --git a/backend/migrations/20251117222148_email_enabled.down.sql b/backend/migrations/20251117222148_email_enabled.down.sql
new file mode 100644
index 0000000000..d2f607c5b8
--- /dev/null
+++ b/backend/migrations/20251117222148_email_enabled.down.sql
@@ -0,0 +1 @@
+-- Add down migration script here
diff --git a/backend/migrations/20251117222148_email_enabled.up.sql b/backend/migrations/20251117222148_email_enabled.up.sql
new file mode 100644
index 0000000000..861d171af9
--- /dev/null
+++ b/backend/migrations/20251117222148_email_enabled.up.sql
@@ -0,0 +1,3 @@
+-- Add up migration script here
+
+ALTER TABLE email_trigger ADD COLUMN enabled BOOLEAN DEFAULT TRUE NOT NULL;
\ No newline at end of file
diff --git a/backend/windmill-api/src/triggers/email/handler_oss.rs b/backend/windmill-api/src/triggers/email/handler_oss.rs
index 2f3a318bdd..ca4de1733e 100644
--- a/backend/windmill-api/src/triggers/email/handler_oss.rs
+++ b/backend/windmill-api/src/triggers/email/handler_oss.rs
@@ -28,7 +28,7 @@ impl TriggerCrud for EmailTrigger {
 
     const TABLE_NAME: &'static str = "";
     const TRIGGER_TYPE: &'static str = "";
-    const SUPPORTS_ENABLED: bool = false;
+    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/email_triggers";
diff --git a/backend/windmill-api/src/triggers/handler.rs b/backend/windmill-api/src/triggers/handler.rs
index 66851aed9e..a6019c5a14 100644
--- a/backend/windmill-api/src/triggers/handler.rs
+++ b/backend/windmill-api/src/triggers/handler.rs
@@ -366,6 +366,7 @@ pub trait TriggerCrud: Send + Sync + 'static {
             .sql()
             .map_err(|e| Error::InternalErr(format!("SQL error: {}", e)))?;
 
+        tracing::info!("SQL: {}", sql);
         let triggers = sqlx::query_as(&sql).fetch_all(&mut *tx).await?;
 
         Ok(triggers)

From b87d2cc64cb54b602ee599fcde7f0fd3c8931550 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Mon, 17 Nov 2025 23:33:02 +0100
Subject: [PATCH 24/81] fix(backend): worker count in latest worker usage
 (#7160)

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index beac4ec475..4eee5664d7 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-41e693c08aa096a0d2e9a76a4ebe9b4149bdde24
\ No newline at end of file
+136bcf8cdffe4de5ad2128c9b14961294dc7e20f

From 88d04b9cbeee98f3256b78e9d34beb930cd729ec Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Mon, 17 Nov 2025 23:33:16 +0100
Subject: [PATCH 25/81] feat(mcp): granular token scopes for scripts, flows,
 and endpoints (#7130)

* feat(mcp): add granular scope parsing and filtering

- Add scope_matcher.rs with McpScopeConfig and parsing logic
- Support new scope format: mcp:scripts:{paths}, mcp:flows:{paths}, mcp:endpoints:{names}
- Update check_scopes() to accept any mcp:* scope
- Implement resource matching with wildcard support (f/folder/*)
- Full backward compatibility with legacy scopes (mcp:all, mcp:favorites, mcp:hub:{app})
- Add comprehensive unit tests for scope parsing and matching

Co-authored-by: centdix <centdix@users.noreply.github.com>

* feat(mcp): add badge-based UI for granular scope selection

- Add 'Custom' toggle option to MCP token creation UI
- Implement clickable badge interface for selecting scripts/flows/endpoints
- Selected badges show in blue, unselected in gray with opacity
- Automatically load all workspace scripts/flows/endpoints in custom mode
- Generate granular scopes: mcp:scripts:{paths}, mcp:flows:{paths}, mcp:endpoints:{names}
- Validate at least one resource is selected before token creation
- Display selection count for user feedback

Co-authored-by: centdix <centdix@users.noreply.github.com>

* docs(openapi): document granular MCP scope format

- Add comprehensive documentation for MCP scopes in NewToken schema
- Document new granular format: mcp:scripts:{paths}, mcp:flows:{paths}, mcp:endpoints:{names}
- Provide usage examples for common scenarios
- Mark legacy scopes (mcp:all, mcp:favorites) as deprecated but supported
- Include wildcard pattern examples (f/folder/*)

Co-authored-by: centdix <centdix@users.noreply.github.com>

* fix: add type annotation for None in scope_path tuple

Fix compilation error where type parameter T could not be inferred for Option.
Changed None to None::<&str> to explicitly specify the type.

Co-authored-by: centdix <centdix@users.noreply.github.com>

* better ui

* cleaning

* fix back comp

* fix

* fix

* cleaning

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: centdix <centdix@users.noreply.github.com>
---
 backend/windmill-api/openapi.yaml             |   2 +-
 backend/windmill-api/src/mcp/server.rs        | 124 ++++++----
 .../windmill-api/src/mcp/utils/database.rs    |  27 +--
 backend/windmill-api/src/mcp/utils/mod.rs     |   3 +-
 .../src/mcp/utils/scope_matcher.rs            | 229 ++++++++++++++++++
 .../components/settings/CreateToken.svelte    | 148 ++++++++++-
 6 files changed, 455 insertions(+), 78 deletions(-)
 create mode 100644 backend/windmill-api/src/mcp/utils/scope_matcher.rs

diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index c8345e4b38..72d3ac3407 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -15113,7 +15113,7 @@ components:
       schema:
         type: integer
     JobTriggerKind:
-      name: trigger_kind 
+      name: trigger_kind
       description: trigger kind (schedule, http, websocket...)
       in: query
       schema:
diff --git a/backend/windmill-api/src/mcp/server.rs b/backend/windmill-api/src/mcp/server.rs
index 8a09459202..0e1a585383 100644
--- a/backend/windmill-api/src/mcp/server.rs
+++ b/backend/windmill-api/src/mcp/server.rs
@@ -39,6 +39,7 @@ use super::utils::{
         FlowInfo, ResourceInfo, ResourceType, SchemaType, ScriptInfo, ToolableItem, WorkspaceId,
     },
     schema::transform_schema_for_resources,
+    scope_matcher::{is_resource_allowed, parse_mcp_scopes},
     transform::{reverse_transform, reverse_transform_key},
 };
 
@@ -151,6 +152,10 @@ impl ServerHandler for Runner {
 
         check_scopes(authed)?;
 
+        // Parse MCP scopes for authorization
+        let scopes = authed.scopes.as_ref().map(|s| s.as_slice()).unwrap_or(&[]);
+        let scope_config = parse_mcp_scopes(scopes)?;
+
         if request.name.ends_with("_TRUNC") {
             return Ok(CallToolResult::error(
                 vec![
@@ -197,6 +202,19 @@ impl ServerHandler for Runner {
         let endpoint_tools = all_endpoint_tools();
         for endpoint_tool in endpoint_tools {
             if endpoint_tool.name.as_ref() == request.name {
+                // Validate endpoint scope
+                if scope_config.granular
+                    && !is_resource_allowed(&endpoint_tool.name, &scope_config.endpoints)
+                {
+                    return Err(ErrorData::internal_error(
+                        format!(
+                            "Access denied: endpoint '{}' not in token scope",
+                            endpoint_tool.name
+                        ),
+                        None,
+                    ));
+                }
+
                 // This is an endpoint tool, forward to the actual HTTP endpoint
                 let result =
                     call_endpoint_tool(&endpoint_tool, args.clone(), &workspace_id, &authed)
@@ -212,6 +230,21 @@ impl ServerHandler for Runner {
             ErrorData::internal_error(format!("Failed to reverse transform path: {}", e), None)
         })?;
 
+        // Validate script/flow scope
+        if !is_hub && scope_config.granular {
+            if tool_type == "script" && !is_resource_allowed(&path, &scope_config.scripts) {
+                return Err(ErrorData::internal_error(
+                    format!("Access denied: script '{}' not in token scope", path),
+                    None,
+                ));
+            } else if tool_type == "flow" && !is_resource_allowed(&path, &scope_config.flows) {
+                return Err(ErrorData::internal_error(
+                    format!("Access denied: flow '{}' not in token scope", path),
+                    None,
+                ));
+            }
+        }
+
         let item_schema = if is_hub {
             get_hub_script_schema(&format!("hub/{}", path), db).await?
         } else {
@@ -337,53 +370,23 @@ impl ServerHandler for Runner {
             })
             .map(|w_id| w_id.0.clone())?;
 
-        let scopes = authed.scopes.as_ref();
-        let owned_scope = scopes.and_then(|scopes| {
-            scopes
-                .iter()
-                .find(|scope| scope.starts_with("mcp:") && !scope.contains("hub"))
-        });
-        let hub_scope =
-            scopes.and_then(|scopes| scopes.iter().find(|scope| scope.starts_with("mcp:hub")));
-        let (scope_type, scope_path) = owned_scope.map_or(("all", None), |scope| {
-            let parts = scope.split(":").collect::<Vec<&str>>();
-            (
-                parts[1],
-                if parts.len() == 3 {
-                    Some(parts[2])
-                } else {
-                    None
-                },
-            )
-        });
-        let scope_integrations = hub_scope.and_then(|scope| {
-            let parts = scope.split(":").collect::<Vec<&str>>();
-            if parts.len() == 3 {
-                Some(parts[2])
-            } else {
-                None
-            }
-        });
+        // Parse MCP scopes to determine what to expose
+        let scopes = authed.scopes.as_ref().map(|s| s.as_slice()).unwrap_or(&[]);
+        let scope_config = parse_mcp_scopes(scopes)?;
 
-        let scripts_fn = get_items::<ScriptInfo>(
-            user_db,
-            authed,
-            &workspace_id,
-            scope_type,
-            "script",
-            scope_path.as_deref(),
-        );
-        let flows_fn = get_items::<FlowInfo>(
-            user_db,
-            authed,
-            &workspace_id,
-            scope_type,
-            "flow",
-            scope_path.as_deref(),
-        );
+        let scope_type = if scope_config.favorites {
+            "favorites"
+        } else {
+            // Fetch all items if either all or granular scope set (we filter later for granular scopes)
+            "all"
+        };
+
+        let scripts_fn =
+            get_items::<ScriptInfo>(user_db, authed, &workspace_id, scope_type, "script");
+        let flows_fn = get_items::<FlowInfo>(user_db, authed, &workspace_id, scope_type, "flow");
         let resources_types_fn = get_resources_types(user_db, authed, &workspace_id);
-        let hub_scripts_fn = get_scripts_from_hub(db, scope_integrations.as_deref());
-        let (scripts, flows, resources_types, hub_scripts) = if scope_integrations.is_some() {
+        let hub_scripts_fn = get_scripts_from_hub(db, scope_config.hub_apps.as_deref());
+        let (scripts, flows, resources_types, hub_scripts) = if scope_config.hub_apps.is_some() {
             let (scripts, flows, resources_types, hub_scripts) =
                 try_join!(scripts_fn, flows_fn, resources_types_fn, hub_scripts_fn)?;
             (scripts, flows, resources_types, hub_scripts)
@@ -396,7 +399,13 @@ impl ServerHandler for Runner {
         let mut resources_cache: HashMap<String, Vec<ResourceInfo>> = HashMap::new();
         let mut tools: Vec<Tool> = Vec::new();
 
+        // Filter and add scripts based on scope
         for script in scripts {
+            // For granular scopes, filter by path
+            if scope_config.granular && !is_resource_allowed(&script.path, &scope_config.scripts) {
+                continue;
+            }
+
             tools.push(
                 Runner::create_tool_from_item(
                     &script,
@@ -410,7 +419,13 @@ impl ServerHandler for Runner {
             );
         }
 
+        // Filter and add flows based on scope
         for flow in flows {
+            // For granular scopes, filter by path
+            if scope_config.granular && !is_resource_allowed(&flow.path, &scope_config.flows) {
+                continue;
+            }
+
             tools.push(
                 Runner::create_tool_from_item(
                     &flow,
@@ -438,10 +453,23 @@ impl ServerHandler for Runner {
             );
         }
 
-        // Add endpoint tools from the generated MCP tools
+        // Add endpoint tools from the generated MCP tools, filtered by scope
         let endpoint_tools = all_endpoint_tools();
-        let mcp_tools_converted = endpoint_tools_to_mcp_tools(endpoint_tools);
-        tools.extend(mcp_tools_converted);
+        for endpoint_tool in endpoint_tools {
+            // For granular scopes, filter by endpoint name
+            if scope_config.granular
+                && !is_resource_allowed(&endpoint_tool.name, &scope_config.endpoints)
+            {
+                continue;
+            }
+
+            tools.push(
+                endpoint_tools_to_mcp_tools(vec![endpoint_tool])
+                    .into_iter()
+                    .next()
+                    .unwrap(),
+            );
+        }
 
         Ok(ListToolsResult { tools, next_cursor: None })
     }
diff --git a/backend/windmill-api/src/mcp/utils/database.rs b/backend/windmill-api/src/mcp/utils/database.rs
index 39aac1ae6e..32da184638 100644
--- a/backend/windmill-api/src/mcp/utils/database.rs
+++ b/backend/windmill-api/src/mcp/utils/database.rs
@@ -18,11 +18,10 @@ use crate::HTTP_CLIENT;
 pub fn check_scopes(authed: &ApiAuthed) -> Result<(), ErrorData> {
     let scopes = authed.scopes.as_ref();
     if scopes.is_none()
-        || scopes.unwrap().iter().all(|scope| {
-            !scope.starts_with("mcp:all")
-                && !scope.starts_with("mcp:favorites")
-                && !scope.starts_with("mcp:hub:")
-        })
+        || scopes
+            .unwrap()
+            .iter()
+            .all(|scope| !scope.starts_with("mcp:"))
     {
         tracing::error!("Unauthorized: missing mcp scope");
         return Err(ErrorData::internal_error(
@@ -141,7 +140,6 @@ pub async fn get_items<T: for<'a> sqlx::FromRow<'a, sqlx::postgres::PgRow> + Sen
     workspace_id: &str,
     scope_type: &str,
     item_type: &str,
-    scope_path: Option<&str>,
 ) -> Result<Vec<T>, ErrorData> {
     let mut sqlb = SqlBuilder::select_from(&format!("{} as o", item_type));
     let fields = vec!["o.path", "o.summary", "o.description", "o.schema"];
@@ -159,23 +157,6 @@ pub async fn get_items<T: for<'a> sqlx::FromRow<'a, sqlx::postgres::PgRow> + Sen
         sqlb.and_where("(o.no_main_func IS NOT TRUE OR o.no_main_func IS NULL)");
     }
 
-    // scope path is always a folder path, format is f/my_folder/*
-    if let Some(scope_path) = scope_path {
-        if scope_path.split("/").count() != 3
-            || !scope_path.starts_with("f/")
-            || !scope_path.ends_with("/*")
-        {
-            return Err(ErrorData::internal_error(
-                format!(
-                    "Invalid folder format: {}, expected format is f/my_folder/*",
-                    scope_path
-                ),
-                None,
-            ));
-        }
-        sqlb.and_where_like_left("o.path", &scope_path[..scope_path.len() - 2]);
-    }
-
     sqlb.order_by(
         if item_type == "flow" {
             "o.edited_at"
diff --git a/backend/windmill-api/src/mcp/utils/mod.rs b/backend/windmill-api/src/mcp/utils/mod.rs
index 04464be481..e4072313a0 100644
--- a/backend/windmill-api/src/mcp/utils/mod.rs
+++ b/backend/windmill-api/src/mcp/utils/mod.rs
@@ -6,4 +6,5 @@
 pub mod models;
 pub mod database;
 pub mod schema;
-pub mod transform;
\ No newline at end of file
+pub mod transform;
+pub mod scope_matcher;
\ No newline at end of file
diff --git a/backend/windmill-api/src/mcp/utils/scope_matcher.rs b/backend/windmill-api/src/mcp/utils/scope_matcher.rs
new file mode 100644
index 0000000000..05fdafb706
--- /dev/null
+++ b/backend/windmill-api/src/mcp/utils/scope_matcher.rs
@@ -0,0 +1,229 @@
+//! MCP Scope matching utilities
+//!
+//! Contains utilities for parsing and matching MCP token scopes to determine
+//! which scripts, flows, and endpoints a token has access to.
+
+use rmcp::ErrorData;
+
+/// Configuration for MCP scopes parsed from token scopes
+#[derive(Debug, Clone, Default)]
+pub struct McpScopeConfig {
+    /// Script paths/patterns allowed by this token
+    pub scripts: Vec<String>,
+    /// Flow paths/patterns allowed by this token
+    pub flows: Vec<String>,
+    /// Endpoint names/patterns allowed by this token
+    pub endpoints: Vec<String>,
+    /// Whether this is a legacy "all" scope
+    pub all: bool,
+    /// Whether this is a "favorites" scope
+    pub favorites: bool,
+    /// Whether a granular scope is detected
+    pub granular: bool,
+    /// Hub app filter (if any)
+    pub hub_apps: Option<String>,
+}
+
+/// Parse MCP scopes from token scope strings
+pub fn parse_mcp_scopes(scopes: &[String]) -> Result<McpScopeConfig, ErrorData> {
+    let mut config = McpScopeConfig::default();
+
+    for scope in scopes {
+        if !scope.starts_with("mcp:") {
+            continue;
+        }
+
+        if scope == "mcp:all" {
+            // Legacy scope: grant access to everything
+            config.all = true;
+            config.scripts.push("*".to_string());
+            config.flows.push("*".to_string());
+            config.endpoints.push("*".to_string());
+            continue;
+        }
+
+        if scope == "mcp:favorites" {
+            // Legacy favorites scope
+            config.favorites = true;
+            continue;
+        }
+
+        // Legacy folder scope: mcp:all:f/folder/*
+        if scope.starts_with("mcp:all:") {
+            if let Some(folder_pattern) = scope.strip_prefix("mcp:all:") {
+                // Parse as folder pattern - add to both scripts and flows. Also add all endpoints.
+                config.scripts.push(folder_pattern.to_string());
+                config.flows.push(folder_pattern.to_string());
+                config.endpoints.push("*".to_string());
+            }
+            continue;
+        }
+
+        if scope.starts_with("mcp:hub:") {
+            // Legacy hub scope
+            if let Some(apps) = scope.strip_prefix("mcp:hub:") {
+                config.hub_apps = Some(apps.to_string());
+            }
+            continue;
+        }
+
+        if let Some(resources) = scope.strip_prefix("mcp:scripts:") {
+            // New granular script scope: mcp:scripts:path1,path2,f/folder/*
+            config.scripts.extend(parse_resource_list(resources)?);
+            continue;
+        }
+
+        if let Some(resources) = scope.strip_prefix("mcp:flows:") {
+            // New granular flow scope: mcp:flows:path1,path2,f/folder/*
+            config.flows.extend(parse_resource_list(resources)?);
+            continue;
+        }
+
+        if let Some(resources) = scope.strip_prefix("mcp:endpoints:") {
+            // New granular endpoint scope: mcp:endpoints:name1,name2
+            config.endpoints.extend(parse_resource_list(resources)?);
+            continue;
+        }
+
+        tracing::warn!("Unrecognized MCP scope format: {}", scope);
+    }
+
+    config.granular = !config.all && !config.favorites;
+
+    Ok(config)
+}
+
+/// Parse comma-separated resource list
+fn parse_resource_list(resources: &str) -> Result<Vec<String>, ErrorData> {
+    if resources.is_empty() {
+        return Ok(vec![]);
+    }
+
+    Ok(resources
+        .split(',')
+        .map(|s| s.trim().to_string())
+        .filter(|s| !s.is_empty())
+        .collect())
+}
+
+/// Check if a resource path matches any pattern in the allowed list
+pub fn is_resource_allowed(resource_path: &str, allowed_patterns: &[String]) -> bool {
+    if allowed_patterns.is_empty() {
+        return false;
+    }
+
+    // Wildcard grants all access
+    if allowed_patterns.contains(&"*".to_string()) {
+        return true;
+    }
+
+    // Check against each pattern
+    for pattern in allowed_patterns {
+        if resource_matches_pattern(resource_path, pattern) {
+            return true;
+        }
+    }
+
+    false
+}
+
+/// Check if a resource path matches a pattern (supports wildcards like f/folder/*)
+fn resource_matches_pattern(resource_path: &str, pattern: &str) -> bool {
+    // Exact match
+    if pattern == resource_path {
+        return true;
+    }
+
+    // Wildcard pattern matching
+    if pattern.ends_with("/*") {
+        let prefix = &pattern[..pattern.len() - 2];
+
+        if !resource_path.starts_with(prefix) {
+            return false;
+        }
+
+        // If the resource is exactly the prefix, it matches
+        if resource_path.len() == prefix.len() {
+            return true;
+        }
+
+        // If the resource is longer, the next character must be '/' for a valid match
+        // This prevents "u/user" from matching "u/use/*"
+        return resource_path.chars().nth(prefix.len()) == Some('/');
+    }
+
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_parse_legacy_scopes() {
+        let scopes = vec!["mcp:all".to_string()];
+        let config = parse_mcp_scopes(&scopes).unwrap();
+        assert!(config.all);
+        assert_eq!(config.scripts, vec!["*"]);
+        assert_eq!(config.flows, vec!["*"]);
+        assert_eq!(config.endpoints, vec!["*"]);
+
+        let scopes = vec!["mcp:favorites".to_string()];
+        let config = parse_mcp_scopes(&scopes).unwrap();
+        assert!(config.favorites);
+
+        let scopes = vec!["mcp:hub:slack".to_string()];
+        let config = parse_mcp_scopes(&scopes).unwrap();
+        assert_eq!(config.hub_apps, Some("slack".to_string()));
+    }
+
+    #[test]
+    fn test_parse_granular_scopes() {
+        let scopes = vec![
+            "mcp:scripts:u/admin/script1,u/admin/script2".to_string(),
+            "mcp:flows:f/automation/*".to_string(),
+            "mcp:endpoints:list_jobs,get_job".to_string(),
+        ];
+        let config = parse_mcp_scopes(&scopes).unwrap();
+
+        assert_eq!(config.scripts, vec!["u/admin/script1", "u/admin/script2"]);
+        assert_eq!(config.flows, vec!["f/automation/*"]);
+        assert_eq!(config.endpoints, vec!["list_jobs", "get_job"]);
+    }
+
+    #[test]
+    fn test_resource_matching() {
+        // Exact match
+        assert!(resource_matches_pattern("u/admin/script", "u/admin/script"));
+
+        // Wildcard folder match
+        assert!(resource_matches_pattern("f/folder/script", "f/folder/*"));
+        assert!(resource_matches_pattern(
+            "f/folder/sub/script",
+            "f/folder/*"
+        ));
+
+        // Should NOT match - prefix is not complete
+        assert!(!resource_matches_pattern("u/username", "u/user/*"));
+
+        // Should match - exact prefix
+        assert!(resource_matches_pattern("u/user/script", "u/user/*"));
+    }
+
+    #[test]
+    fn test_is_resource_allowed() {
+        let patterns = vec!["u/admin/script1".to_string(), "f/folder/*".to_string()];
+
+        assert!(is_resource_allowed("u/admin/script1", &patterns));
+        assert!(is_resource_allowed("f/folder/anything", &patterns));
+        assert!(!is_resource_allowed("u/other/script", &patterns));
+
+        // Test wildcard
+        let wildcard = vec!["*".to_string()];
+        assert!(is_resource_allowed("any/path", &wildcard));
+
+        // Test empty patterns
+        let empty: Vec<String> = vec![];
+        assert!(!is_resource_allowed("any/path", &empty));
+    }
+}
diff --git a/frontend/src/lib/components/settings/CreateToken.svelte b/frontend/src/lib/components/settings/CreateToken.svelte
index e6c36bdf70..ec06cabf7a 100644
--- a/frontend/src/lib/components/settings/CreateToken.svelte
+++ b/frontend/src/lib/components/settings/CreateToken.svelte
@@ -58,6 +58,13 @@
 	let includedRunnables = $state<string[]>([])
 	let selectedFolder = $state<string>('')
 
+	// Granular scope selection
+	let selectedScripts = $state<string[]>([])
+	let selectedFlows = $state<string[]>([])
+	let selectedEndpoints = $state<string[]>([])
+	let allScripts = $state<string[]>([])
+	let allFlows = $state<string[]>([])
+
 	let runnablesCache = new Map<string, string[]>()
 
 	let customScopes = $state<string[]>([])
@@ -86,9 +93,21 @@
 
 			let tokenScopes = scopes
 			if (mcpMode) {
-				if (newMcpScope === 'folder') {
+				if (newMcpScope === 'custom') {
+					// Granular scope format
+					tokenScopes = []
+					if (selectedScripts.length > 0) {
+						tokenScopes.push(`mcp:scripts:${selectedScripts.join(',')}`)
+					}
+					if (selectedFlows.length > 0) {
+						tokenScopes.push(`mcp:flows:${selectedFlows.join(',')}`)
+					}
+					if (selectedEndpoints.length > 0) {
+						tokenScopes.push(`mcp:endpoints:${selectedEndpoints.join(',')}`)
+					}
+				} else if (newMcpScope === 'folder') {
 					const folderPath = `f/${selectedFolder}/*`
-					tokenScopes = [`mcp:all:${folderPath}`]
+					tokenScopes = [`mcp:scripts:${folderPath}`, `mcp:flows:${folderPath}`, `mcp:endpoints:*`]
 				} else {
 					tokenScopes = [`mcp:${newMcpScope}`]
 				}
@@ -247,6 +266,53 @@
 			selectedFolder = ''
 		}
 	})
+
+	$effect(() => {
+		if (mcpCreationMode && newMcpScope === 'custom') {
+			const workspace = newTokenWorkspace || $workspaceStore
+			if (workspace) {
+				loadAllScriptsAndFlows(workspace)
+			}
+		}
+	})
+
+	async function loadAllScriptsAndFlows(workspace: string) {
+		try {
+			loadingRunnables = true
+			const [scripts, flows] = await Promise.all([
+				getScripts(false, workspace, undefined),
+				getFlows(false, workspace, undefined)
+			])
+			allScripts = scripts
+			allFlows = flows
+		} finally {
+			loadingRunnables = false
+		}
+	}
+
+	function selectAllScripts() {
+		selectedScripts = [...allScripts]
+	}
+
+	function clearAllScripts() {
+		selectedScripts = []
+	}
+
+	function selectAllFlows() {
+		selectedFlows = [...allFlows]
+	}
+
+	function clearAllFlows() {
+		selectedFlows = []
+	}
+
+	function selectAllEndpoints() {
+		selectedEndpoints = [...mcpEndpointTools.map((e) => e.name)]
+	}
+
+	function clearAllEndpoints() {
+		selectedEndpoints = []
+	}
 </script>
 
 <div>
@@ -317,7 +383,7 @@
 
 		<div class="mt-2 grid grid-cols-1 md:grid-cols-2 gap-4">
 			{#if mcpCreationMode}
-				<div>
+				<div class="col-span-2">
 					<span class="block mb-1 text-emphasis text-xs font-semibold">Scope</span>
 					<ToggleButtonGroup bind:selected={newMcpScope} allowEmpty={false}>
 						{#snippet children({ item })}
@@ -339,6 +405,12 @@
 								label="Folder"
 								tooltip="Make all scripts and flows in the selected folder available as tools"
 							/>
+							<ToggleButton
+								{item}
+								value="custom"
+								label="Custom"
+								tooltip="Select exactly which scripts, flows, and endpoints to expose"
+							/>
 						{/snippet}
 					</ToggleButtonGroup>
 				</div>
@@ -404,7 +476,68 @@
 					/>
 				</div>
 			{/if}
-			{#if mcpCreationMode && (newMcpScope !== 'folder' || selectedFolder.length > 0)}
+			{#if mcpCreationMode && newMcpScope === 'custom'}
+				{#if loadingRunnables}
+					<div class="flex flex-col gap-2 col-span-2 pr-4">
+						<span class="block text-xs text-primary">Loading scripts and flows...</span>
+						<div class="flex flex-wrap gap-1">
+							<Badge rounded small color="dark-gray" baseClass="animate-skeleton">Loading...</Badge>
+						</div>
+					</div>
+				{:else}
+					{#snippet sectionHeader(label: string, selectAll: () => void, clearAll: () => void)}
+						<div class="flex items-center justify-between">
+							<span class="block text-xs font-semibold">{label}</span>
+							<div class="flex gap-2">
+								<Button size="xs2" on:click={selectAll}>Select All</Button>
+								<Button size="xs2" on:click={clearAll}>Clear All</Button>
+							</div>
+						</div>
+					{/snippet}
+
+					<div class="flex flex-col gap-2 col-span-2 pr-4">
+						<div class="flex flex-col gap-2">
+							{@render sectionHeader('Scripts', selectAllScripts, clearAllScripts)}
+							{#if allScripts.length > 0}
+								<MultiSelect
+									items={safeSelectItems(allScripts)}
+									placeholder="Select scripts"
+									bind:value={selectedScripts}
+								/>
+							{:else}
+								<p class="text-xs text-primary">No scripts available</p>
+							{/if}
+						</div>
+
+						<div class="flex flex-col gap-2 mt-2">
+							{@render sectionHeader('Flows', selectAllFlows, clearAllFlows)}
+							{#if allFlows.length > 0}
+								<MultiSelect
+									items={safeSelectItems(allFlows)}
+									placeholder="Select flows"
+									bind:value={selectedFlows}
+								/>
+							{:else}
+								<p class="text-xs text-primary">No flows available</p>
+							{/if}
+						</div>
+
+						<div class="flex flex-col gap-2 mt-2">
+							{@render sectionHeader('API Endpoints', selectAllEndpoints, clearAllEndpoints)}
+							<MultiSelect
+								items={safeSelectItems(mcpEndpointTools.map((e) => e.name))}
+								placeholder="Select endpoints"
+								bind:value={selectedEndpoints}
+							/>
+						</div>
+
+						<div class="text-xs text-primary mt-2">
+							Selected: {selectedScripts.length} scripts, {selectedFlows.length} flows, {selectedEndpoints.length}
+							endpoints
+						</div>
+					</div>
+				{/if}
+			{:else if mcpCreationMode && (newMcpScope !== 'folder' || selectedFolder.length > 0)}
 				{#if loadingRunnables}
 					<div class="flex flex-col gap-2 col-span-2 pr-4">
 						<span class="block text-xs text-primary"
@@ -476,7 +609,12 @@
 			<Button
 				on:click={() => createToken(mcpCreationMode)}
 				disabled={mcpCreationMode &&
-					(newTokenWorkspace == undefined || (newMcpScope === 'folder' && !selectedFolder))}
+					(newTokenWorkspace == undefined ||
+						(newMcpScope === 'folder' && !selectedFolder) ||
+						(newMcpScope === 'custom' &&
+							selectedScripts.length === 0 &&
+							selectedFlows.length === 0 &&
+							selectedEndpoints.length === 0))}
 				variant="accent"
 			>
 				New token

From 13216bc2a3a13733c18afd16b3b2fe3616d993e6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 17 Nov 2025 23:00:21 +0000
Subject: [PATCH 26/81] add tracing on email receiving

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 4eee5664d7..04d1178335 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-136bcf8cdffe4de5ad2128c9b14961294dc7e20f
+eddbf00e260df9e7357256eed449250c63b72dce
\ No newline at end of file

From 9b7527c379ec6934cff8667311cecef4e244deb1 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Mon, 17 Nov 2025 23:07:02 +0000
Subject: [PATCH 27/81] add tracing on email receiving

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 04d1178335..51bac9a355 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-eddbf00e260df9e7357256eed449250c63b72dce
\ No newline at end of file
+4dd9a05c122ff4a1559fc2ddf84fa3ede3efd5ca
\ No newline at end of file

From 499d7d4098758726a8cb2bf3e4837927b8fd70a4 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Mon, 17 Nov 2025 18:12:13 -0500
Subject: [PATCH 28/81] feat: rhel8 + fix rhel9 (#7165)

---
 .github/workflows/build-publish-rh8-image.yml | 140 ++++++++++++++++++
 docker/RHEL8/Dockerfile                       |  79 ++++++++++
 docker/RHEL9/Dockerfile                       |   2 +-
 3 files changed, 220 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/build-publish-rh8-image.yml
 create mode 100644 docker/RHEL8/Dockerfile

diff --git a/.github/workflows/build-publish-rh8-image.yml b/.github/workflows/build-publish-rh8-image.yml
new file mode 100644
index 0000000000..aabb17a592
--- /dev/null
+++ b/.github/workflows/build-publish-rh8-image.yml
@@ -0,0 +1,140 @@
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+name: Build and publish windmill for RHEL8
+on: workflow_dispatch
+
+permissions: write-all
+
+jobs:
+  build_ee:
+    runs-on: ubicloud
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Read EE repo commit hash
+        run: |
+          echo "ee_repo_ref=$(cat ./backend/ee-repo-ref.txt)" >> "$GITHUB_ENV"
+
+      - uses: actions/checkout@v4
+        with:
+          repository: windmill-labs/windmill-ee-private
+          path: ./windmill-ee-private
+          ref: ${{ env.ee_repo_ref }}
+          token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
+          fetch-depth: 0
+
+      # - name: Set up Docker Buildx
+      #   uses: docker/setup-buildx-action@v2
+      - uses: depot/setup-action@v1
+
+      - name: Docker meta
+        id: meta-ee-public
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee-rhel8
+          flavor: |
+            latest=false
+          tags: |
+            type=sha
+
+      - name: Login to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Substitute EE code
+        run: |
+          ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
+
+      - name: Copy RHEL8 Dockerfile
+        run: |
+          cp ./docker/RHEL8/Dockerfile ./Dockerfile
+
+      - name: Build and push publicly ee amd64
+        uses: depot/build-push-action@v1
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          build-args: |
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,license,otel,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp,private
+          secrets: |
+            rh_username=${{ secrets.RH_USERNAME }}
+            rh_password=${{ secrets.RH_PASSWORD }}
+          tags: |
+            ${{ steps.meta-ee-public.outputs.tags }}-amd64
+          labels: |
+            ${{ steps.meta-ee-public.outputs.labels }}-amd64
+            org.opencontainers.image.licenses=Windmill-Enterprise-License
+
+      - name: Build and push publicly ee arm64
+        uses: depot/build-push-action@v1
+        with:
+          context: .
+          platforms: linux/arm64
+          push: true
+          build-args: |
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,license,otel,http_trigger,zip,oauth2,kafka,sqs_trigger,nats,postgres_trigger,gcp_trigger,mqtt_trigger,websocket,smtp,static_frontend,all_languages,deno_core,mcp,private
+          secrets: |
+            rh_username=${{ secrets.RH_USERNAME }}
+            rh_password=${{ secrets.RH_PASSWORD }}
+          tags: |
+            ${{ steps.meta-ee-public.outputs.tags }}-arm64
+          labels: |
+            ${{ steps.meta-ee-public.outputs.labels }}-arm64
+            org.opencontainers.image.licenses=Windmill-Enterprise-License
+
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-ee-amd64
+        with:
+          image: ${{ steps.meta-ee-public.outputs.tags}}-amd64
+          path: "/windmill/target/release/windmill"
+
+      - uses: shrink/actions-docker-extract@v3
+        id: extract-duckdb-ffi-internal
+        with:
+          image: ${{ steps.meta-ee-public.outputs.tags}}-amd64
+          path: "/usr/src/app/libwindmill_duckdb_ffi_internal.so"
+
+      # - uses: shrink/actions-docker-extract@v3
+      #   id: extract-ee-arm64
+      #   with:
+      #     image: ${{ steps.meta-ee-public.outputs.tags}}-arm64
+      #     path: "/windmill/target/release/windmill"
+
+      - name: Rename binary with corresponding architecture
+        run: |
+          mv "${{ steps.extract-ee-amd64.outputs.destination }}/windmill" "${{ steps.extract-ee-amd64.outputs.destination }}/windmill-ee-amd64-rhel8"
+          # mv "${{ steps.extract-ee-arm64.outputs.destination }}/windmill" "${{ steps.extract-ee-arm64.outputs.destination }}/windmill-ee-arm64-rhel8"
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: RHEL8-amd64 build
+          path: ${{ steps.extract-ee-amd64.outputs.destination }}/windmill-ee-amd64-rhel8
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: RHEL8-amd64 dynamic libraries build
+          path: ${{ steps.extract-duckdb-ffi-internal.outputs.destination }}/libwindmill_duckdb_ffi_internal.so
+
+      # - uses: actions/upload-artifact@v4
+      #   with:
+      #     name: RHEL8-arm64 build
+      #     path:
+      #       ${{ steps.extract-ee-arm64.outputs.destination
+      #       }}/windmill-ee-arm64-rhel8
+
+      # - name: Attach binary to release
+      #   uses: softprops/action-gh-release@v2
+      #   if: startsWith(github.ref, 'refs/tags/')
+      #   with:
+      #     files: |
+      #       ${{ steps.extract-ee-arm64.outputs.destination }}/windmill-ee-arm64-rhel8
+      #       ${{ steps.extract-ee-amd64.outputs.destination }}/windmill-ee-amd64-rhel8
diff --git a/docker/RHEL8/Dockerfile b/docker/RHEL8/Dockerfile
new file mode 100644
index 0000000000..2d4ba3fb3a
--- /dev/null
+++ b/docker/RHEL8/Dockerfile
@@ -0,0 +1,79 @@
+ARG DEBIAN_IMAGE=debian:bookworm-slim
+ARG RUST_IMAGE=registry.access.redhat.com/ubi8/ubi:latest
+ARG PYTHON_IMAGE=python:3.11.10-slim-bookworm
+
+FROM ${RUST_IMAGE} AS rust_base
+
+RUN yum update -y && \
+    yum install -y git openssl-devel npm nodejs rustfmt
+
+# Install rust manually
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+RUN CARGO_NET_GIT_FETCH_WITH_CLI=true cargo install cargo-chef --version ^0.1
+
+WORKDIR /windmill
+
+ENV SQLX_OFFLINE=true
+# ENV CARGO_INCREMENTAL=1
+
+FROM node:20-alpine as frontend
+
+# install dependencies
+WORKDIR /frontend
+COPY ./frontend/package.json ./frontend/package-lock.json ./
+RUN npm ci
+
+# Copy all local files into the image.
+COPY frontend .
+RUN mkdir /backend
+COPY /backend/windmill-api/openapi.yaml /backend/windmill-api/openapi.yaml
+COPY /openflow.openapi.yaml /openflow.openapi.yaml
+COPY /backend/windmill-api/build_openapi.sh /backend/windmill-api/build_openapi.sh
+
+RUN cd /backend/windmill-api && . ./build_openapi.sh
+COPY /backend/parsers/windmill-parser-wasm/pkg/ /backend/parsers/windmill-parser-wasm/pkg/
+COPY /typescript-client/docs/ /frontend/static/tsdocs/
+
+RUN npm run generate-backend-client
+ENV NODE_OPTIONS "--max-old-space-size=10240"
+RUN npm run build
+
+
+FROM rust_base AS planner
+
+COPY ./openflow.openapi.yaml /openflow.openapi.yaml
+COPY ./backend ./
+
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo chef prepare --recipe-path recipe.json
+
+FROM rust_base AS builder
+ARG features=""
+
+COPY --from=planner /windmill/recipe.json recipe.json
+
+RUN --mount=type=secret,id=rh_username \
+    --mount=type=secret,id=rh_password \
+    subscription-manager register --username $(cat /run/secrets/rh_username) --password $(cat /run/secrets/rh_password)
+
+RUN subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
+
+RUN yum update -y && \
+    yum install -y perl-interpreter perl-IPC-Cmd perl-Time-Piece libxml2-devel xmlsec1-devel xmlsec1-openssl-devel clang llvm-devel cmake libtool-ltdl-devel
+
+# RUN --mount=type=cache,target=/usr/local/cargo/registry \
+#     CARGO_NET_GIT_FETCH_WITH_CLI=true RUST_BACKTRACE=1 cargo chef cook --release --features "$features" --recipe-path recipe.json
+
+COPY ./openflow.openapi.yaml /openflow.openapi.yaml
+COPY ./backend ./
+
+COPY --from=frontend /frontend /frontend
+COPY --from=frontend /backend/windmill-api/openapi-deref.yaml ./windmill-api/openapi-deref.yaml
+COPY .git/ .git/
+
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
+
+RUN subscription-manager unregister
diff --git a/docker/RHEL9/Dockerfile b/docker/RHEL9/Dockerfile
index 7399fd690a..ace996cab5 100644
--- a/docker/RHEL9/Dockerfile
+++ b/docker/RHEL9/Dockerfile
@@ -61,7 +61,7 @@ RUN --mount=type=secret,id=rh_username \
 RUN subscription-manager repos --enable codeready-builder-for-rhel-9-$(arch)-rpms
 
 RUN yum update -y && \
-    yum install -y perl-FindBin perl-IPC-Cmd libxml2-devel xmlsec1-devel xmlsec1-openssl-devel clang llvm-devel cmake libtool-ltdl-devel
+    yum install -y perl-FindBin perl-IPC-Cmd perl-Time-Piece libxml2-devel xmlsec1-devel xmlsec1-openssl-devel clang llvm-devel cmake libtool-ltdl-devel
 
 # RUN --mount=type=cache,target=/usr/local/cargo/registry \
 #     CARGO_NET_GIT_FETCH_WITH_CLI=true RUST_BACKTRACE=1 cargo chef cook --release --features "$features" --recipe-path recipe.json

From 25c9223ba0a5b93eefd072fc4865b9249ee20b63 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 00:26:59 +0100
Subject: [PATCH 29/81] chore(main): release 1.579.0 (#7161)

* chore(main): release 1.579.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  | 15 +++++
 backend/Cargo.lock                            | 62 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 63 insertions(+), 48 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 54b4a82ee4..c27a4050fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [1.579.0](https://github.com/windmill-labs/windmill/compare/v1.578.0...v1.579.0) (2025-11-17)
+
+
+### Features
+
+* **ai:** handle aws bedrock as provider ([#7155](https://github.com/windmill-labs/windmill/issues/7155)) ([79ac631](https://github.com/windmill-labs/windmill/commit/79ac6312e87afa3646bddc0f7e66fc4367dbff7c))
+* **mcp:** granular token scopes for scripts, flows, and endpoints ([#7130](https://github.com/windmill-labs/windmill/issues/7130)) ([88d04b9](https://github.com/windmill-labs/windmill/commit/88d04b9cbeee98f3256b78e9d34beb930cd729ec))
+* rhel8 + fix rhel9 ([#7165](https://github.com/windmill-labs/windmill/issues/7165)) ([499d7d4](https://github.com/windmill-labs/windmill/commit/499d7d4098758726a8cb2bf3e4837927b8fd70a4))
+
+
+### Bug Fixes
+
+* **backend:** worker count in latest worker usage ([#7160](https://github.com/windmill-labs/windmill/issues/7160)) ([b87d2cc](https://github.com/windmill-labs/windmill/commit/b87d2cc64cb54b602ee599fcde7f0fd3c8931550))
+* fix custom email triggers enabled ([#7164](https://github.com/windmill-labs/windmill/issues/7164)) ([90b5569](https://github.com/windmill-labs/windmill/commit/90b5569c911f9025b0e6b5318f57705efbd9bd17))
+
 ## [1.578.0](https://github.com/windmill-labs/windmill/compare/v1.577.0...v1.578.0) (2025-11-17)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index d55a6487c9..76ec2ea3fb 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2094,9 +2094,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.51"
+version = "4.5.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c26d721170e0295f191a69bd9a1f93efcdb0aff38684b61ab5750468972e5f5"
+checksum = "aa8120877db0e5c011242f96806ce3c94e0737ab8108532a76a3300a01db2ab8"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2104,9 +2104,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.51"
+version = "4.5.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75835f0c7bf681bfd05abe44e965760fea999a5286c6eb2d59883634fd02011a"
+checksum = "02576b399397b659c26064fbc92a75fede9d18ffd5f80ca1cd74ddab167016e1"
 dependencies = [
  "anstream",
  "anstyle",
@@ -15188,7 +15188,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15250,7 +15250,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15371,7 +15371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "regex",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15591,7 +15591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15615,7 +15615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15627,7 +15627,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15638,7 +15638,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15649,7 +15649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15661,7 +15661,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15715,7 +15715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15729,7 +15729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15793,7 +15793,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15803,7 +15803,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.578.0"
+version = "1.579.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index b196852f58..b396ce6949 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.578.0"
+version = "1.579.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.578.0"
+version = "1.579.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 72d3ac3407..83651cece7 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.578.0
+  version: 1.579.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index ecee3e3434..d509942ef2 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.578.0";
+export const VERSION = "v1.579.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 682fedd85f..70baafb5ce 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.578.0";
+export const VERSION = "1.579.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index f404b4910e..7a7ef8928e 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.578.0",
+	"version": "1.579.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.578.0",
+			"version": "1.579.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 09d94af50d..db3c55d311 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.578.0",
+	"version": "1.579.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 97c0e43736..8cb880680b 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.578.0"
-wmill_pg = ">=1.578.0"
+wmill = ">=1.579.0"
+wmill_pg = ">=1.579.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 3c43d04b63..e3216466ec 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.578.0
+  version: 1.579.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index f475c8d0e0..9abcc2edcf 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.578.0'
+    ModuleVersion     = '1.579.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 92d46d3330..129fe2686d 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.578.0"
+version = "1.579.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index ea146232cd..facff31609 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.578.0"
+version = "1.579.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index f38e455c56..0a07acb78a 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.578.0",
+  "version": "1.579.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 564c31c948..294dc0b0d5 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.578.0",
+  "version": "1.579.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 8e8031afb2..ecf50ba8f0 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.578.0
+1.579.0

From 09a6e1feaa79ce3f8548f8090fddbf46abb08b18 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 00:09:51 +0000
Subject: [PATCH 30/81] fix: fix s3 object download frontend freezes

---
 .../common/fileDownload/FileDownload.svelte   | 30 ++++++++++---------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
index 8887e6b4e0..0062c171aa 100644
--- a/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
+++ b/frontend/src/lib/components/common/fileDownload/FileDownload.svelte
@@ -12,20 +12,22 @@
 	let { s3object, workspaceId = undefined, appPath = undefined }: Props = $props()
 </script>
 
-<a
-	class="relative center-center flex w-full text-center font-normal text-primary text-sm
+{#if s3object && s3object?.s3}
+	<a
+		class="relative center-center flex w-full text-center font-normal text-primary text-sm
 border border-dashed border-gray-400 hover:border-blue-500
 focus-within:border-blue-500 hover:bg-blue-50 dark:hover:bg-frost-900 focus-within:bg-blue-50
 duration-200 rounded-lg p-1 gap-2"
-	href={`${base}/api/w/${workspaceId ?? $workspaceStore}${
-		appPath ? `/apps_u/download_s3_file/${appPath}` : '/job_helpers/download_s3_file'
-	}?${appPath ? 's3' : 'file_key'}=${encodeURIComponent(s3object?.s3 ?? '')}${
-		s3object?.storage ? `&storage=${s3object.storage}` : ''
-	}${appPath && s3object?.presigned ? `&${s3object.presigned}` : ''}`}
-	download={s3object?.s3.split('/').pop() ?? 'unnamed_download.file'}
->
-	<Download />
-	<span>
-		{s3object.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
-	</span>
-</a>
+		href={`${base}/api/w/${workspaceId ?? $workspaceStore}${
+			appPath ? `/apps_u/download_s3_file/${appPath}` : '/job_helpers/download_s3_file'
+		}?${appPath ? 's3' : 'file_key'}=${encodeURIComponent(s3object?.s3 ?? '')}${
+			s3object?.storage ? `&storage=${s3object.storage}` : ''
+		}${appPath && s3object?.presigned ? `&${s3object?.presigned}` : ''}`}
+		download={s3object?.s3?.split?.('/')?.pop() ?? 'unnamed_download.file'}
+	>
+		<Download />
+		<span>
+			{s3object?.storage ? `s3://${s3object.storage}/${s3object.s3}` : `s3:///${s3object.s3}`}
+		</span>
+	</a>
+{/if}

From 610f90b19eab43fde1fed601ba6d2cc8dfd3ed62 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 01:19:08 +0100
Subject: [PATCH 31/81] chore(main): release 1.579.1 (#7166)

* chore(main): release 1.579.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c27a4050fe..36009604d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.579.1](https://github.com/windmill-labs/windmill/compare/v1.579.0...v1.579.1) (2025-11-18)
+
+
+### Bug Fixes
+
+* fix s3 object download frontend freezes ([09a6e1f](https://github.com/windmill-labs/windmill/commit/09a6e1feaa79ce3f8548f8090fddbf46abb08b18))
+
 ## [1.579.0](https://github.com/windmill-labs/windmill/compare/v1.578.0...v1.579.0) (2025-11-17)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 76ec2ea3fb..ed35b2b940 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15188,7 +15188,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15250,7 +15250,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15371,7 +15371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "axum",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "regex",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15591,7 +15591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15615,7 +15615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15627,7 +15627,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15638,7 +15638,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15649,7 +15649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15661,7 +15661,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15715,7 +15715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15729,7 +15729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15793,7 +15793,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15803,7 +15803,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.579.0"
+version = "1.579.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index b396ce6949..b1ddecc49e 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.579.0"
+version = "1.579.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.579.0"
+version = "1.579.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 83651cece7..8d72610fad 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.579.0
+  version: 1.579.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index d509942ef2..447826de29 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.579.0";
+export const VERSION = "v1.579.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 70baafb5ce..5a2d934040 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.579.0";
+export const VERSION = "1.579.1";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 7a7ef8928e..988f9a52bb 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.579.0",
+	"version": "1.579.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.579.0",
+			"version": "1.579.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index db3c55d311..d424efa23c 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.579.0",
+	"version": "1.579.1",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 8cb880680b..30561cf3ee 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.579.0"
-wmill_pg = ">=1.579.0"
+wmill = ">=1.579.1"
+wmill_pg = ">=1.579.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index e3216466ec..58f44122bb 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.579.0
+  version: 1.579.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 9abcc2edcf..1469a4fac8 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.579.0'
+    ModuleVersion     = '1.579.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 129fe2686d..2dc4ab23ed 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.579.0"
+version = "1.579.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index facff31609..d55947ade4 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.579.0"
+version = "1.579.1"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 0a07acb78a..bc8e1103a2 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.579.0",
+  "version": "1.579.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 294dc0b0d5..4332c4eb89 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.579.0",
+  "version": "1.579.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index ecf50ba8f0..47529062aa 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.579.0
+1.579.1

From 4e9c22a0bdb59a50af2f6bc7614f594dbdc23566 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Mon, 17 Nov 2025 19:37:52 -0500
Subject: [PATCH 32/81] rhel duckdb lib (#7167)

* feat: rhel8 + fix rhel9

* duckdb lib
---
 docker/RHEL8/Dockerfile | 6 ++++++
 docker/RHEL9/Dockerfile | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/docker/RHEL8/Dockerfile b/docker/RHEL8/Dockerfile
index 2d4ba3fb3a..453d5bf3db 100644
--- a/docker/RHEL8/Dockerfile
+++ b/docker/RHEL8/Dockerfile
@@ -76,4 +76,10 @@ COPY .git/ .git/
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p windmill_duckdb_ffi_internal
+
+RUN mkdir -p /usr/src/app && \
+    cp /windmill/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
+
 RUN subscription-manager unregister
diff --git a/docker/RHEL9/Dockerfile b/docker/RHEL9/Dockerfile
index ace996cab5..6c0ef21293 100644
--- a/docker/RHEL9/Dockerfile
+++ b/docker/RHEL9/Dockerfile
@@ -76,4 +76,10 @@ COPY .git/ .git/
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p windmill_duckdb_ffi_internal
+
+RUN mkdir -p /usr/src/app && \
+    cp /windmill/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
+
 RUN subscription-manager unregister

From d08c0916f72a67f01e0c4475f03f9d1d33c10905 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 00:48:50 +0000
Subject: [PATCH 33/81] fix: ducklake manager table explorer issue

---
 frontend/src/lib/components/dbOps.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/dbOps.ts b/frontend/src/lib/components/dbOps.ts
index 3a9e413d7b..fa1d265dbb 100644
--- a/frontend/src/lib/components/dbOps.ts
+++ b/frontend/src/lib/components/dbOps.ts
@@ -179,11 +179,11 @@ export async function getDucklakeSchema({
 			args: {}
 		}
 	})
-	const stringified = Array.isArray(result) && result.length && (result?.[0]?.['result'] ?? '[]')
+	const mainSchema = Array.isArray(result) && result.length && (result?.[0]?.['result'] ?? '[]')
 
-	if (!stringified) throw new Error('Failed to get Ducklake schema: ' + JSON.stringify(result))
+	if (!mainSchema) throw new Error('Failed to get Ducklake schema: ' + JSON.stringify(result))
 	let schema: Omit<SQLSchema, 'stringified'> = {
-		schema: { main: JSON.parse(stringified) },
+		schema: { main: mainSchema },
 		publicOnly: true,
 		lang: 'ducklake'
 	}

From aad43768d43dd6bc8cea7ae8df8e6a33fe47ebfd Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 01:58:17 +0100
Subject: [PATCH 34/81] chore(main): release 1.579.2 (#7168)

* chore(main): release 1.579.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 36009604d8..1fd328ff7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.579.2](https://github.com/windmill-labs/windmill/compare/v1.579.1...v1.579.2) (2025-11-18)
+
+
+### Bug Fixes
+
+* ducklake manager table explorer issue ([d08c091](https://github.com/windmill-labs/windmill/commit/d08c0916f72a67f01e0c4475f03f9d1d33c10905))
+
 ## [1.579.1](https://github.com/windmill-labs/windmill/compare/v1.579.0...v1.579.1) (2025-11-18)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index ed35b2b940..f535756953 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15188,7 +15188,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15250,7 +15250,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15371,7 +15371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "regex",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15591,7 +15591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15615,7 +15615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15627,7 +15627,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15638,7 +15638,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15649,7 +15649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15661,7 +15661,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15715,7 +15715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15729,7 +15729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15793,7 +15793,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15803,7 +15803,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.579.1"
+version = "1.579.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index b1ddecc49e..39f6d688f7 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.579.1"
+version = "1.579.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.579.1"
+version = "1.579.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 8d72610fad..928e5d007a 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.579.1
+  version: 1.579.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 447826de29..f03e8dc8d8 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.579.1";
+export const VERSION = "v1.579.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 5a2d934040..2dd914a174 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.579.1";
+export const VERSION = "1.579.2";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 988f9a52bb..3aa6091a03 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.579.1",
+	"version": "1.579.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.579.1",
+			"version": "1.579.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index d424efa23c..2cafa2f164 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.579.1",
+	"version": "1.579.2",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 30561cf3ee..83039a03a0 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.579.1"
-wmill_pg = ">=1.579.1"
+wmill = ">=1.579.2"
+wmill_pg = ">=1.579.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 58f44122bb..767ac52c39 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.579.1
+  version: 1.579.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 1469a4fac8..c9bf412999 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.579.1'
+    ModuleVersion     = '1.579.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 2dc4ab23ed..1176f685b3 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.579.1"
+version = "1.579.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index d55947ade4..6eee2cdc7c 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.579.1"
+version = "1.579.2"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index bc8e1103a2..b2486f5590 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.579.1",
+  "version": "1.579.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 4332c4eb89..58620fb9f4 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.579.1",
+  "version": "1.579.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 47529062aa..70d301e6a1 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.579.1
+1.579.2

From 423ed04cb928ef845f767ad4c206d768b03c9f0e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 01:34:32 +0000
Subject: [PATCH 35/81] irsa attempts

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 51bac9a355..e83596a378 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-4dd9a05c122ff4a1559fc2ddf84fa3ede3efd5ca
\ No newline at end of file
+72d263f41c59a5bcbdf8c49238a3123d6e49c612
\ No newline at end of file

From 2058f27e03468d45813f340b8563f935ca2142f4 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 01:37:18 +0000
Subject: [PATCH 36/81] fix: support IRSA for duckdb s3 proxy

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index e83596a378..f885c61364 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-72d263f41c59a5bcbdf8c49238a3123d6e49c612
\ No newline at end of file
+785ec89a5fb08d62b5ef59d1860089ed1266ae8b
\ No newline at end of file

From f371fbeb9bb0946bd29a6413ee7ede75dedda5d9 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 08:12:54 +0000
Subject: [PATCH 37/81] fix: improve delete to handle ai chat

---
 ...0fb02e7ffea83ae94a670b598b6dada0b3d0914629.json | 14 ++++++++++++++
 ...ba69de89c4a5cb1fbc9a8b73e6b8ba4d6e74088352.json | 14 ++++++++++++++
 ...04ff3153c43903f929ae5d62fbba12610f89c36d55.json |  2 +-
 backend/windmill-api/src/workspaces_extra.rs       | 11 +++++++++++
 4 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 backend/.sqlx/query-08574e8e5dc165041750880fb02e7ffea83ae94a670b598b6dada0b3d0914629.json
 create mode 100644 backend/.sqlx/query-56d3dccce81c652d6ab3d4ba69de89c4a5cb1fbc9a8b73e6b8ba4d6e74088352.json

diff --git a/backend/.sqlx/query-08574e8e5dc165041750880fb02e7ffea83ae94a670b598b6dada0b3d0914629.json b/backend/.sqlx/query-08574e8e5dc165041750880fb02e7ffea83ae94a670b598b6dada0b3d0914629.json
new file mode 100644
index 0000000000..12d5a410f8
--- /dev/null
+++ b/backend/.sqlx/query-08574e8e5dc165041750880fb02e7ffea83ae94a670b598b6dada0b3d0914629.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM flow_conversation WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "08574e8e5dc165041750880fb02e7ffea83ae94a670b598b6dada0b3d0914629"
+}
diff --git a/backend/.sqlx/query-56d3dccce81c652d6ab3d4ba69de89c4a5cb1fbc9a8b73e6b8ba4d6e74088352.json b/backend/.sqlx/query-56d3dccce81c652d6ab3d4ba69de89c4a5cb1fbc9a8b73e6b8ba4d6e74088352.json
new file mode 100644
index 0000000000..7be13f4746
--- /dev/null
+++ b/backend/.sqlx/query-56d3dccce81c652d6ab3d4ba69de89c4a5cb1fbc9a8b73e6b8ba4d6e74088352.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM ai_agent_memory WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "56d3dccce81c652d6ab3d4ba69de89c4a5cb1fbc9a8b73e6b8ba4d6e74088352"
+}
diff --git a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
index 36ddb8ab9f..713ccb9dd3 100644
--- a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
+++ b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      true
+      null
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"
diff --git a/backend/windmill-api/src/workspaces_extra.rs b/backend/windmill-api/src/workspaces_extra.rs
index 2df23f3ce9..ca4f9db6a7 100644
--- a/backend/windmill-api/src/workspaces_extra.rs
+++ b/backend/windmill-api/src/workspaces_extra.rs
@@ -448,6 +448,17 @@ pub(crate) async fn delete_workspace(
         require_super_admin(&db, &authed.email).await?;
     }
 
+    sqlx::query!("DELETE FROM ai_agent_memory WHERE workspace_id = $1", &w_id)
+        .execute(&mut *tx)
+        .await?;
+
+    sqlx::query!(
+        "DELETE FROM flow_conversation WHERE workspace_id = $1",
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     sqlx::query!("DELETE FROM workspace_env WHERE workspace_id = $1", &w_id)
         .execute(&mut *tx)
         .await?;

From b112c218db86f0161ac24fe5a5ec877ad3182188 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 08:44:32 +0000
Subject: [PATCH 38/81] nit test

---
 .github/workflows/backend-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index 366e6bd27d..e55cf5c004 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -80,7 +80,7 @@ jobs:
           cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd .. &&
           SQLX_OFFLINE=true
           DATABASE_URL=postgres://postgres:changeme@localhost:5432/windmill
-          DISABLE_EMBEDDING=true RUST_LOG=info RUST_LOG_STYLE=never
+          DISABLE_EMBEDDING=true RUST_LOG=info RUST_LOG_STYLE=never CARGO_NET_GIT_FETCH_WITH_CLI=true
           DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go)
           UV_PATH=$(which uv) cargo test --features
           enterprise,deno_core,license,python,duckdb,rust,scoped_cache,private --all --

From 478e19379fa75e57ca1fe5931af73f04a93ce809 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 09:40:57 +0000
Subject: [PATCH 39/81] buffer cloud hosted usage

---
 backend/Cargo.lock                        |   2 +
 backend/Cargo.toml                        |   1 +
 backend/windmill-api/src/lib.rs           |   9 +-
 backend/windmill-queue/Cargo.toml         |   2 +
 backend/windmill-queue/src/cloud_usage.rs | 203 ++++++++++++++++++++++
 backend/windmill-queue/src/jobs.rs        |  45 +----
 backend/windmill-queue/src/lib.rs         |   5 +
 7 files changed, 221 insertions(+), 46 deletions(-)
 create mode 100644 backend/windmill-queue/src/cloud_usage.rs

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index f535756953..2ea6c7fb7b 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15767,12 +15767,14 @@ dependencies = [
  "chrono",
  "chrono-tz",
  "cron",
+ "dashmap 6.1.0",
  "futures",
  "futures-core",
  "hex",
  "hmac",
  "itertools 0.14.0",
  "lazy_static",
+ "once_cell",
  "prometheus",
  "quick_cache",
  "regex",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 39f6d688f7..6a5197d215 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -332,6 +332,7 @@ dyn-iter = "0.2.0"
 rsa = "^0"
 async_zip = { version = "0.0.17", features = ["tokio", "tokio-fs", "deflate", "chrono"] }
 once_cell = "1.17.1"
+dashmap = "6.1.0"
 gosyn = "0.2.6"
 bytes = "1.4.0"
 gethostname = "0.4.3"
diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index 3a83b11ce8..96bf0ed085 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -75,12 +75,12 @@ pub mod agent_workers_ee;
 #[cfg(feature = "agent_worker_server")]
 mod agent_workers_oss;
 mod ai;
-mod bedrock;
 mod apps;
 pub mod args;
 mod assets;
 mod audit;
 pub mod auth;
+mod bedrock;
 mod capture;
 mod concurrency_groups;
 mod configs;
@@ -155,6 +155,7 @@ mod smtp_server_oss;
 pub mod teams_approvals_ee;
 mod teams_approvals_oss;
 
+mod public_app_layer;
 mod static_assets;
 #[cfg(all(feature = "stripe", feature = "enterprise", feature = "private"))]
 pub mod stripe_ee;
@@ -184,7 +185,6 @@ pub mod workspaces_ee;
 mod workspaces_export;
 mod workspaces_extra;
 mod workspaces_oss;
-mod public_app_layer;
 
 #[cfg(feature = "mcp")]
 mod mcp;
@@ -325,6 +325,11 @@ pub async fn run_server(
         #[cfg(feature = "embedding")]
         load_embeddings_db(&db);
 
+        #[cfg(feature = "cloud")]
+        if *CLOUD_HOSTED {
+            windmill_queue::init_usage_buffer(db.clone());
+        }
+
         let mut start_smtp_server = false;
         if let Some(smtp_settings) =
             load_value_from_global_settings(&db, EMAIL_DOMAIN_SETTING).await?
diff --git a/backend/windmill-queue/Cargo.toml b/backend/windmill-queue/Cargo.toml
index 6349aee84e..16178502fe 100644
--- a/backend/windmill-queue/Cargo.toml
+++ b/backend/windmill-queue/Cargo.toml
@@ -47,3 +47,5 @@ regex.workspace = true
 backon.workspace = true
 quick_cache.workspace = true
 thiserror.workspace = true
+dashmap.workspace = true
+once_cell.workspace = true
diff --git a/backend/windmill-queue/src/cloud_usage.rs b/backend/windmill-queue/src/cloud_usage.rs
new file mode 100644
index 0000000000..7ded6977ef
--- /dev/null
+++ b/backend/windmill-queue/src/cloud_usage.rs
@@ -0,0 +1,203 @@
+/*
+ * Author: Ruben Fiszel
+ * Copyright: Windmill Labs, Inc 2022
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+use chrono::Datelike;
+use dashmap::DashMap;
+use sqlx::{Pool, Postgres};
+use std::sync::Arc;
+use tokio::sync::Notify;
+
+#[derive(Debug, Clone, Hash, Eq, PartialEq)]
+struct UsageKey {
+    id: String,
+    is_workspace: bool,
+    month: i32,
+}
+
+pub struct UsageBuffer {
+    buffer: Arc<DashMap<UsageKey, i32>>,
+    db: Pool<Postgres>,
+    shutdown_notify: Arc<Notify>,
+}
+
+impl UsageBuffer {
+    pub fn new(db: Pool<Postgres>) -> Arc<Self> {
+        let buffer = Arc::new(Self {
+            buffer: Arc::new(DashMap::new()),
+            db,
+            shutdown_notify: Arc::new(Notify::new()),
+        });
+
+        // Spawn the periodic flush task
+        let buffer_clone = buffer.clone();
+        tokio::spawn(async move {
+            buffer_clone.flush_loop().await;
+        });
+
+        buffer
+    }
+
+    pub fn increment(&self, workspace_id: String, email: Option<String>) {
+        let month = Self::current_month();
+
+        // Increment workspace usage
+        self.buffer
+            .entry(UsageKey { id: workspace_id, is_workspace: true, month })
+            .and_modify(|counter| *counter += 1)
+            .or_insert(1);
+
+        // Increment user usage if email is provided
+        if let Some(email) = email {
+            self.buffer
+                .entry(UsageKey { id: email, is_workspace: false, month })
+                .and_modify(|counter| *counter += 1)
+                .or_insert(1);
+        }
+    }
+
+    async fn flush_loop(&self) {
+        let mut interval = tokio::time::interval(std::time::Duration::from_secs(60));
+        interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+
+        loop {
+            tokio::select! {
+                _ = interval.tick() => {
+                    self.flush().await;
+                }
+                _ = self.shutdown_notify.notified() => {
+                    // Final flush on shutdown
+                    self.flush().await;
+                    break;
+                }
+            }
+        }
+    }
+
+    async fn flush(&self) {
+        if self.buffer.is_empty() {
+            return;
+        }
+
+        // Drain all buffered usage counts
+        let mut to_flush = Vec::new();
+        self.buffer.retain(|key, value| {
+            to_flush.push((key.clone(), *value));
+            false
+        });
+
+        if to_flush.is_empty() {
+            return;
+        }
+
+        tracing::debug!(
+            "Flushing {} buffered usage entries to database",
+            to_flush.len()
+        );
+
+        // Batch update to database
+        for (key, count) in to_flush {
+            let result = tokio::time::timeout(
+                std::time::Duration::from_secs(10),
+                sqlx::query!(
+                    "INSERT INTO usage (id, is_workspace, month_, usage)
+                    VALUES ($1, $2, $3, $4)
+                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + $4",
+                    &key.id,
+                    key.is_workspace,
+                    key.month,
+                    count
+                )
+                .execute(&self.db),
+            )
+            .await;
+
+            match result {
+                Ok(Ok(_)) => {}
+                Ok(Err(e)) => {
+                    tracing::error!(
+                        "Failed to flush usage for {} (is_workspace: {}): {:#}",
+                        key.id,
+                        key.is_workspace,
+                        e
+                    );
+                }
+                Err(_) => {
+                    tracing::error!(
+                        "Usage flush timed out for {} (is_workspace: {})",
+                        key.id,
+                        key.is_workspace
+                    );
+                }
+            }
+        }
+    }
+
+    fn current_month() -> i32 {
+        let now = chrono::Utc::now();
+        (now.year() * 12 + now.month() as i32) as i32
+    }
+}
+
+lazy_static::lazy_static! {
+    static ref USAGE_BUFFER: once_cell::sync::OnceCell<Arc<UsageBuffer>> = once_cell::sync::OnceCell::new();
+}
+
+pub fn init_usage_buffer(db: Pool<Postgres>) {
+    USAGE_BUFFER.get_or_init(|| UsageBuffer::new(db));
+}
+
+pub fn increment_usage_async(db: Pool<Postgres>, workspace_id: String, email: Option<String>) {
+    if let Some(buffer) = USAGE_BUFFER.get() {
+        buffer.increment(workspace_id, email);
+    } else {
+        tracing::warn!("Usage buffer not initialized, falling back to direct database update");
+        // Fallback to old implementation if buffer not initialized
+        tokio::task::spawn(async move {
+            let result = tokio::time::timeout(std::time::Duration::from_secs(10), async {
+                // Update workspace usage
+                let workspace_result = sqlx::query!(
+                    "INSERT INTO usage (id, is_workspace, month_, usage)
+                    VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)
+                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
+                    &workspace_id
+                )
+                .execute(&db)
+                .await;
+
+                if let Err(e) = workspace_result {
+                    tracing::error!("Failed to update workspace usage for {}: {:#}", workspace_id, e);
+                }
+
+                // Update user usage if email is provided (non-premium workspaces only)
+                if let Some(ref email) = email {
+                    let user_result = sqlx::query!(
+                        "INSERT INTO usage (id, is_workspace, month_, usage)
+                        VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)
+                        ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
+                        email
+                    )
+                    .execute(&db)
+                    .await;
+
+                    if let Err(e) = user_result {
+                        tracing::error!("Failed to update user usage for {}: {:#}", email, e);
+                    }
+                }
+            })
+            .await;
+
+            if let Err(_) = result {
+                tracing::error!(
+                    "Usage update timed out after 10s for workspace {} and email {:?}",
+                    workspace_id,
+                    email
+                );
+            }
+        });
+    }
+}
diff --git a/backend/windmill-queue/src/jobs.rs b/backend/windmill-queue/src/jobs.rs
index 7783751944..c050d56659 100644
--- a/backend/windmill-queue/src/jobs.rs
+++ b/backend/windmill-queue/src/jobs.rs
@@ -3809,50 +3809,7 @@ async fn check_usage_limits(
 }
 
 #[cfg(feature = "cloud")]
-fn increment_usage_async(db: Pool<Postgres>, workspace_id: String, email: Option<String>) {
-    tokio::task::spawn(async move {
-        let result = tokio::time::timeout(std::time::Duration::from_secs(10), async {
-            // Update workspace usage
-            let workspace_result = sqlx::query!(
-                "INSERT INTO usage (id, is_workspace, month_, usage)
-                VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)
-                ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
-                &workspace_id
-            )
-            .execute(&db)
-            .await;
-
-            if let Err(e) = workspace_result {
-                tracing::error!("Failed to update workspace usage for {}: {:#}", workspace_id, e);
-            }
-
-            // Update user usage if email is provided (non-premium workspaces only)
-            if let Some(ref email) = email {
-                let user_result = sqlx::query!(
-                    "INSERT INTO usage (id, is_workspace, month_, usage)
-                    VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)
-                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
-                    email
-                )
-                .execute(&db)
-                .await;
-
-                if let Err(e) = user_result {
-                    tracing::error!("Failed to update user usage for {}: {:#}", email, e);
-                }
-            }
-        })
-        .await;
-
-        if let Err(_) = result {
-            tracing::error!(
-                "Usage update timed out after 10s for workspace {} and email {:?}",
-                workspace_id,
-                email
-            );
-        }
-    });
-}
+use crate::cloud_usage::increment_usage_async;
 
 // #[instrument(level = "trace", skip_all)]
 pub async fn push<'c, 'd>(
diff --git a/backend/windmill-queue/src/lib.rs b/backend/windmill-queue/src/lib.rs
index 9b6025e515..3ea2e2c1aa 100644
--- a/backend/windmill-queue/src/lib.rs
+++ b/backend/windmill-queue/src/lib.rs
@@ -14,3 +14,8 @@ pub mod schedule;
 pub use jobs::*;
 pub mod flow_status;
 pub mod tags;
+
+#[cfg(feature = "cloud")]
+pub mod cloud_usage;
+#[cfg(feature = "cloud")]
+pub use cloud_usage::init_usage_buffer;

From c3e59fe064fc3b9d4c05958eea54601ff3410899 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 10:45:45 +0100
Subject: [PATCH 40/81] fix: change uv tool dir from /root to /usr/local/uv

---
 Dockerfile | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index b3f18b4e17..7aeb2b218a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -114,7 +114,10 @@ ARG WITH_GIT=true
 ARG LATEST_STABLE_PY=3.11.10
 ENV UV_PYTHON_INSTALL_DIR=/tmp/windmill/cache/py_runtime
 ENV UV_PYTHON_PREFERENCE=only-managed
+
+RUN mkdir -p /usr/local/uv
 ENV UV_TOOL_BIN_DIR=/usr/local/bin
+ENV UV_TOOL_DIR=/usr/local/uv
 
 ENV PATH /usr/local/bin:/root/.local/bin:$PATH
 

From 64a9c4f7d21e6a2ac0893d4f3a7b143de3e5f481 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 12:12:24 +0000
Subject: [PATCH 41/81] sqlx

---
 ...1d984ff5ce7086ac511e8647e2024d9dbe0af56.json | 14 --------------
 ...1c311afe67d339ca022ba61c2767c004b038ef0.json | 14 --------------
 ...81b525fc3ec54fdbca5d12647c1da88c9983b10.json | 14 ++++++++++++++
 ...ccb5cb0c7146c11adae8c287c0c9e71ac68f7a7.json | 14 ++++++++++++++
 ...01a5f235f39558dee88cbb486d7ac988d0a44d1.json | 17 +++++++++++++++++
 5 files changed, 45 insertions(+), 28 deletions(-)
 delete mode 100644 backend/.sqlx/query-045b26db0cefe6eaac0e572661d984ff5ce7086ac511e8647e2024d9dbe0af56.json
 delete mode 100644 backend/.sqlx/query-42baae3c69367bbb21771a9711c311afe67d339ca022ba61c2767c004b038ef0.json
 create mode 100644 backend/.sqlx/query-6525e65ffe66643fed4db83aa81b525fc3ec54fdbca5d12647c1da88c9983b10.json
 create mode 100644 backend/.sqlx/query-88d529fd26d6ecba7640c74daccb5cb0c7146c11adae8c287c0c9e71ac68f7a7.json
 create mode 100644 backend/.sqlx/query-cabc79429825b5f4861e4ba2001a5f235f39558dee88cbb486d7ac988d0a44d1.json

diff --git a/backend/.sqlx/query-045b26db0cefe6eaac0e572661d984ff5ce7086ac511e8647e2024d9dbe0af56.json b/backend/.sqlx/query-045b26db0cefe6eaac0e572661d984ff5ce7086ac511e8647e2024d9dbe0af56.json
deleted file mode 100644
index 9affa78033..0000000000
--- a/backend/.sqlx/query-045b26db0cefe6eaac0e572661d984ff5ce7086ac511e8647e2024d9dbe0af56.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                    VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "045b26db0cefe6eaac0e572661d984ff5ce7086ac511e8647e2024d9dbe0af56"
-}
diff --git a/backend/.sqlx/query-42baae3c69367bbb21771a9711c311afe67d339ca022ba61c2767c004b038ef0.json b/backend/.sqlx/query-42baae3c69367bbb21771a9711c311afe67d339ca022ba61c2767c004b038ef0.json
deleted file mode 100644
index de5b99791f..0000000000
--- a/backend/.sqlx/query-42baae3c69367bbb21771a9711c311afe67d339ca022ba61c2767c004b038ef0.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "42baae3c69367bbb21771a9711c311afe67d339ca022ba61c2767c004b038ef0"
-}
diff --git a/backend/.sqlx/query-6525e65ffe66643fed4db83aa81b525fc3ec54fdbca5d12647c1da88c9983b10.json b/backend/.sqlx/query-6525e65ffe66643fed4db83aa81b525fc3ec54fdbca5d12647c1da88c9983b10.json
new file mode 100644
index 0000000000..1059fac898
--- /dev/null
+++ b/backend/.sqlx/query-6525e65ffe66643fed4db83aa81b525fc3ec54fdbca5d12647c1da88c9983b10.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                        VALUES ($1, FALSE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                        ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6525e65ffe66643fed4db83aa81b525fc3ec54fdbca5d12647c1da88c9983b10"
+}
diff --git a/backend/.sqlx/query-88d529fd26d6ecba7640c74daccb5cb0c7146c11adae8c287c0c9e71ac68f7a7.json b/backend/.sqlx/query-88d529fd26d6ecba7640c74daccb5cb0c7146c11adae8c287c0c9e71ac68f7a7.json
new file mode 100644
index 0000000000..b664b2a91a
--- /dev/null
+++ b/backend/.sqlx/query-88d529fd26d6ecba7640c74daccb5cb0c7146c11adae8c287c0c9e71ac68f7a7.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                    VALUES ($1, TRUE, EXTRACT(YEAR FROM current_date) * 12 + EXTRACT(MONTH FROM current_date), 1)\n                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + 1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "88d529fd26d6ecba7640c74daccb5cb0c7146c11adae8c287c0c9e71ac68f7a7"
+}
diff --git a/backend/.sqlx/query-cabc79429825b5f4861e4ba2001a5f235f39558dee88cbb486d7ac988d0a44d1.json b/backend/.sqlx/query-cabc79429825b5f4861e4ba2001a5f235f39558dee88cbb486d7ac988d0a44d1.json
new file mode 100644
index 0000000000..9e4ee46248
--- /dev/null
+++ b/backend/.sqlx/query-cabc79429825b5f4861e4ba2001a5f235f39558dee88cbb486d7ac988d0a44d1.json
@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usage (id, is_workspace, month_, usage)\n                    VALUES ($1, $2, $3, $4)\n                    ON CONFLICT (id, is_workspace, month_) DO UPDATE SET usage = usage.usage + $4",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Bool",
+        "Int4",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "cabc79429825b5f4861e4ba2001a5f235f39558dee88cbb486d7ac988d0a44d1"
+}

From f3e62a2e0f9847c770546196c37431494a7d4225 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 12:29:24 +0000
Subject: [PATCH 42/81] test fix

---
 .github/workflows/backend-test.yml | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index e55cf5c004..748f5add26 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -76,12 +76,14 @@ jobs:
             ${{ runner.os }}-duckdb-ffi-
       - name: cargo test
         timeout-minutes: 16
-        run: deno --version && bun -v && go version && python3 --version &&
-          cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd .. &&
-          SQLX_OFFLINE=true
-          DATABASE_URL=postgres://postgres:changeme@localhost:5432/windmill
-          DISABLE_EMBEDDING=true RUST_LOG=info RUST_LOG_STYLE=never CARGO_NET_GIT_FETCH_WITH_CLI=true
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go)
-          UV_PATH=$(which uv) cargo test --features
-          enterprise,deno_core,license,python,duckdb,rust,scoped_cache,private --all --
-          --nocapture
+        env:
+          SQLX_OFFLINE: true
+          DATABASE_URL: postgres://postgres:changeme@localhost:5432/windmill
+          DISABLE_EMBEDDING: true
+          RUST_LOG: info
+          RUST_LOG_STYLE: never
+          CARGO_NET_GIT_FETCH_WITH_CLI: true
+        run: |
+          deno --version && bun -v && go version && python3 --version
+          cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd ..
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,license,python,duckdb,rust,scoped_cache,private --all -- --nocapture

From a3cf674cd0adc278b39e9df9762223b055df2395 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 12:59:00 +0000
Subject: [PATCH 43/81] test fix

---
 backend/.cargo/config.toml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/.cargo/config.toml b/backend/.cargo/config.toml
index 5babef3f8a..234ac9a50f 100644
--- a/backend/.cargo/config.toml
+++ b/backend/.cargo/config.toml
@@ -13,4 +13,7 @@ rustflags = [
     "-C", "link-arg=-undefined",
     "-C", "link-arg=dynamic_lookup",
     "-C", "link-args=-Wl,-rpath,$ORIGIN/"
-]
\ No newline at end of file
+]
+
+[net]
+git-fetch-with-cli = true
\ No newline at end of file

From 4acd5e526fd25d6f7a95e2836851cc5e3fcc5477 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Tue, 18 Nov 2025 10:44:23 -0500
Subject: [PATCH 44/81] fix rhel9 add rhel8 ci (#7172)

---
 docker/RHEL8/Dockerfile | 5 +++--
 docker/RHEL9/Dockerfile | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docker/RHEL8/Dockerfile b/docker/RHEL8/Dockerfile
index 453d5bf3db..c8c4fa0588 100644
--- a/docker/RHEL8/Dockerfile
+++ b/docker/RHEL8/Dockerfile
@@ -77,9 +77,10 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p windmill_duckdb_ffi_internal
+    cd windmill-duckdb-ffi-internal && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release
 
 RUN mkdir -p /usr/src/app && \
-    cp /windmill/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
+    cp windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
 
 RUN subscription-manager unregister
diff --git a/docker/RHEL9/Dockerfile b/docker/RHEL9/Dockerfile
index 6c0ef21293..098091ef17 100644
--- a/docker/RHEL9/Dockerfile
+++ b/docker/RHEL9/Dockerfile
@@ -77,9 +77,10 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release --features "$features"
 
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p windmill_duckdb_ffi_internal
+    cd windmill-duckdb-ffi-internal && \
+    CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release
 
 RUN mkdir -p /usr/src/app && \
-    cp /windmill/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
+    cp windmill-duckdb-ffi-internal/target/release/libwindmill_duckdb_ffi_internal.so /usr/src/app/
 
 RUN subscription-manager unregister

From 55482210921fe2eb0fd158abd4f7369495f2dfd7 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Tue, 18 Nov 2025 18:02:04 -0500
Subject: [PATCH 45/81] feat: support secondary promotion repos in git sync
 settings (#7173)

---
 .../git_sync/GitSyncContext.svelte.ts         |  4 +-
 .../git_sync/GitSyncRepositoryCard.svelte     | 17 +++-
 .../components/git_sync/GitSyncSection.svelte | 91 +++++++++++++------
 3 files changed, 76 insertions(+), 36 deletions(-)

diff --git a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
index c23ccf590e..33c2f2fa5c 100644
--- a/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
+++ b/frontend/src/lib/components/git_sync/GitSyncContext.svelte.ts
@@ -595,7 +595,7 @@ export function createGitSyncContext(workspace: string) {
 		return result
 	}
 
-	function getLegacyPromotionRepositories(): { repo: GitSyncRepository, idx: number }[] {
+	function getSecondaryPromotionRepositories(): { repo: GitSyncRepository, idx: number }[] {
 		const result: { repo: GitSyncRepository, idx: number }[] = []
 		let foundFirst = false
 		repositories.forEach((repo, idx) => {
@@ -736,7 +736,7 @@ export function createGitSyncContext(workspace: string) {
 		getPrimarySyncRepository,
 		getPrimaryPromotionRepository,
 		getSecondarySyncRepositories,
-		getLegacyPromotionRepositories,
+		getSecondaryPromotionRepositories,
 
 		// Helper methods
 		getTargetBranch,
diff --git a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
index 85c19362d7..c5700622d4 100644
--- a/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncRepositoryCard.svelte
@@ -94,10 +94,19 @@
 				: isLegacy
 					? 'Legacy promotion repository'
 					: isSecondary
-						? 'Secondary sync repository'
+						? repo?.use_individual_branch
+							? 'Secondary promotion repository'
+							: 'Secondary sync repository'
 						: `Repository #${(idx ?? 0) + 1}`
 	)
 
+	// Determine the actual mode based on repository configuration
+	const repoMode = $derived<'sync' | 'promotion'>(
+		variant === 'primary-promotion' || variant === 'legacy' || repo?.use_individual_branch
+			? 'promotion'
+			: 'sync'
+	)
+
 	// Determine display description based on variant and mode
 	const displayDescription = $derived(
 		variant === 'primary-sync' || variant === 'primary-promotion'
@@ -353,7 +362,7 @@
 			{#if repo.isUnsavedConnection && !emptyString(repo.git_repo_resource_path) && idx !== null}
 				<DetectionFlow
 					{idx}
-					mode={variant === 'primary-promotion' || variant === 'legacy' ? 'promotion' : 'sync'}
+					mode={repoMode}
 				/>
 			{:else}
 				<GitSyncFilterSettings
@@ -380,9 +389,7 @@
 						<!-- Display mode settings as prominent text -->
 						<div class="flex-1 mr-4">
 							<GitSyncModeDisplay
-								mode={variant === 'primary-promotion' || variant === 'legacy'
-									? 'promotion'
-									: 'sync'}
+								mode={repoMode}
 								{targetBranch}
 								repository={repo}
 							/>
diff --git a/frontend/src/lib/components/git_sync/GitSyncSection.svelte b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
index 41269a82bd..52b4b4326d 100644
--- a/frontend/src/lib/components/git_sync/GitSyncSection.svelte
+++ b/frontend/src/lib/components/git_sync/GitSyncSection.svelte
@@ -30,14 +30,15 @@
 	const primarySync = $derived(gitSyncContext?.getPrimarySyncRepository() || null)
 	const primaryPromotion = $derived(gitSyncContext?.getPrimaryPromotionRepository() || null)
 	const secondarySync = $derived(gitSyncContext?.getSecondarySyncRepositories() || [])
-	const legacyPromotion = $derived(gitSyncContext?.getLegacyPromotionRepositories() || [])
+	const secondaryPromotion = $derived(gitSyncContext?.getSecondaryPromotionRepositories() || [])
 
 	// State for collapsible sections
 	let secondarySyncExpanded = $state(false)
-	let legacyPromotionExpanded = $state(false)
+	let secondaryPromotionExpanded = $state(false)
 
 	// Check if any secondary repositories are unsaved
 	const hasUnsavedSecondary = $derived(secondarySync.some((s) => s.repo.isUnsavedConnection))
+	const hasUnsavedSecondaryPromotion = $derived(secondaryPromotion.some((s) => s.repo.isUnsavedConnection))
 </script>
 
 {#if !gitSyncContext}
@@ -169,38 +170,70 @@
 					isCollapsible={false}
 					showEmptyState={primaryPromotion?.repo === null}
 				/>
-			</div>
 
-			<!-- Legacy promotion repositories (backwards compatibility) -->
-			{#if legacyPromotion.length > 0}
-				<Alert type="warning" title="Multiple promotion repositories detected">
-					Multiple promotion repositories are no longer supported. Please reduce to a single
-					promotion repository. Only deletion is allowed for the additional repositories below.
-				</Alert>
-				<div class="mt-4">
-					<button
-						class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
-						onclick={() => (legacyPromotionExpanded = !legacyPromotionExpanded)}
-					>
-						{#if legacyPromotionExpanded}
-							<ChevronDown size={16} />
-						{:else}
-							<ChevronRight size={16} />
-						{/if}
-						Legacy promotion repositories ({legacyPromotion.length})
-					</button>
+				<!-- Secondary Promotion Repositories -->
+				{#if primaryPromotion && !primaryPromotion.repo?.isUnsavedConnection}
+					{#if secondaryPromotion.length > 0 || secondaryPromotionExpanded}
+						<div class="mt-4">
+							<button
+								class="flex items-center gap-2 text-sm text-secondary hover:text-primary transition-colors"
+								onclick={() => (secondaryPromotionExpanded = !secondaryPromotionExpanded)}
+							>
+								{#if secondaryPromotionExpanded}
+									<ChevronDown size={16} />
+								{:else}
+									<ChevronRight size={16} />
+								{/if}
+								Secondary promotion repositories ({secondaryPromotion.length})
+							</button>
 
-					{#if legacyPromotionExpanded}
-						<div class="space-y-3 mt-3">
-							{#each legacyPromotion as { repo, idx } (repo.git_repo_resource_path)}
-								<div class="pl-4">
-									<GitSyncRepositoryCard {idx} variant="legacy" isLegacy={true} />
+							{#if secondaryPromotionExpanded}
+								<div class="mt-3 space-y-3">
+									{#if secondaryPromotion.length === 0}
+										<div class="text-sm text-secondary italic">
+											No secondary promotion repositories configured
+										</div>
+									{:else}
+										{#each secondaryPromotion as { repo, idx } (repo.git_repo_resource_path)}
+											<div class="pl-4">
+												<GitSyncRepositoryCard variant="secondary" {idx} isSecondary={true} />
+											</div>
+										{/each}
+									{/if}
+
+									{#if !hasUnsavedSecondaryPromotion}
+										<div class="pl-4">
+											<Button
+												size="xs"
+												variant="default"
+												startIcon={{ icon: Plus }}
+												onclick={() => gitSyncContext.addPromotionRepository()}
+											>
+												Add secondary promotion
+											</Button>
+										</div>
+									{/if}
 								</div>
-							{/each}
+							{/if}
 						</div>
+					{:else}
+						<!-- Collapsed state when no secondary promotion repos exist -->
+						{#if !hasUnsavedSecondaryPromotion}
+							<div class="mt-2">
+								<button
+									class="text-xs text-primary hover:text-secondary transition-colors"
+									onclick={() => {
+										secondaryPromotionExpanded = true
+										gitSyncContext.addPromotionRepository()
+									}}
+								>
+									+ Add secondary promotion repository
+								</button>
+							</div>
+						{/if}
 					{/if}
-				</div>
-			{/if}
+				{/if}
+			</div>
 		</div>
 
 		<!-- Modals -->

From f2dbf6d20d76d25cfa499860366d1ed0360c9205 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 19 Nov 2025 00:03:35 +0100
Subject: [PATCH 46/81] count external jwts for telemetry

* feat: count external jwts

* nits
---
 ...9468e01c4bee4cd755322eb2a83353a279a2b.json | 14 +++++++++++++
 ...02c8adee995eac05b5051e480f0a20fa6b7bb.json | 20 +++++++++++++++++++
 backend/ee-repo-ref.txt                       |  2 +-
 .../20251118190643_unique_jwt_token.down.sql  |  3 +++
 .../20251118190643_unique_jwt_token.up.sql    |  9 +++++++++
 backend/windmill-api/src/auth.rs              |  1 +
 backend/windmill-api/src/ee_oss.rs            |  1 +
 backend/windmill-common/src/auth.rs           | 15 ++++++++++++++
 backend/windmill-common/src/utils.rs          |  6 ++++++
 9 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 backend/.sqlx/query-778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b.json
 create mode 100644 backend/.sqlx/query-d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb.json
 create mode 100644 backend/migrations/20251118190643_unique_jwt_token.down.sql
 create mode 100644 backend/migrations/20251118190643_unique_jwt_token.up.sql

diff --git a/backend/.sqlx/query-778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b.json b/backend/.sqlx/query-778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b.json
new file mode 100644
index 0000000000..a35e6560e3
--- /dev/null
+++ b/backend/.sqlx/query-778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO unique_ext_jwt_token (jwt_hash, last_used_at)\n         VALUES ($1, NOW())\n         ON CONFLICT (jwt_hash)\n         DO UPDATE SET last_used_at = NOW()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b"
+}
diff --git a/backend/.sqlx/query-d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb.json b/backend/.sqlx/query-d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb.json
new file mode 100644
index 0000000000..fda5b760b3
--- /dev/null
+++ b/backend/.sqlx/query-d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb.json
@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM unique_ext_jwt_token WHERE last_used_at > NOW() - INTERVAL '30 days'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb"
+}
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index f885c61364..7dd5e2c77a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-785ec89a5fb08d62b5ef59d1860089ed1266ae8b
\ No newline at end of file
+6694dfbc62ff69570743f028aa19c543ae846e6e
\ No newline at end of file
diff --git a/backend/migrations/20251118190643_unique_jwt_token.down.sql b/backend/migrations/20251118190643_unique_jwt_token.down.sql
new file mode 100644
index 0000000000..8e1dca2f24
--- /dev/null
+++ b/backend/migrations/20251118190643_unique_jwt_token.down.sql
@@ -0,0 +1,3 @@
+-- Add down migration script here
+
+DROP TABLE IF EXISTS unique_ext_jwt_token;
diff --git a/backend/migrations/20251118190643_unique_jwt_token.up.sql b/backend/migrations/20251118190643_unique_jwt_token.up.sql
new file mode 100644
index 0000000000..bf7613c35d
--- /dev/null
+++ b/backend/migrations/20251118190643_unique_jwt_token.up.sql
@@ -0,0 +1,9 @@
+-- Add up migration script here
+
+CREATE TABLE IF NOT EXISTS unique_ext_jwt_token (
+    jwt_hash BIGINT PRIMARY KEY NOT NULL,
+    last_used_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_unique_ext_jwt_token_last_used_at ON unique_ext_jwt_token(last_used_at);
+
diff --git a/backend/windmill-api/src/auth.rs b/backend/windmill-api/src/auth.rs
index 0765f701f9..7f2ccc6876 100644
--- a/backend/windmill-api/src/auth.rs
+++ b/backend/windmill-api/src/auth.rs
@@ -90,6 +90,7 @@ impl AuthCache {
                     w_id.as_ref(),
                     token.trim_start_matches("jwt_ext_"),
                     self.ext_jwks.clone(),
+                    &self.db,
                 )
                 .await
                 {
diff --git a/backend/windmill-api/src/ee_oss.rs b/backend/windmill-api/src/ee_oss.rs
index 30756af8ab..24eea5ab85 100644
--- a/backend/windmill-api/src/ee_oss.rs
+++ b/backend/windmill-api/src/ee_oss.rs
@@ -26,6 +26,7 @@ pub async fn jwt_ext_auth(
     _w_id: Option<&String>,
     _token: &str,
     _external_jwks: Option<Arc<RwLock<ExternalJwks>>>,
+    _db: &crate::db::DB,
 ) -> anyhow::Result<(crate::db::ApiAuthed, usize)> {
     // Implementation is not open source
 
diff --git a/backend/windmill-common/src/auth.rs b/backend/windmill-common/src/auth.rs
index e48cf3728e..89d4831e38 100644
--- a/backend/windmill-common/src/auth.rs
+++ b/backend/windmill-common/src/auth.rs
@@ -158,6 +158,21 @@ impl JWTAuthClaims {
                 .as_ref()
                 .is_some_and(|token_w_ids| token_w_ids.iter().any(|token_w_id| w_id == token_w_id))
     }
+
+    pub fn compute_ext_jwt_hash(&self) -> i64 {
+        let mut hasher = DefaultHasher::new();
+        self.email.hash(&mut hasher);
+        self.username.hash(&mut hasher);
+        self.is_admin.hash(&mut hasher);
+        self.is_operator.hash(&mut hasher);
+        self.groups.hash(&mut hasher);
+        self.folders.hash(&mut hasher);
+        self.workspace_id.hash(&mut hasher);
+        self.workspace_ids.hash(&mut hasher);
+        self.label.hash(&mut hasher);
+        self.scopes.hash(&mut hasher);
+        hasher.finish() as i64
+    }
 }
 
 #[derive(Deserialize, Debug)]
diff --git a/backend/windmill-common/src/utils.rs b/backend/windmill-common/src/utils.rs
index 174d3cd261..623486d19c 100644
--- a/backend/windmill-common/src/utils.rs
+++ b/backend/windmill-common/src/utils.rs
@@ -947,3 +947,9 @@ pub struct ExpiringCacheEntry<T> {
     pub value: T,
     pub expiry: std::time::Instant,
 }
+
+impl<T> ExpiringCacheEntry<T> {
+    pub fn is_expired(&self) -> bool {
+        self.expiry < std::time::Instant::now()
+    }
+}

From 8ae266b6a9ced16e1b7416cfc8bea5fe7a7af042 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Wed, 19 Nov 2025 00:04:12 +0100
Subject: [PATCH 47/81] feat: disabling/enabling email triggers (#7171)

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 ...010d4476d5c222184f09e5a189975a37b941.json} |  4 +--
 ...8a186fc91f94d4fcc40eeb9914084e4ef60c.json} |  7 ++--
 ...d6994d75c6b9e5f61daf54d298a2fdcfd9af.json} |  5 +--
 ...bdf5b5feac9c6fa9de38bd24104bac8539d2.json} |  5 +--
 ...5ae228697602e3769c479582470dc0b9488b.json} |  4 +--
 ...a80eeac12c6ca07a0e8950941ba796b0ba79.json} |  5 +--
 backend/ee-repo-ref.txt                       |  2 +-
 backend/windmill-api/openapi.yaml             | 30 ++++++++++++++++-
 .../src/triggers/email/handler_oss.rs         |  1 -
 .../src/triggers/gcp/handler_oss.rs           |  1 -
 backend/windmill-api/src/triggers/handler.rs  | 18 +++-------
 .../windmill-api/src/triggers/http/handler.rs | 31 ++++++++---------
 .../src/triggers/kafka/handler_oss.rs         |  1 -
 .../windmill-api/src/triggers/mqtt/handler.rs |  1 -
 .../src/triggers/nats/handler_oss.rs          |  1 -
 .../src/triggers/postgres/handler.rs          |  2 --
 .../src/triggers/sqs/handler_oss.rs           |  1 -
 .../src/triggers/websocket/handler.rs         |  1 -
 .../email/EmailTriggerEditorInner.svelte      | 33 ++++++++++++++-----
 .../lib/components/triggers/email/utils.ts    | 27 +++++++--------
 .../triggers/http/RouteEditorInner.svelte     |  2 +-
 .../src/lib/components/triggers/http/utils.ts |  2 +-
 .../(logged)/email_triggers/+page.svelte      | 26 ++++++++++++++-
 23 files changed, 133 insertions(+), 77 deletions(-)
 rename backend/.sqlx/{query-668edc2f84eccf5db6b8daa3ed97e25e46a37c50a9d1a6eca5a277fb58a2e7b4.json => query-628d303956d55d22e5ac64496b66010d4476d5c222184f09e5a189975a37b941.json} (90%)
 rename backend/.sqlx/{query-d328d00e5393b0e8d2c4b3674221fabbae580fc404e0d4481fd8d7fb51272c94.json => query-6c568509908c1833d9e6f58f739b8a186fc91f94d4fcc40eeb9914084e4ef60c.json} (70%)
 rename backend/.sqlx/{query-acb094aef60bba9083087264d65034fce38417099f15e8312be72a386f10bc1f.json => query-a704283ff62ac1cd6db489ca3f84d6994d75c6b9e5f61daf54d298a2fdcfd9af.json} (73%)
 rename backend/.sqlx/{query-4c64bd0e364f536597db83161b5a27ff58b5ec7148bc94807423593bcfa27b90.json => query-ada1a14b4f25e41742df153b07e8bdf5b5feac9c6fa9de38bd24104bac8539d2.json} (67%)
 rename backend/.sqlx/{query-bbd51f4f0a8bb2db5d6b634f2d32f5f7f7f57390a0e4b6e7cad45c9147fd6356.json => query-df6972fb16a2364f10379fe37e125ae228697602e3769c479582470dc0b9488b.json} (91%)
 rename backend/.sqlx/{query-6fafc23924eded970689040bd4a94d4d23ebee4f2b7d37bb54c47edb7720be00.json => query-fe12006498b9e7aece6b104fc5d9a80eeac12c6ca07a0e8950941ba796b0ba79.json} (73%)

diff --git a/backend/.sqlx/query-668edc2f84eccf5db6b8daa3ed97e25e46a37c50a9d1a6eca5a277fb58a2e7b4.json b/backend/.sqlx/query-628d303956d55d22e5ac64496b66010d4476d5c222184f09e5a189975a37b941.json
similarity index 90%
rename from backend/.sqlx/query-668edc2f84eccf5db6b8daa3ed97e25e46a37c50a9d1a6eca5a277fb58a2e7b4.json
rename to backend/.sqlx/query-628d303956d55d22e5ac64496b66010d4476d5c222184f09e5a189975a37b941.json
index 7520bc8879..3f5e733cb1 100644
--- a/backend/.sqlx/query-668edc2f84eccf5db6b8daa3ed97e25e46a37c50a9d1a6eca5a277fb58a2e7b4.json
+++ b/backend/.sqlx/query-628d303956d55d22e5ac64496b66010d4476d5c222184f09e5a189975a37b941.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                SELECT \n                    script_path, \n                    is_flow, \n                    workspace_id, \n                    edited_by, \n                    email, \n                    path, \n                    error_handler_path as \"error_handler_path: _\", \n                    error_handler_args as \"error_handler_args: _\", \n                    retry as \"retry: _\" \n                FROM email_trigger \n                WHERE local_part = $1 \n                    AND workspaced_local_part = FALSE\n                ",
+  "query": "\n                SELECT \n                    script_path, \n                    is_flow, \n                    workspace_id, \n                    edited_by, \n                    email, \n                    path, \n                    error_handler_path as \"error_handler_path: _\", \n                    error_handler_args as \"error_handler_args: _\", \n                    retry as \"retry: _\" \n                FROM email_trigger \n                WHERE local_part = $1 \n                    AND workspaced_local_part = FALSE\n                    AND enabled IS TRUE\n                ",
   "describe": {
     "columns": [
       {
@@ -66,5 +66,5 @@
       true
     ]
   },
-  "hash": "668edc2f84eccf5db6b8daa3ed97e25e46a37c50a9d1a6eca5a277fb58a2e7b4"
+  "hash": "628d303956d55d22e5ac64496b66010d4476d5c222184f09e5a189975a37b941"
 }
diff --git a/backend/.sqlx/query-d328d00e5393b0e8d2c4b3674221fabbae580fc404e0d4481fd8d7fb51272c94.json b/backend/.sqlx/query-6c568509908c1833d9e6f58f739b8a186fc91f94d4fcc40eeb9914084e4ef60c.json
similarity index 70%
rename from backend/.sqlx/query-d328d00e5393b0e8d2c4b3674221fabbae580fc404e0d4481fd8d7fb51272c94.json
rename to backend/.sqlx/query-6c568509908c1833d9e6f58f739b8a186fc91f94d4fcc40eeb9914084e4ef60c.json
index 474ce7b688..b6e4f96c3c 100644
--- a/backend/.sqlx/query-d328d00e5393b0e8d2c4b3674221fabbae580fc404e0d4481fd8d7fb51272c94.json
+++ b/backend/.sqlx/query-6c568509908c1833d9e6f58f739b8a186fc91f94d4fcc40eeb9914084e4ef60c.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO email_trigger (\n                workspace_id,\n                path,\n                script_path,\n                is_flow,\n                local_part,\n                workspaced_local_part,\n                edited_by,\n                email,\n                edited_at,\n                error_handler_path,\n                error_handler_args,\n                retry\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, now(), $9, $10, $11\n            )\n            ",
+  "query": "\n            INSERT INTO email_trigger (\n                workspace_id,\n                path,\n                script_path,\n                is_flow,\n                local_part,\n                workspaced_local_part,\n                edited_by,\n                email,\n                edited_at,\n                error_handler_path,\n                error_handler_args,\n                retry,\n                enabled\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, now(), $9, $10, $11, $12\n            )\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -15,10 +15,11 @@
         "Varchar",
         "Varchar",
         "Jsonb",
-        "Jsonb"
+        "Jsonb",
+        "Bool"
       ]
     },
     "nullable": []
   },
-  "hash": "d328d00e5393b0e8d2c4b3674221fabbae580fc404e0d4481fd8d7fb51272c94"
+  "hash": "6c568509908c1833d9e6f58f739b8a186fc91f94d4fcc40eeb9914084e4ef60c"
 }
diff --git a/backend/.sqlx/query-acb094aef60bba9083087264d65034fce38417099f15e8312be72a386f10bc1f.json b/backend/.sqlx/query-a704283ff62ac1cd6db489ca3f84d6994d75c6b9e5f61daf54d298a2fdcfd9af.json
similarity index 73%
rename from backend/.sqlx/query-acb094aef60bba9083087264d65034fce38417099f15e8312be72a386f10bc1f.json
rename to backend/.sqlx/query-a704283ff62ac1cd6db489ca3f84d6994d75c6b9e5f61daf54d298a2fdcfd9af.json
index 805e5f0e79..b59a7f294a 100644
--- a/backend/.sqlx/query-acb094aef60bba9083087264d65034fce38417099f15e8312be72a386f10bc1f.json
+++ b/backend/.sqlx/query-a704283ff62ac1cd6db489ca3f84d6994d75c6b9e5f61daf54d298a2fdcfd9af.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                UPDATE email_trigger \n                SET \n                    script_path = $1,\n                    path = $2,\n                    is_flow = $3,\n                    edited_by = $4,\n                    email = $5,\n                    edited_at = now(),\n                    error_handler_path = $6,\n                    error_handler_args = $7,\n                    retry = $8\n                WHERE \n                    workspace_id = $9 AND path = $10\n                ",
+  "query": "\n                UPDATE email_trigger \n                SET \n                    script_path = $1,\n                    path = $2,\n                    is_flow = $3,\n                    edited_by = $4,\n                    email = $5,\n                    edited_at = now(),\n                    error_handler_path = $6,\n                    error_handler_args = $7,\n                    retry = $8,\n                    enabled = $9\n                WHERE \n                    workspace_id = $10 AND path = $11\n                ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -13,11 +13,12 @@
         "Varchar",
         "Jsonb",
         "Jsonb",
+        "Bool",
         "Text",
         "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "acb094aef60bba9083087264d65034fce38417099f15e8312be72a386f10bc1f"
+  "hash": "a704283ff62ac1cd6db489ca3f84d6994d75c6b9e5f61daf54d298a2fdcfd9af"
 }
diff --git a/backend/.sqlx/query-4c64bd0e364f536597db83161b5a27ff58b5ec7148bc94807423593bcfa27b90.json b/backend/.sqlx/query-ada1a14b4f25e41742df153b07e8bdf5b5feac9c6fa9de38bd24104bac8539d2.json
similarity index 67%
rename from backend/.sqlx/query-4c64bd0e364f536597db83161b5a27ff58b5ec7148bc94807423593bcfa27b90.json
rename to backend/.sqlx/query-ada1a14b4f25e41742df153b07e8bdf5b5feac9c6fa9de38bd24104bac8539d2.json
index dfe905113e..1a33383b67 100644
--- a/backend/.sqlx/query-4c64bd0e364f536597db83161b5a27ff58b5ec7148bc94807423593bcfa27b90.json
+++ b/backend/.sqlx/query-ada1a14b4f25e41742df153b07e8bdf5b5feac9c6fa9de38bd24104bac8539d2.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            UPDATE\n                http_trigger\n            SET\n                wrap_body = $1,\n                raw_string = $2,\n                authentication_resource_path = $3,\n                script_path = $4,\n                path = $5,\n                is_flow = $6,\n                http_method = $7,\n                static_asset_config = $8,\n                edited_by = $9,\n                email = $10,\n                request_type = $11,\n                authentication_method = $12,\n                summary = $13,\n                description = $14,\n                edited_at = now(),\n                is_static_website = $15,\n                error_handler_path = $16,\n                error_handler_args = $17,\n                retry = $18\n            WHERE\n                workspace_id = $19 AND\n                path = $20\n            ",
+  "query": "\n            UPDATE\n                http_trigger\n            SET\n                wrap_body = $1,\n                raw_string = $2,\n                authentication_resource_path = $3,\n                script_path = $4,\n                path = $5,\n                is_flow = $6,\n                enabled = $7,\n                http_method = $8,\n                static_asset_config = $9,\n                edited_by = $10,\n                email = $11,\n                request_type = $12,\n                authentication_method = $13,\n                summary = $14,\n                description = $15,\n                edited_at = now(),\n                is_static_website = $16,\n                error_handler_path = $17,\n                error_handler_args = $18,\n                retry = $19\n            WHERE\n                workspace_id = $20 AND\n                path = $21\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,6 +11,7 @@
         "Varchar",
         "Varchar",
         "Bool",
+        "Bool",
         {
           "Custom": {
             "name": "http_method",
@@ -67,5 +68,5 @@
     },
     "nullable": []
   },
-  "hash": "4c64bd0e364f536597db83161b5a27ff58b5ec7148bc94807423593bcfa27b90"
+  "hash": "ada1a14b4f25e41742df153b07e8bdf5b5feac9c6fa9de38bd24104bac8539d2"
 }
diff --git a/backend/.sqlx/query-bbd51f4f0a8bb2db5d6b634f2d32f5f7f7f57390a0e4b6e7cad45c9147fd6356.json b/backend/.sqlx/query-df6972fb16a2364f10379fe37e125ae228697602e3769c479582470dc0b9488b.json
similarity index 91%
rename from backend/.sqlx/query-bbd51f4f0a8bb2db5d6b634f2d32f5f7f7f57390a0e4b6e7cad45c9147fd6356.json
rename to backend/.sqlx/query-df6972fb16a2364f10379fe37e125ae228697602e3769c479582470dc0b9488b.json
index ab4e5e5d36..1e5c26b2e7 100644
--- a/backend/.sqlx/query-bbd51f4f0a8bb2db5d6b634f2d32f5f7f7f57390a0e4b6e7cad45c9147fd6356.json
+++ b/backend/.sqlx/query-df6972fb16a2364f10379fe37e125ae228697602e3769c479582470dc0b9488b.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                SELECT \n                    script_path, \n                    is_flow, \n                    workspace_id, \n                    edited_by, \n                    email, \n                    path, \n                    error_handler_path as \"error_handler_path: _\", \n                    error_handler_args as \"error_handler_args: _\", \n                    retry as \"retry: _\" \n                FROM email_trigger \n                WHERE workspace_id = $1 \n                    AND local_part = $2 \n                    AND (workspaced_local_part = TRUE OR $3 IS TRUE)\n                ",
+  "query": "\n                SELECT \n                    script_path, \n                    is_flow, \n                    workspace_id, \n                    edited_by, \n                    email, \n                    path, \n                    error_handler_path as \"error_handler_path: _\", \n                    error_handler_args as \"error_handler_args: _\", \n                    retry as \"retry: _\" \n                FROM email_trigger \n                WHERE workspace_id = $1 \n                    AND local_part = $2 \n                    AND (workspaced_local_part = TRUE OR $3 IS TRUE)\n                    AND enabled IS TRUE\n                ",
   "describe": {
     "columns": [
       {
@@ -68,5 +68,5 @@
       true
     ]
   },
-  "hash": "bbd51f4f0a8bb2db5d6b634f2d32f5f7f7f57390a0e4b6e7cad45c9147fd6356"
+  "hash": "df6972fb16a2364f10379fe37e125ae228697602e3769c479582470dc0b9488b"
 }
diff --git a/backend/.sqlx/query-6fafc23924eded970689040bd4a94d4d23ebee4f2b7d37bb54c47edb7720be00.json b/backend/.sqlx/query-fe12006498b9e7aece6b104fc5d9a80eeac12c6ca07a0e8950941ba796b0ba79.json
similarity index 73%
rename from backend/.sqlx/query-6fafc23924eded970689040bd4a94d4d23ebee4f2b7d37bb54c47edb7720be00.json
rename to backend/.sqlx/query-fe12006498b9e7aece6b104fc5d9a80eeac12c6ca07a0e8950941ba796b0ba79.json
index 706bcacdb2..150d2d9504 100644
--- a/backend/.sqlx/query-6fafc23924eded970689040bd4a94d4d23ebee4f2b7d37bb54c47edb7720be00.json
+++ b/backend/.sqlx/query-fe12006498b9e7aece6b104fc5d9a80eeac12c6ca07a0e8950941ba796b0ba79.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                UPDATE email_trigger \n                SET \n                    script_path = $1,\n                    path = $2,\n                    is_flow = $3,\n                    local_part = $4,\n                    workspaced_local_part = $5,\n                    edited_by = $6,\n                    email = $7,\n                    edited_at = now(),\n                    error_handler_path = $8,\n                    error_handler_args = $9,\n                    retry = $10\n                WHERE \n                    workspace_id = $11 AND path = $12\n                ",
+  "query": "\n                UPDATE email_trigger \n                SET \n                    script_path = $1,\n                    path = $2,\n                    is_flow = $3,\n                    local_part = $4,\n                    workspaced_local_part = $5,\n                    edited_by = $6,\n                    email = $7,\n                    edited_at = now(),\n                    error_handler_path = $8,\n                    error_handler_args = $9,\n                    retry = $10,\n                    enabled = $11\n                WHERE \n                    workspace_id = $12 AND path = $13\n                ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -15,11 +15,12 @@
         "Varchar",
         "Jsonb",
         "Jsonb",
+        "Bool",
         "Text",
         "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "6fafc23924eded970689040bd4a94d4d23ebee4f2b7d37bb54c47edb7720be00"
+  "hash": "fe12006498b9e7aece6b104fc5d9a80eeac12c6ca07a0e8950941ba796b0ba79"
 }
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 7dd5e2c77a..ada9554f8a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-6694dfbc62ff69570743f028aa19c543ae846e6e
\ No newline at end of file
+6009dffc0e9549463e34d748ad54c401cbe46ffd
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 928e5d007a..85740d0d2f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -11998,6 +11998,33 @@ paths:
             application/json:
               schema:
                 type: boolean
+  /w/{workspace}/email_triggers/setenabled/{path}:
+      post:
+        summary: enable/disable email trigger
+        operationId: setEmailTriggerEnabled
+        tags:
+          - email_trigger
+        parameters:
+          - $ref: "#/components/parameters/WorkspaceId"
+          - $ref: "#/components/parameters/Path"
+        requestBody:
+          required: true
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  enabled:
+                    type: boolean
+                required:
+                  - enabled
+        responses:
+          "200":
+            description: email trigger enable/disable
+            content:
+              text/plain:
+                schema:
+                  type: string
 
   /groups/list:
     get:
@@ -18612,7 +18639,8 @@ components:
           $ref: "#/components/schemas/ScriptArgs"
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
-
+        enabled:
+          type: boolean
       required:
         - path
         - script_path
diff --git a/backend/windmill-api/src/triggers/email/handler_oss.rs b/backend/windmill-api/src/triggers/email/handler_oss.rs
index ca4de1733e..03a377df98 100644
--- a/backend/windmill-api/src/triggers/email/handler_oss.rs
+++ b/backend/windmill-api/src/triggers/email/handler_oss.rs
@@ -28,7 +28,6 @@ impl TriggerCrud for EmailTrigger {
 
     const TABLE_NAME: &'static str = "";
     const TRIGGER_TYPE: &'static str = "";
-    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/email_triggers";
diff --git a/backend/windmill-api/src/triggers/gcp/handler_oss.rs b/backend/windmill-api/src/triggers/gcp/handler_oss.rs
index 4b52ff9c68..b75a9721eb 100644
--- a/backend/windmill-api/src/triggers/gcp/handler_oss.rs
+++ b/backend/windmill-api/src/triggers/gcp/handler_oss.rs
@@ -25,7 +25,6 @@ impl TriggerCrud for GcpTrigger {
 
     const TABLE_NAME: &'static str = "";
     const TRIGGER_TYPE: &'static str = "";
-    const SUPPORTS_ENABLED: bool = false;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/gcp_triggers";
diff --git a/backend/windmill-api/src/triggers/handler.rs b/backend/windmill-api/src/triggers/handler.rs
index a6019c5a14..05042bd385 100644
--- a/backend/windmill-api/src/triggers/handler.rs
+++ b/backend/windmill-api/src/triggers/handler.rs
@@ -50,7 +50,6 @@ pub trait TriggerCrud: Send + Sync + 'static {
 
     const TABLE_NAME: &'static str;
     const TRIGGER_TYPE: &'static str;
-    const SUPPORTS_ENABLED: bool;
     const SUPPORTS_SERVER_STATE: bool;
     const SUPPORTS_TEST_CONNECTION: bool;
     const ROUTE_PREFIX: &'static str;
@@ -144,12 +143,9 @@ pub trait TriggerCrud: Send + Sync + 'static {
             "email",
             "edited_at",
             "extra_perms",
+            "enabled",
         ];
 
-        if Self::SUPPORTS_ENABLED {
-            fields.push("enabled");
-        }
-
         if Self::SUPPORTS_SERVER_STATE {
             fields.extend_from_slice(&["server_id", "last_server_ping", "error"]);
         }
@@ -325,12 +321,9 @@ pub trait TriggerCrud: Send + Sync + 'static {
             "email",
             "edited_at",
             "extra_perms",
+            "enabled",
         ];
 
-        if Self::SUPPORTS_ENABLED {
-            fields.push("enabled");
-        }
-
         if Self::SUPPORTS_SERVER_STATE {
             fields.extend_from_slice(&["server_id", "last_server_ping", "error"]);
         }
@@ -380,11 +373,8 @@ pub fn trigger_routes<T: TriggerCrud + 'static>() -> Router {
         .route("/get/*path", get(get_trigger::<T>))
         .route("/update/*path", post(update_trigger::<T>))
         .route("/delete/*path", delete(delete_trigger::<T>))
-        .route("/exists/*path", get(exists_trigger::<T>));
-
-    if T::SUPPORTS_ENABLED {
-        router = router.route("/setenabled/*path", post(set_enabled_trigger::<T>));
-    }
+        .route("/exists/*path", get(exists_trigger::<T>))
+        .route("/setenabled/*path", post(set_enabled_trigger::<T>));
 
     if T::SUPPORTS_TEST_CONNECTION {
         router = router.route("/test", post(test_connection::<T>));
diff --git a/backend/windmill-api/src/triggers/http/handler.rs b/backend/windmill-api/src/triggers/http/handler.rs
index 19fabe40ea..cf1a004c32 100644
--- a/backend/windmill-api/src/triggers/http/handler.rs
+++ b/backend/windmill-api/src/triggers/http/handler.rs
@@ -358,7 +358,6 @@ impl TriggerCrud for HttpTrigger {
 
     const TABLE_NAME: &'static str = "http_trigger";
     const TRIGGER_TYPE: &'static str = "http";
-    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/http_triggers";
@@ -543,22 +542,23 @@ impl TriggerCrud for HttpTrigger {
                 script_path = $4,
                 path = $5,
                 is_flow = $6,
-                http_method = $7,
-                static_asset_config = $8,
-                edited_by = $9,
-                email = $10,
-                request_type = $11,
-                authentication_method = $12,
-                summary = $13,
-                description = $14,
+                enabled = $7,
+                http_method = $8,
+                static_asset_config = $9,
+                edited_by = $10,
+                email = $11,
+                request_type = $12,
+                authentication_method = $13,
+                summary = $14,
+                description = $15,
                 edited_at = now(),
-                is_static_website = $15,
-                error_handler_path = $16,
-                error_handler_args = $17,
-                retry = $18
+                is_static_website = $16,
+                error_handler_path = $17,
+                error_handler_args = $18,
+                retry = $19
             WHERE
-                workspace_id = $19 AND
-                path = $20
+                workspace_id = $20 AND
+                path = $21
             "#,
                 trigger.config.wrap_body,
                 trigger.config.raw_string,
@@ -566,6 +566,7 @@ impl TriggerCrud for HttpTrigger {
                 trigger.base.script_path,
                 trigger.base.path,
                 trigger.base.is_flow,
+                trigger.base.enabled.unwrap_or(true),
                 trigger.config.http_method as _,
                 trigger.config.static_asset_config as _,
                 &authed.username,
diff --git a/backend/windmill-api/src/triggers/kafka/handler_oss.rs b/backend/windmill-api/src/triggers/kafka/handler_oss.rs
index bf5537b941..9fda83916f 100644
--- a/backend/windmill-api/src/triggers/kafka/handler_oss.rs
+++ b/backend/windmill-api/src/triggers/kafka/handler_oss.rs
@@ -28,7 +28,6 @@ impl TriggerCrud for KafkaTrigger {
 
     const TABLE_NAME: &'static str = "";
     const TRIGGER_TYPE: &'static str = "";
-    const SUPPORTS_ENABLED: bool = false;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/kafka_triggers";
diff --git a/backend/windmill-api/src/triggers/mqtt/handler.rs b/backend/windmill-api/src/triggers/mqtt/handler.rs
index d8e314a836..fd6054666c 100644
--- a/backend/windmill-api/src/triggers/mqtt/handler.rs
+++ b/backend/windmill-api/src/triggers/mqtt/handler.rs
@@ -26,7 +26,6 @@ impl TriggerCrud for MqttTrigger {
 
     const TABLE_NAME: &'static str = "mqtt_trigger";
     const TRIGGER_TYPE: &'static str = "mqtt";
-    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = true;
     const SUPPORTS_TEST_CONNECTION: bool = true;
     const ROUTE_PREFIX: &'static str = "/mqtt_triggers";
diff --git a/backend/windmill-api/src/triggers/nats/handler_oss.rs b/backend/windmill-api/src/triggers/nats/handler_oss.rs
index 41f060003f..3ab3430e5f 100644
--- a/backend/windmill-api/src/triggers/nats/handler_oss.rs
+++ b/backend/windmill-api/src/triggers/nats/handler_oss.rs
@@ -25,7 +25,6 @@ impl TriggerCrud for NatsTrigger {
 
     const TABLE_NAME: &'static str = "";
     const TRIGGER_TYPE: &'static str = "";
-    const SUPPORTS_ENABLED: bool = false;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/nats_triggers";
diff --git a/backend/windmill-api/src/triggers/postgres/handler.rs b/backend/windmill-api/src/triggers/postgres/handler.rs
index 5dce0345c6..3b0a1b6972 100644
--- a/backend/windmill-api/src/triggers/postgres/handler.rs
+++ b/backend/windmill-api/src/triggers/postgres/handler.rs
@@ -47,7 +47,6 @@ impl TriggerCrud for PostgresTrigger {
 
     const TABLE_NAME: &'static str = "postgres_trigger";
     const TRIGGER_TYPE: &'static str = "postgres";
-    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = true;
     const SUPPORTS_TEST_CONNECTION: bool = true;
     const ROUTE_PREFIX: &'static str = "/postgres_triggers";
@@ -64,7 +63,6 @@ impl TriggerCrud for PostgresTrigger {
         DeployedObject::PostgresTrigger { path }
     }
 
-
     async fn create_trigger(
         &self,
         db: &DB,
diff --git a/backend/windmill-api/src/triggers/sqs/handler_oss.rs b/backend/windmill-api/src/triggers/sqs/handler_oss.rs
index 6b6d18b72e..21200e8e38 100644
--- a/backend/windmill-api/src/triggers/sqs/handler_oss.rs
+++ b/backend/windmill-api/src/triggers/sqs/handler_oss.rs
@@ -26,7 +26,6 @@ impl TriggerCrud for SqsTrigger {
 
     const TABLE_NAME: &'static str = "";
     const TRIGGER_TYPE: &'static str = "";
-    const SUPPORTS_ENABLED: bool = false;
     const SUPPORTS_SERVER_STATE: bool = false;
     const SUPPORTS_TEST_CONNECTION: bool = false;
     const ROUTE_PREFIX: &'static str = "/sqs_triggers";
diff --git a/backend/windmill-api/src/triggers/websocket/handler.rs b/backend/windmill-api/src/triggers/websocket/handler.rs
index 510f6e97ae..2439be8292 100644
--- a/backend/windmill-api/src/triggers/websocket/handler.rs
+++ b/backend/windmill-api/src/triggers/websocket/handler.rs
@@ -30,7 +30,6 @@ impl TriggerCrud for WebsocketTrigger {
 
     const TABLE_NAME: &'static str = "websocket_trigger";
     const TRIGGER_TYPE: &'static str = "websocket";
-    const SUPPORTS_ENABLED: bool = true;
     const SUPPORTS_SERVER_STATE: bool = true;
     const SUPPORTS_TEST_CONNECTION: bool = true;
     const ROUTE_PREFIX: &'static str = "/websocket_triggers";
diff --git a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
index 291a3e08ac..4e8a37e9e0 100644
--- a/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/email/EmailTriggerEditorInner.svelte
@@ -65,6 +65,7 @@
 	let error_handler_path: string | undefined = $state()
 	let error_handler_args: Record<string, any> = $state({})
 	let retry: Retry | undefined = $state()
+	let enabled = $state(false)
 	// Component references
 	let drawer = $state<Drawer | undefined>(undefined)
 	let initialConfig: NewEmailTrigger | undefined = undefined
@@ -72,7 +73,7 @@
 	let optionTabSelected: 'error_handler' | 'retries' = $state('error_handler')
 	let errorHandlerSelected: ErrorHandler = $state('slack')
 	const isAdmin = $derived($userStore?.is_admin || $userStore?.is_super_admin)
-	const routeConfig = $derived.by(getEmailTriggerConfig)
+	const emailConfig = $derived.by(getEmailTriggerConfig)
 	const captureConfig = $derived.by(isEditor ? getCaptureConfig : () => ({}))
 	const saveDisabled = $derived(
 		drawerLoading || !can_write || pathError != '' || !isValid || emptyString(script_path)
@@ -141,6 +142,7 @@
 			error_handler_args = defaultValues?.error_handler_args ?? {}
 			retry = defaultValues?.retry ?? undefined
 			errorHandlerSelected = getHandlerType(error_handler_path ?? '')
+			enabled = defaultValues?.enabled ?? false
 		} finally {
 			clearTimeout(loader)
 			drawerLoading = false
@@ -161,6 +163,7 @@
 		error_handler_args = cfg?.error_handler_args ?? {}
 		retry = cfg?.retry
 		errorHandlerSelected = getHandlerType(error_handler_path ?? '')
+		enabled = cfg?.enabled ?? false
 	}
 
 	async function loadTrigger(defaultConfig?: Partial<EmailTrigger>): Promise<void> {
@@ -179,11 +182,11 @@
 
 	async function triggerScript(): Promise<void> {
 		if (customSaveBehavior) {
-			customSaveBehavior(routeConfig)
+			customSaveBehavior(emailConfig)
 			drawer?.closeDrawer()
 		} else {
 			deploymentLoading = true
-			const saveCfg = routeConfig
+			const saveCfg = emailConfig
 			const isSaved = await saveEmailTriggerFromCfg(
 				initialPath,
 				saveCfg,
@@ -210,17 +213,30 @@
 			extra_perms: extraPerms,
 			error_handler_path,
 			error_handler_args,
-			retry
+			retry,
+			enabled
 		}
 
 		return nCfg
 	}
 
+	async function handleToggleEnabled(newEnabled: boolean) {
+		enabled = newEnabled
+		if (!trigger?.draftConfig) {
+			await EmailTriggerService.setEmailTriggerEnabled({
+				path: initialPath,
+				workspace: $workspaceStore ?? '',
+				requestBody: { enabled: newEnabled }
+			})
+			sendUserToast(`${newEnabled ? 'enabled' : 'disabled'} email trigger ${initialPath}`)
+		}
+	}
+
 	// Update config for captures
 	function getCaptureConfig() {
 		const newCaptureConfig = {
-			local_part: routeConfig.local_part,
-			path: routeConfig.path
+			local_part: emailConfig.local_part,
+			path: emailConfig.path
 		}
 		//
 		return newCaptureConfig
@@ -233,7 +249,7 @@
 
 	$effect(() => {
 		if (!drawerLoading) {
-			handleConfigChange(routeConfig, initialConfig, saveDisabled, edit, onConfigChange)
+			handleConfigChange(emailConfig, initialConfig, saveDisabled, edit, onConfigChange)
 		}
 	})
 </script>
@@ -338,8 +354,9 @@
 			{trigger}
 			permissions={drawerLoading || !can_write ? 'none' : can_write && isAdmin ? 'create' : 'write'}
 			{saveDisabled}
-			enabled={undefined}
+			{enabled}
 			{allowDraft}
+			onToggleEnabled={handleToggleEnabled}
 			{edit}
 			isLoading={deploymentLoading}
 			onUpdate={triggerScript}
diff --git a/frontend/src/lib/components/triggers/email/utils.ts b/frontend/src/lib/components/triggers/email/utils.ts
index 82de2a0a0d..49a94093eb 100644
--- a/frontend/src/lib/components/triggers/email/utils.ts
+++ b/frontend/src/lib/components/triggers/email/utils.ts
@@ -15,21 +15,22 @@ export function getEmailAddress(
 
 export async function saveEmailTriggerFromCfg(
 	initialPath: string,
-	routeCfg: Record<string, any>,
+	emailCfg: Record<string, any>,
 	edit: boolean,
 	workspace: string,
 	isAdmin: boolean,
 	usedTriggerKinds: Writable<string[]>
 ): Promise<boolean> {
 	const requestBody: NewEmailTrigger = {
-		path: routeCfg.path,
-		script_path: routeCfg.script_path,
-		local_part: routeCfg.local_part,
-		is_flow: routeCfg.is_flow,
-		workspaced_local_part: routeCfg.workspaced_local_part,
-		error_handler_path: routeCfg.error_handler_path,
-		error_handler_args: routeCfg.error_handler_path ? routeCfg.error_handler_args : undefined,
-		retry: routeCfg.retry
+		path: emailCfg.path,
+		script_path: emailCfg.script_path,
+		local_part: emailCfg.local_part,
+		is_flow: emailCfg.is_flow,
+		workspaced_local_part: emailCfg.workspaced_local_part,
+		error_handler_path: emailCfg.error_handler_path,
+		error_handler_args: emailCfg.error_handler_path ? emailCfg.error_handler_args : undefined,
+		retry: emailCfg.retry,
+		enabled: emailCfg.enabled
 	}
 	try {
 		if (edit) {
@@ -38,16 +39,16 @@ export async function saveEmailTriggerFromCfg(
 				path: initialPath,
 				requestBody: {
 					...requestBody,
-					local_part: isAdmin || !edit ? routeCfg.local_part : undefined
+					local_part: isAdmin || !edit ? emailCfg.local_part : undefined
 				}
 			})
-			sendUserToast(`Route ${routeCfg.path} updated`)
+			sendUserToast(`Email trigger ${emailCfg.path} updated`)
 		} else {
 			await EmailTriggerService.createEmailTrigger({
 				workspace: workspace,
-				requestBody: requestBody
+				requestBody: { ...requestBody, enabled: true }
 			})
-			sendUserToast(`Route ${routeCfg.path} created`)
+			sendUserToast(`Email trigger ${emailCfg.path} created`)
 		}
 		if (!get(usedTriggerKinds).includes('email')) {
 			usedTriggerKinds.update((t) => [...t, 'email'])
diff --git a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
index bb11e620bf..085360df6a 100644
--- a/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
+++ b/frontend/src/lib/components/triggers/http/RouteEditorInner.svelte
@@ -236,7 +236,7 @@
 			s3FileUploadRawMode = defaultValues?.s3FileUploadRawMode ?? false
 			path = defaultValues?.path ?? ''
 			initialPath = ''
-			enabled = defaultValues?.enabled ?? true
+			enabled = defaultValues?.enabled ?? false
 			dirtyPath = false
 			is_static_website = defaultValues?.is_static_website ?? false
 			workspaced_route = defaultValues?.workspaced_route ?? false
diff --git a/frontend/src/lib/components/triggers/http/utils.ts b/frontend/src/lib/components/triggers/http/utils.ts
index 212201f0b6..5cb2cf2b4f 100644
--- a/frontend/src/lib/components/triggers/http/utils.ts
+++ b/frontend/src/lib/components/triggers/http/utils.ts
@@ -77,7 +77,7 @@ export async function saveHttpRouteFromCfg(
 		} else {
 			await HttpTriggerService.createHttpTrigger({
 				workspace: workspace,
-				requestBody: requestBody
+				requestBody: { ...requestBody, enabled: true }
 			})
 			sendUserToast(`Route ${routeCfg.path} created`)
 		}
diff --git a/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte b/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
index 8ea6a5069a..386db77449 100644
--- a/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/email_triggers/+page.svelte
@@ -193,6 +193,23 @@
 		}
 	}
 
+	async function setTriggerEnabled(path: string, enabled: boolean): Promise<void> {
+		try {
+			await EmailTriggerService.setEmailTriggerEnabled({
+				path,
+				workspace: $workspaceStore!,
+				requestBody: { enabled }
+			})
+		} catch (err) {
+			sendUserToast(
+				`Cannot ` + (enabled ? 'enable' : 'disable') + ` email trigger: ${err.body}`,
+				true
+			)
+		} finally {
+			loadTriggers()
+		}
+	}
+
 	onMount(() => {
 		loadQueryFilters()
 	})
@@ -274,7 +291,7 @@
 				<div class="text-center text-sm text-primary mt-2"> No email triggers </div>
 			{:else if items?.length}
 				<div class="border rounded-md divide-y">
-					{#each items.slice(0, nbDisplayed) as { workspace_id, workspaced_local_part, path, edited_by, edited_at, script_path, is_flow, extra_perms, canWrite, marked, local_part } (path)}
+					{#each items.slice(0, nbDisplayed) as { workspace_id, workspaced_local_part, path, edited_by, edited_at, script_path, is_flow, extra_perms, canWrite, marked, local_part, enabled } (path)}
 						{@const href = `${is_flow ? '/flows/get' : '/scripts/get'}/${script_path}`}
 						{@const emailAddress = getEmailAddress(
 							local_part,
@@ -317,6 +334,13 @@
 								<div class="hidden lg:flex flex-row gap-1 items-center">
 									<SharedBadge {canWrite} extraPerms={extra_perms} />
 								</div>
+								<Toggle
+									checked={enabled}
+									disabled={!canWrite}
+									on:change={(e) => {
+										setTriggerEnabled(path, e.detail)
+									}}
+								/>
 
 								<div class="flex gap-2 items-center justify-end">
 									<Button

From 5aa251a2d276cc9d27bf104f8e4f724ea6a28231 Mon Sep 17 00:00:00 2001
From: Alexander Petric <alpetric@users.noreply.github.com>
Date: Tue, 18 Nov 2025 18:04:31 -0500
Subject: [PATCH 48/81] feat(security): unshare pid of worker job process
 (#7106)

* feat(security): unbind pid for worker jobs to create extra process isolation

* review

* simplify

* cleanup + compose files

* re-add removed comments from nu executor

* simplify

* fail immediately

* updates

* update ping backend

* nsjail / unshare in workers page

* migrations

* frontend + sqlx

* frontend

* frontend

* fix error message

* undo example changes
---
 ...1f7f387f5055c47f493271d26731336257384.json |  10 +-
 ...a90d9206c45d92a0423c0bc2396d0d66a0b0d.json |   4 +-
 ...03c36be56b2b2b08ca787417a9822ef56f64.json} |   7 +-
 ...5c9c4d48fd213852e2f997cd4b2420580d30.json} |  10 +-
 ...0cb549a34b96554ae1872355b90304f5dcb76.json |   4 +-
 ...5bb358c91ebdd9dab50d7e3d2fdce63b947c.json} |   7 +-
 ...1112200815_add_enable_unshare_pid.down.sql |   2 +
 ...251112200815_add_enable_unshare_pid.up.sql |   4 +
 backend/windmill-api/openapi.yaml             |   2 +
 backend/windmill-api/src/workers.rs           |   6 +-
 backend/windmill-common/src/worker.rs         |  13 +-
 .../windmill-worker/src/ansible_executor.rs   |  15 +-
 backend/windmill-worker/src/bash_executor.rs  |   8 +-
 backend/windmill-worker/src/bun_executor.rs   |  27 +--
 backend/windmill-worker/src/common.rs         |  33 +++
 .../windmill-worker/src/csharp_executor.rs    |  11 +-
 backend/windmill-worker/src/deno_executor.rs  |  13 +-
 backend/windmill-worker/src/go_executor.rs    |   7 +-
 backend/windmill-worker/src/java_executor.rs  |  18 +-
 backend/windmill-worker/src/nu_executor.rs    |  46 ++--
 backend/windmill-worker/src/php_executor.rs   |  40 ++--
 backend/windmill-worker/src/pwsh_executor.rs  |  33 +--
 .../windmill-worker/src/python_executor.rs    |  10 +-
 backend/windmill-worker/src/ruby_executor.rs  |  43 ++--
 backend/windmill-worker/src/rust_executor.rs  |   4 +-
 backend/windmill-worker/src/worker.rs         | 135 +++++++++++
 backend/windmill-worker/src/worker_utils.rs   |  23 ++
 docker-compose.yml                            |  18 ++
 .../src/lib/components/WorkerGroup.svelte     | 213 +++++++++++-------
 .../(root)/(logged)/workers/+page.svelte      |   2 +-
 30 files changed, 536 insertions(+), 232 deletions(-)
 rename backend/.sqlx/{query-506066203c49424e9944eb3948dc1657d3d796e6233e9f0ec925879c705d4773.json => query-76a7ad0588afcb4e9f0b876c50e203c36be56b2b2b08ca787417a9822ef56f64.json} (69%)
 rename backend/.sqlx/{query-6a497334c98bfaf70be44fced572a1cc0dde4141aa4c5002765a95432d0101ab.json => query-771a858a4b7ca41b6787e61f5a4a5c9c4d48fd213852e2f997cd4b2420580d30.json} (80%)
 rename backend/.sqlx/{query-e5f8830450e90f678494ae2b0f86b0692a02dec4c8415fd7d364b0cc088905c2.json => query-ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c.json} (56%)
 create mode 100644 backend/migrations/20251112200815_add_enable_unshare_pid.down.sql
 create mode 100644 backend/migrations/20251112200815_add_enable_unshare_pid.up.sql

diff --git a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
index e7ed0aee65..d29a18c691 100644
--- a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
+++ b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
+      true,
+      true,
+      true,
+      true,
+      true,
       true,
       true
     ]
diff --git a/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json b/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json
index ecaf828737..bc15928e38 100644
--- a/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json
+++ b/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json
@@ -59,7 +59,9 @@
                 "failure",
                 "command",
                 "approval",
-                "preprocessor"
+                "preprocessor",
+                "schedule_handler_old",
+                "dynamic_skip"
               ]
             }
           }
diff --git a/backend/.sqlx/query-506066203c49424e9944eb3948dc1657d3d796e6233e9f0ec925879c705d4773.json b/backend/.sqlx/query-76a7ad0588afcb4e9f0b876c50e203c36be56b2b2b08ca787417a9822ef56f64.json
similarity index 69%
rename from backend/.sqlx/query-506066203c49424e9944eb3948dc1657d3d796e6233e9f0ec925879c705d4773.json
rename to backend/.sqlx/query-76a7ad0588afcb4e9f0b876c50e203c36be56b2b2b08ca787417a9822ef56f64.json
index 50d4a9595d..f0c32e5dd0 100644
--- a/backend/.sqlx/query-506066203c49424e9944eb3948dc1657d3d796e6233e9f0ec925879c705d4773.json
+++ b/backend/.sqlx/query-76a7ad0588afcb4e9f0b876c50e203c36be56b2b2b08ca787417a9822ef56f64.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE worker_ping SET ping_at = now(), current_job_id = $1, current_job_workspace_id = $2, memory_usage = $3, wm_memory_usage = $4,\n        occupancy_rate = $6, occupancy_rate_15s = $7, occupancy_rate_5m = $8, occupancy_rate_30m = $9 WHERE worker = $5",
+  "query": "UPDATE worker_ping SET ping_at = now(), current_job_id = $1, current_job_workspace_id = $2, memory_usage = $3, wm_memory_usage = $4,\n        occupancy_rate = $6, occupancy_rate_15s = $7, occupancy_rate_5m = $8, occupancy_rate_30m = $9, job_isolation = $10 WHERE worker = $5",
   "describe": {
     "columns": [],
     "parameters": {
@@ -13,10 +13,11 @@
         "Float4",
         "Float4",
         "Float4",
-        "Float4"
+        "Float4",
+        "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "506066203c49424e9944eb3948dc1657d3d796e6233e9f0ec925879c705d4773"
+  "hash": "76a7ad0588afcb4e9f0b876c50e203c36be56b2b2b08ca787417a9822ef56f64"
 }
diff --git a/backend/.sqlx/query-6a497334c98bfaf70be44fced572a1cc0dde4141aa4c5002765a95432d0101ab.json b/backend/.sqlx/query-771a858a4b7ca41b6787e61f5a4a5c9c4d48fd213852e2f997cd4b2420580d30.json
similarity index 80%
rename from backend/.sqlx/query-6a497334c98bfaf70be44fced572a1cc0dde4141aa4c5002765a95432d0101ab.json
rename to backend/.sqlx/query-771a858a4b7ca41b6787e61f5a4a5c9c4d48fd213852e2f997cd4b2420580d30.json
index 9df7dced7b..644cb25123 100644
--- a/backend/.sqlx/query-6a497334c98bfaf70be44fced572a1cc0dde4141aa4c5002765a95432d0101ab.json
+++ b/backend/.sqlx/query-771a858a4b7ca41b6787e61f5a4a5c9c4d48fd213852e2f997cd4b2420580d30.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,\n        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id, \n        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage\n        FROM worker_ping\n        WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)\n        ORDER BY ping_at desc LIMIT $2 OFFSET $3",
+  "query": "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,\n        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,\n        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation\n        FROM worker_ping\n        WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)\n        ORDER BY ping_at desc LIMIT $2 OFFSET $3",
   "describe": {
     "columns": [
       {
@@ -97,6 +97,11 @@
         "ordinal": 18,
         "name": "wm_memory_usage",
         "type_info": "Int8"
+      },
+      {
+        "ordinal": 19,
+        "name": "job_isolation",
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -126,8 +131,9 @@
       true,
       true,
       true,
+      true,
       true
     ]
   },
-  "hash": "6a497334c98bfaf70be44fced572a1cc0dde4141aa4c5002765a95432d0101ab"
+  "hash": "771a858a4b7ca41b6787e61f5a4a5c9c4d48fd213852e2f997cd4b2420580d30"
 }
diff --git a/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json b/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json
index 54e94cfb8f..99269c9851 100644
--- a/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json
+++ b/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json
@@ -18,8 +18,8 @@
       "Left": []
     },
     "nullable": [
-      false,
-      true
+      true,
+      false
     ]
   },
   "hash": "b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76"
diff --git a/backend/.sqlx/query-e5f8830450e90f678494ae2b0f86b0692a02dec4c8415fd7d364b0cc088905c2.json b/backend/.sqlx/query-ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c.json
similarity index 56%
rename from backend/.sqlx/query-e5f8830450e90f678494ae2b0f86b0692a02dec4c8415fd7d364b0cc088905c2.json
rename to backend/.sqlx/query-ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c.json
index 3867319977..15e83648ec 100644
--- a/backend/.sqlx/query-e5f8830450e90f678494ae2b0f86b0692a02dec4c8415fd7d364b0cc088905c2.json
+++ b/backend/.sqlx/query-ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, wm_version, vcpus, memory) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) ON CONFLICT (worker) \n        DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group",
+  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, wm_version, vcpus, memory, job_isolation) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10) ON CONFLICT (worker)\n        DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group",
   "describe": {
     "columns": [],
     "parameters": {
@@ -13,10 +13,11 @@
         "Varchar",
         "Varchar",
         "Int8",
-        "Int8"
+        "Int8",
+        "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "e5f8830450e90f678494ae2b0f86b0692a02dec4c8415fd7d364b0cc088905c2"
+  "hash": "ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c"
 }
diff --git a/backend/migrations/20251112200815_add_enable_unshare_pid.down.sql b/backend/migrations/20251112200815_add_enable_unshare_pid.down.sql
new file mode 100644
index 0000000000..d6fbf14f23
--- /dev/null
+++ b/backend/migrations/20251112200815_add_enable_unshare_pid.down.sql
@@ -0,0 +1,2 @@
+-- Rollback: Remove job_isolation column from worker_ping table
+ALTER TABLE worker_ping DROP COLUMN IF EXISTS job_isolation;
diff --git a/backend/migrations/20251112200815_add_enable_unshare_pid.up.sql b/backend/migrations/20251112200815_add_enable_unshare_pid.up.sql
new file mode 100644
index 0000000000..b7b2674ebd
--- /dev/null
+++ b/backend/migrations/20251112200815_add_enable_unshare_pid.up.sql
@@ -0,0 +1,4 @@
+-- Add job_isolation column to worker_ping table
+-- This tracks which job isolation method the worker is using: 'nsjail', 'unshare', or 'none'
+-- Nullable for backwards compatibility - old workers will report NULL
+ALTER TABLE worker_ping ADD COLUMN job_isolation TEXT;
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 85740d0d2f..e3d9404018 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -18802,6 +18802,8 @@ components:
           type: number
         wm_memory_usage:
           type: number
+        job_isolation:
+          type: string
       required:
         - worker
         - worker_instance
diff --git a/backend/windmill-api/src/workers.rs b/backend/windmill-api/src/workers.rs
index 4e6c5ab086..1f49ec5492 100644
--- a/backend/windmill-api/src/workers.rs
+++ b/backend/windmill-api/src/workers.rs
@@ -69,6 +69,8 @@ struct WorkerPing {
     memory_usage: Option<i64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     wm_memory_usage: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    job_isolation: Option<String>,
 }
 
 // #[derive(Serialize, Deserialize)]
@@ -97,8 +99,8 @@ async fn list_worker_pings(
     let rows = sqlx::query_as!(
         WorkerPing,
         "SELECT worker, worker_instance,  EXTRACT(EPOCH FROM (now() - ping_at))::integer as last_ping, started_at, ip, jobs_executed,
-        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id, 
-        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage
+        CASE WHEN $4 IS TRUE THEN current_job_id ELSE NULL END as last_job_id, CASE WHEN $4 IS TRUE THEN current_job_workspace_id ELSE NULL END as last_job_workspace_id,
+        custom_tags, worker_group, wm_version, occupancy_rate, occupancy_rate_15s, occupancy_rate_5m, occupancy_rate_30m, memory, vcpus, memory_usage, wm_memory_usage, job_isolation
         FROM worker_ping
         WHERE ($1::integer IS NULL AND ping_at > now() - interval '5 minute') OR (ping_at > now() - ($1 || ' seconds')::interval)
         ORDER BY ping_at desc LIMIT $2 OFFSET $3",
diff --git a/backend/windmill-common/src/worker.rs b/backend/windmill-common/src/worker.rs
index 0b0055ed0d..2918d40b0c 100644
--- a/backend/windmill-common/src/worker.rs
+++ b/backend/windmill-common/src/worker.rs
@@ -1301,6 +1301,7 @@ pub struct Ping {
     pub occupancy_rate_15s: Option<f32>,
     pub occupancy_rate_5m: Option<f32>,
     pub occupancy_rate_30m: Option<f32>,
+    pub job_isolation: Option<String>,
     pub ping_type: PingType,
 }
 pub async fn update_ping_http(
@@ -1348,6 +1349,7 @@ pub async fn update_ping_http(
                 &insert_ping.version.unwrap(),
                 insert_ping.vcpus,
                 insert_ping.memory,
+                insert_ping.job_isolation,
                 db,
             )
             .await?;
@@ -1363,6 +1365,7 @@ pub async fn update_ping_http(
                 insert_ping.occupancy_rate_15s,
                 insert_ping.occupancy_rate_5m,
                 insert_ping.occupancy_rate_30m,
+                insert_ping.job_isolation,
                 db,
             )
             .await?;
@@ -1476,10 +1479,11 @@ pub async fn insert_ping_query(
     version: &str,
     vcpus: Option<i64>,
     memory: Option<i64>,
+    job_isolation: Option<String>,
     db: &DB,
 ) -> anyhow::Result<()> {
     sqlx::query!(
-        "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, wm_version, vcpus, memory) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) ON CONFLICT (worker) 
+        "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, wm_version, vcpus, memory, job_isolation) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10) ON CONFLICT (worker)
         DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group",
         worker_instance,
         worker_name,
@@ -1489,7 +1493,8 @@ pub async fn insert_ping_query(
         dw,
         version,
         vcpus,
-        memory
+        memory,
+        job_isolation.as_deref()
         )
         .execute(db)
         .await?;
@@ -1506,11 +1511,12 @@ pub async fn update_worker_ping_from_job_query(
     occupancy_rate_15s: Option<f32>,
     occupancy_rate_5m: Option<f32>,
     occupancy_rate_30m: Option<f32>,
+    job_isolation: Option<String>,
     db: &DB,
 ) -> anyhow::Result<()> {
     sqlx::query!(
         "UPDATE worker_ping SET ping_at = now(), current_job_id = $1, current_job_workspace_id = $2, memory_usage = $3, wm_memory_usage = $4,
-        occupancy_rate = $6, occupancy_rate_15s = $7, occupancy_rate_5m = $8, occupancy_rate_30m = $9 WHERE worker = $5",
+        occupancy_rate = $6, occupancy_rate_15s = $7, occupancy_rate_5m = $8, occupancy_rate_30m = $9, job_isolation = $10 WHERE worker = $5",
             job_id,
         w_id,
         memory_usage,
@@ -1520,6 +1526,7 @@ pub async fn update_worker_ping_from_job_query(
         occupancy_rate_15s,
         occupancy_rate_5m,
         occupancy_rate_30m,
+        job_isolation,
     )
     .execute(db)
     .await?;
diff --git a/backend/windmill-worker/src/ansible_executor.rs b/backend/windmill-worker/src/ansible_executor.rs
index ac1ae4e233..9aed0e18ad 100644
--- a/backend/windmill-worker/src/ansible_executor.rs
+++ b/backend/windmill-worker/src/ansible_executor.rs
@@ -29,13 +29,13 @@ use windmill_queue::{append_logs, CanceledBy};
 use crate::{
     bash_executor::BIN_BASH,
     common::{
-        check_executor_binary_exists, get_reserved_variables, read_and_check_result,
-        start_child_process, transform_json, OccupancyMetrics,
+        build_command_with_isolation, check_executor_binary_exists, get_reserved_variables,
+        read_and_check_result, start_child_process, transform_json, OccupancyMetrics,
     },
     handle_child::handle_child,
     python_executor::{create_dependencies_dir, handle_python_reqs, uv_pip_compile},
-    PyVAlias, DISABLE_NSJAIL, DISABLE_NUSER, GIT_PATH, HOME_ENV, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
-    PY_INSTALL_DIR, TZ_ENV,
+    DISABLE_NSJAIL, DISABLE_NUSER, GIT_PATH, HOME_ENV, NSJAIL_PATH, PATH_ENV,
+    PROXY_ENVS, PY_INSTALL_DIR, PyVAlias, TZ_ENV,
 };
 use windmill_common::client::AuthedClient;
 
@@ -1240,7 +1240,11 @@ fi
             .stderr(Stdio::piped());
         start_child_process(nsjail_cmd, NSJAIL_PATH.as_str(), false).await?
     } else {
-        let mut ansible_cmd = Command::new(ANSIBLE_PLAYBOOK_PATH.as_str());
+        let ansible_args: Vec<&str> = cmd_args.iter().map(|s| s.as_ref()).collect();
+        let mut ansible_cmd = build_command_with_isolation(
+            ANSIBLE_PLAYBOOK_PATH.as_str(),
+            &ansible_args,
+        );
         ansible_cmd
             .current_dir(job_dir)
             .env_clear()
@@ -1250,7 +1254,6 @@ fi
             .env("TZ", TZ_ENV.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
-            .args(cmd_args)
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
diff --git a/backend/windmill-worker/src/bash_executor.rs b/backend/windmill-worker/src/bash_executor.rs
index d147aaff9b..640f3c9fae 100644
--- a/backend/windmill-worker/src/bash_executor.rs
+++ b/backend/windmill-worker/src/bash_executor.rs
@@ -35,7 +35,7 @@ use crate::handle_child::run_future_with_polling_update_job_poller;
 
 use crate::{
     common::{
-        build_args_map, get_reserved_variables, read_file, read_file_content, start_child_process,
+        build_args_map, build_command_with_isolation, get_reserved_variables, read_file, read_file_content, start_child_process,
         OccupancyMetrics,
     },
     handle_child::handle_child,
@@ -200,7 +200,10 @@ exit $exit_status
     } else {
         let mut cmd_args = vec!["wrapper.sh"];
         cmd_args.extend(&args);
-        let mut bash_cmd = Command::new(BIN_BASH.as_str());
+        let mut bash_cmd = build_command_with_isolation(
+            BIN_BASH.as_str(),
+            &cmd_args.iter().map(|s| s.as_ref()).collect::<Vec<&str>>(),
+        );
         bash_cmd
             .current_dir(job_dir)
             .env_clear()
@@ -209,7 +212,6 @@ exit $exit_status
             .env("PATH", PATH_ENV.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
-            .args(cmd_args)
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
diff --git a/backend/windmill-worker/src/bun_executor.rs b/backend/windmill-worker/src/bun_executor.rs
index 757656b934..b8723ad815 100644
--- a/backend/windmill-worker/src/bun_executor.rs
+++ b/backend/windmill-worker/src/bun_executor.rs
@@ -17,7 +17,7 @@ use crate::common::build_envs_map;
 use crate::{
     common::{
         create_args_and_out_file, get_reserved_variables, parse_npm_config, read_file,
-        read_file_content, read_result, start_child_process, write_file_binary, OccupancyMetrics,
+        build_command_with_isolation, read_file_content, read_result, start_child_process, write_file_binary, OccupancyMetrics,
         StreamNotifier,
     },
     handle_child::handle_child,
@@ -1430,15 +1430,15 @@ try {{
     } else {
         let cmd = if annotation.nodejs {
             let script_path = format!("{job_dir}/wrapper.mjs");
+            let args = vec!["--preserve-symlinks", script_path.as_str()];
 
-            let mut bun_cmd = Command::new(&*NODE_BIN_PATH);
+            let mut bun_cmd = build_command_with_isolation(&*NODE_BIN_PATH, &args);
             bun_cmd
                 .current_dir(job_dir)
                 .env_clear()
                 .envs(envs)
                 .envs(reserved_variables)
                 .envs(common_bun_proc_envs)
-                .args(vec!["--preserve-symlinks", &script_path])
                 .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
@@ -1450,8 +1450,7 @@ try {{
         } else {
             let script_path = format!("{job_dir}/wrapper.mjs");
 
-            let mut bun_cmd = Command::new(&*BUN_PATH);
-            let args = if codebase.is_some() || has_bundle_cache {
+            let args: Vec<&str> = if codebase.is_some() || has_bundle_cache {
                 vec!["run", &script_path]
             } else {
                 vec![
@@ -1463,13 +1462,13 @@ try {{
                     &script_path,
                 ]
             };
+            let mut bun_cmd = build_command_with_isolation(&*BUN_PATH, &args);
             bun_cmd
                 .current_dir(job_dir)
                 .env_clear()
                 .envs(envs)
                 .envs(reserved_variables)
                 .envs(common_bun_proc_envs)
-                .args(args)
                 .stdin(Stdio::null())
                 .stdout(Stdio::piped())
                 .stderr(Stdio::piped());
@@ -1480,16 +1479,12 @@ try {{
             bun_cmd
         };
 
-        start_child_process(
-            cmd,
-            if annotation.nodejs {
-                &*NODE_BIN_PATH
-            } else {
-                &*BUN_PATH
-            },
-            false,
-        )
-        .await?
+        let executable = if annotation.nodejs {
+            &*NODE_BIN_PATH
+        } else {
+            &*BUN_PATH
+        };
+        start_child_process(cmd, executable, false).await?
     };
 
     let stream_notifier = StreamNotifier::new(conn, job);
diff --git a/backend/windmill-worker/src/common.rs b/backend/windmill-worker/src/common.rs
index 4a6edbd55d..2d995ea9bb 100644
--- a/backend/windmill-worker/src/common.rs
+++ b/backend/windmill-worker/src/common.rs
@@ -528,6 +528,7 @@ pub async fn update_worker_ping_for_failed_init_script(
                         memory: None,
                         memory_usage: None,
                         wm_memory_usage: None,
+                        job_isolation: None,
                         ping_type: PingType::InitScript,
                     },
                 )
@@ -628,6 +629,38 @@ lazy_static! {
     static ref DISABLE_PROCESS_GROUP: bool = std::env::var("DISABLE_PROCESS_GROUP").is_ok();
 }
 
+pub fn build_command_with_isolation(
+    program: &str,
+    args: &[&str],
+) -> Command {
+    use tokio::process::Command;
+
+    if *crate::ENABLE_UNSHARE_PID {
+        if let Some(unshare_path) = crate::UNSHARE_PATH.as_ref() {
+            let mut cmd = Command::new(unshare_path);
+
+            let flags = crate::UNSHARE_ISOLATION_FLAGS.as_str();
+            for flag in flags.split_whitespace() {
+                cmd.arg(flag);
+            }
+
+            cmd.arg("--");
+            cmd.arg(program);
+            cmd.args(args);
+            cmd
+        } else {
+            panic!(
+                "BUG: ENABLE_UNSHARE_PID is true but UNSHARE_PATH is None. \
+                This should have been caught at worker startup."
+            );
+        }
+    } else {
+        let mut cmd = Command::new(program);
+        cmd.args(args);
+        cmd
+    }
+}
+
 pub async fn start_child_process(
     cmd: Command,
     executable: &str,
diff --git a/backend/windmill-worker/src/csharp_executor.rs b/backend/windmill-worker/src/csharp_executor.rs
index 51bdf2f8e8..d5a91ab61e 100644
--- a/backend/windmill-worker/src/csharp_executor.rs
+++ b/backend/windmill-worker/src/csharp_executor.rs
@@ -27,12 +27,12 @@ use windmill_queue::CanceledBy;
 #[cfg(feature = "csharp")]
 use crate::{
     common::{
-        check_executor_binary_exists, create_args_and_out_file, get_reserved_variables,
-        read_result, start_child_process,
+        build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file,
+        get_reserved_variables, read_result, start_child_process,
     },
     handle_child::handle_child,
-    CSHARP_CACHE_DIR, DISABLE_NSJAIL, DISABLE_NUSER, DOTNET_PATH, HOME_ENV, NSJAIL_PATH,
-    NUGET_CONFIG, PATH_ENV, TZ_ENV,
+    CSHARP_CACHE_DIR, DISABLE_NSJAIL, DISABLE_NUSER, DOTNET_PATH, HOME_ENV,
+    NSJAIL_PATH, NUGET_CONFIG, PATH_ENV, TZ_ENV,
 };
 
 use crate::common::OccupancyMetrics;
@@ -588,7 +588,8 @@ pub async fn handle_csharp_job(
         } else {
             format!("{job_dir}/Main.exe")
         };
-        let mut run_csharp = Command::new(&compiled_executable_name);
+
+        let mut run_csharp = build_command_with_isolation(&compiled_executable_name, &[]);
         run_csharp
             .current_dir(job_dir)
             .env_clear()
diff --git a/backend/windmill-worker/src/deno_executor.rs b/backend/windmill-worker/src/deno_executor.rs
index cda1f78fdc..332cd142db 100644
--- a/backend/windmill-worker/src/deno_executor.rs
+++ b/backend/windmill-worker/src/deno_executor.rs
@@ -7,7 +7,7 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        create_args_and_out_file, get_reserved_variables, parse_npm_config, read_file, read_result,
+        build_command_with_isolation, create_args_and_out_file, get_reserved_variables, parse_npm_config, read_file, read_result,
         start_child_process, OccupancyMetrics, StreamNotifier,
     },
     handle_child::handle_child,
@@ -406,14 +406,17 @@ try {{
             args.push("-A");
         }
         args.push(&script_path);
-        let mut deno_cmd = Command::new(DENO_PATH.as_str());
+
+        let mut deno_cmd = build_command_with_isolation(
+            DENO_PATH.as_str(),
+            &args.iter().map(|s| s.as_ref()).collect::<Vec<&str>>(),
+        );
         deno_cmd
             .current_dir(job_dir)
             .env_clear()
             .envs(envs)
             .envs(reserved_variables)
             .envs(common_deno_proc_envs)
-            .args(args)
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
@@ -589,7 +592,7 @@ BigInt.prototype.toJSON = function () {{
 
 {dates}
 
-console.log('start\n'); 
+console.log('start\n');
 
 const decoder = new TextDecoder();
 for await (const chunk of Deno.stdin.readable) {{
@@ -601,7 +604,7 @@ for await (const chunk of Deno.stdin.readable) {{
             break;
         }}
         try {{
-            let {{ {spread} }} = JSON.parse(line) 
+            let {{ {spread} }} = JSON.parse(line)
             {dates}
             let res: any = await main(...[ {spread} ]);
             console.log("wm_res[success]:" + JSON.stringify(res ?? null, (key, value) => typeof value === 'undefined' ? null : value) + '\n');
diff --git a/backend/windmill-worker/src/go_executor.rs b/backend/windmill-worker/src/go_executor.rs
index 0409ceba95..bf3957c430 100644
--- a/backend/windmill-worker/src/go_executor.rs
+++ b/backend/windmill-worker/src/go_executor.rs
@@ -19,7 +19,7 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        capitalize, create_args_and_out_file, get_reserved_variables, read_result,
+        build_command_with_isolation, capitalize, create_args_and_out_file, get_reserved_variables, read_result,
         start_child_process, OccupancyMetrics,
     },
     handle_child::handle_child,
@@ -371,10 +371,7 @@ func Run(req Req) (interface{{}}, error){{
         #[cfg(windows)]
         let compiled_executable_name = format!("{}/main.exe", job_dir);
 
-        #[cfg(unix)]
-        let mut run_go = Command::new(&compiled_executable_name);
-        #[cfg(windows)]
-        let mut run_go = Command::new(&compiled_executable_name);
+        let mut run_go = build_command_with_isolation(&compiled_executable_name, &[]);
 
         run_go
             .current_dir(job_dir)
diff --git a/backend/windmill-worker/src/java_executor.rs b/backend/windmill-worker/src/java_executor.rs
index 92ef69da16..b553b9eff1 100644
--- a/backend/windmill-worker/src/java_executor.rs
+++ b/backend/windmill-worker/src/java_executor.rs
@@ -21,13 +21,13 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        create_args_and_out_file, get_reserved_variables, read_result, start_child_process,
-        OccupancyMetrics,
+        build_command_with_isolation, create_args_and_out_file, get_reserved_variables,
+        read_result, start_child_process, OccupancyMetrics,
     },
     handle_child,
     universal_pkg_installer::{par_install_language_dependencies_all_at_once, RequiredDependency},
-    COURSIER_CACHE_DIR, DISABLE_NSJAIL, DISABLE_NUSER, JAVA_CACHE_DIR, JAVA_REPOSITORY_DIR,
-    MAVEN_REPOS, NO_DEFAULT_MAVEN, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
+    COURSIER_CACHE_DIR, DISABLE_NSJAIL, DISABLE_NUSER, JAVA_CACHE_DIR,
+    JAVA_REPOSITORY_DIR, MAVEN_REPOS, NO_DEFAULT_MAVEN, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
 };
 use windmill_common::client::AuthedClient;
 
@@ -653,11 +653,13 @@ async fn run<'a>(
         )
         .await;
 
-        let mut cmd = Command::new(if cfg!(windows) {
+        let java_executable = if cfg!(windows) {
             "java"
         } else {
             JAVA_PATH.as_str()
-        });
+        };
+
+        let mut cmd = build_command_with_isolation(java_executable, &[]);
         cmd.env_clear()
             .current_dir(job_dir.to_owned())
             .env("PATH", PATH_ENV.as_str())
@@ -703,7 +705,7 @@ async fn run<'a>(
                     std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
                 );
         }
-        start_child_process(cmd, "java", false).await?
+        start_child_process(cmd, java_executable, false).await?
     };
     handle_child::handle_child(
         &job.id,
@@ -836,7 +838,7 @@ fn wrap(inner_content: &str) -> Result<String, Error> {
         })
         .collect_vec()
         .join(" ");
-    Ok(r#"    
+    Ok(r#"
 package net.script;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import java.io.FileInputStream;
diff --git a/backend/windmill-worker/src/nu_executor.rs b/backend/windmill-worker/src/nu_executor.rs
index 2497757d9d..917c5333ee 100644
--- a/backend/windmill-worker/src/nu_executor.rs
+++ b/backend/windmill-worker/src/nu_executor.rs
@@ -13,10 +13,11 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        create_args_and_out_file, get_reserved_variables, read_result, start_child_process,
-        OccupancyMetrics,
+        build_command_with_isolation, create_args_and_out_file, get_reserved_variables,
+        read_result, start_child_process, OccupancyMetrics,
     },
-    handle_child, DISABLE_NSJAIL, DISABLE_NUSER, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
+    handle_child, DISABLE_NSJAIL, DISABLE_NUSER, NSJAIL_PATH, PATH_ENV,
+    PROXY_ENVS,
 };
 use windmill_common::client::AuthedClient;
 
@@ -181,7 +182,7 @@ fn wrap(inner_content: &str) -> Result<String, Error> {
         .collect_vec()
         .join(" ");
     Ok(
-        r#"    
+        r#"
 $env.config.table.mode = 'basic'
 
 def nullguard [ name: string ] {
@@ -194,11 +195,11 @@ def nullguard [ name: string ] {
 # TODO: Probably needs rework in order for LSP to work
 def get_variable [ pat ] {
     let addr = $"($env.BASE_INTERNAL_URL)/api/w/($env.WM_WORKSPACE)/variables/get_value/($pat)" ;
-    http get -H ["Authorization", $"Bearer ($env.WM_TOKEN)"] $addr | return $in 
+    http get -H ["Authorization", $"Bearer ($env.WM_TOKEN)"] $addr | return $in
 }
 def get_resource [ pat ] {
     let addr = $"($env.BASE_INTERNAL_URL)/api/w/($env.WM_WORKSPACE)/resources/get_value_interpolated/($pat)" ;
-    http get -H ["Authorization", $"Bearer ($env.WM_TOKEN)"] $addr | return $in 
+    http get -H ["Authorization", $"Bearer ($env.WM_TOKEN)"] $addr | return $in
 }
 
 def 'main --wrapped' [] {
@@ -285,11 +286,14 @@ async fn run<'a>(
         // let plugin_registry = format!("{job_dir}/plugin-registry");
         // File::create(&plugin_registry).await?;
         //
-        let mut cmd = Command::new(if cfg!(windows) {
+        let nu_executable = if cfg!(windows) {
             "nu"
         } else {
             NU_PATH.as_str()
-        });
+        };
+
+        let args = vec!["main.nu", "--wrapped"];
+        let mut cmd = build_command_with_isolation(nu_executable, &args);
         cmd.env_clear()
             .current_dir(job_dir.to_owned())
             .env("PATH", PATH_ENV.as_str())
@@ -297,20 +301,16 @@ async fn run<'a>(
             .envs(envs)
             .envs(reserved_variables)
             .envs(PROXY_ENVS.clone())
-            .args(&[
-                "main.nu",
-                "--wrapped",
-                // TODO(v1):
-                // "--plugins",
-                // &format!(
-                //     "[{}]",
-                //     plugins
-                //         .into_iter()
-                //         .map(|pl| format!("{NU_CACHE_DIR}/plugins/bin/nu_plugin_{pl}"))
-                //         .collect_vec()
-                //         .join(",")
-                // ),
-            ])
+            // TODO(v1):
+            // "--plugins",
+            // &format!(
+            //     "[{}]",
+            //     plugins
+            //         .into_iter()
+            //         .map(|pl| format!("{NU_CACHE_DIR}/plugins/bin/nu_plugin_{pl}"))
+            //         .collect_vec()
+            //         .join(",")
+            // ),
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
@@ -324,7 +324,7 @@ async fn run<'a>(
                     std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
                 );
         }
-        start_child_process(cmd, "nu", false).await?
+        start_child_process(cmd, nu_executable, false).await?
     };
     handle_child::handle_child(
         &job.id,
diff --git a/backend/windmill-worker/src/php_executor.rs b/backend/windmill-worker/src/php_executor.rs
index b272d631da..4ead742f63 100644
--- a/backend/windmill-worker/src/php_executor.rs
+++ b/backend/windmill-worker/src/php_executor.rs
@@ -16,11 +16,12 @@ use windmill_queue::{append_logs, CanceledBy};
 
 use crate::{
     common::{
-        check_executor_binary_exists, create_args_and_out_file, get_reserved_variables,
-        read_result, start_child_process, OccupancyMetrics,
+        build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file,
+        get_reserved_variables, read_result, start_child_process, OccupancyMetrics,
     },
     handle_child::handle_child,
-    COMPOSER_CACHE_DIR, COMPOSER_PATH, DISABLE_NSJAIL, DISABLE_NUSER, NSJAIL_PATH, PHP_PATH,
+    COMPOSER_CACHE_DIR, COMPOSER_PATH, DISABLE_NSJAIL, DISABLE_NUSER,
+    NSJAIL_PATH, PHP_PATH,
 };
 use windmill_common::client::AuthedClient;
 
@@ -309,25 +310,22 @@ try {{
             .stderr(Stdio::piped());
         start_child_process(nsjail_cmd, NSJAIL_PATH.as_str(), false).await?
     } else {
-        let cmd = {
-            let script_path = format!("{job_dir}/wrapper.php");
+        let script_path = format!("{job_dir}/wrapper.php");
+        let args = vec![script_path.as_str()];
 
-            let mut php_cmd = Command::new(&*PHP_PATH);
-            let args = vec![&script_path];
-            php_cmd
-                .current_dir(job_dir)
-                .env_clear()
-                .envs(envs)
-                .envs(reserved_variables)
-                .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
-                .env("BASE_INTERNAL_URL", base_internal_url)
-                .args(args)
-                .stdin(Stdio::null())
-                .stdout(Stdio::piped())
-                .stderr(Stdio::piped());
-            php_cmd
-        };
-        start_child_process(cmd, &*PHP_PATH, false).await?
+        let mut php_cmd = build_command_with_isolation(&*PHP_PATH, &args);
+        php_cmd
+            .current_dir(job_dir)
+            .env_clear()
+            .envs(envs)
+            .envs(reserved_variables)
+            .env("COMPOSER_HOME", &*COMPOSER_CACHE_DIR)
+            .env("BASE_INTERNAL_URL", base_internal_url)
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped());
+
+        start_child_process(php_cmd, &*PHP_PATH, false).await?
     };
 
     handle_child(
diff --git a/backend/windmill-worker/src/pwsh_executor.rs b/backend/windmill-worker/src/pwsh_executor.rs
index 5c2b6f2e0a..b2a81234a3 100644
--- a/backend/windmill-worker/src/pwsh_executor.rs
+++ b/backend/windmill-worker/src/pwsh_executor.rs
@@ -23,12 +23,13 @@ lazy_static::lazy_static! {
 
 use crate::{
     common::{
-        build_args_map, get_reserved_variables, read_file, read_file_content, start_child_process,
-        OccupancyMetrics,
+        build_args_map, build_command_with_isolation, get_reserved_variables, read_file,
+        read_file_content, start_child_process, OccupancyMetrics,
     },
     handle_child::handle_child,
-    DISABLE_NSJAIL, DISABLE_NUSER, HOME_ENV, NSJAIL_PATH, PATH_ENV, POWERSHELL_CACHE_DIR,
-    POWERSHELL_PATH, POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL, PROXY_ENVS, TZ_ENV,
+    DISABLE_NSJAIL, DISABLE_NUSER, HOME_ENV, NSJAIL_PATH, PATH_ENV,
+    POWERSHELL_CACHE_DIR, POWERSHELL_PATH, POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL, PROXY_ENVS,
+    TZ_ENV,
 };
 
 fn val_to_pwsh_param(v: serde_json::Value) -> String {
@@ -81,14 +82,14 @@ $credentials = $null
 if ($hasPrivateRepo) {
     $repoName = "windmill-private-$jobId"
     $repoUri = "$privateRepoUrl"
-    
+
     # Create PSCredential for authentication
     $username = "token"
     $patToken = ConvertTo-SecureString $privateRepoPat -AsPlainText -Force
     $credentials = New-Object System.Management.Automation.PSCredential($username, $patToken)
-    
+
     Write-Host "Registering temporary repository: $repoName"
-    
+
     # Remove repository if it already exists
     Unregister-PSResourceRepository -Name $repoName -ErrorAction SilentlyContinue
     Register-PSResourceRepository -Name $repoName -Uri $repoUri -Trusted
@@ -99,7 +100,7 @@ try {
     foreach ($moduleRequest in $moduleRequests) {
         $moduleName = $moduleRequest.Name
         $requiredVersion = $moduleRequest.Version
-        
+
         # Check if module is already installed with the required version (case-insensitive)
         $isInstalled = $false
         if ($requiredVersion) {
@@ -107,32 +108,32 @@ try {
         } else {
             $isInstalled = $availableModules | Where-Object { $_.Name -eq $moduleName }
         }
-        
+
         if (-not $isInstalled) {
             $moduleFound = $false
-            
+
             # First try private repository if configured
             if ($hasPrivateRepo) {
                 $findParams = @{ Name = $moduleName; Repository = $repoName; ErrorAction = 'SilentlyContinue'; Credential = $credentials }
                 if ($requiredVersion) { $findParams.Version = $requiredVersion }
-                
+
                 $privateModule = Find-PSResource @findParams
                 if ($privateModule) {
                     $moduleFound = $true
                     $versionInfo = if ($requiredVersion) { " version $requiredVersion" } else { "" }
                     Write-Host "Found module $moduleName$versionInfo in private repository, installing from there..."
-                    
+
                     $saveParams = @{ Name = $moduleName; Path = $path; Repository = $repoName; Credential = $credentials }
                     if ($requiredVersion) { $saveParams.Version = $requiredVersion }
                     Save-PSResource @saveParams
                 }
             }
-            
+
             # If not found in private repo (or no private repo configured), try all repositories
             if (-not $moduleFound) {
                 $versionInfo = if ($requiredVersion) { " version $requiredVersion" } else { "" }
                 Write-Host "Installing module $moduleName$versionInfo from public repositories..."
-                
+
                 $saveParams = @{ Name = $moduleName; Path = $path; TrustRepository = $true }
                 if ($requiredVersion) { $saveParams.Version = $requiredVersion }
                 Save-PSResource @saveParams
@@ -526,7 +527,6 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
 
         start_child_process(cmd, NSJAIL_PATH.as_str(), false).await?
     } else {
-        let mut cmd = Command::new(POWERSHELL_PATH.as_str());
         let cmd_args;
 
         #[cfg(unix)]
@@ -539,6 +539,8 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
             cmd_args = vec![r".\wrapper.ps1"];
         }
 
+        let mut cmd = build_command_with_isolation(POWERSHELL_PATH.as_str(), &cmd_args);
+
         cmd.current_dir(job_dir)
             .env_clear()
             .envs(envs)
@@ -547,7 +549,6 @@ $env:PSModulePath = \"{};$PSModulePathBackup\"",
             .env("PATH", PATH_ENV.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
-            .args(&cmd_args)
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
diff --git a/backend/windmill-worker/src/python_executor.rs b/backend/windmill-worker/src/python_executor.rs
index 7ae80a97b6..bc84a2e19f 100644
--- a/backend/windmill-worker/src/python_executor.rs
+++ b/backend/windmill-worker/src/python_executor.rs
@@ -120,7 +120,7 @@ use windmill_common::s3_helpers::OBJECT_STORE_SETTINGS;
 
 use crate::{
     common::{
-        create_args_and_out_file, get_reserved_variables, read_file, read_result,
+        build_command_with_isolation, create_args_and_out_file, get_reserved_variables, read_file, read_result,
         start_child_process, OccupancyMetrics, StreamNotifier,
     },
     handle_child::handle_child,
@@ -835,9 +835,12 @@ mount {{
             .stderr(Stdio::piped());
         start_child_process(nsjail_cmd, NSJAIL_PATH.as_str(), false).await?
     } else {
-        let mut python_cmd = Command::new(&python_path);
-
         let args = vec!["-u", "-m", "wrapper"];
+
+        let mut python_cmd = build_command_with_isolation(
+            &python_path,
+            &args,
+        );
         python_cmd
             .current_dir(job_dir)
             .env_clear()
@@ -847,7 +850,6 @@ mount {{
             .env("TZ", TZ_ENV.as_str())
             .env("BASE_INTERNAL_URL", base_internal_url)
             .env("HOME", HOME_ENV.as_str())
-            .args(args)
             .stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
diff --git a/backend/windmill-worker/src/ruby_executor.rs b/backend/windmill-worker/src/ruby_executor.rs
index cd25663889..0039e6e8c2 100644
--- a/backend/windmill-worker/src/ruby_executor.rs
+++ b/backend/windmill-worker/src/ruby_executor.rs
@@ -23,12 +23,13 @@ use windmill_queue::{append_logs, CanceledBy, MiniPulledJob};
 
 use crate::{
     common::{
-        create_args_and_out_file, get_reserved_variables, read_result, start_child_process,
-        OccupancyMetrics,
+        build_command_with_isolation, create_args_and_out_file, get_reserved_variables,
+        read_result, start_child_process, OccupancyMetrics,
     },
     handle_child::{self},
     universal_pkg_installer::{par_install_language_dependencies_seq, RequiredDependency},
-    DISABLE_NSJAIL, DISABLE_NUSER, NSJAIL_PATH, PATH_ENV, PROXY_ENVS, RUBY_CACHE_DIR, RUBY_REPOS,
+    DISABLE_NSJAIL, DISABLE_NUSER, NSJAIL_PATH, PATH_ENV, PROXY_ENVS,
+    RUBY_CACHE_DIR, RUBY_REPOS,
 };
 lazy_static::lazy_static! {
     static ref RUBY_CONCURRENT_DOWNLOADS: usize = std::env::var("RUBY_CONCURRENT_DOWNLOADS").ok().map(|flag| flag.parse().unwrap_or(20)).unwrap_or(20);
@@ -140,7 +141,7 @@ pub async fn prepare<'a>(
         File::create(format!("{}/inline.rb", &mini_wm_path))
             .await?
             .write_all(&wrap(
-        r#"    
+        r#"
 class GemfileProxy
   def initialize
     @gem_calls = []
@@ -213,7 +214,7 @@ end
             .await?
             .write_all(
                 &wrap(
-                    r##"    
+                    r##"
 require 'net/http'
 require 'uri'
 require 'json'
@@ -223,17 +224,17 @@ def get_variable(path)
   base_url = ENV['BASE_INTERNAL_URL']
   workspace = ENV['WM_WORKSPACE']
   token = ENV['WM_TOKEN']
-  
+
   uri = URI("#{base_url}/api/w/#{workspace}/variables/get_value/#{path}")
-  
+
   http = Net::HTTP.new(uri.host, uri.port)
   http.use_ssl = uri.scheme == 'https'
-  
+
   request = Net::HTTP::Get.new(uri)
   request['Authorization'] = "Bearer #{token}"
-  
+
   response = http.request(request)
-  
+
   if response.code == '200'
     JSON.parse(response.body)
   else
@@ -245,17 +246,17 @@ def get_resource(path)
   base_url = ENV['BASE_INTERNAL_URL']
   workspace = ENV['WM_WORKSPACE']
   token = ENV['WM_TOKEN']
-  
+
   uri = URI("#{base_url}/api/w/#{workspace}/resources/get_value_interpolated/#{path}")
-  
+
   http = Net::HTTP.new(uri.host, uri.port)
   http.use_ssl = uri.scheme == 'https'
-  
+
   request = Net::HTTP::Get.new(uri)
   request['Authorization'] = "Bearer #{token}"
-  
+
   response = http.request(request)
-  
+
   if response.code == '200'
     JSON.parse(response.body)
   else
@@ -823,11 +824,14 @@ mount {{
         )
         .await;
 
-        let mut cmd = Command::new(if cfg!(windows) {
+        let ruby_executable = if cfg!(windows) {
             "ruby.exe"
         } else {
             RUBY_PATH.as_str()
-        });
+        };
+
+        let args = vec!["main.rb"];
+        let mut cmd = build_command_with_isolation(ruby_executable, &args);
 
         #[cfg(windows)]
         let rubylib = rubylib.replace(":", ";");
@@ -842,8 +846,7 @@ mount {{
             .envs(PROXY_ENVS.clone())
             .envs(envs);
 
-        cmd.args(&["main.rb"])
-            .stdin(Stdio::null())
+        cmd.stdin(Stdio::null())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped());
 
@@ -856,7 +859,7 @@ mount {{
                     std::env::var("TMP").unwrap_or_else(|_| String::from("/tmp")),
                 );
         }
-        start_child_process(cmd, "ruby", false).await?
+        start_child_process(cmd, ruby_executable, false).await?
     };
     handle_child::handle_child(
         &job.id,
diff --git a/backend/windmill-worker/src/rust_executor.rs b/backend/windmill-worker/src/rust_executor.rs
index 6a05de459c..c43a7d2d97 100644
--- a/backend/windmill-worker/src/rust_executor.rs
+++ b/backend/windmill-worker/src/rust_executor.rs
@@ -19,7 +19,7 @@ use windmill_queue::{append_logs, CanceledBy};
 
 use crate::{
     common::{
-        check_executor_binary_exists, create_args_and_out_file, get_reserved_variables,
+        build_command_with_isolation, check_executor_binary_exists, create_args_and_out_file, get_reserved_variables,
         read_result, start_child_process, OccupancyMetrics,
     },
     handle_child::handle_child,
@@ -567,7 +567,7 @@ pub async fn handle_rust_job(
         start_child_process(nsjail_cmd, NSJAIL_PATH.as_str(), false).await?
     } else {
         let compiled_executable_name = "./main";
-        let mut run_rust = Command::new(compiled_executable_name);
+        let mut run_rust = build_command_with_isolation(compiled_executable_name, &[]);
         run_rust
             .current_dir(job_dir)
             .env_clear()
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index e58d521a5d..9b47aa5113 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -303,6 +303,128 @@ lazy_static::lazy_static! {
         .and_then(|x| x.parse::<bool>().ok())
         .unwrap_or(true);
 
+    pub static ref ENABLE_UNSHARE_PID: bool = std::env::var("ENABLE_UNSHARE_PID")
+        .ok()
+        .and_then(|x| x.parse::<bool>().ok())
+        .unwrap_or(false);
+
+    pub static ref UNSHARE_ISOLATION_FLAGS: String = {
+        std::env::var("UNSHARE_ISOLATION_FLAGS")
+            .unwrap_or_else(|_| "--user --map-root-user --pid --fork --mount-proc".to_string())
+    };
+
+    pub static ref UNSHARE_PATH: Option<String> = {
+        let flags = UNSHARE_ISOLATION_FLAGS.as_str();
+        let mut test_cmd_args: Vec<&str> = flags.split_whitespace().collect();
+        test_cmd_args.push("--");
+        test_cmd_args.push("true");
+
+        let test_result = std::process::Command::new("unshare")
+            .args(&test_cmd_args)
+            .output();
+
+        match test_result {
+            Ok(output) if output.status.success() => {
+                tracing::info!("PID namespace isolation enabled. Flags: {}", flags);
+                Some("unshare".to_string())
+            },
+            Ok(output) => {
+                let stderr = String::from_utf8_lossy(&output.stderr);
+
+                if *ENABLE_UNSHARE_PID {
+                    panic!(
+                        "ENABLE_UNSHARE_PID is set but unshare test failed.\n\
+                        Error: {}\n\
+                        Flags: {}\n\
+                        \n\
+                        Solutions:\n\
+                        • Check if user namespaces are enabled: 'sysctl kernel.unprivileged_userns_clone'\n\
+                        • For Docker: Requires 'privileged: true' in docker-compose for --mount-proc flag\n\
+                        • For Kubernetes: Requires 'privileged: true' in securityContext for --mount-proc flag\n\
+                        • Try different flags via UNSHARE_ISOLATION_FLAGS env var (remove --mount-proc if privileged mode not possible)\n\
+                        • Alternative: Use NSJAIL instead\n\
+                        • Disable: Set ENABLE_UNSHARE_PID=false",
+                        stderr.trim(),
+                        flags
+                    );
+                }
+
+                tracing::warn!(
+                    "unshare test failed: {}. Flags: {}. Set ENABLE_UNSHARE_PID=true to fail on error.",
+                    stderr.trim(),
+                    flags
+                );
+                None
+            },
+            Err(e) => {
+                if *ENABLE_UNSHARE_PID {
+                    if e.kind() == std::io::ErrorKind::NotFound {
+                        panic!(
+                            "ENABLE_UNSHARE_PID is set but unshare binary not found.\n\
+                            Install util-linux package or set ENABLE_UNSHARE_PID=false"
+                        );
+                    } else {
+                        panic!(
+                            "ENABLE_UNSHARE_PID is set but failed to test unshare: {}",
+                            e
+                        );
+                    }
+                }
+
+                if e.kind() == std::io::ErrorKind::NotFound {
+                    tracing::debug!("unshare binary not found");
+                } else {
+                    tracing::warn!("Failed to test unshare: {}", e);
+                }
+                None
+            }
+        }
+    };
+
+    pub static ref NSJAIL_AVAILABLE: Option<String> = {
+        if *DISABLE_NSJAIL {
+            None
+        } else {
+            let nsjail_path = NSJAIL_PATH.as_str();
+
+            let test_result = std::process::Command::new(nsjail_path)
+                .arg("--help")
+                .output();
+
+            match test_result {
+                Ok(output) if output.status.success() => {
+                    tracing::info!("NSJAIL sandboxing available at: {}", nsjail_path);
+                    Some(nsjail_path.to_string())
+                },
+                Ok(output) => {
+                    let stderr = String::from_utf8_lossy(&output.stderr);
+                    tracing::warn!(
+                        "nsjail test failed: {}. Jobs will run without nsjail sandboxing. \
+                        To enable nsjail: install nsjail binary or use windmill image with -nsjail suffix",
+                        stderr.trim()
+                    );
+                    None
+                },
+                Err(e) => {
+                    if e.kind() == std::io::ErrorKind::NotFound {
+                        tracing::warn!(
+                            "nsjail not found at '{}'. Jobs will run without nsjail sandboxing. \
+                            To enable nsjail: install nsjail binary or use windmill image with -nsjail suffix",
+                            nsjail_path
+                        );
+                    } else {
+                        tracing::warn!(
+                            "Failed to test nsjail at '{}': {}. Jobs will run without nsjail sandboxing.",
+                            nsjail_path,
+                            e
+                        );
+                    }
+                    None
+                }
+            }
+        }
+    };
+
     pub static ref KEEP_JOB_DIR: AtomicBool = AtomicBool::new(std::env::var("KEEP_JOB_DIR")
         .ok()
         .and_then(|x| x.parse::<bool>().ok())
@@ -981,6 +1103,19 @@ pub async fn run_worker(
         );
     }
 
+    // Force UNSHARE_PATH initialization now to fail-fast if unshare doesn't work
+    // This ensures we panic at startup rather than lazily when first accessed during job execution
+    if *ENABLE_UNSHARE_PID {
+        // Access UNSHARE_PATH to trigger lazy_static initialization and test
+        let _ = &*UNSHARE_PATH;
+
+        tracing::info!(
+            worker = %worker_name, hostname = %hostname,
+            "PID namespace isolation enabled via unshare with flags: {}",
+            UNSHARE_ISOLATION_FLAGS.as_str()
+        );
+    }
+
     let start_time = Instant::now();
 
     let worker_dir = format!("{TMP_DIR}/{worker_name}");
diff --git a/backend/windmill-worker/src/worker_utils.rs b/backend/windmill-worker/src/worker_utils.rs
index 366cc9cdf7..f105d8c415 100644
--- a/backend/windmill-worker/src/worker_utils.rs
+++ b/backend/windmill-worker/src/worker_utils.rs
@@ -143,6 +143,7 @@ async fn update_worker_ping_full_inner(
                         memory: memory,
                         memory_usage: get_worker_memory_usage(),
                         wm_memory_usage: get_windmill_memory_usage(),
+                        job_isolation: None,
                         ping_type: PingType::MainLoop,
                     },
                 )
@@ -171,6 +172,15 @@ pub async fn insert_ping(
     let vcpus = get_vcpus();
     let memory = get_memory();
 
+    // Determine job isolation method
+    let job_isolation = if crate::NSJAIL_AVAILABLE.is_some() {
+        Some("nsjail".to_string())
+    } else if *crate::ENABLE_UNSHARE_PID && crate::UNSHARE_PATH.is_some() {
+        Some("unshare".to_string())
+    } else {
+        Some("none".to_string())
+    };
+
     match db {
         Connection::Sql(db) => {
             insert_ping_query(
@@ -183,6 +193,7 @@ pub async fn insert_ping(
                 windmill_common::utils::GIT_VERSION,
                 vcpus,
                 memory,
+                job_isolation,
                 db,
             )
             .await?;
@@ -209,6 +220,7 @@ pub async fn insert_ping(
                         memory: memory,
                         memory_usage: get_worker_memory_usage(),
                         wm_memory_usage: get_windmill_memory_usage(),
+                        job_isolation,
                         ping_type: PingType::Initial,
                     },
                 )
@@ -231,6 +243,15 @@ pub async fn update_worker_ping_from_job(
     let occupancy_rate_15s = occupancy.as_ref().and_then(|x| x.occupancy_rate_15s);
     let occupancy_rate_5m = occupancy.as_ref().and_then(|x| x.occupancy_rate_5m);
     let occupancy_rate_30m = occupancy.as_ref().and_then(|x| x.occupancy_rate_30m);
+
+    let job_isolation = if crate::NSJAIL_AVAILABLE.is_some() {
+        Some("nsjail".to_string())
+    } else if *crate::ENABLE_UNSHARE_PID && crate::UNSHARE_PATH.is_some() {
+        Some("unshare".to_string())
+    } else {
+        Some("none".to_string())
+    };
+
     match conn.clone() {
         Connection::Sql(ref db) => {
             update_worker_ping_from_job_query(
@@ -243,6 +264,7 @@ pub async fn update_worker_ping_from_job(
                 occupancy_rate_15s,
                 occupancy_rate_5m,
                 occupancy_rate_30m,
+                job_isolation,
                 db,
             )
             .await?;
@@ -270,6 +292,7 @@ pub async fn update_worker_ping_from_job(
                         occupancy_rate_15s: occupancy_rate_15s,
                         occupancy_rate_5m: occupancy_rate_5m,
                         occupancy_rate_30m: occupancy_rate_30m,
+                        job_isolation,
                     },
                 )
                 .await?;
diff --git a/docker-compose.yml b/docker-compose.yml
index ea67377ffc..a6d96aaec9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -60,10 +60,16 @@ services:
           memory: 2048M
           # for GB, use syntax '2Gi'
     restart: unless-stopped
+    # Uncomment to enable PID namespace isolation (recommended for security)
+    # Requires privileged mode for --mount-proc flag
+    # See: https://www.windmill.dev/docs/advanced/security_isolation
+    # privileged: true
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - MODE=worker
       - WORKER_GROUP=default
+      # Uncomment to enable PID namespace isolation (requires privileged: true above)
+      # - ENABLE_UNSHARE_PID=true
     depends_on:
       db:
         condition: service_healthy
@@ -89,12 +95,18 @@ services:
           memory: 2048M
           # for GB, use syntax '2Gi'
     restart: unless-stopped
+    # Uncomment to enable PID namespace isolation (recommended for security)
+    # Requires privileged mode for --mount-proc flag
+    # See: https://www.windmill.dev/docs/advanced/security_isolation
+    # privileged: true
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - MODE=worker
       - WORKER_GROUP=native
       - NUM_WORKERS=8
       - SLEEP_QUEUE=200
+      # Uncomment to enable PID namespace isolation (requires privileged: true above)
+      # - ENABLE_UNSHARE_PID=true
     depends_on:
       db:
         condition: service_healthy
@@ -113,10 +125,16 @@ services:
   #         memory: 2048M
   #         # for GB, use syntax '2Gi'
   #   restart: unless-stopped
+  #   # Uncomment to enable PID namespace isolation (recommended for security)
+  #   # Requires privileged mode for --mount-proc flag
+  #   # See: https://www.windmill.dev/docs/advanced/security_isolation
+  #   # privileged: true
   #   environment:
   #     - DATABASE_URL=${DATABASE_URL}
   #     - MODE=worker
   #     - WORKER_GROUP=reports
+  #     # Uncomment to enable PID namespace isolation (requires privileged: true above)
+  #     # - ENABLE_UNSHARE_PID=true
   #   depends_on:
   #     db:
   #       condition: service_healthy
diff --git a/frontend/src/lib/components/WorkerGroup.svelte b/frontend/src/lib/components/WorkerGroup.svelte
index 4457f536c6..d22e8c8539 100644
--- a/frontend/src/lib/components/WorkerGroup.svelte
+++ b/frontend/src/lib/components/WorkerGroup.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
-	import { Copy, Plus, RefreshCcwIcon, Settings, Trash, X } from 'lucide-svelte'
-	import { Alert, Badge, Button, Drawer } from './common'
+	import { AlertTriangle, Copy, Plus, RefreshCcwIcon, Settings, Trash, X } from 'lucide-svelte'
+	import { Alert, Button, Drawer } from './common'
+	import Badge from './common/badge/Badge.svelte'
+	import Popover from './meltComponents/Popover.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import { ConfigService, WorkspaceService, type WorkerPing, type Workspace } from '$lib/gen'
@@ -40,6 +42,16 @@
 		return { vcpus, memory }
 	}
 
+	function hasWorkersWithoutIsolation(workers: [string, WorkerPing[]][]): boolean {
+		return workers.some(([_, pings]) => pings.some((w) => !w.job_isolation || w.job_isolation === 'none'))
+	}
+
+	function getWorkersWithoutIsolation(workers: [string, WorkerPing[]][]): WorkerPing[] {
+		return workers.flatMap(([_, pings]) =>
+			pings.filter((w) => !w.job_isolation || w.job_isolation === 'none')
+		)
+	}
+
 	let nconfig: {
 		dedicated_worker?: string
 		worker_tags?: string[]
@@ -896,90 +908,139 @@
 	</DrawerContent>
 </Drawer>
 
-<div class=" flex items-center justify-between pt-1">
-	<div class="text-xs"
-		>{pluralize(activeWorkers, 'worker')}
-		{#if vcpus_memory?.vcpus}
-			- {(vcpus_memory?.vcpus / 100000).toFixed(2)} vCPUs{/if}
-		{#if vcpus_memory?.memory}
-			- {((vcpus_memory?.memory * 1.0) / 1024 / 1024 / 1024).toFixed(2)} GB{/if}</div
-	>
-	<div class="flex gap-2 items-center justify-end flex-row my-2">
-		{#if $superadmin}
-			<Button
-				variant="subtle"
-				unifiedSize="md"
-				on:click={() => {
-					dirty = false
-					loadNConfig()
-					drawer?.openDrawer()
-				}}
-				startIcon={{ icon: config == undefined ? Plus : Settings }}
+<div class="flex flex-col gap-2">
+	{#if hasWorkersWithoutIsolation(workers)}
+		{@const unsafeWorkers = getWorkersWithoutIsolation(workers)}
+		<div class="flex justify-end">
+			<Popover
+				placement="bottom"
+				closeButton
+				containerClasses="border rounded-lg shadow-lg bg-surface"
 			>
-				<div class="flex flex-row gap-1 items-center">
-					{config == undefined ? 'Create' : 'Edit'} config
-				</div>
-			</Button>
+				{#snippet trigger()}
+					<Button
+						nonCaptureEvent
+						startIcon={{ icon: AlertTriangle, classes: 'text-yellow-600' }}
+						unifiedSize="md"
+						variant="subtle"
+						btnClasses="text-3xs"
+					>
+						Workers without isolation
+					</Button>
+				{/snippet}
+				{#snippet content()}
+					<div class="flex flex-col gap-2 text-sm max-w-md p-4">
+						<div class="font-semibold">Workers without job isolation</div>
+						<p class="text-secondary">
+							{unsafeWorkers.length}
+							{unsafeWorkers.length === 1 ? 'worker' : 'workers'} in this group
+							{unsafeWorkers.length === 1 ? 'is' : 'are'} running without job isolation (nsjail/unshare).
+						</p>
+						<div class="flex flex-wrap gap-1">
+							{#each unsafeWorkers as worker}
+								<Badge color="orange" verySmall={true}>
+									{worker.worker}
+								</Badge>
+							{/each}
+						</div>
+						<a
+							href="https://www.windmill.dev/docs/advanced/security_isolation"
+							target="_blank"
+							class="text-blue-600 hover:underline text-xs"
+						>
+							Learn more about job isolation →
+						</a>
+					</div>
+				{/snippet}
+			</Popover>
+		</div>
+	{/if}
 
-			<Button
-				unifiedSize="md"
-				variant="subtle"
-				on:click={() => {
-					navigator.clipboard.writeText(
-						YAML.stringify({
-							name,
-							...config
-						})
-					)
-					sendUserToast('Worker config copied to clipboard as YAML')
-				}}
-				startIcon={{ icon: Copy }}
-			>
-				Copy config
-			</Button>
+	<div class="flex items-center justify-between">
+		<div class="text-xs"
+			>{pluralize(activeWorkers, 'worker')}
+			{#if vcpus_memory?.vcpus}
+				- {(vcpus_memory?.vcpus / 100000).toFixed(2)} vCPUs{/if}
+			{#if vcpus_memory?.memory}
+				- {((vcpus_memory?.memory * 1.0) / 1024 / 1024 / 1024).toFixed(2)} GB{/if}</div
+		>
+		<div class="flex gap-2 items-center justify-end flex-row">
+			{#if $superadmin}
+				<Button
+					variant="subtle"
+					unifiedSize="md"
+					on:click={() => {
+						dirty = false
+						loadNConfig()
+						drawer?.openDrawer()
+					}}
+					startIcon={{ icon: config == undefined ? Plus : Settings }}
+				>
+					<div class="flex flex-row gap-1 items-center">
+						{config == undefined ? 'Create' : 'Edit'} config
+					</div>
+				</Button>
 
-			{#if config}
 				<Button
 					unifiedSize="md"
 					variant="subtle"
 					on:click={() => {
-						if (!$enterpriseLicense) {
-							sendUserToast('Worker Management UI is an EE feature', true)
-						} else {
-							openDelete = true
-						}
+						navigator.clipboard.writeText(
+							YAML.stringify({
+								name,
+								...config
+							})
+						)
+						sendUserToast('Worker config copied to clipboard as YAML')
 					}}
-					startIcon={{ icon: Trash }}
-					btnClasses="text-red-400"
+					startIcon={{ icon: Copy }}
 				>
-					Delete config
+					Copy config
+				</Button>
+
+				{#if config}
+					<Button
+						unifiedSize="md"
+						variant="subtle"
+						on:click={() => {
+							if (!$enterpriseLicense) {
+								sendUserToast('Worker Management UI is an EE feature', true)
+							} else {
+								openDelete = true
+							}
+						}}
+						startIcon={{ icon: Trash }}
+						btnClasses="text-red-400"
+					>
+						Delete config
+					</Button>
+				{/if}
+
+				<Button
+					unifiedSize="md"
+					variant="subtle"
+					on:click={() => {
+						loadNConfig()
+
+						openClean = true
+					}}
+					btnClasses="text-red-400"
+					startIcon={{ icon: RefreshCcwIcon }}
+				>
+					Clean cache
+				</Button>
+			{:else if config}
+				<Button
+					unifiedSize="md"
+					variant="accent"
+					on:click={() => {
+						loadNConfig()
+						drawer?.openDrawer()
+					}}
+				>
+					Config
 				</Button>
 			{/if}
-
-			<Button
-				unifiedSize="md"
-				variant="subtle"
-				on:click={() => {
-					loadNConfig()
-
-					openClean = true
-				}}
-				btnClasses="text-red-400"
-				startIcon={{ icon: RefreshCcwIcon }}
-			>
-				Clean cache
-			</Button>
-		{:else if config}
-			<Button
-				unifiedSize="md"
-				variant="accent"
-				on:click={() => {
-					loadNConfig()
-					drawer?.openDrawer()
-				}}
-			>
-				Config
-			</Button>
-		{/if}
+		</div>
 	</div>
 </div>
diff --git a/frontend/src/routes/(root)/(logged)/workers/+page.svelte b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
index adf2d6744c..4afc391e88 100644
--- a/frontend/src/routes/(root)/(logged)/workers/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/workers/+page.svelte
@@ -2,8 +2,8 @@
 	import AssignableTags from '$lib/components/AssignableTags.svelte'
 	import CenteredPage from '$lib/components/CenteredPage.svelte'
 	import { Alert, Button, Skeleton, Tab, Tabs } from '$lib/components/common'
-	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Badge from '$lib/components/common/badge/Badge.svelte'
+	import Popover from '$lib/components/meltComponents/Popover.svelte'
 	import Drawer from '$lib/components/common/drawer/Drawer.svelte'
 	import DrawerContent from '$lib/components/common/drawer/DrawerContent.svelte'
 	import DefaultTags from '$lib/components/DefaultTags.svelte'

From 58b9b9e330ea84dc9eb79ba7e5d8dea1a36ec09f Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 23:04:50 +0000
Subject: [PATCH 49/81] ee ref

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index ada9554f8a..4cf11331d0 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-6009dffc0e9549463e34d748ad54c401cbe46ffd
+b9c3a50e2f1bd49d08cd77e0ecacd2ab7b63cb94
\ No newline at end of file

From 5c79a35306855143428d0725519578aea0a746fd Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Wed, 19 Nov 2025 00:12:42 +0100
Subject: [PATCH 50/81] feat(aichat): use responses api for openai models
 (#7163)

* use responses api

* way cleaner

* fix non streaming

* fix metadatagen

* fix for azure

* remove deprecated

* fix listing

* fix
---
 backend/windmill-api/src/ai.rs                |  11 +-
 backend/windmill-common/src/ai_providers.rs   |  12 +-
 .../src/ai/providers/openai.rs                |   4 +-
 backend/windmill-worker/src/ai_executor.rs    |   6 +-
 frontend/package-lock.json                    |  10 +-
 frontend/package.json                         |   2 +-
 .../copilot/chat/AIChatManager.svelte.ts      |  14 +-
 .../copilot/chat/openai-responses.ts          | 366 ++++++++++++++++++
 frontend/src/lib/components/copilot/lib.ts    |  67 +---
 9 files changed, 411 insertions(+), 81 deletions(-)
 create mode 100644 frontend/src/lib/components/copilot/chat/openai-responses.ts

diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs
index 2df04beb7a..c9d4e69c5d 100644
--- a/backend/windmill-api/src/ai.rs
+++ b/backend/windmill-api/src/ai.rs
@@ -9,7 +9,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::value::RawValue;
 use std::collections::HashMap;
 use windmill_audit::{audit_oss::audit_log, ActionKind};
-use windmill_common::ai_providers::{AIProvider, ProviderConfig, ProviderModel, AZURE_API_VERSION};
+use windmill_common::ai_providers::{AIProvider, ProviderConfig, ProviderModel};
 use windmill_common::error::{to_anyhow, Error, Result};
 use windmill_common::utils::configure_client;
 use windmill_common::variables::get_variable_or_self;
@@ -202,9 +202,8 @@ impl AIRequestConfig {
             let bedrock_base_url = base_url.replace("bedrock-runtime.", "bedrock.");
             let bedrock_url = format!("{}/{}", bedrock_base_url, path);
             (bedrock_url, body)
-        } else if is_azure && method != Method::GET {
-            let model = AIProvider::extract_model_from_body(&body)?;
-            let azure_url = AIProvider::build_azure_openai_url(base_url, &model, path);
+        } else if is_azure {
+            let azure_url = AIProvider::build_azure_openai_url(base_url, path);
             (azure_url, body)
         } else if is_anthropic_sdk {
             let truncated_base_url = base_url.trim_end_matches("/v1");
@@ -229,10 +228,6 @@ impl AIRequestConfig {
 
         request = request.body(body);
 
-        if is_azure {
-            request = request.query(&[("api-version", AZURE_API_VERSION)])
-        }
-
         if let Some(api_key) = self.api_key {
             if is_azure {
                 request = request.header("api-key", api_key.clone())
diff --git a/backend/windmill-common/src/ai_providers.rs b/backend/windmill-common/src/ai_providers.rs
index 58d2e041e4..b8c1aaf8fe 100644
--- a/backend/windmill-common/src/ai_providers.rs
+++ b/backend/windmill-common/src/ai_providers.rs
@@ -10,7 +10,6 @@ lazy_static::lazy_static! {
     static ref OPENAI_AZURE_BASE_PATH: Option<String> = std::env::var("OPENAI_AZURE_BASE_PATH").ok();
 }
 
-pub const AZURE_API_VERSION: &str = "2025-04-01-preview";
 pub const OPENAI_BASE_URL: &str = "https://api.openai.com/v1";
 
 #[derive(Serialize, Deserialize, Debug, Eq, PartialEq, Hash, Clone)]
@@ -100,13 +99,12 @@ impl AIProvider {
     }
 
     /// Build Azure OpenAI URL with deployment model path
-    pub fn build_azure_openai_url(base_url: &str, model: &str, path: &str) -> String {
+    pub fn build_azure_openai_url(base_url: &str, path: &str) -> String {
         let base_url = base_url.trim_end_matches('/');
-
-        if base_url.ends_with("/deployments") {
-            format!("{}/{}/{}", base_url, model, path)
-        } else if base_url.ends_with("/openai") {
-            format!("{}/deployments/{}/{}", base_url, model, path)
+        if base_url.ends_with("/openai") {
+            format!("{}/v1/{}", base_url, path)
+        } else if base_url.ends_with("/deployments") {
+            format!("{}/v1/{}", base_url.trim_end_matches("/deployments"), path)
         } else {
             format!("{}/{}", base_url, path)
         }
diff --git a/backend/windmill-worker/src/ai/providers/openai.rs b/backend/windmill-worker/src/ai/providers/openai.rs
index 64a6e4a1b8..b3205b529a 100644
--- a/backend/windmill-worker/src/ai/providers/openai.rs
+++ b/backend/windmill-worker/src/ai/providers/openai.rs
@@ -351,7 +351,7 @@ impl QueryBuilder for OpenAIQueryBuilder {
     fn get_endpoint(
         &self,
         base_url: &str,
-        model: &str,
+        _model: &str,
         output_type: &OutputType,
         _stream: bool,
     ) -> String {
@@ -361,7 +361,7 @@ impl QueryBuilder for OpenAIQueryBuilder {
         };
 
         if self.provider_kind.is_azure_openai(base_url) {
-            AIProvider::build_azure_openai_url(base_url, model, path)
+            AIProvider::build_azure_openai_url(base_url, path)
         } else {
             format!("{}/{}", base_url, path)
         }
diff --git a/backend/windmill-worker/src/ai_executor.rs b/backend/windmill-worker/src/ai_executor.rs
index aff089b82b..d18e32e845 100644
--- a/backend/windmill-worker/src/ai_executor.rs
+++ b/backend/windmill-worker/src/ai_executor.rs
@@ -15,7 +15,7 @@ use std::{collections::HashMap, sync::Arc};
 use uuid::Uuid;
 use windmill_common::mcp_client::McpClient;
 use windmill_common::{
-    ai_providers::{AIProvider, AZURE_API_VERSION},
+    ai_providers::AIProvider,
     cache,
     client::AuthedClient,
     db::DB,
@@ -623,10 +623,6 @@ pub async fn run_agent(
                 request = request.header(header_name.as_str(), header_value.as_str());
             }
 
-            if args.provider.kind.is_azure_openai(&base_url) {
-                request = request.query(&[("api-version", AZURE_API_VERSION)])
-            }
-
             let resp = request
                 .body(request_body)
                 .send()
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 3aa6091a03..2b48dca6b7 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -55,7 +55,7 @@
 				"monaco-languageclient": "10.1.0",
 				"monaco-vim": "^0.4.1",
 				"ol": "^7.4.0",
-				"openai": "^5.16.0",
+				"openai": "^6.9.0",
 				"openapi-types": "^12.1.3",
 				"p-limit": "^6.1.0",
 				"panzoom": "^9.4.3",
@@ -9752,16 +9752,16 @@
 			}
 		},
 		"node_modules/openai": {
-			"version": "5.23.2",
-			"resolved": "https://registry.npmjs.org/openai/-/openai-5.23.2.tgz",
-			"integrity": "sha512-MQBzmTulj+MM5O8SKEk/gL8a7s5mktS9zUtAkU257WjvobGc9nKcBuVwjyEEcb9SI8a8Y2G/mzn3vm9n1Jlleg==",
+			"version": "6.9.0",
+			"resolved": "https://registry.npmjs.org/openai/-/openai-6.9.0.tgz",
+			"integrity": "sha512-n2sJRYmM+xfJ0l3OfH8eNnIyv3nQY7L08gZQu3dw6wSdfPtKAk92L83M2NIP5SS8Cl/bsBBG3yKzEOjkx0O+7A==",
 			"license": "Apache-2.0",
 			"bin": {
 				"openai": "bin/cli"
 			},
 			"peerDependencies": {
 				"ws": "^8.18.0",
-				"zod": "^3.23.8"
+				"zod": "^3.25 || ^4.0"
 			},
 			"peerDependenciesMeta": {
 				"ws": {
diff --git a/frontend/package.json b/frontend/package.json
index 2cafa2f164..5e923da228 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -120,7 +120,7 @@
 		"monaco-languageclient": "10.1.0",
 		"monaco-vim": "^0.4.1",
 		"ol": "^7.4.0",
-		"openai": "^5.16.0",
+		"openai": "^6.9.0",
 		"openapi-types": "^12.1.3",
 		"p-limit": "^6.1.0",
 		"panzoom": "^9.4.3",
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 53cd319d55..edeeed1af9 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -43,6 +43,7 @@ import type { Selection } from 'monaco-editor'
 import type AIChatInput from './AIChatInput.svelte'
 import { prepareApiSystemMessage, prepareApiUserMessage } from './api/core'
 import { getAnthropicCompletion, parseAnthropicCompletion } from './anthropic'
+import { getOpenAIResponsesCompletion, parseOpenAIResponsesCompletion } from './openai-responses'
 import type { ReviewChangesOpts } from './monaco-adapter'
 import { getCurrentModel, getCombinedCustomPrompt } from '$lib/aiStore'
 
@@ -407,9 +408,18 @@ class AIChatManager {
 				}
 
 				const model = getCurrentModel()
-				const completionFn = model.provider === 'anthropic' ? getAnthropicCompletion : getCompletion
+				const completionFn =
+					model.provider === 'anthropic'
+						? getAnthropicCompletion
+						: model.provider === 'openai' || model.provider === 'azure_openai'
+							? getOpenAIResponsesCompletion
+							: getCompletion
 				const parseFn =
-					model.provider === 'anthropic' ? parseAnthropicCompletion : parseOpenAICompletion
+					model.provider === 'anthropic'
+						? parseAnthropicCompletion
+						: model.provider === 'openai' || model.provider === 'azure_openai'
+							? parseOpenAIResponsesCompletion
+							: parseOpenAICompletion
 
 				const completion = await completionFn(
 					[systemMessage, ...messages, ...(pendingUserMessage ? [pendingUserMessage] : [])],
diff --git a/frontend/src/lib/components/copilot/chat/openai-responses.ts b/frontend/src/lib/components/copilot/chat/openai-responses.ts
new file mode 100644
index 0000000000..4229af0d16
--- /dev/null
+++ b/frontend/src/lib/components/copilot/chat/openai-responses.ts
@@ -0,0 +1,366 @@
+import OpenAI, { OpenAIError } from 'openai'
+import type {
+	ChatCompletionMessageParam,
+	ChatCompletionMessageFunctionToolCall,
+	ChatCompletionCreateParams
+} from 'openai/resources/index.mjs'
+import type { ResponseErrorEvent } from 'openai/resources/responses/responses.mjs'
+import { getProviderAndCompletionConfig, workspaceAIClients } from '../lib'
+import { processToolCall, type Tool, type ToolCallbacks } from './shared'
+import type { ResponseStream } from 'openai/lib/responses/ResponseStream.mjs'
+import { OpenAPI } from '$lib/gen'
+import type { AIProviderModel } from '$lib/gen'
+
+// Conversion utilities for Responses API
+function convertMessagesToResponsesInput(messages: ChatCompletionMessageParam[]): {
+	instructions?: string
+	input: Array<any>
+} {
+	const systemMessage = messages.find((m) => m.role === 'system')
+	const nonSystemMessages = messages.filter((m) => m.role !== 'system')
+
+	const input: Array<any> = []
+
+	for (const m of nonSystemMessages) {
+		// Handle assistant messages with tool calls
+		if (m.role === 'assistant' && 'tool_calls' in m && m.tool_calls) {
+			// First, add the assistant's text content if it exists
+			if ('content' in m && m.content) {
+				input.push({
+					type: 'message' as const,
+					role: 'assistant',
+					content: m.content
+				})
+			}
+
+			// Then add tool calls
+			for (const toolCall of m.tool_calls) {
+				if (toolCall.type === 'function') {
+					// Validate that required fields exist
+					if (!toolCall.function.name || toolCall.function.name.trim() === '') {
+						console.warn('Skipping tool call with empty name:', toolCall)
+						continue
+					}
+
+					input.push({
+						type: 'function_call',
+						call_id: toolCall.id,
+						name: toolCall.function.name,
+						arguments: toolCall.function.arguments
+					})
+				}
+			}
+		}
+		// Handle tool result messages
+		else if (m.role === 'tool' && 'content' in m && 'tool_call_id' in m) {
+			input.push({
+				type: 'function_call_output',
+				call_id: m.tool_call_id,
+				output: typeof m.content === 'string' ? m.content : JSON.stringify(m.content)
+			})
+		}
+		// Handle regular messages
+		else if ('content' in m && m.content !== null && m.content !== undefined) {
+			input.push({
+				type: 'message' as const,
+				role: m.role === 'developer' ? 'developer' : m.role === 'assistant' ? 'assistant' : 'user',
+				content: m.content
+			})
+		}
+	}
+
+	return {
+		instructions:
+			systemMessage && 'content' in systemMessage
+				? typeof systemMessage.content === 'string'
+					? systemMessage.content
+					: JSON.stringify(systemMessage.content)
+				: undefined,
+		input
+	}
+}
+
+function convertCompletionConfigToResponsesConfig(
+	config: ChatCompletionCreateParams
+): Record<string, any> {
+	const responsesConfig: Record<string, any> = {
+		model: config.model
+	}
+
+	// Map max_tokens or max_completion_tokens to max_output_tokens
+	if ('max_completion_tokens' in config && config.max_completion_tokens) {
+		responsesConfig.max_output_tokens = config.max_completion_tokens
+	} else if ('max_tokens' in config && config.max_tokens) {
+		responsesConfig.max_output_tokens = config.max_tokens
+	}
+
+	// Keep other relevant fields
+	if (config.temperature !== undefined) {
+		responsesConfig.temperature = config.temperature
+	}
+	if ('tools' in config && config.tools && config.tools.length > 0) {
+		responsesConfig.tools = config.tools.map((tool) => {
+			if (tool.type === 'function' && 'function' in tool) {
+				// Convert from Completions format to Responses format
+				return {
+					type: 'function',
+					name: tool.function.name,
+					description: tool.function.description,
+					parameters: tool.function.parameters,
+					strict: tool.function.strict ?? null
+				}
+			}
+			// Pass through other tool types unchanged
+			return tool
+		})
+	}
+
+	return responsesConfig
+}
+
+export async function getOpenAIResponsesCompletion(
+	messages: ChatCompletionMessageParam[],
+	abortController: AbortController,
+	tools?: OpenAI.Chat.Completions.ChatCompletionTool[]
+) {
+	const { provider, config } = getProviderAndCompletionConfig({ messages, stream: true, tools })
+	const { instructions, input } = convertMessagesToResponsesInput(messages)
+	const responsesConfig = convertCompletionConfigToResponsesConfig(config)
+
+	const openaiClient = workspaceAIClients.getOpenaiClient()
+
+	const runner = openaiClient.responses.stream(
+		{
+			...responsesConfig,
+			input,
+			...(instructions ? { instructions } : {})
+		},
+		{
+			signal: abortController.signal,
+			headers: {
+				'X-Provider': provider
+			}
+		}
+	)
+
+	return runner
+}
+
+// Wrapper that converts ResponseStream to ChatCompletionChunk format for lib.ts usage
+export async function* getOpenAIResponsesCompletionStream(
+	messages: ChatCompletionMessageParam[],
+	abortController: AbortController,
+	tools?: OpenAI.Chat.Completions.ChatCompletionTool[]
+): AsyncGenerator<OpenAI.Chat.Completions.ChatCompletionChunk> {
+	const { provider, config } = getProviderAndCompletionConfig({ messages, stream: true, tools })
+	const { instructions, input } = convertMessagesToResponsesInput(messages)
+	const responsesConfig = convertCompletionConfigToResponsesConfig(config)
+
+	const openaiClient = workspaceAIClients.getOpenaiClient()
+
+	const runner = openaiClient.responses.stream(
+		{
+			...responsesConfig,
+			input,
+			...(instructions ? { instructions } : {})
+		},
+		{
+			signal: abortController.signal,
+			headers: {
+				'X-Provider': provider
+			}
+		}
+	)
+
+	// Convert ResponseStream events to ChatCompletionChunk format
+	for await (const event of runner) {
+		if (event.type === 'response.output_text.delta') {
+			// Yield text chunks in ChatCompletionChunk format
+			yield {
+				id: 'chatcmpl-' + Date.now(),
+				object: 'chat.completion.chunk',
+				created: Date.now(),
+				model: responsesConfig.model,
+				choices: [
+					{
+						index: 0,
+						delta: {
+							content: event.delta || ''
+						},
+						finish_reason: null
+					}
+				]
+			} as OpenAI.Chat.Completions.ChatCompletionChunk
+		}
+	}
+}
+
+export async function parseOpenAIResponsesCompletion(
+	runner: ResponseStream,
+	callbacks: ToolCallbacks & {
+		onNewToken: (token: string) => void
+		onMessageEnd: () => void
+	},
+	messages: ChatCompletionMessageParam[],
+	addedMessages: ChatCompletionMessageParam[],
+	tools: Tool<any>[],
+	helpers: any
+): Promise<boolean> {
+	let toolCallsToProcess: ChatCompletionMessageFunctionToolCall[] = []
+	let error: OpenAIError | ResponseErrorEvent | null = null
+	let textContent = ''
+	let toolCallsMap: Record<string, { name: string; call_id: string }> = {}
+
+	// Handle text streaming
+	runner.on('response.output_text.delta', (event) => {
+		callbacks.onNewToken(event.delta)
+		textContent += event.delta
+	})
+
+	// Handle new output items (including function calls)
+	runner.on('response.output_item.added', (event) => {
+		const item = event.item
+		if (item.type === 'function_call' && item.id) {
+			toolCallsMap[item.id] = {
+				name: item.name,
+				call_id: item.call_id
+			}
+
+			// Show temporary loading state for the tool call
+			callbacks.onMessageEnd()
+			callbacks.setToolStatus(`${item.id}`, {
+				isLoading: true,
+				content: `Calling ${item.name} tool...`
+			})
+		}
+	})
+
+	// Handle function call arguments done
+	runner.on('response.function_call_arguments.done', (event) => {
+		// Retrieve tool call metadata from map
+		const metadata = toolCallsMap[event.item_id]
+		if (!metadata) {
+			console.error('Missing tool call metadata for:', event.item_id)
+			return
+		}
+
+		// Convert to OpenAI format for compatibility with existing tool processing
+		toolCallsToProcess.push({
+			id: event.item_id,
+			type: 'function' as const,
+			function: {
+				name: metadata.name,
+				arguments: event.arguments
+			}
+		})
+	})
+
+	// Handle errors
+	runner.on('error', (err: OpenAIError | ResponseErrorEvent) => {
+		console.error('OpenAI Responses stream error:', err)
+		error = err
+	})
+
+	// Wait for completion
+	await runner.done()
+
+	// Add text message if we got any text
+	if (textContent) {
+		const assistantMessage = { role: 'assistant' as const, content: textContent }
+		messages.push(assistantMessage)
+		addedMessages.push(assistantMessage)
+		callbacks.onMessageEnd()
+	}
+
+	if (error) {
+		throw error
+	}
+
+	// Process tool calls if any
+	if (toolCallsToProcess.length > 0) {
+		const assistantWithTools = {
+			role: 'assistant' as const,
+			tool_calls: toolCallsToProcess
+		}
+		messages.push(assistantWithTools)
+		addedMessages.push(assistantWithTools)
+
+		// Process each tool call
+		for (const toolCall of toolCallsToProcess) {
+			const messageToAdd = await processToolCall({
+				tools,
+				toolCall,
+				helpers,
+				toolCallbacks: callbacks
+			})
+			messages.push(messageToAdd)
+			addedMessages.push(messageToAdd)
+		}
+		return true // Continue the conversation loop
+	}
+
+	return false // End the conversation
+}
+
+export async function getNonStreamingOpenAIResponsesCompletion(
+	messages: ChatCompletionMessageParam[],
+	abortController: AbortController,
+	testOptions?: {
+		apiKey?: string
+		resourcePath?: string
+		forceModelProvider: AIProviderModel
+	}
+): Promise<string> {
+	const { provider, config } = getProviderAndCompletionConfig({
+		messages,
+		stream: false,
+		forceModelProvider: testOptions?.forceModelProvider
+	})
+
+	const { instructions, input } = convertMessagesToResponsesInput(messages)
+	const responsesConfig = convertCompletionConfigToResponsesConfig(config)
+
+	const fetchOptions: {
+		signal: AbortSignal
+		headers: Record<string, string>
+	} = {
+		signal: abortController.signal,
+		headers: {
+			'X-Provider': provider
+		}
+	}
+
+	if (testOptions?.resourcePath) {
+		fetchOptions.headers = {
+			...fetchOptions.headers,
+			'X-Resource-Path': testOptions.resourcePath
+		}
+	} else if (testOptions?.apiKey) {
+		fetchOptions.headers = {
+			...fetchOptions.headers,
+			'X-API-Key': testOptions.apiKey
+		}
+	}
+
+	const openaiClient = testOptions?.apiKey
+		? new OpenAI({
+				baseURL: `${location.origin}${OpenAPI.BASE}/ai/proxy`,
+				apiKey: 'fake-key',
+				defaultHeaders: {
+					Authorization: '' // a non empty string will be unable to access Windmill backend proxy
+				},
+				dangerouslyAllowBrowser: true
+			})
+		: workspaceAIClients.getOpenaiClient()
+
+	const response = await openaiClient.responses.create(
+		{
+			...responsesConfig,
+			input,
+			...(instructions ? { instructions } : {})
+		},
+		fetchOptions
+	)
+
+	return response.output_text || ''
+}
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 4914e538c5..3f2686765b 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -17,6 +17,10 @@ import { EDIT_CONFIG, FIX_CONFIG, GEN_CONFIG } from './prompts'
 import { formatResourceTypes } from './utils'
 import { z } from 'zod'
 import { processToolCall, type Tool, type ToolCallbacks } from './chat/shared'
+import {
+	getNonStreamingOpenAIResponsesCompletion,
+	getOpenAIResponsesCompletionStream
+} from './chat/openai-responses'
 import type { Stream } from 'openai/core/streaming.mjs'
 import { generateRandomString } from '$lib/utils'
 import { copilotInfo, getCurrentModel } from '$lib/aiStore'
@@ -225,8 +229,7 @@ export async function fetchAvailableModels(
 					.filter(
 						(m) =>
 							(m.id.startsWith('gpt-') || m.id.startsWith('o') || m.id.startsWith('codex')) &&
-							m.lifecycle_status !== 'deprecated' &&
-							(m.capabilities.completion || m.capabilities.chat_completion)
+							m.lifecycle_status !== 'deprecated'
 					)
 					.map((m) => m.id)
 					.sort(sortFunc(provider))
@@ -670,6 +673,11 @@ export async function getNonStreamingCompletion(
 		forceModelProvider: testOptions?.forceModelProvider
 	})
 
+	// Use Responses API for OpenAI and Azure OpenAI
+	if (provider === 'openai' || provider === 'azure_openai') {
+		return getNonStreamingOpenAIResponsesCompletion(messages, abortController, testOptions)
+	}
+
 	const fetchOptions: {
 		signal: AbortSignal
 		headers: Record<string, string>
@@ -789,6 +797,12 @@ export async function getCompletion(
 ): Promise<Stream<ChatCompletionChunk>> {
 	const { provider, config } = getProviderAndCompletionConfig({ messages, stream: true, tools })
 
+	// Use Responses API for OpenAI and Azure OpenAI
+	if (provider === 'openai' || provider === 'azure_openai') {
+		return getOpenAIResponsesCompletionStream(messages, abortController, tools) as any
+	}
+
+	// Use Completions API for other providers
 	const openaiClient = workspaceAIClients.getOpenaiClient()
 	const completion = openaiClient.chat.completions.create(config, {
 		signal: abortController.signal,
@@ -1020,52 +1034,3 @@ export async function copilot(
 
 	return code
 }
-
-function getStringEndDelta(prev: string, now: string) {
-	return now.slice(prev.length)
-}
-
-export async function deltaCodeCompletion(
-	messages: ChatCompletionMessageParam[],
-	generatedCodeDelta: Writable<string>,
-	abortController: AbortController
-) {
-	const completion = await getCompletion(messages, abortController)
-
-	let response = ''
-	let code = ''
-	let delta = ''
-	for await (const part of completion) {
-		response += getResponseFromEvent(part)
-		let match = response.match(/```[a-zA-Z]+\n([\s\S]*?)\n```/)
-
-		if (match) {
-			// if we have a full code block
-			delta = getStringEndDelta(code, match[1])
-			code = match[1]
-			generatedCodeDelta.set(delta)
-
-			break
-		}
-
-		// partial code block, keep going
-		match = response.match(/```[a-zA-Z]+\n([\s\S]*)/)
-
-		if (!match) {
-			continue
-		}
-
-		if (!match[1].endsWith('`')) {
-			// skip updating if possible that part of three ticks (end of code block)s
-			delta = getStringEndDelta(code, match[1])
-			generatedCodeDelta.set(delta)
-			code = match[1]
-		}
-	}
-
-	if (code.length === 0) {
-		throw new Error('No code block found')
-	}
-
-	return code
-}

From 04ddda1b5620b816b921aa003e95e4aa7bdedb5c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 18 Nov 2025 23:14:21 +0000
Subject: [PATCH 51/81] remove cli dead code

---
 cli/src/commands/sync/sync.ts | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index 429fbd6ebc..0c64a0d857 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -661,29 +661,6 @@ export async function elementsToMap(
   const map: { [key: string]: string } = {};
   const processedBasePaths = new Set<string>();
 
-  // First pass: collect all file paths to identify branch-specific files
-  const allPaths: string[] = [];
-  for await (const entry of readDirRecursiveWithIgnore(ignore, els)) {
-    if (!entry.isDirectory && !entry.ignored) {
-      allPaths.push(entry.path);
-    }
-  }
-
-  const branchSpecificExists = new Set<string>();
-
-  if (specificItems) {
-    const currentBranch = getCurrentGitBranch();
-    if (currentBranch) {
-      for (const path of allPaths) {
-        if (isCurrentBranchFile(path)) {
-          const basePath = fromBranchSpecificPath(path, currentBranch);
-          if (isSpecificItem(basePath, specificItems)) {
-            branchSpecificExists.add(basePath);
-          }
-        }
-      }
-    }
-  }
 
   for await (const entry of readDirRecursiveWithIgnore(ignore, els)) {
     if (entry.isDirectory || entry.ignored) continue;

From 83c0c54613e950640deb3c7b8fec3c6018ffbf3c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 01:12:46 +0100
Subject: [PATCH 52/81] chore(main): release 1.580.0 (#7169)

* chore(main): release 1.580.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  | 17 ++++++
 backend/Cargo.lock                            | 58 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 63 insertions(+), 46 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1fd328ff7a..ee09e12696 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,22 @@
 # Changelog
 
+## [1.580.0](https://github.com/windmill-labs/windmill/compare/v1.579.2...v1.580.0) (2025-11-18)
+
+
+### Features
+
+* **aichat:** use responses api for openai models ([#7163](https://github.com/windmill-labs/windmill/issues/7163)) ([5c79a35](https://github.com/windmill-labs/windmill/commit/5c79a35306855143428d0725519578aea0a746fd))
+* disabling/enabling email triggers ([#7171](https://github.com/windmill-labs/windmill/issues/7171)) ([8ae266b](https://github.com/windmill-labs/windmill/commit/8ae266b6a9ced16e1b7416cfc8bea5fe7a7af042))
+* **security:** unshare pid of worker job process ([#7106](https://github.com/windmill-labs/windmill/issues/7106)) ([5aa251a](https://github.com/windmill-labs/windmill/commit/5aa251a2d276cc9d27bf104f8e4f724ea6a28231))
+* support secondary promotion repos in git sync settings ([#7173](https://github.com/windmill-labs/windmill/issues/7173)) ([5548221](https://github.com/windmill-labs/windmill/commit/55482210921fe2eb0fd158abd4f7369495f2dfd7))
+
+
+### Bug Fixes
+
+* change uv tool dir from /root to /usr/local/uv ([c3e59fe](https://github.com/windmill-labs/windmill/commit/c3e59fe064fc3b9d4c05958eea54601ff3410899))
+* improve delete to handle ai chat ([f371fbe](https://github.com/windmill-labs/windmill/commit/f371fbeb9bb0946bd29a6413ee7ede75dedda5d9))
+* support IRSA for duckdb s3 proxy ([2058f27](https://github.com/windmill-labs/windmill/commit/2058f27e03468d45813f340b8563f935ca2142f4))
+
 ## [1.579.2](https://github.com/windmill-labs/windmill/compare/v1.579.1...v1.579.2) (2025-11-18)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 2ea6c7fb7b..ff91f7063b 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -10825,9 +10825,9 @@ dependencies = [
 
 [[package]]
 name = "resolv-conf"
-version = "0.7.5"
+version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b3789b30bd25ba102de4beabd95d21ac45b69b1be7d14522bab988c526d6799"
+checksum = "1e061d1b48cb8d38042de4ae0a7a6401009d6143dc80d2e2d6f31f0bdd6470c7"
 
 [[package]]
 name = "retry-policies"
@@ -15188,7 +15188,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15250,7 +15250,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15371,7 +15371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "regex",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15591,7 +15591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15615,7 +15615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15627,7 +15627,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15638,7 +15638,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15649,7 +15649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15661,7 +15661,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15715,7 +15715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15729,7 +15729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15795,7 +15795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15805,7 +15805,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.579.2"
+version = "1.580.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 6a5197d215..20470e42b0 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.579.2"
+version = "1.580.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.579.2"
+version = "1.580.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index e3d9404018..fac07d1abb 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.579.2
+  version: 1.580.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index f03e8dc8d8..14d0b8ce73 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.579.2";
+export const VERSION = "v1.580.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 2dd914a174..c98ad8a997 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.579.2";
+export const VERSION = "1.580.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 2b48dca6b7..047e89119d 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.579.2",
+	"version": "1.580.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.579.2",
+			"version": "1.580.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 5e923da228..344c843dcd 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.579.2",
+	"version": "1.580.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 83039a03a0..f4c670f6e5 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.579.2"
-wmill_pg = ">=1.579.2"
+wmill = ">=1.580.0"
+wmill_pg = ">=1.580.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 767ac52c39..63b52b9f74 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.579.2
+  version: 1.580.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index c9bf412999..f993af076d 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.579.2'
+    ModuleVersion     = '1.580.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 1176f685b3..056ef57769 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.579.2"
+version = "1.580.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 6eee2cdc7c..411f60ca58 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.579.2"
+version = "1.580.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index b2486f5590..f2e92959b3 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.579.2",
+  "version": "1.580.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 58620fb9f4..e4892ec746 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.579.2",
+  "version": "1.580.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 70d301e6a1..98470cba67 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.579.2
+1.580.0

From 4dfc8f5f9174964f4f54be14f1a83dfe5311cf1e Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 09:56:10 +0000
Subject: [PATCH 53/81] make s3 proxy work with IRSA

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 4cf11331d0..d1db15ef9f 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-b9c3a50e2f1bd49d08cd77e0ecacd2ab7b63cb94
\ No newline at end of file
+ec4e70822dbe7916177086390bc907dfc659ebdb
\ No newline at end of file

From 88ab5659e7b4b2c09b3f8c2b1db6653bc95987f3 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 10:18:02 +0000
Subject: [PATCH 54/81] disable duckdb temporarily

---
 .github/workflows/backend-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index 748f5add26..9e517927dc 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -86,4 +86,4 @@ jobs:
         run: |
           deno --version && bun -v && go version && python3 --version
           cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd ..
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,license,python,duckdb,rust,scoped_cache,private --all -- --nocapture
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,license,python,rust,scoped_cache,private --all -- --nocapture

From 350a1e7e70f790ffef91f66ddf98dbeca856b1bd Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 11:15:31 +0000
Subject: [PATCH 55/81] fix test

---
 .github/workflows/backend-test.yml                | 2 +-
 backend/windmill-duckdb-ffi-internal/build_dev.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/backend-test.yml b/.github/workflows/backend-test.yml
index 9e517927dc..43e8954c33 100644
--- a/.github/workflows/backend-test.yml
+++ b/.github/workflows/backend-test.yml
@@ -86,4 +86,4 @@ jobs:
         run: |
           deno --version && bun -v && go version && python3 --version
           cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd ..
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,license,python,rust,scoped_cache,private --all -- --nocapture
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,private --all -- --nocapture
diff --git a/backend/windmill-duckdb-ffi-internal/build_dev.sh b/backend/windmill-duckdb-ffi-internal/build_dev.sh
index 2530dcdceb..6d6a7f66c5 100755
--- a/backend/windmill-duckdb-ffi-internal/build_dev.sh
+++ b/backend/windmill-duckdb-ffi-internal/build_dev.sh
@@ -1,2 +1,2 @@
-CARGO_NET_GIT_FETCH_WITH_CLI=1 cargo build --release -p windmill_duckdb_ffi_internal
+CARGO_NET_GIT_FETCH_WITH_CLI=true cargo build --release -p windmill_duckdb_ffi_internal
 cp target/release/libwindmill_duckdb_ffi_internal.* ../target/debug/
\ No newline at end of file

From 95b168d665018b7894e8ac75223ffbd4c39d5f6b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 13:01:24 +0000
Subject: [PATCH 56/81] irsa 2nd attempt

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index d1db15ef9f..4056fdd46c 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-ec4e70822dbe7916177086390bc907dfc659ebdb
\ No newline at end of file
+0d55e7c20f15ae6f537fbe2a7b68ab227125c5f0
\ No newline at end of file

From 22cb3b011467fdcdfe1830e22e25df9688221fcb Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 14:23:44 +0000
Subject: [PATCH 57/81] irsa III

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 4056fdd46c..1e61a3e79f 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-0d55e7c20f15ae6f537fbe2a7b68ab227125c5f0
\ No newline at end of file
+0dd58ee6227a0c0fd6d44a680b95f71a179c9c9f
\ No newline at end of file

From 4ef47d4bdfd8ae8f4031758c052b707864206fc8 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 15:26:14 +0000
Subject: [PATCH 58/81] irsa 4

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 1e61a3e79f..eeaa99bcfe 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-0dd58ee6227a0c0fd6d44a680b95f71a179c9c9f
\ No newline at end of file
+5dd7ab7ce9e78e1b96ea78fd297da95d9b69e7a3
\ No newline at end of file

From 4eb494228a6aec7f7b0b093ab526c8e0d63cf933 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Wed, 19 Nov 2025 18:38:44 +0100
Subject: [PATCH 59/81] set context length for chat mode (#7180)

---
 .../components/flows/content/FlowInput.svelte | 39 +++++++++++++++++--
 1 file changed, 36 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/flows/content/FlowInput.svelte b/frontend/src/lib/components/flows/content/FlowInput.svelte
index 546412930a..aed8a0fa73 100644
--- a/frontend/src/lib/components/flows/content/FlowInput.svelte
+++ b/frontend/src/lib/components/flows/content/FlowInput.svelte
@@ -42,7 +42,7 @@
 	import CaptureTable from '$lib/components/triggers/CaptureTable.svelte'
 	import { isObjectTooBig, readFieldsRecursively } from '$lib/utils'
 	import { refreshStateStore } from '$lib/svelte5Utils.svelte'
-	import type { ScriptLang } from '$lib/gen'
+	import type { AiAgent, ScriptLang } from '$lib/gen'
 	import { deepEqual } from 'fast-equals'
 	import Toggle from '$lib/components/Toggle.svelte'
 	import { AI_AGENT_SCHEMA } from '../flowInfers'
@@ -429,8 +429,12 @@
 			},
 			required: ['user_message']
 		}
-		const hasAiAgent = flowStore.val.value.modules.some((m) => m.value.type === 'aiagent')
-		if (!hasAiAgent) {
+
+		// Find all AI agent modules
+		const aiAgentModules = flowStore.val.value.modules.filter((m) => m.value.type === 'aiagent')
+
+		if (aiAgentModules.length === 0) {
+			// No AI agent exists, create one with context memory set to 10
 			const aiAgentId = nextId(flowStateStore.val, flowStore.val)
 			flowStore.val.value.modules = [
 				...flowStore.val.value.modules,
@@ -442,6 +446,8 @@
 						input_transforms: Object.keys(AI_AGENT_SCHEMA.properties ?? {}).reduce((accu, key) => {
 							if (key === 'user_message') {
 								accu[key] = { type: 'javascript', expr: 'flow_input.user_message' }
+							} else if (key === 'messages_context_length') {
+								accu[key] = { type: 'static', value: 10 }
 							} else {
 								accu[key] = {
 									type: 'static',
@@ -453,7 +459,34 @@
 					}
 				}
 			]
+			sendUserToast(
+				'Chat mode enabled. AI agent created with user message input and context memory set to 10.',
+				false
+			)
+		} else if (aiAgentModules.length === 1) {
+			// Exactly one AI agent exists, configure it
+			const aiAgent = aiAgentModules[0]
+			const value = aiAgent.value as AiAgent
+
+			// Set user_message to flow_input.user_message
+			value.input_transforms['user_message'] = {
+				type: 'javascript',
+				expr: 'flow_input.user_message'
+			}
+
+			// Set messages_context_length to 10
+			value.input_transforms['messages_context_length'] = {
+				type: 'static',
+				value: 10
+			}
+
+			sendUserToast(
+				'Chat mode enabled. AI agent configured with user message input and context memory set to 10.',
+				false
+			)
 		}
+		// If there are multiple AI agents, don't auto-configure (ambiguous which one to configure)
+
 		showChatModeWarning = false
 	}
 </script>

From cfeb294308ba85763025f3628cbb85144d7f0778 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Wed, 19 Nov 2025 21:25:57 +0000
Subject: [PATCH 60/81] feat(frontend): add notes to flow (#6628)

* Add note component

* save note size and position

* move add note button up

* nit

* Add markdown support

* wip

* fix add sticky note button

* fix text update

* Add sticky note to saved flow data

* add note color picker

* Introduce node multiselect

* Add group notes

* Adapt layout to group node

* create a note manager class

* clean reactivity

* clean

* improve adaptive layout to group note

* modify layout based on cached text height

* fined grained graph rendering for notes

* separate noteManager into editor and render

* separate noteManager into editor and render

* create a note change observer

* render note node from context

* simplify note state managment

* show note in flow viewer

* clean dirty changes

* clean selection manager

* fix layout check

* improve bg surface select

* Handle z-index for stacked group notes

* clean selection manager

* exclude notes from rect select

* Allow switch between selection modes with keyboard keys

* improve selection box styling

* prevent dragging note when editing

* nit

* Simplify selection using svelte flow built in feature

* handle note selection separately

* Add min size for notes

* improve selection toggle

* improve mode switch

* make size and position optional for group notes

* Improve initial viewport position

* Add context menu for the canevas

* nit

* Add node context menu

* improve note select

* use clickoutside for note deselect

* use pointerdown outside to close context menu

* nit

* fix selection issues

* make edges non selectable

* improve color palette

* fix backend

* fix backend check

* cargo lock restore

* Add toggle to display notes

* fix note selection

* nit

* account for css offset in for loop

* fix multiple selection pannel styling

* clear flow selection when creating note

* Improve placeholder and note default text

* Escape note edit mode when pressing Esc

* Allow note edition in local dev

* clean

* Handle subflow selection

* prevent group note resizing

* nit

* allow notes in flow expand

* Improve multi select panel

* Allow context menu in note mode

* Add event listenner to fix pane click deselect

* prevent zoom in text area in notes

* improve bounding box styling

* Use control for box selection for non mac users

* nit

* clean notes groups

* nit

* use portal for note actions

* handle assets node when computing note layout

* Simplify layout compute for notes

* use smart color choice for notes

* Switch display note when adding a new note

* clean code

* improve group note bound size calculation

* simplify AI tool nodes and asset handling

* nit

* nit

* improve flow centering

* create group note button

* Improve selection of nodes

* Revert "Improve selection of nodes"

This reverts commit d2c40d82b1db3701bbfb609d5704d9580c5a73e3.

* refert backend changes

* nit

* improve graph selection

* clean

* make backend work except job runs

* fix notSelectable

---------

Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
---
 ...8d1e383aeda9a5a71183b7fbaa41deca4e333.json |   2 +-
 ...f4a5b962f7803def9ecd6e33d2aec6abce772.json |   2 +-
 backend/windmill-api/openapi.yaml             |   2 +
 backend/windmill-api/src/flows.rs             |  22 +-
 backend/windmill-common/src/cache.rs          |  15 +
 backend/windmill-common/src/flows.rs          |   2 +-
 .../windmill-worker/src/worker_lockfiles.rs   |  32 +-
 frontend/src/lib/assets/tokens/tokens.json    |  41 +-
 frontend/src/lib/components/Dev.svelte        |  24 +-
 .../src/lib/components/FlowBuilder.svelte     |  55 ++-
 .../src/lib/components/FlowGraphViewer.svelte |   3 +-
 .../lib/components/FlowPreviewContent.svelte  |   6 +-
 .../components/FlowStatusViewerInner.svelte   |   7 +-
 .../src/lib/components/GfmMarkdown.svelte     |   9 +-
 .../components/common/button/Button.svelte    |   2 +-
 .../src/lib/components/common/button/model.ts |  10 +-
 .../common/contextmenu/ContextMenu.svelte     | 126 ++++++
 .../common/contextmenu/contextMenuStyles.ts   |  45 ++
 .../lib/components/copilot/IteratorGen.svelte |   6 +-
 .../components/copilot/PredicateGen.svelte    |   6 +-
 .../components/copilot/StepInputGen.svelte    |   6 +-
 .../components/copilot/StepInputsGen.svelte   |   6 +-
 .../copilot/chat/AIChatManager.svelte.ts      |   2 +-
 .../copilot/chat/flow/FlowAIChat.svelte       |  20 +-
 .../lib/components/flows/FlowEditor.svelte    |   4 +
 .../flows/content/FlowEditorPanel.svelte      |  31 +-
 .../flows/content/FlowModuleComponent.svelte  |  20 +-
 .../flows/content/FlowModuleSleep.svelte      |   4 +-
 .../flows/content/FlowModuleSuspend.svelte    |   4 +-
 .../content/FlowModuleWorkerTagSelect.svelte  |   4 +-
 .../flows/content/FlowModuleWrapper.svelte    |  29 +-
 .../flows/content/FlowSelectionPanel.svelte   |  44 ++
 .../flows/header/FlowPreviewButtons.svelte    |  10 +-
 .../flows/map/FlowErrorHandlerItem.svelte     |  10 +-
 .../flows/map/FlowModuleSchemaItem.svelte     |   2 +-
 .../flows/map/FlowModuleSchemaMap.svelte      |  45 +-
 .../flows/map/FlowStickyNode.svelte           |  30 +-
 .../lib/components/flows/map/MapItem.svelte   |  23 +-
 frontend/src/lib/components/flows/types.ts    |   5 +-
 .../lib/components/graph/FlowGraphV2.svelte   | 395 ++++++++++++++--
 .../components/graph/NodeContextMenu.svelte   |  47 ++
 .../components/graph/NoteColorPicker.svelte   |  50 +++
 .../src/lib/components/graph/NoteTool.svelte  | 216 +++++++++
 .../components/graph/PaneContextMenu.svelte   | 115 +++++
 .../graph/SelectionBoundingBox.svelte         |  82 ++++
 .../lib/components/graph/SelectionTool.svelte |  43 ++
 .../components/graph/graphBuilder.svelte.ts   |  15 +-
 .../src/lib/components/graph/graphContext.ts  |  19 +
 .../components/graph/groupDetectionUtils.ts   |  86 ++++
 .../src/lib/components/graph/noteColors.ts    | 135 ++++++
 .../lib/components/graph/noteEditor.svelte.ts | 322 ++++++++++++++
 .../components/graph/noteManager.svelte.ts    | 150 +++++++
 .../lib/components/graph/noteUtils.svelte.ts  | 420 ++++++++++++++++++
 .../graph/renderers/edges/BaseEdge.svelte     |   8 +-
 .../graph/renderers/edges/EmptyEdge.svelte    |   7 +-
 .../graph/renderers/nodes/AIToolNode.svelte   |  20 +-
 .../graph/renderers/nodes/AssetNode.svelte    |   6 +-
 .../renderers/nodes/BranchAllEndNode.svelte   |   9 +-
 .../renderers/nodes/BranchAllStart.svelte     |   9 +-
 .../renderers/nodes/BranchOneStart.svelte     |   8 +-
 .../renderers/nodes/ForLoopEndNode.svelte     |   9 +-
 .../renderers/nodes/ForLoopStartNode.svelte   |   9 +-
 .../graph/renderers/nodes/InputNode.svelte    |   9 +-
 .../graph/renderers/nodes/ModuleNode.svelte   |  13 +-
 .../graph/renderers/nodes/NoBranchNode.svelte |   1 -
 .../graph/renderers/nodes/NodeWrapper.svelte  |  53 ++-
 .../graph/renderers/nodes/NoteNode.svelte     | 368 +++++++++++++++
 .../graph/renderers/nodes/ResultNode.svelte   |  12 +-
 .../graph/renderers/nodes/SubflowBound.svelte |   8 +-
 .../graph/renderers/nodes/TriggersNode.svelte |  57 ++-
 .../renderers/nodes/branchOneEndNode.svelte   |   9 +-
 .../components/graph/selectionUtils.svelte.ts | 106 +++++
 frontend/src/lib/components/graph/util.ts     | 101 +++++
 .../components/text_input/TextInput.svelte    |   7 +-
 .../FlowBuilderTutorialForLoop.svelte         |   4 +-
 frontend/src/routes/flows/dev/+page.svelte    |   8 +-
 .../routes/test_dev/kitchen_sink/+page.svelte |  99 +++++
 frontend/src/routes/view_graph/+page.svelte   |   3 +-
 frontend/tailwind.config.cjs                  |  75 ++--
 openflow.openapi.yaml                         |  63 +++
 80 files changed, 3538 insertions(+), 354 deletions(-)
 create mode 100644 frontend/src/lib/components/common/contextmenu/ContextMenu.svelte
 create mode 100644 frontend/src/lib/components/common/contextmenu/contextMenuStyles.ts
 create mode 100644 frontend/src/lib/components/flows/content/FlowSelectionPanel.svelte
 create mode 100644 frontend/src/lib/components/graph/NodeContextMenu.svelte
 create mode 100644 frontend/src/lib/components/graph/NoteColorPicker.svelte
 create mode 100644 frontend/src/lib/components/graph/NoteTool.svelte
 create mode 100644 frontend/src/lib/components/graph/PaneContextMenu.svelte
 create mode 100644 frontend/src/lib/components/graph/SelectionBoundingBox.svelte
 create mode 100644 frontend/src/lib/components/graph/SelectionTool.svelte
 create mode 100644 frontend/src/lib/components/graph/graphContext.ts
 create mode 100644 frontend/src/lib/components/graph/groupDetectionUtils.ts
 create mode 100644 frontend/src/lib/components/graph/noteColors.ts
 create mode 100644 frontend/src/lib/components/graph/noteEditor.svelte.ts
 create mode 100644 frontend/src/lib/components/graph/noteManager.svelte.ts
 create mode 100644 frontend/src/lib/components/graph/noteUtils.svelte.ts
 create mode 100644 frontend/src/lib/components/graph/renderers/nodes/NoteNode.svelte
 create mode 100644 frontend/src/lib/components/graph/selectionUtils.svelte.ts

diff --git a/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json b/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json
index bf1418bb0d..8c0d13fbd1 100644
--- a/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json
+++ b/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json
@@ -13,4 +13,4 @@
     "nullable": []
   },
   "hash": "544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333"
-}
+}
\ No newline at end of file
diff --git a/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json b/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json
index a5329c6a9b..a13d62402a 100644
--- a/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json
+++ b/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json
@@ -22,4 +22,4 @@
     "nullable": []
   },
   "hash": "d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772"
-}
+}
\ No newline at end of file
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index fac07d1abb..39e23a74db 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -15510,6 +15510,8 @@ components:
       $ref: "../../openflow.openapi.yaml#/components/schemas/FlowStatus"
     FlowStatusModule:
       $ref: "../../openflow.openapi.yaml#/components/schemas/FlowStatusModule"
+    FlowNote:
+      $ref: "../../openflow.openapi.yaml#/components/schemas/FlowNote"
     # -- INLINE END --
     # Do not change line above
 
diff --git a/backend/windmill-api/src/flows.rs b/backend/windmill-api/src/flows.rs
index dd141d46f6..a2e8e307e6 100644
--- a/backend/windmill-api/src/flows.rs
+++ b/backend/windmill-api/src/flows.rs
@@ -783,8 +783,8 @@ async fn update_flow(
 
     sqlx::query!(
         "
-        UPDATE 
-            flow 
+        UPDATE
+            flow
         SET
             path = $1,
             summary = $2,
@@ -800,7 +800,7 @@ async fn update_flow(
             schema = $9::text::json,
             edited_by = $10,
             edited_at = now()
-        WHERE 
+        WHERE
             path = $11 AND workspace_id = $12",
         if is_new_path { flow_path } else { &nf.path },
         nf.summary,
@@ -824,8 +824,8 @@ async fn update_flow(
     if is_new_path {
         // if new path, must clone flow to new path and delete old flow for flow_version foreign key constraint
         sqlx::query!(
-            "INSERT INTO flow 
-                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at) 
+            "INSERT INTO flow
+                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)
             SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at
                 FROM flow
                 WHERE path = $2 AND workspace_id = $3",
@@ -893,6 +893,8 @@ async fn update_flow(
     .warn_after_seconds(10)
     .await??;
 
+    // tracing::error!("Updating flow: {:?}", nf.value.get());
+
     // This will lock anyone who is trying to iterate on flow_versions with given path and parameters.
     let version = sqlx::query_scalar!(
         "INSERT INTO flow_version (workspace_id, path, value, schema, created_by) VALUES ($1, $2, $3, $4::text::json, $5) RETURNING id",
@@ -1143,11 +1145,11 @@ async fn get_flow_by_path(
             favorite.path IS NOT NULL AS starred
         FROM flow
         LEFT JOIN favorite
-            ON favorite.favorite_kind = 'flow' 
-            AND favorite.workspace_id = flow.workspace_id 
-            AND favorite.path = flow.path 
+            ON favorite.favorite_kind = 'flow'
+            AND favorite.workspace_id = flow.workspace_id
+            AND favorite.path = flow.path
             AND favorite.usr = $3
-        LEFT JOIN flow_version 
+        LEFT JOIN flow_version
             ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]
         WHERE flow.path = $1 AND flow.workspace_id = $2
         "#,
@@ -1182,7 +1184,7 @@ async fn get_flow_by_path(
             flow_version.created_by AS edited_by, 
             NULL AS starred
         FROM flow
-        LEFT JOIN flow_version 
+        LEFT JOIN flow_version
             ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]
         WHERE flow.path = $1 AND flow.workspace_id = $2
         "#,
diff --git a/backend/windmill-common/src/cache.rs b/backend/windmill-common/src/cache.rs
index c7972d3a7e..df0ef6842a 100644
--- a/backend/windmill-common/src/cache.rs
+++ b/backend/windmill-common/src/cache.rs
@@ -285,6 +285,21 @@ pub struct FlowData {
     pub flow: FlowValue,
 }
 
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct FlowNotes {
+    pub notes: Option<Box<RawValue>>,
+}
+
+impl FlowData {
+    pub fn notes(&self) -> Option<FlowNotes> {
+        serde_json::from_str::<FlowNotes>(self.raw_flow.get())
+            .map_err(|e| {
+                tracing::error!("Failed to parse notes into FlowNotes: {}", e);
+                error::Error::internal_err(format!("Failed to parse notes into FlowNotes: {}", e))
+            })
+            .ok()
+    }
+}
 /// !!!Shouldn't be used. Reverted optimization for ai agent steps.!!!
 #[derive(Deserialize)]
 struct RevertedFlowNodeFlow {
diff --git a/backend/windmill-common/src/flows.rs b/backend/windmill-common/src/flows.rs
index 5b81d35f75..27044c1dd3 100644
--- a/backend/windmill-common/src/flows.rs
+++ b/backend/windmill-common/src/flows.rs
@@ -194,7 +194,7 @@ pub struct FlowValue {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub chat_input_enabled: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub flow_env: Option<HashMap<String, Box<RawValue>>>
+    pub flow_env: Option<HashMap<String, Box<RawValue>>>,
 }
 
 impl FlowValue {
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index 0b840884f5..cc92955569 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -9,6 +9,7 @@ use crate::scoped_dependency_map::ScopedDependencyMap;
 use async_recursion::async_recursion;
 use chrono::{Duration, Utc};
 use itertools::Itertools;
+use serde::Serialize;
 use serde_json::value::RawValue;
 use serde_json::{from_value, json, Value};
 use sha2::Digest;
@@ -16,6 +17,7 @@ use sqlx::types::Json;
 use tokio::time::timeout;
 use uuid::Uuid;
 use windmill_common::assets::{clear_asset_usage, insert_asset_usage, AssetUsageKind};
+use windmill_common::cache::FlowNotes;
 use windmill_common::error::Error;
 use windmill_common::error::Result;
 use windmill_common::flows::{FlowModule, FlowModuleValue, FlowNodeId};
@@ -765,15 +767,16 @@ pub async fn handle_flow_dependency_job(
     // `JobKind::FlowDependencies` job store either:
     // - A saved flow version `id` in the `script_hash` column.
     // - Preview raw flow in the `queue` or `job` table.
-    let mut flow = match job.runnable_id {
-        Some(ScriptHash(id)) => cache::flow::fetch_version(db, id).await?,
+    let (mut flow, notes) = match job.runnable_id {
+        Some(ScriptHash(id)) => {
+            let flow = cache::flow::fetch_version(db, id).await?;
+            (flow.value().clone(), flow.notes())
+        }
         _ => match preview_data {
-            Some(RawData::Flow(data)) => data.clone(),
+            Some(RawData::Flow(data)) => (data.value().clone(), data.notes()),
             _ => return Err(Error::internal_err("expected script hash")),
         },
-    }
-    .value()
-    .clone();
+    };
 
     let mut tx = db.begin().await?;
 
@@ -861,7 +864,22 @@ pub async fn handle_flow_dependency_job(
         .await?;
     }
 
-    let new_flow_value = Json(serde_json::value::to_raw_value(&flow).map_err(to_anyhow)?);
+    #[derive(Debug, Clone, Serialize)]
+    struct FlowValueWithNotes<'a> {
+        #[serde(flatten)]
+        value: &'a FlowValue,
+
+        #[serde(skip_serializing_if = "Option::is_none")]
+        notes: Option<Box<RawValue>>, // TODO: Make this a Vec<FlowNote>
+    }
+
+    let new_flow_value = Json(
+        serde_json::value::to_raw_value(&FlowValueWithNotes {
+            value: &flow,
+            notes: notes.and_then(|n| n.notes).map(|n| n.into()),
+        })
+        .map_err(to_anyhow)?,
+    );
 
     // Re-check cancellation to ensure we don't accidentally override a flow.
     if sqlx::query_scalar!(
diff --git a/frontend/src/lib/assets/tokens/tokens.json b/frontend/src/lib/assets/tokens/tokens.json
index f04c2432f3..d4749e0e2d 100644
--- a/frontend/src/lib/assets/tokens/tokens.json
+++ b/frontend/src/lib/assets/tokens/tokens.json
@@ -17,7 +17,7 @@
 			"border-light": "#e5e7eb",
 			"border-normal": "#9ca3af",
 			"border-accent": "#2c5beb",
-			"surface-accent-selected": "#bfdbfe4c",
+			"surface-accent-selected": "#ebefff",
 			"surface-accent-secondary": "#293676",
 			"surface-tertiary": "#ffffff",
 			"text-emphasis": "#1d2430",
@@ -52,7 +52,7 @@
 			"border-light": "#485971",
 			"border-normal": "#718096",
 			"border-accent": "#a0affa",
-			"surface-accent-selected": "#6790c34c",
+			"surface-accent-selected": "#33384e",
 			"surface-accent-secondary": "#e8ebfb",
 			"surface-tertiary": "#434c5e",
 			"text-emphasis": "#f3f4f6",
@@ -87,7 +87,7 @@
 			"border-light": "#374457",
 			"border-normal": "#a9b0ba",
 			"border-accent": "#a0affa",
-			"surface-accent-selected": "#6790c44c",
+			"surface-accent-selected": "#33384e",
 			"surface-accent-secondary": "#e8ebfb",
 			"surface-tertiary": "#353c4a",
 			"text-emphasis": "#eeeff2",
@@ -193,7 +193,40 @@
 			"purple-800": "#483c60",
 			"purple-900": "#3a3549",
 			"purple-950": "#31313f",
-			"blue-950": "#213263"
+			"blue-950": "#213263",
+			"pink-50": "#fdf2f8",
+			"pink-100": "#fce7f3",
+			"pink-200": "#fbcfe8",
+			"pink-300": "#f9a8d4",
+			"pink-400": "#f472b6",
+			"pink-500": "#cc4e8c",
+			"pink-600": "#af4677",
+			"pink-700": "#8e4266",
+			"pink-800": "#5f3e52",
+			"pink-900": "#473340",
+			"pink-950": "#372b36",
+			"lime-50": "#f7fee7",
+			"lime-100": "#ecfccb",
+			"lime-200": "#d9f99d",
+			"lime-300": "#bef264",
+			"lime-400": "#a3e635",
+			"lime-500": "#84cc16",
+			"lime-600": "#5d8f16",
+			"lime-700": "#527029",
+			"lime-800": "#415824",
+			"lime-900": "#324220",
+			"lime-950": "#232f16",
+			"yellow-50": "#fefce8",
+			"yellow-100": "#fef9c3",
+			"yellow-200": "#fef08a",
+			"yellow-300": "#fde047",
+			"yellow-400": "#facc15",
+			"yellow-500": "#e0ae12",
+			"yellow-600": "#b1882e",
+			"yellow-700": "#8a6e31",
+			"yellow-800": "#61512d",
+			"yellow-900": "#443d22",
+			"yellow-950": "#3a351a"
 		}
 	},
 	"guidelines": { "mode-1": { "blue": "#5e81ac", "demo-background": "#ffffff00" } },
diff --git a/frontend/src/lib/components/Dev.svelte b/frontend/src/lib/components/Dev.svelte
index 86ded3bc0d..1b6df2a06f 100644
--- a/frontend/src/lib/components/Dev.svelte
+++ b/frontend/src/lib/components/Dev.svelte
@@ -31,6 +31,8 @@
 	import type { FlowState } from './flows/flowState'
 	import { initHistory } from '$lib/history.svelte'
 	import type { FlowEditorContext, FlowInput, FlowInputEditorState } from './flows/types'
+	import { SelectionManager } from './graph/selectionUtils.svelte'
+	import { NoteEditor, setNoteEditorContext } from './graph/noteEditor.svelte'
 	import { dfs } from './flows/dfs'
 	import { loadSchemaFromModule } from './flows/flowInfers'
 	import { CornerDownLeft, Play } from 'lucide-svelte'
@@ -475,7 +477,7 @@
 					let ids = dfs(flowStore.val.value.modules ?? [], (m) => m.id)
 					flowStateStore.val = Object.fromEntries(ids.map((k) => [k, {}]))
 				} catch (e) {}
-				inferModuleArgs($selectedIdStore)
+				inferModuleArgs(selectedId)
 			}
 		} catch (e) {
 			console.error('issue setting new flowstore', e)
@@ -489,7 +491,8 @@
 	const moving = writable<{ id: string } | undefined>(undefined)
 	const history = initHistory(flowStore.val)
 	const stepsInputArgs = new StepsInputArgs()
-	const selectedIdStore = writable('settings-metadata')
+	const selectionManager = new SelectionManager()
+	selectionManager.selectId('settings-metadata')
 	const triggersCount = writable<TriggersCount | undefined>(undefined)
 	const modulesTestStates = new ModulesTestStates((moduleId) => {
 		// console.log('FOO')
@@ -508,7 +511,7 @@
 	let pathStore = writable('')
 	let initialPathStore = writable('')
 	setContext<FlowEditorContext>('FlowEditorContext', {
-		selectedId: selectedIdStore,
+		selectionManager,
 		previewArgs: previewArgsStore,
 		scriptEditorDrawer,
 		moving,
@@ -538,6 +541,13 @@
 		pickablePropertiesFiltered: writable<PickableProperties | undefined>(undefined)
 	})
 
+	// Set up NoteEditor context for note editing capabilities
+	const noteEditor = new NoteEditor(flowStore, () => {
+		// Enable notes display when a note is created
+		flowModuleSchemaMap?.enableNotes?.()
+	})
+	setNoteEditorContext(noteEditor)
+
 	let lastSent: OpenFlow | undefined = undefined
 	function updateFlow(flow: OpenFlow) {
 		if (lockChanges) {
@@ -618,7 +628,7 @@
 		flowStore.val && untrack(() => updateFlow(flowStore.val))
 	})
 	$effect(() => {
-		$selectedIdStore && untrack(() => inferModuleArgs($selectedIdStore))
+		selectedId && untrack(() => inferModuleArgs(selectedId))
 	})
 
 	let localModuleStates: Record<string, GraphModuleState> = $state({})
@@ -640,7 +650,7 @@
 				job.success &&
 				flowPreviewButtons?.getPreviewMode() === 'whole'
 			) {
-				if (flowModuleSchemaMap?.isNodeVisible('result') && $selectedIdStore !== 'Result') {
+				if (flowModuleSchemaMap?.isNodeVisible('result') && selectedId !== 'Result') {
 					outputPickerOpenFns['Result']?.()
 				}
 			} else {
@@ -665,6 +675,8 @@
 	}
 
 	const flowHasChanged = $derived(flowPreviewContent?.flowHasChanged())
+
+	const selectedId = $derived(selectionManager.getSelectedId())
 </script>
 
 <svelte:window onkeydown={onKeyDown} />
@@ -846,7 +858,7 @@
 								on:applyArgs={(ev) => {
 									if (ev.detail.kind === 'preprocessor') {
 										stepsInputArgs.setStepArgs('preprocessor', ev.detail.args ?? {})
-										$selectedIdStore = 'preprocessor'
+										selectionManager.selectId('preprocessor')
 									} else {
 										previewArgsStore.val = ev.detail.args ?? {}
 										flowPreviewButtons?.openPreview()
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index 2ed847bff4..daaa4d5238 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -43,6 +43,9 @@
 	import FlowImportExportMenu from './flows/header/FlowImportExportMenu.svelte'
 	import FlowPreviewButtons from './flows/header/FlowPreviewButtons.svelte'
 	import type { FlowEditorContext, FlowInput, FlowInputEditorState } from './flows/types'
+	import { SelectionManager } from './graph/selectionUtils.svelte'
+	import { NoteEditor } from './graph/noteEditor.svelte'
+	import { setNoteEditorContext } from './graph/noteEditor.svelte'
 	import { cleanFlow } from './flows/utils.svelte'
 	import {
 		Calendar,
@@ -338,11 +341,11 @@
 
 			let savedAtNewPath = false
 			if (newFlow) {
-				onSaveInitial?.({ path: $pathStore, id: getSelectedId() })
+				onSaveInitial?.({ path: $pathStore, id: getSelectedId() ?? 'settings' })
 			} else if (savedFlow?.draft_only && $pathStore !== initialPath) {
 				savedAtNewPath = true
 				initialPath = $pathStore
-				onSaveDraftOnlyAtNewPath?.({ path: $pathStore, selectedId: getSelectedId() })
+				onSaveDraftOnlyAtNewPath?.({ path: $pathStore, selectedId: getSelectedId() ?? 'settings' })
 				// this is so we can use the flow builder outside of sveltekit
 			}
 			onSaveDraft?.({ path: $pathStore, savedAtNewPath, newFlow })
@@ -561,7 +564,7 @@
 					encodeState({
 						flow: flowStore.val,
 						path: $pathStore,
-						selectedId: $selectedIdStore,
+						selectedId: selectedIdStore,
 						draft_triggers: triggersState.getDraftTriggersSnapshot(),
 						selected_trigger: triggersState.getSelectedTriggerSnapshot(),
 						loadedFromHistory: {
@@ -576,10 +579,17 @@
 		}, 500)
 	}
 
-	const selectedIdStore = writable<string>(selectedId ?? 'settings-metadata')
+	const selectionManager = new SelectionManager()
+	const selectedIdStore = $derived(selectionManager.getSelectedId())
+	// Initialize with selected id if provided
+	if (selectedId) {
+		selectionManager.selectId(selectedId)
+	} else {
+		selectionManager.selectId('settings-metadata')
+	}
 
 	export function getSelectedId() {
-		return $selectedIdStore
+		return selectedIdStore
 	}
 
 	const previewArgsStore = $state({ val: initialArgs })
@@ -598,7 +608,7 @@
 	const stepsInputArgs = new StepsInputArgs()
 
 	function select(selectedId: string) {
-		selectedIdStore.set(selectedId)
+		selectionManager.selectId(selectedId)
 	}
 
 	let insertButtonOpen = writable<boolean>(false)
@@ -607,7 +617,7 @@
 	let flowEditor: FlowEditor | undefined = $state(undefined)
 
 	setContext<FlowEditorContext>('FlowEditorContext', {
-		selectedId: selectedIdStore,
+		selectionManager,
 		currentEditor: writable(undefined),
 		previewArgs: previewArgsStore,
 		scriptEditorDrawer,
@@ -629,6 +639,13 @@
 		outputPickerOpenFns
 	})
 
+	// Set up NoteEditor context for note editing capabilities
+	const noteEditor = new NoteEditor(flowStore, () => {
+		// Enable notes display when a note is created
+		flowEditor?.enableNotes?.()
+	})
+	setNoteEditorContext(noteEditor)
+
 	setContext(
 		'FlowGraphAssetContext',
 		initFlowGraphAssetsCtx({ getModules: () => flowStore.val.value.modules })
@@ -695,7 +712,7 @@
 			case 'z':
 				if (event.ctrlKey || event.metaKey) {
 					flowStore.val = undo(history, flowStore.val)
-					$selectedIdStore = 'Input'
+					selectionManager.selectId('Input')
 					event.preventDefault()
 				}
 				break
@@ -708,9 +725,9 @@
 			case 'ArrowDown': {
 				if (!$insertButtonOpen && !flowPreviewButtons?.getPreviewOpen()) {
 					let ids = generateIds()
-					let idx = ids.indexOf($selectedIdStore)
+					let idx = ids.indexOf(selectedIdStore!)
 					if (idx > -1 && idx < ids.length - 1) {
-						$selectedIdStore = ids[idx + 1]
+						selectionManager.selectId(ids[idx + 1])
 						event.preventDefault()
 					}
 				}
@@ -719,9 +736,9 @@
 			case 'ArrowUp': {
 				if (!$insertButtonOpen && !flowPreviewButtons?.getPreviewOpen()) {
 					let ids = generateIds()
-					let idx = ids.indexOf($selectedIdStore)
+					let idx = ids.indexOf(selectedIdStore!)
 					if (idx > 0 && idx < ids.length) {
-						$selectedIdStore = ids[idx - 1]
+						selectionManager.selectId(ids[idx - 1])
 						event.preventDefault()
 					}
 				}
@@ -868,7 +885,7 @@
 		setContext('customUi', customUi)
 	})
 	$effect.pre(() => {
-		if (flowStore.val || $selectedIdStore) {
+		if (flowStore.val || selectedIdStore) {
 			readFieldsRecursively(flowStore.val)
 			untrack(() => saveSessionDraft())
 		}
@@ -932,7 +949,7 @@
 				job.success &&
 				flowPreviewButtons?.getPreviewMode() === 'whole'
 			) {
-				if (flowEditor?.isNodeVisible('result') && $selectedIdStore !== 'Result') {
+				if (flowEditor?.isNodeVisible('result') && selectedIdStore !== 'Result') {
 					outputPickerOpenFns['Result']?.()
 				}
 			} else {
@@ -1026,7 +1043,7 @@
 								}
 							}
 
-							$selectedIdStore = 'Input'
+							selectionManager.selectId('Input')
 						}}
 						on:redo={() => {
 							flowStore.val = redo(history)
@@ -1044,7 +1061,7 @@
 							variant="subtle"
 							size="xs"
 							on:click={async () => {
-								select('triggers')
+								select('Trigger')
 								const selected = primaryScheduleIndex ?? scheduleIndex
 								if (selected) {
 									triggersState.selectedTriggerIndex = selected
@@ -1137,7 +1154,7 @@
 					{/if}
 					<FlowPreviewButtons
 						on:openTriggers={(e) => {
-							select('triggers')
+							select('Trigger')
 							handleSelectTriggerFromKind(triggersState, triggersCount, initialPath, e.detail.kind)
 							captureOn.set(true)
 							showCaptureHint.set(true)
@@ -1190,7 +1207,7 @@
 					on:applyArgs={(ev) => {
 						if (ev.detail.kind === 'preprocessor') {
 							stepsInputArgs.setStepArgs('preprocessor', ev.detail.args ?? {})
-							$selectedIdStore = 'preprocessor'
+							selectionManager.selectId('preprocessor')
 						}
 					}}
 					on:testWithArgs={(e) => {
@@ -1203,7 +1220,7 @@
 					{savedFlow}
 					onDeployTrigger={handleDeployTrigger}
 					onEditInput={(moduleId, key) => {
-						selectedIdStore.set(moduleId)
+						selectionManager.selectId(moduleId)
 						// Use new prop-based system
 						forceTestTab[moduleId] = true
 						highlightArg[moduleId] = key
diff --git a/frontend/src/lib/components/FlowGraphViewer.svelte b/frontend/src/lib/components/FlowGraphViewer.svelte
index 5297ed3584..c54935299d 100644
--- a/frontend/src/lib/components/FlowGraphViewer.svelte
+++ b/frontend/src/lib/components/FlowGraphViewer.svelte
@@ -45,8 +45,9 @@
 				modules={flow?.value?.modules}
 				failureModule={flow?.value?.failure_module}
 				preprocessorModule={flow?.value?.preprocessor_module}
+				notes={flow?.value?.notes}
 				onSelect={(nodeId) => {
-					if (nodeId === 'triggers') {
+					if (nodeId === 'Trigger') {
 						dispatch('triggerDetail')
 						return
 					} else if (nodeId === 'failure') {
diff --git a/frontend/src/lib/components/FlowPreviewContent.svelte b/frontend/src/lib/components/FlowPreviewContent.svelte
index 751f412a11..ec6d02f0dd 100644
--- a/frontend/src/lib/components/FlowPreviewContent.svelte
+++ b/frontend/src/lib/components/FlowPreviewContent.svelte
@@ -100,7 +100,7 @@
 	}
 
 	const {
-		selectedId,
+		selectionManager,
 		previewArgs,
 		flowStateStore,
 		flowStore,
@@ -136,7 +136,7 @@
 		} else {
 			const flow = previewFlow ?? stateSnapshot(flowStore).val
 			const idOrders = dfs(flow.value.modules, (x) => x.id)
-			let upToIndex = idOrders.indexOf(upToId ?? $selectedId)
+			let upToIndex = idOrders.indexOf(upToId ?? selectionManager.getSelectedId() ?? '')
 
 			if (upToIndex != -1) {
 				flow.value.modules = sliceModules(flow.value.modules, upToIndex, idOrders)
@@ -441,7 +441,7 @@
 							{#if previewMode == 'upTo'}
 								Test up to
 								<Badge baseClass="ml-1" color="indigo">
-									{$selectedId}
+									{selectionManager.getSelectedId()}
 								</Badge>
 							{:else}
 								Test flow
diff --git a/frontend/src/lib/components/FlowStatusViewerInner.svelte b/frontend/src/lib/components/FlowStatusViewerInner.svelte
index 4a573bfcc5..120c7cb9a1 100644
--- a/frontend/src/lib/components/FlowStatusViewerInner.svelte
+++ b/frontend/src/lib/components/FlowStatusViewerInner.svelte
@@ -39,7 +39,6 @@
 	import type { FlowGraphAssetContext } from './flows/types'
 	import { createState } from '$lib/svelte5Utils.svelte'
 	import JobLoader from './JobLoader.svelte'
-	import { writable } from 'svelte/store'
 	import {
 		AI_TOOL_CALL_PREFIX,
 		AI_TOOL_MESSAGE_PREFIX,
@@ -48,6 +47,7 @@
 	} from './graph/renderers/nodes/AIToolNode.svelte'
 	import JobAssetsViewer from './assets/JobAssetsViewer.svelte'
 	import McpToolCallDetails from './McpToolCallDetails.svelte'
+	import { SelectionManager } from './graph/selectionUtils.svelte'
 
 	let {
 		flowState: flowStateStore,
@@ -232,7 +232,7 @@
 
 	let expandedSubflows: Record<string, FlowModule[]> = $state({})
 
-	let selectedId = writable<string | undefined>(selectedNode)
+	let selectionManager = new SelectionManager()
 
 	function onFlowModuleId() {
 		let modId = flowJobIds?.moduleId
@@ -1730,7 +1730,7 @@
 							{/each}
 						</div>
 						<FlowGraphV2
-							{selectedId}
+							{selectionManager}
 							triggerNode={true}
 							download={!hideDownloadInGraph}
 							minHeight={wrapperHeight}
@@ -1773,6 +1773,7 @@
 							earlyStop={job.raw_flow?.skip_expr !== undefined}
 							cache={job.raw_flow?.cache_ttl !== undefined}
 							modules={job.raw_flow?.modules ?? []}
+							notes={job.raw_flow?.notes ?? []}
 							failureModule={job.raw_flow?.failure_module}
 							preprocessorModule={job.raw_flow?.preprocessor_module}
 							allowSimplifiedPoll={false}
diff --git a/frontend/src/lib/components/GfmMarkdown.svelte b/frontend/src/lib/components/GfmMarkdown.svelte
index 7392de5484..83cce90fbe 100644
--- a/frontend/src/lib/components/GfmMarkdown.svelte
+++ b/frontend/src/lib/components/GfmMarkdown.svelte
@@ -3,7 +3,12 @@
 	import { gfmPlugin } from 'svelte-exmarkdown/gfm'
 	import rehypeRaw from 'rehype-raw'
 	import { rehypeGithubAlerts } from 'rehype-github-alerts'
-	export let md: string
+	interface Props {
+		md: string
+		noPadding?: boolean
+	}
+
+	let { md, noPadding }: Props = $props()
 	const plugins: Plugin[] = [
 		gfmPlugin(),
 		{ rehypePlugin: [rehypeRaw] },
@@ -11,7 +16,7 @@
 	]
 </script>
 
-<div class="!prose-xs pgap">
+<div class="!prose-xs {noPadding ? '' : 'pgap'}">
 	<Markdown {md} {plugins} />
 </div>
 
diff --git a/frontend/src/lib/components/common/button/Button.svelte b/frontend/src/lib/components/common/button/Button.svelte
index ee6a3265de..b1372dfd0b 100644
--- a/frontend/src/lib/components/common/button/Button.svelte
+++ b/frontend/src/lib/components/common/button/Button.svelte
@@ -215,7 +215,7 @@
 			const horizontalPadding = iconOnly
 				? ButtonType.UnifiedIconOnlySizingClasses[unifiedSize]
 				: ButtonType.UnifiedSizingClasses[unifiedSize]
-			const height = ButtonType.UnifiedMinHeightClasses[unifiedSize]
+			const height = ButtonType.UnifiedHeightClasses[unifiedSize]
 			return `${horizontalPadding} ${height}`
 		}
 
diff --git a/frontend/src/lib/components/common/button/model.ts b/frontend/src/lib/components/common/button/model.ts
index 5eb75ba531..e1af83c971 100644
--- a/frontend/src/lib/components/common/button/model.ts
+++ b/frontend/src/lib/components/common/button/model.ts
@@ -17,7 +17,7 @@ export namespace ButtonType {
 	 * @deprecated Use `UnifiedSize` instead
 	 */
 	export type Size = 'xs3' | 'xs2' | 'xs' | 'sm' | 'md' | 'lg' | 'xl'
-	export type UnifiedSize = 'sm' | 'md' | 'lg'
+	export type UnifiedSize = 'xs' | 'sm' | 'md' | 'lg'
 	export type ExtendedSize = 'xs2' | 'xs' | 'sm' | 'md' | 'lg' | 'xl'
 	/**
 	 * @deprecated Use `Variant` instead
@@ -194,7 +194,7 @@ export namespace ButtonType {
 		accent:
 			'bg-red-500 dark:bg-red-600 hover:bg-red-600 dark:hover:bg-red-700 focus-visible:bg-red-700 text-white focus-visible:ring-red-300',
 		default:
-			'border border-border-light bg-transparent hover:bg-red-500 dark:hover:bg-red-600 hover:text-white dark:hover:bg-red-900/20 text-primary focus-visible:bg-red-100 dark:focus-visible:bg-red-900/30 focus-visible:ring-red-300',
+			'border border-border-light bg-transparent hover:bg-red-500 dark:hover:bg-red-600 hover:text-white dark:hover:bg-red-600 text-primary focus-visible:bg-red-100 dark:focus-visible:bg-red-900/30 focus-visible:ring-red-300',
 		subtle:
 			'bg-transparent hover:bg-red-500 hover:text-white dark:hover:bg-red-600 text-primary focus-visible:bg-red-100 dark:focus-visible:bg-red-900/30 focus-visible:ring-red-300'
 	}
@@ -221,36 +221,42 @@ export namespace ButtonType {
 
 	// New unified sizing system
 	export const UnifiedSizingClasses: Record<ButtonType.UnifiedSize, string> = {
+		xs: 'px-1',
 		sm: 'px-2', // Regular horizontal padding
 		md: 'px-4',
 		lg: 'px-6'
 	}
 
 	export const UnifiedIconOnlySizingClasses: Record<ButtonType.UnifiedSize, string> = {
+		xs: 'px-1',
 		sm: 'px-2', // Square padding for icon-only (same as width padding)
 		md: 'px-2',
 		lg: 'px-4'
 	}
 
 	export const UnifiedMinHeightClasses: Record<ButtonType.UnifiedSize, string> = {
+		xs: 'min-h-5',
 		sm: 'min-h-7',
 		md: 'min-h-8',
 		lg: 'min-h-10'
 	}
 
 	export const UnifiedHeightClasses: Record<ButtonType.UnifiedSize, string> = {
+		xs: 'h-5',
 		sm: 'h-7',
 		md: 'h-8',
 		lg: 'h-10'
 	}
 
 	export const UnifiedIconSizes: Record<ButtonType.UnifiedSize, number> = {
+		xs: 12,
 		sm: 13,
 		md: 14,
 		lg: 18
 	}
 
 	export const UnifiedFontSizes: Record<ButtonType.UnifiedSize, string> = {
+		xs: 'font-normal',
 		sm: 'font-normal',
 		md: 'font-medium',
 		lg: 'font-medium'
diff --git a/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte b/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte
new file mode 100644
index 0000000000..8e0f440bde
--- /dev/null
+++ b/frontend/src/lib/components/common/contextmenu/ContextMenu.svelte
@@ -0,0 +1,126 @@
+<script lang="ts">
+	import { createContextMenu, melt } from '@melt-ui/svelte'
+	import { fly } from 'svelte/transition'
+	import { twMerge } from 'tailwind-merge'
+	import type { Snippet } from 'svelte'
+	import { pointerDownOutside } from '$lib/utils'
+	import {
+		getContextMenuContainerClass,
+		CONTEXT_MENU_ITEM_BASE_CLASS,
+		CONTEXT_MENU_ITEM_HOVER_MELT_CLASS,
+		CONTEXT_MENU_ITEM_DISABLED_CLASS,
+		CONTEXT_MENU_DIVIDER_CLASS,
+		CONTEXT_MENU_ANIMATION_CLASSES
+	} from './contextMenuStyles'
+
+	export interface ContextMenuItem {
+		id: string
+		label: string
+		icon?: any
+		disabled?: boolean
+		onClick?: () => void
+		divider?: boolean
+	}
+
+	interface Props {
+		items?: ContextMenuItem[]
+		children?: Snippet
+		menu?: Snippet<[{ item: ContextMenuItem }]>
+		class?: string
+		onItemClick?: (item: ContextMenuItem) => void
+		closeOnOutsideClick?: boolean
+	}
+
+	let {
+		items = [],
+		children,
+		menu,
+		class: className = '',
+		onItemClick,
+		closeOnOutsideClick = true
+	}: Props = $props()
+
+	const {
+		elements: { menu: menuElement, item, trigger },
+		states: { open }
+	} = createContextMenu({
+		positioning: {
+			placement: 'right-start'
+		},
+		preventScroll: true,
+		closeOnOutsideClick: false
+	})
+
+	function handleItemClick(menuItem: ContextMenuItem) {
+		if (!menuItem.disabled) {
+			menuItem.onClick?.()
+			onItemClick?.(menuItem)
+		}
+	}
+
+	function close() {
+		open.set(false)
+	}
+
+	async function getMenuElements(): Promise<HTMLElement[]> {
+		return Array.from(document.querySelectorAll('[data-context-menu]')) as HTMLElement[]
+	}
+
+	function handlePointerDownOutside() {
+		if (closeOnOutsideClick && open.get()) {
+			close()
+		}
+	}
+</script>
+
+<div
+	use:melt={$trigger}
+	class={twMerge('block w-full h-full', className)}
+	role="button"
+	tabindex="0"
+	aria-label="Right click for context menu"
+	use:pointerDownOutside={{
+		capture: true,
+		stopPropagation: false,
+		exclude: getMenuElements,
+		onClickOutside: handlePointerDownOutside
+	}}
+	data-context-menu-trigger
+>
+	{@render children?.()}
+</div>
+
+{#if $open}
+	<div
+		class="{getContextMenuContainerClass()} {CONTEXT_MENU_ANIMATION_CLASSES}"
+		use:melt={$menuElement}
+		transition:fly={{ duration: 150, y: -10 }}
+		data-context-menu
+	>
+		{#each items as menuItem (menuItem.id)}
+			{#if menuItem.divider}
+				<div class={CONTEXT_MENU_DIVIDER_CLASS}></div>
+			{:else}
+				<div
+					class={twMerge(
+						CONTEXT_MENU_ITEM_BASE_CLASS,
+						menuItem.disabled
+							? CONTEXT_MENU_ITEM_DISABLED_CLASS
+							: CONTEXT_MENU_ITEM_HOVER_MELT_CLASS
+					)}
+					use:melt={$item}
+					onclick={() => handleItemClick(menuItem)}
+				>
+					{#if menuItem.icon}
+						<menuItem.icon size={14} class="mr-2" />
+					{/if}
+					{#if menu}
+						{@render menu({ item: menuItem })}
+					{:else}
+						<span>{menuItem.label}</span>
+					{/if}
+				</div>
+			{/if}
+		{/each}
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/common/contextmenu/contextMenuStyles.ts b/frontend/src/lib/components/common/contextmenu/contextMenuStyles.ts
new file mode 100644
index 0000000000..ecbe6c6f87
--- /dev/null
+++ b/frontend/src/lib/components/common/contextmenu/contextMenuStyles.ts
@@ -0,0 +1,45 @@
+/**
+ * Shared styles for context menu components
+ * Ensures visual consistency across all context menu implementations
+ */
+
+/**
+ * Base container styles for context menu
+ * @param zIndex - Optional z-index override (default: 'z-50')
+ */
+export function getContextMenuContainerClass(zIndex: string = 'z-50'): string {
+	return `${zIndex} flex flex-col gap-1 min-w-[12rem] overflow-hidden rounded-md border bg-surface p-1 shadow-md`
+}
+
+/**
+ * Base styles for context menu items
+ */
+export const CONTEXT_MENU_ITEM_BASE_CLASS =
+	'relative flex cursor-default select-none items-center rounded-md px-2 py-1.5 text-xs outline-none transition-colors'
+
+/**
+ * Hover state styles for context menu items (standard CSS hover)
+ */
+export const CONTEXT_MENU_ITEM_HOVER_CLASS = 'hover:bg-surface-hover'
+
+/**
+ * Hover state styles for context menu items (Melt UI data attribute)
+ */
+export const CONTEXT_MENU_ITEM_HOVER_MELT_CLASS = 'data-[highlighted]:bg-surface-hover'
+
+/**
+ * Disabled state styles for context menu items
+ */
+export const CONTEXT_MENU_ITEM_DISABLED_CLASS = 'pointer-events-none opacity-50'
+
+/**
+ * Divider styles for context menu
+ */
+export const CONTEXT_MENU_DIVIDER_CLASS = 'my-1 h-px bg-border-light'
+
+/**
+ * Melt UI animation classes for context menu
+ */
+export const CONTEXT_MENU_ANIMATION_CLASSES =
+	'data-[state=open]:animate-in data-[state=closed]:animate-out data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0 data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95 data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2 data-[side=right]:slide-in-from-left-2 data-[side=top]:slide-in-from-bottom-2'
+
diff --git a/frontend/src/lib/components/copilot/IteratorGen.svelte b/frontend/src/lib/components/copilot/IteratorGen.svelte
index 46eb6d1519..b9015eb2b1 100644
--- a/frontend/src/lib/components/copilot/IteratorGen.svelte
+++ b/frontend/src/lib/components/copilot/IteratorGen.svelte
@@ -35,7 +35,7 @@
 	)
 
 	let abortController = new AbortController()
-	const { flowStore, selectedId } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 
 	async function generateIteratorExpr() {
 		if (generatedContent.length > 0 || loading) {
@@ -45,7 +45,7 @@
 		loading = true
 		const flow: Flow = JSON.parse(JSON.stringify(flowStore.val))
 		const idOrders = dfs(flow.value.modules, (x) => x.id)
-		const upToIndex = idOrders.indexOf($selectedId)
+		const upToIndex = idOrders.indexOf(selectionManager.getSelectedId())
 		if (upToIndex === -1) {
 			throw new Error('Could not find the selected id in the flow')
 		}
@@ -60,7 +60,7 @@
 				flow_input: pickableProperties?.flow_input
 			}
 			const user = `I'm building a workflow which is a DAG of script steps.
-The current step is ${$selectedId} and represents a for-loop. You can find the details of all the steps below:
+The current step is ${selectionManager.getSelectedId()} and represents a for-loop. You can find the details of all the steps below:
 ${flowDetails}
 Determine the iterator expression to pass either from the previous results or the flow inputs. Here's a summary of the available data:
 <available>
diff --git a/frontend/src/lib/components/copilot/PredicateGen.svelte b/frontend/src/lib/components/copilot/PredicateGen.svelte
index 6bfeacd62c..c49edb70a8 100644
--- a/frontend/src/lib/components/copilot/PredicateGen.svelte
+++ b/frontend/src/lib/components/copilot/PredicateGen.svelte
@@ -29,7 +29,7 @@
 	})
 
 	let abortController = $state(new AbortController())
-	const { flowStore, selectedId } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const dispatch = createEventDispatcher()
 
@@ -38,7 +38,7 @@
 		loading = true
 		const flow: Flow = JSON.parse(JSON.stringify(flowStore.val))
 		const idOrders = dfs(flow.value.modules, (x) => x.id)
-		const upToIndex = idOrders.indexOf($selectedId)
+		const upToIndex = idOrders.indexOf(selectionManager.getSelectedId())
 		if (upToIndex === -1) {
 			throw new Error('Could not find the selected id in the flow')
 		}
@@ -53,7 +53,7 @@
 				flow_input: pickableProperties?.flow_input
 			}
 			const user = `I'm building a workflow which is a DAG of script steps.
-The current step is ${$selectedId} and is a branching step (if-else). 
+The current step is ${selectionManager.getSelectedId()} and is a branching step (if-else). 
 The user wants to generate a predicate for the branching condition.
 Here's the user's request: ${instructions}
 You can find the details of all the steps below:
diff --git a/frontend/src/lib/components/copilot/StepInputGen.svelte b/frontend/src/lib/components/copilot/StepInputGen.svelte
index 9dec547627..d2a29cfa8c 100644
--- a/frontend/src/lib/components/copilot/StepInputGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputGen.svelte
@@ -54,7 +54,7 @@
 	let abortController = new AbortController()
 	let newFlowInput = $state('')
 
-	const { flowStore, selectedId } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 	const { stepInputsLoading, generatedExprs } =
 		getContext<FlowCopilotContext | undefined>('FlowCopilotContext') || {}
 
@@ -86,7 +86,7 @@
 		loading = true
 		const flow: Flow = JSON.parse(JSON.stringify(flowStore.val))
 		const idOrders = dfs(flow.value.modules, (x) => x.id)
-		const upToIndex = idOrders.indexOf($selectedId)
+		const upToIndex = idOrders.indexOf(selectionManager.getSelectedId())
 		if (upToIndex === -1) {
 			throw new Error('Could not find the selected id in the flow')
 		}
@@ -102,7 +102,7 @@
 			}
 			const isInsideLoop = availableData.flow_input && 'iter' in availableData.flow_input
 			const user = `I'm building a workflow which is a DAG of script steps.
-The current step is ${$selectedId}, you can find the details for the step and previous ones below:
+The current step is ${selectionManager.getSelectedId()}, you can find the details for the step and previous ones below:
 ${flowDetails}
 Determine for the input "${argName}", what to pass either from the previous results or the flow inputs. 
 All possibles inputs either start with results. or flow_input. and are followed by the key of the input.
diff --git a/frontend/src/lib/components/copilot/StepInputsGen.svelte b/frontend/src/lib/components/copilot/StepInputsGen.svelte
index 2ce8d4b177..c2781153a6 100644
--- a/frontend/src/lib/components/copilot/StepInputsGen.svelte
+++ b/frontend/src/lib/components/copilot/StepInputsGen.svelte
@@ -30,7 +30,7 @@
 
 	let { pickableProperties = undefined, argNames = [], schema = undefined }: Props = $props()
 
-	const { flowStore, selectedId } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const { exprsToSet, stepInputsLoading, generatedExprs } =
 		getContext<FlowCopilotContext | undefined>('FlowCopilotContext') || {}
@@ -49,7 +49,7 @@
 		stepInputsLoading?.set(true)
 		const flow: Flow = JSON.parse(JSON.stringify(flowStore.val))
 		const idOrders = dfs(flow.value.modules, (x) => x.id)
-		const upToIndex = idOrders.indexOf($selectedId)
+		const upToIndex = idOrders.indexOf(selectionManager.getSelectedId())
 		if (upToIndex === -1) {
 			throw new Error('Could not find the selected id in the flow')
 		}
@@ -65,7 +65,7 @@
 			}
 			const isInsideLoop = availableData.flow_input && 'iter' in availableData.flow_input
 			const user = `I'm building a workflow which is a DAG of script steps.
-The current step is ${$selectedId}, you can find the details for the step and previous ones below:
+The current step is ${selectionManager.getSelectedId()}, you can find the details for the step and previous ones below:
 ${flowDetails}
 
 Determine for all the inputs "${argNames.join(
diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index edeeed1af9..149f6930d8 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -882,7 +882,7 @@ class AIChatManager {
 	}
 
 	listenForSelectedIdChanges = (
-		selectedId: string,
+		selectedId: string | undefined,
 		flowStore: ExtendedOpenFlow,
 		flowStateStore: FlowState,
 		currentEditor: CurrentEditor
diff --git a/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte b/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte
index dc48253240..56c7f18f7c 100644
--- a/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte
+++ b/frontend/src/lib/components/copilot/chat/flow/FlowAIChat.svelte
@@ -25,8 +25,9 @@
 		flowModuleSchemaMap: FlowModuleSchemaMap | undefined
 	} = $props()
 
-	const { flowStore, flowStateStore, selectedId, currentEditor } =
+	const { flowStore, flowStateStore, selectionManager, currentEditor } =
 		getContext<FlowEditorContext>('FlowEditorContext')
+	const selectedId = $derived(selectionManager.getSelectedId())
 
 	const { exprsToSet } = getContext<FlowCopilotContext | undefined>('FlowCopilotContext') ?? {}
 
@@ -84,7 +85,7 @@
 			const flow = $state.snapshot(flowStore).val
 			return {
 				flow,
-				selectedId: $selectedId
+				selectedId: selectedId
 			}
 		},
 		// flow apply/reject
@@ -382,7 +383,7 @@
 				value: match[2].trim()
 			}))
 
-			if (id === $selectedId) {
+			if (id === selectedId) {
 				exprsToSet?.set({})
 				const argsToUpdate = {}
 				for (const { input, value } of parsedInputs) {
@@ -421,7 +422,7 @@
 			setModuleStatus('Input', 'modified')
 		},
 		selectStep: (id) => {
-			$selectedId = id
+			selectionManager.selectId(id)
 		},
 		getStepCode: (id) => {
 			const module = getModule(id)
@@ -611,7 +612,7 @@
 
 	$effect(() => {
 		const cleanup = aiChatManager.listenForSelectedIdChanges(
-			$selectedId,
+			selectedId,
 			flowStore.val,
 			flowStateStore.val,
 			$currentEditor
@@ -628,19 +629,18 @@
 	$effect(() => {
 		if (
 			$currentEditor?.type === 'script' &&
-			$selectedId &&
-			affectedModules[$selectedId] &&
+			selectedId &&
+			affectedModules[selectedId] &&
 			$currentEditor.editor.getAiChatEditorHandler()
 		) {
-			const moduleLastSnapshot = getModule($selectedId, lastSnapshot)
+			const moduleLastSnapshot = getModule(selectedId, lastSnapshot)
 			const content =
 				moduleLastSnapshot?.value.type === 'rawscript' ? moduleLastSnapshot.value.content : ''
 			if (content.length > 0) {
 				untrack(() =>
 					$currentEditor.editor.reviewAppliedCode(content, {
 						onFinishedReview: () => {
-							const id = $selectedId
-							flowHelpers.acceptModuleAction(id)
+							flowHelpers.acceptModuleAction(selectedId)
 							$currentEditor.hideDiffMode()
 						}
 					})
diff --git a/frontend/src/lib/components/flows/FlowEditor.svelte b/frontend/src/lib/components/flows/FlowEditor.svelte
index 775bd7cadb..0d7be9c358 100644
--- a/frontend/src/lib/components/flows/FlowEditor.svelte
+++ b/frontend/src/lib/components/flows/FlowEditor.svelte
@@ -102,6 +102,10 @@
 		return flowModuleSchemaMap?.isNodeVisible(nodeId) ?? false
 	}
 
+	export function enableNotes(): void {
+		flowModuleSchemaMap?.enableNotes?.()
+	}
+
 	setContext<PropPickerContext>('PropPickerContext', {
 		flowPropPickerConfig: writable<FlowPropPickerConfig | undefined>(undefined),
 		pickablePropertiesFiltered: writable<PickableProperties | undefined>(undefined)
diff --git a/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte b/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
index 3e6d4e22af..f0288e6533 100644
--- a/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
+++ b/frontend/src/lib/components/flows/content/FlowEditorPanel.svelte
@@ -15,6 +15,7 @@
 	import { computeMissingInputWarnings } from '../missingInputWarnings'
 	import FlowResult from './FlowResult.svelte'
 	import type { StateStore } from '$lib/utils'
+	import FlowSelectionPanel from './FlowSelectionPanel.svelte'
 
 	interface Props {
 		noEditor?: boolean
@@ -55,7 +56,7 @@
 	}: Props = $props()
 
 	const {
-		selectedId,
+		selectionManager,
 		flowStore,
 		flowStateStore,
 		flowInputsStore,
@@ -66,6 +67,8 @@
 		flowInputEditorState
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
+	const selectedId = $derived(selectionManager.getSelectedId())
+
 	const { showCaptureHint, triggersState, triggersCount } =
 		getContext<TriggerContext>('TriggerContext')
 	function checkDup(modules: FlowModule[]): string | undefined {
@@ -84,14 +87,16 @@
 	})
 </script>
 
-{#if $selectedId?.startsWith('settings')}
+{#if selectionManager && selectionManager.selectedIds.length > 1}
+	<FlowSelectionPanel {selectionManager} {noEditor} />
+{:else if selectedId?.startsWith('settings')}
 	<FlowSettings {enableAi} {noEditor} />
-{:else if $selectedId === 'Input'}
+{:else if selectedId === 'Input'}
 	<FlowInput
 		{noEditor}
 		disabled={disabledFlowInputs}
 		on:openTriggers={(ev) => {
-			$selectedId = 'triggers'
+			selectionManager.selectId('Trigger')
 			handleSelectTriggerFromKind(triggersState, triggersCount, savedFlow?.path, ev.detail.kind)
 			showCaptureHint.set(true)
 		}}
@@ -99,22 +104,22 @@
 		{onTestFlow}
 		{previewOpen}
 	/>
-{:else if $selectedId === 'Result'}
+{:else if selectedId === 'Result'}
 	<FlowResult {noEditor} {job} {isOwner} {suspendStatus} {onOpenDetails} />
-{:else if $selectedId === 'constants'}
+{:else if selectedId === 'constants'}
 	<FlowEnvironmentVariables {noEditor} />
-{:else if $selectedId === 'failure'}
+{:else if selectedId === 'failure'}
 	<FlowFailureModule {noEditor} savedModule={savedFlow?.value.failure_module} />
-{:else if $selectedId === 'preprocessor'}
+{:else if selectedId === 'preprocessor'}
 	<FlowPreprocessorModule {noEditor} savedModule={savedFlow?.value.preprocessor_module} />
-{:else if $selectedId === 'triggers'}
+{:else if selectedId === 'Trigger'}
 	<TriggersEditor
 		on:applyArgs
 		on:addPreprocessor={async () => {
 			await insertNewPreprocessorModule(flowStore, flowStateStore, {
 				language: 'bun'
 			})
-			$selectedId = 'preprocessor'
+			selectionManager.selectId('preprocessor')
 		}}
 		on:updateSchema={(e) => {
 			const { payloadData, redirect } = e.detail
@@ -122,7 +127,7 @@
 				previewArgs.val = JSON.parse(JSON.stringify(payloadData))
 			}
 			if (redirect) {
-				$selectedId = 'Input'
+				selectionManager.selectId('Input')
 				$flowInputEditorState.selectedTab = 'captures'
 				$flowInputEditorState.payloadData = payloadData
 			}
@@ -141,7 +146,7 @@
 		schema={flowStore.val.schema}
 		{onDeployTrigger}
 	/>
-{:else if $selectedId.startsWith('subflow:')}
+{:else if selectedId?.startsWith('subflow:')}
 	<div class="p-4"
 		>Selected step is witin an expanded subflow and is not directly editable in the flow editor</div
 	>
@@ -150,7 +155,7 @@
 	{#if dup}
 		<div class="text-red-600 text-xl p-2">There are duplicate modules in the flow at id: {dup}</div>
 	{:else}
-		{#key $selectedId}
+		{#key selectedId}
 			{#each flowStore.val.value.modules as flowModule, index (flowModule.id ?? index)}
 				<FlowModuleWrapper
 					{noEditor}
diff --git a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
index d7b1266868..c40f6465a3 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleComponent.svelte
@@ -59,7 +59,7 @@
 	import { DynamicInput } from '$lib/utils'
 
 	const {
-		selectedId,
+		selectionManager,
 		currentEditor,
 		previewArgs,
 		flowStateStore,
@@ -70,6 +70,8 @@
 		executionCount
 	} = getContext<FlowEditorContext>('FlowEditorContext')
 
+	const selectedId = $derived(selectionManager.getSelectedId())
+
 	interface Props {
 		flowModule: FlowModule
 		failureModule?: boolean
@@ -215,7 +217,7 @@
 	let stepHistoryLoader = getStepHistoryLoaderContext()
 
 	function onSelectedIdChange() {
-		if (!flowStateStore?.val?.[$selectedId]?.schema && flowModule) {
+		if (!flowStateStore?.val?.[selectedId]?.schema && flowModule) {
 			reload(flowModule)
 		}
 	}
@@ -252,7 +254,7 @@
 	)
 
 	$effect.pre(() => {
-		$selectedId && untrack(() => onSelectedIdChange())
+		selectedId && untrack(() => onSelectedIdChange())
 	})
 	let parentLoop = $derived(
 		flowStore.val && flowModule ? checkIfParentLoop(flowStore.val, flowModule.id) : undefined
@@ -404,7 +406,7 @@
 					on:createScriptFromInlineScript={async () => {
 						const [module, state] = await createScriptFromInlineScript(
 							flowModule,
-							$selectedId,
+							selectedId,
 							flowStateStore.val[flowModule.id].schema,
 							$pathStore
 						)
@@ -468,7 +470,7 @@
 												automaticLayout={true}
 												cmdEnterAction={async () => {
 													selected = 'test'
-													if ($selectedId == flowModule.id) {
+													if (selectedId == flowModule.id) {
 														if (flowModule.value.type === 'rawscript' && editor) {
 															flowModule.value.content = editor.getCode()
 														}
@@ -578,7 +580,7 @@
 														class="px-2 xl:px-4"
 														bind:this={inputTransformSchemaForm}
 														pickableProperties={stepPropPicker.pickableProperties}
-														schema={flowStateStore.val[$selectedId]?.schema ?? {}}
+														schema={flowStateStore.val[selectedId]?.schema ?? {}}
 														previousModuleId={previousModule?.id}
 														bind:args={
 															() => {
@@ -609,7 +611,7 @@
 												bind:this={modulePreview}
 												mod={flowModule}
 												{noEditor}
-												schema={flowStateStore.val[$selectedId]?.schema ?? {}}
+												schema={flowStateStore.val[selectedId]?.schema ?? {}}
 												bind:testJob
 												bind:testIsLoading
 												bind:scriptProgress
@@ -623,7 +625,7 @@
 													active={flowModule.retry !== undefined}
 													label="Retries"
 												/>
-												{#if !$selectedId.includes('failure')}
+												{#if !selectedId.includes('failure')}
 													<Tab value="runtime" label="Runtime" />
 													<Tab value="cache" active={Boolean(flowModule.cache_ttl)} label="Cache" />
 													<Tab
@@ -838,7 +840,7 @@
 														<Button
 															btnClasses="mt-4"
 															on:click={() => {
-																$selectedId = 'settings-same-worker'
+																selectionManager.selectId('settings-same-worker')
 															}}
 														>
 															Set shared directory in the flow settings
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte b/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte
index e9e15120fc..4a393893bf 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSleep.svelte
@@ -20,7 +20,7 @@
 
 	let { flowModule = $bindable(), previousModuleId }: Props = $props()
 
-	const { selectedId, flowStore, flowStateStore, previewArgs } =
+	const { selectionManager, flowStore, flowStateStore, previewArgs } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 	let schema = $state(emptySchema())
 	schema.properties['sleep'] = {
@@ -41,7 +41,7 @@
 		)
 	)
 
-	const result = flowStateStore.val[$selectedId]?.previewResult ?? {}
+	const result = flowStateStore.val[selectionManager.getSelectedId()]?.previewResult ?? {}
 
 	let isSleepEnabled = $derived(Boolean(flowModule.sleep))
 </script>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
index fffc702a22..d1d946c5cd 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleSuspend.svelte
@@ -18,8 +18,8 @@
 	import EditableSchemaDrawer from '$lib/components/schema/EditableSchemaDrawer.svelte'
 	import AddProperty from '$lib/components/schema/AddProperty.svelte'
 
-	const { selectedId, flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
-	const result = flowStateStore.val[$selectedId]?.previewResult ?? {}
+	const { selectionManager, flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
+	const result = flowStateStore.val[selectionManager.getSelectedId()]?.previewResult ?? {}
 	let editor: SimpleEditor | undefined = $state(undefined)
 
 	interface Props {
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte b/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
index 21b689206c..d724f241e8 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWorkerTagSelect.svelte
@@ -17,7 +17,7 @@
 		noLabel?: boolean
 	} = $props()
 
-	const { flowStore, selectedId } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { flowStore, selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 
 	const dispatch = createEventDispatcher()
 	loadWorkerGroups()
@@ -44,7 +44,7 @@
 				<button
 					title="Worker Group is defined at the flow level"
 					class="w-full text-left items-center font-normal p-1 py-2 border text-xs rounded"
-					onclick={() => ($selectedId = 'settings-worker-group')}
+					onclick={() => selectionManager.selectId('settings-worker-group')}
 				>
 					Flow's WG: {flowStore.val.tag}
 				</button>
diff --git a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
index 8af071e7f5..cb50e8a327 100644
--- a/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
+++ b/frontend/src/lib/components/flows/content/FlowModuleWrapper.svelte
@@ -23,7 +23,8 @@
 	import { formatCron } from '$lib/utils'
 	import AgentToolWrapper from './AgentToolWrapper.svelte'
 
-	const { selectedId, flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { selectionManager, flowStateStore } = getContext<FlowEditorContext>('FlowEditorContext')
+	const selectedId = $derived(selectionManager.getSelectedId())
 
 	const { triggersState, triggersCount } = getContext<TriggerContext>('TriggerContext')
 
@@ -113,7 +114,7 @@
 	}
 </script>
 
-{#if flowModule.id === $selectedId}
+{#if flowModule.id === selectedId}
 	{#if flowModule.value.type === 'forloopflow'}
 		<FlowLoop {noEditor} bind:mod={flowModule} {parentModule} {previousModule} {enableAi} />
 	{:else if flowModule.value.type === 'whileloopflow'}
@@ -123,13 +124,13 @@
 	{:else if flowModule.value.type === 'branchall'}
 		<FlowBranchesAllWrapper {noEditor} {previousModule} {parentModule} bind:flowModule />
 	{:else if flowModule.value.type === 'identity'}
-		{#if $selectedId == 'failure'}
+		{#if selectedId == 'failure'}
 			<div class="p-4">
 				<Alert type="info" title="Error handlers are triggered upon non recovered errors">
 					If defined, the error handler will take the error as input.
 				</Alert>
 			</div>
-		{:else if $selectedId == 'preprocessor'}
+		{:else if selectedId == 'preprocessor'}
 			<div class="p-4">
 				<Alert
 					type="info"
@@ -157,8 +158,8 @@
 				summary={flowModule.summary}
 				shouldDisableTriggerScripts={parentModule !== undefined ||
 					previousModule !== undefined ||
-					$selectedId == 'failure' ||
-					$selectedId == 'preprocessor'}
+					selectedId == 'failure' ||
+					selectedId == 'preprocessor'}
 				on:pick={async ({ detail }) => {
 					const { path, summary, kind, hash } = detail
 					createModuleFromScript(path, summary, kind, hash)
@@ -187,8 +188,8 @@
 					flowModule = module
 					flowStateStore.val[module.id] = state
 				}}
-				failureModule={$selectedId === 'failure'}
-				preprocessorModule={$selectedId === 'preprocessor'}
+				failureModule={selectedId === 'failure'}
+				preprocessorModule={selectedId === 'preprocessor'}
 			/>
 		{/if}
 	{:else if flowModule.value.type === 'rawscript' || flowModule.value.type === 'script' || flowModule.value.type === 'flow' || flowModule.value.type === 'aiagent'}
@@ -197,8 +198,8 @@
 			bind:flowModule
 			{parentModule}
 			{previousModule}
-			failureModule={$selectedId === 'failure'}
-			preprocessorModule={$selectedId === 'preprocessor'}
+			failureModule={selectedId === 'failure'}
+			preprocessorModule={selectedId === 'preprocessor'}
 			{scriptKind}
 			{scriptTemplate}
 			{enableAi}
@@ -225,7 +226,7 @@
 		/>
 	{/each}
 {:else if flowModule.value.type === 'branchone'}
-	{#if $selectedId === `${flowModule?.id}-branch-default`}
+	{#if selectedId === `${flowModule?.id}-branch-default`}
 		<div class="p-2">
 			<h3 class="mb-4">Default branch</h3>
 			Nothing to configure, this is the default branch if none of the predicates are met.
@@ -247,7 +248,7 @@
 		{/each}
 	{/if}
 	{#each flowModule.value.branches as branch, branchIndex (branchIndex)}
-		{#if $selectedId === `${flowModule?.id}-branch-${branchIndex}`}
+		{#if selectedId === `${flowModule?.id}-branch-${branchIndex}`}
 			<FlowBranchOneWrapper
 				{noEditor}
 				bind:branch={flowModule.value.branches[branchIndex]}
@@ -274,7 +275,7 @@
 	{/each}
 {:else if flowModule.value.type === 'branchall'}
 	{#each flowModule.value.branches as branch, branchIndex (branchIndex)}
-		{#if $selectedId === `${flowModule?.id}-branch-${branchIndex}`}
+		{#if selectedId === `${flowModule?.id}-branch-${branchIndex}`}
 			<FlowBranchAllWrapper {noEditor} bind:branch={flowModule.value.branches[branchIndex]} />
 		{:else}
 			{#each branch.modules as _, index}
@@ -295,7 +296,7 @@
 	{/each}
 {:else if flowModule.value.type === 'aiagent'}
 	{#each flowModule.value.tools as tool, toolIndex (toolIndex)}
-		{#if $selectedId === tool.id}
+		{#if selectedId === tool.id}
 			<AgentToolWrapper
 				{noEditor}
 				bind:tool={flowModule.value.tools[toolIndex]}
diff --git a/frontend/src/lib/components/flows/content/FlowSelectionPanel.svelte b/frontend/src/lib/components/flows/content/FlowSelectionPanel.svelte
new file mode 100644
index 0000000000..b14f090afc
--- /dev/null
+++ b/frontend/src/lib/components/flows/content/FlowSelectionPanel.svelte
@@ -0,0 +1,44 @@
+<script lang="ts">
+	import FlowCard from '../common/FlowCard.svelte'
+	import type { SelectionManager } from '$lib/components/graph/selectionUtils.svelte'
+	import { Button } from '$lib/components/common'
+	import { getNoteEditorContext } from '$lib/components/graph/noteEditor.svelte'
+	import { StickyNote } from 'lucide-svelte'
+
+	interface Props {
+		selectionManager: SelectionManager
+		noEditor: boolean
+	}
+	let { selectionManager, noEditor }: Props = $props()
+
+	const noteEditorContext = getNoteEditorContext()
+
+	function addGroupNote() {
+		if (selectionManager.selectedIds.length > 0 && noteEditorContext?.noteEditor) {
+			// Create the group note
+			noteEditorContext.noteEditor.createGroupNote(selectionManager.selectedIds)
+		}
+	}
+</script>
+
+<FlowCard {noEditor} title="Multiple Selection">
+	{#snippet action()}
+		<Button
+			onClick={addGroupNote}
+			disabled={!noteEditorContext?.noteEditor || selectionManager.selectedIds.length === 0}
+			startIcon={{ icon: StickyNote }}
+		>
+			Create group note
+		</Button>
+	{/snippet}
+	<div class="px-4">
+		<p class="text-xs text-secondary mb-4">{selectionManager.selectedIds.length} nodes selected</p>
+		<div class="space-y-2 mb-4">
+			{#each selectionManager.selectedIds as nodeId}
+				<div class="text-sm px-2 py-1 bg-surface rounded border">
+					{nodeId}
+				</div>
+			{/each}
+		</div>
+	</div>
+</FlowCard>
diff --git a/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte b/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte
index d349b05500..64c4416d45 100644
--- a/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte
+++ b/frontend/src/lib/components/flows/header/FlowPreviewButtons.svelte
@@ -25,7 +25,7 @@
 		localModuleStates = $bindable({})
 	}: Props = $props()
 
-	const { selectedId } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { selectionManager } = getContext<FlowEditorContext>('FlowEditorContext')
 
 	let flowPreviewContent: FlowPreviewContent | undefined = $state(undefined)
 	let preventEscape = $state(false)
@@ -70,7 +70,7 @@
 		$state('timeline')
 
 	let upToDisabled = $derived.by(() => {
-		const upToSelected = upToId ?? $selectedId
+		const upToSelected = upToId ?? selectionManager.getSelectedId()
 		return (
 			upToSelected == undefined ||
 			[
@@ -92,7 +92,7 @@
 				'constants',
 				'Result',
 				'Input',
-				'triggers'
+				'Trigger'
 			].includes(upToSelected) ||
 			upToSelected?.includes('branch') ||
 			aiChatManager.flowAiChatHelpers?.getModuleAction(upToSelected) === 'removed'
@@ -144,8 +144,8 @@
 	dropdownItems={!upToDisabled
 		? [
 				{
-					label: 'Test up to ' + $selectedId,
-					onClick: () => testUpTo($selectedId, true)
+					label: 'Test up to ' + selectionManager.getSelectedId(),
+					onClick: () => testUpTo(selectionManager.getSelectedId(), true)
 				}
 			]
 		: undefined}
diff --git a/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte b/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
index 2a80a34f37..c9d681da50 100644
--- a/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
+++ b/frontend/src/lib/components/flows/map/FlowErrorHandlerItem.svelte
@@ -29,7 +29,7 @@
 		generateStep: { moduleId: string; instructions: string; lang: ScriptLang }
 	}>()
 
-	const { selectedId, flowStateStore, flowStore } =
+	const { selectionManager, flowStateStore, flowStore } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
 	async function insertFailureModule(
@@ -50,7 +50,7 @@
 			})
 		}
 
-		$selectedId = 'failure'
+		selectionManager.selectId('failure')
 		refreshStateStore(flowStore)
 	}
 
@@ -70,10 +70,10 @@
 			aiModuleActionToTextColor(action)
 		)}
 		id="flow-editor-error-handler"
-		selected={$selectedId?.includes('failure')}
+		selected={selectionManager.getSelectedId()?.includes('failure')}
 		onClick={() => {
 			if (flowStore.val?.value?.failure_module) {
-				$selectedId = 'failure'
+				selectionManager.selectId('failure')
 			}
 		}}
 	>
@@ -95,7 +95,7 @@
 				class="ml-1"
 				onclick={() => {
 					flowStore.val.value.failure_module = undefined
-					$selectedId = 'settings-metadata'
+					selectionManager.selectId('settings-metadata')
 				}}
 			>
 				<X size={12} />
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte
index 494715ad29..75a12d1e11 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaItem.svelte
@@ -281,7 +281,7 @@
 		style="width: 275px; height: 34px;"
 		onmouseenter={() => (hover = true)}
 		onmouseleave={() => (hover = false)}
-		onpointerdown={stopPropagation(preventDefault(() => dispatch('pointerdown')))}
+		onpointerdown={stopPropagation(preventDefault((e) => dispatch('pointerdown', e)))}
 	>
 		{#if deletable}
 			<ModuleAcceptReject action={moduleAction ?? action} {id} />
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 0b0bcdb778..1b7af36c41 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -42,6 +42,7 @@
 	import { ModulesTestStates } from '$lib/components/modulesTest.svelte'
 	import type { StateStore } from '$lib/utils'
 	import { type AgentTool, flowModuleToAgentTool, createMcpTool } from '../agentToolUtils'
+	import { getNoteEditorContext } from '$lib/components/graph/noteEditor.svelte'
 
 	interface Props {
 		sidebarSize?: number | undefined
@@ -105,12 +106,15 @@
 
 	let flowTutorials: FlowTutorials | undefined = $state(undefined)
 
-	const { customUi, selectedId, moving, history, flowStateStore, flowStore, pathStore } =
+	const { customUi, selectionManager, moving, history, flowStateStore, flowStore, pathStore } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 	const { triggersCount, triggersState } = getContext<TriggerContext>('TriggerContext')
 
 	const { flowPropPickerConfig } = getContext<PropPickerContext>('PropPickerContext')
 
+	// Get NoteEditor context for note position updates
+	const noteEditorContext = getNoteEditorContext()
+
 	export async function insertNewModuleAtIndex(
 		modules: FlowModule[] | AgentTool[],
 		index: number,
@@ -238,9 +242,9 @@
 			let allIds = dfs(flowStore.val.value.modules, (mod) => mod.id)
 			if (allIds.length > 1) {
 				const idx = allIds.indexOf(id)
-				$selectedId = idx == 0 ? allIds[0] : allIds[idx - 1]
+				selectionManager.selectId(idx == 0 ? allIds[0] : allIds[idx - 1])
 			} else {
-				$selectedId = 'settings-metadata'
+				selectionManager.selectId('settings-metadata')
 			}
 		}
 	}
@@ -290,10 +294,19 @@
 	let dependents: Record<string, string[]> = $state({})
 
 	let graph: FlowGraphV2 | undefined = $state(undefined)
+	let noteMode = $state(false)
 	export function isNodeVisible(nodeId: string): boolean {
 		return graph?.isNodeVisible(nodeId) ?? false
 	}
 
+	export function enableNotes(): void {
+		graph?.enableNotes?.()
+	}
+
+	function toggleNoteMode() {
+		noteMode = !noteMode
+	}
+
 	function shouldRunTutorial(tutorialName: string, name: string, index: number) {
 		return (
 			$tutorialsToDo.includes(index) &&
@@ -400,6 +413,8 @@
 			on:generateStep
 			{aiChatOpen}
 			{toggleAiChat}
+			{noteMode}
+			{toggleNoteMode}
 		/>
 	</div>
 
@@ -418,8 +433,10 @@
 			moving={$moving?.id}
 			maxHeight={minHeight}
 			modules={flowStore.val.value.modules}
+			{noteMode}
+			notes={flowStore.val.value.notes}
 			preprocessorModule={flowStore.val.value?.preprocessor_module}
-			{selectedId}
+			{selectionManager}
 			{workspace}
 			editMode
 			{onTestUpTo}
@@ -438,7 +455,7 @@
 				const cb = () => {
 					push(history, flowStore.val)
 					if (id === 'preprocessor') {
-						$selectedId = 'Input'
+						selectionManager.selectId('Input')
 						flowStore.val.value.preprocessor_module = undefined
 					} else {
 						selectNextId(id)
@@ -497,7 +514,7 @@
 
 							let [removedModule] = originalModules.splice(indexToRemove, 1)
 							targetModules.splice(detail.index, 0, removedModule)
-							$selectedId = removedModule.id
+							selectionManager.selectId(removedModule.id)
 							$moving = undefined
 						} else {
 							if (detail.isPreprocessor) {
@@ -507,7 +524,7 @@
 									detail.inlineScript,
 									detail.script
 								)
-								$selectedId = 'preprocessor'
+								selectionManager.selectId('preprocessor')
 
 								if (detail.inlineScript?.instructions) {
 									dispatch('generateStep', {
@@ -534,7 +551,7 @@
 									toolKind
 								)
 								const id = targetModules[index].id
-								$selectedId = id
+								selectionManager.selectId(id)
 
 								if (detail.inlineScript?.instructions) {
 									dispatch('generateStep', {
@@ -619,13 +636,13 @@
 				flowStateStore.val[newId] = flowStateStore.val[id]
 				delete flowStateStore.val[id]
 				refreshStateStore(flowStore)
-				$selectedId = newId
+				selectionManager.selectId(newId)
 			}}
 			onDeleteBranch={async ({ id, index }) => {
 				if (id) {
 					await removeBranch(id, index)
 					refreshStateStore(flowStore)
-					$selectedId = id
+					selectionManager.selectId(id)
 				}
 			}}
 			onMove={(id) => {
@@ -645,6 +662,14 @@
 			{onCancelTestFlow}
 			{onOpenPreview}
 			{onHideJobStatus}
+			exitNoteMode={() => (noteMode = false)}
+			onNotePositionUpdate={(noteId, position) => {
+				// Update note position via NoteEditor context in edit mode
+				if (noteEditorContext?.noteEditor) {
+					noteEditorContext.noteEditor.updatePosition(noteId, position)
+				}
+			}}
+			multiSelectEnabled
 		/>
 	</div>
 </div>
diff --git a/frontend/src/lib/components/flows/map/FlowStickyNode.svelte b/frontend/src/lib/components/flows/map/FlowStickyNode.svelte
index 48e7445593..b1821f98e3 100644
--- a/frontend/src/lib/components/flows/map/FlowStickyNode.svelte
+++ b/frontend/src/lib/components/flows/map/FlowStickyNode.svelte
@@ -2,7 +2,7 @@
 	import type { FlowEditorContext } from '../types'
 	import { getContext } from 'svelte'
 	import { Badge } from '$lib/components/common'
-	import { DollarSign, Settings } from 'lucide-svelte'
+	import { DollarSign, Settings, StickyNote } from 'lucide-svelte'
 	import FlowErrorHandlerItem from './FlowErrorHandlerItem.svelte'
 	import FlowAIButton from '$lib/components/copilot/chat/flow/FlowAIButton.svelte'
 	import Popover from '$lib/components/Popover.svelte'
@@ -15,6 +15,8 @@
 		aiChatOpen?: boolean
 		showFlowAiButton?: boolean
 		toggleAiChat?: () => void
+		noteMode?: boolean
+		toggleNoteMode?: () => void
 		disableAi?: boolean
 	}
 
@@ -25,10 +27,13 @@
 		aiChatOpen,
 		showFlowAiButton,
 		toggleAiChat,
+		noteMode,
+		toggleNoteMode,
 		disableAi
 	}: Props = $props()
 
-	const { selectedId, flowStore } = getContext<FlowEditorContext>('FlowEditorContext')
+	const { selectionManager, flowStore } = getContext<FlowEditorContext>('FlowEditorContext')
+	const selectedId = $derived(selectionManager.getSelectedId())
 </script>
 
 <div class="flex flex-row gap-2 p-1 rounded-md bg-surface">
@@ -37,10 +42,10 @@
 			unifiedSize="sm"
 			wrapperClasses="min-w-36"
 			startIcon={{ icon: Settings }}
-			selected={$selectedId?.startsWith('settings')}
+			selected={selectedId?.startsWith('settings')}
 			variant="default"
 			title="Settings"
-			onClick={() => ($selectedId = 'settings')}
+			onClick={() => selectionManager.selectId('settings')}
 		>
 			Settings
 			{#if flowStore.val.value.same_worker}
@@ -60,10 +65,10 @@
 				wrapperClasses="h-full"
 				unifiedSize="sm"
 				startIcon={{ icon: DollarSign }}
-				selected={$selectedId === 'constants'}
+				selected={selectedId === 'constants'}
 				variant="default"
 				iconOnly
-				onClick={() => ($selectedId = 'constants')}
+				onClick={() => selectionManager.selectId('constants')}
 			/>
 			{#snippet text()}
 				Environment Variables
@@ -83,4 +88,17 @@
 			{/snippet}
 		</Popover>
 	{/if}
+	<Popover>
+		<Button
+			onclick={() => toggleNoteMode?.()}
+			iconOnly
+			variant="default"
+			unifiedSize="sm"
+			startIcon={{ icon: StickyNote }}
+			selected={noteMode}
+		></Button>
+		{#snippet text()}
+			{noteMode ? 'Exit note mode' : 'Add sticky notes'}
+		{/snippet}
+	</Popover>
 </div>
diff --git a/frontend/src/lib/components/flows/map/MapItem.svelte b/frontend/src/lib/components/flows/map/MapItem.svelte
index 2021b10e91..08d88f26aa 100644
--- a/frontend/src/lib/components/flows/map/MapItem.svelte
+++ b/frontend/src/lib/components/flows/map/MapItem.svelte
@@ -2,7 +2,6 @@
 	import { Button } from '$lib/components/common'
 	import type { FlowModule, Job } from '$lib/gen'
 	import { createEventDispatcher, getContext } from 'svelte'
-	import type { Writable } from 'svelte/store'
 	import FlowModuleSchemaItem from './FlowModuleSchemaItem.svelte'
 	import FlowModuleIcon from '../FlowModuleIcon.svelte'
 	import { prettyLanguage } from '$lib/common'
@@ -17,6 +16,7 @@
 	import { twMerge } from 'tailwind-merge'
 	import type { FlowNodeState } from '$lib/components/graph'
 	import type { AIModuleAction } from '$lib/components/copilot/chat/flow/core'
+	import { getGraphContext } from '$lib/components/graph/graphContext'
 
 	interface Props {
 		moduleId: string
@@ -74,9 +74,7 @@
 		maximizeSubflow
 	}: Props = $props()
 
-	const { selectedId } = getContext<{
-		selectedId: Writable<string | undefined>
-	}>('FlowGraphContext')
+	const { selectionManager } = getGraphContext()
 
 	const { flowStore } = getContext<FlowEditorContext | undefined>('FlowEditorContext') || {}
 
@@ -88,7 +86,7 @@
 	}>()
 
 	let itemProps = $derived({
-		selected: $selectedId === mod.id,
+		selected: selectionManager && selectionManager.isNodeSelected(mod.id),
 		retry: mod.retry?.constant != undefined || mod.retry?.exponential != undefined,
 		earlyStop: mod.stop_after_if != undefined || mod.stop_after_all_iters_if != undefined,
 		skip: Boolean(mod.skip_if),
@@ -102,6 +100,13 @@
 	let parentLoop = $derived(
 		flowStore?.val && mod ? checkIfParentLoop(flowStore.val, mod.id) : undefined
 	)
+
+	function handlePointerDown(e: CustomEvent<PointerEvent>) {
+		// Only handle left clicks (button 0)
+		if (e.detail.button === 0) {
+			onSelect(mod.id)
+		}
+	}
 </script>
 
 {#if mod}
@@ -164,7 +169,7 @@
 					on:changeId
 					on:move
 					on:delete
-					on:pointerdown={() => onSelect(mod.id)}
+					on:pointerdown={handlePointerDown}
 					onUpdateMock={(mock) => {
 						mod.mock = mock
 						onUpdateMock?.({ id: mod.id, mock })
@@ -193,7 +198,7 @@
 					on:changeId
 					on:delete
 					on:move
-					on:pointerdown={() => onSelect(mod.id)}
+					on:pointerdown={handlePointerDown}
 					{...itemProps}
 					id={mod.id}
 					label={mod.summary || 'Run one branch'}
@@ -213,7 +218,7 @@
 					on:changeId
 					on:delete
 					on:move
-					on:pointerdown={() => onSelect(mod.id)}
+					on:pointerdown={handlePointerDown}
 					id={mod.id}
 					{...itemProps}
 					label={mod.summary || `Run all branches${mod.value.parallel ? ' (parallel)' : ''}`}
@@ -231,7 +236,7 @@
 					{moduleAction}
 					{onShowModuleDiff}
 					on:changeId
-					on:pointerdown={() => onSelect(mod.id)}
+					on:pointerdown={handlePointerDown}
 					on:delete
 					on:move
 					onUpdateMock={(mock) => {
diff --git a/frontend/src/lib/components/flows/types.ts b/frontend/src/lib/components/flows/types.ts
index 733cd304aa..6ed09a1436 100644
--- a/frontend/src/lib/components/flows/types.ts
+++ b/frontend/src/lib/components/flows/types.ts
@@ -15,6 +15,8 @@ import type ResourceEditorDrawer from '../ResourceEditorDrawer.svelte'
 import type { ModulesTestStates } from '../modulesTest.svelte'
 import type { ButtonProp } from '$lib/components/DiffEditor.svelte'
 
+import type { SelectionManager } from '../graph/selectionUtils.svelte'
+
 export type FlowInput = Record<
 	string,
 	{
@@ -28,6 +30,7 @@ export type FlowInput = Record<
 	}
 >
 
+// Extended OpenFlow with additional properties not in the core spec
 export type ExtendedOpenFlow = OpenFlow & {
 	tag?: string
 	ws_error_handler_muted?: boolean
@@ -68,7 +71,7 @@ export type CurrentEditor =
 	| undefined
 
 export type FlowEditorContext = {
-	selectedId: Writable<string>
+	selectionManager: SelectionManager
 	currentEditor: Writable<CurrentEditor>
 	moving: Writable<{ id: string } | undefined>
 	previewArgs: StateStore<Record<string, any>>
diff --git a/frontend/src/lib/components/graph/FlowGraphV2.svelte b/frontend/src/lib/components/graph/FlowGraphV2.svelte
index 3b41cf2035..26a3ed2aed 100644
--- a/frontend/src/lib/components/graph/FlowGraphV2.svelte
+++ b/frontend/src/lib/components/graph/FlowGraphV2.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
-	import { FlowService, type FlowModule, type Job } from '../../gen'
-	import { NODE, type GraphModuleState } from '.'
-	import { getContext, onDestroy, setContext, tick, untrack, type Snippet } from 'svelte'
+	import { FlowService, type FlowModule, type FlowNote, type Job } from '../../gen'
+	import { AI_OR_ASSET_NODE_TYPES, NODE, type GraphModuleState } from '.'
+	import { getContext, onDestroy, onMount, tick, untrack, type Snippet } from 'svelte'
 
 	import { get, writable, type Writable } from 'svelte/store'
 	import '@xyflow/svelte/dist/base.css'
@@ -13,7 +13,8 @@
 		Controls,
 		ControlButton,
 		SvelteFlowProvider,
-		type Viewport
+		type Viewport,
+		SelectionMode
 	} from '@xyflow/svelte'
 	import {
 		graphBuilder,
@@ -35,10 +36,10 @@
 	import BaseEdge from './renderers/edges/BaseEdge.svelte'
 	import EmptyEdge from './renderers/edges/EmptyEdge.svelte'
 	import { sugiyama, dagStratify, coordCenter, decrossTwoLayer, decrossOpt } from 'd3-dag'
-	import { Expand } from 'lucide-svelte'
+	import { Expand, MousePointer, Hand } from 'lucide-svelte'
 	import Toggle from '../Toggle.svelte'
 	import DataflowEdge from './renderers/edges/DataflowEdge.svelte'
-	import { encodeState, readFieldsRecursively } from '$lib/utils'
+	import { encodeState, readFieldsRecursively, getModifierKey, isMac } from '$lib/utils'
 	import BranchOneStart from './renderers/nodes/BranchOneStart.svelte'
 	import NoBranchNode from './renderers/nodes/NoBranchNode.svelte'
 	import HiddenBaseEdge from './renderers/edges/HiddenBaseEdge.svelte'
@@ -57,14 +58,26 @@
 	import type { FlowGraphAssetContext } from '../flows/types'
 	import AiToolNode, { computeAIToolNodes } from './renderers/nodes/AIToolNode.svelte'
 	import NewAiToolNode from './renderers/nodes/NewAIToolNode.svelte'
+	import NoteNode from './renderers/nodes/NoteNode.svelte'
+	import NoteTool from './NoteTool.svelte'
+	import SelectionBoundingBox from './SelectionBoundingBox.svelte'
+	import SelectionTool from './SelectionTool.svelte'
+	import PaneContextMenu from './PaneContextMenu.svelte'
+	import { SelectionManager } from './selectionUtils.svelte'
 	import { ChangeTracker } from '$lib/svelte5Utils.svelte'
+	import { NoteManager } from './noteManager.svelte'
 	import type { ModulesTestStates } from '../modulesTest.svelte'
 	import { deepEqual } from 'fast-equals'
 	import type { AssetWithAltAccessType } from '../assets/lib'
 	import type { AIModuleAction } from '../copilot/chat/flow/core'
+	import { setGraphContext } from './graphContext'
+	import { computeNoteNodes } from './noteUtils.svelte'
+	import { Tooltip } from '../meltComponents'
+	import { getNoteEditorContext } from './noteEditor.svelte'
 
 	let useDataflow: Writable<boolean | undefined> = writable<boolean | undefined>(false)
 	let showAssets: Writable<boolean | undefined> = writable<boolean | undefined>(true)
+	let showNotes = $state(true)
 
 	const triggerContext = getContext<TriggerContext>('TriggerContext')
 
@@ -85,7 +98,7 @@
 		testModuleStates?: ModulesTestStates
 		moduleActions?: Record<string, AIModuleAction>
 		inputSchemaModified?: boolean
-		selectedId?: Writable<string | undefined>
+		selectionManager?: SelectionManager
 		path?: string | undefined
 		newFlow?: boolean
 		insertable?: boolean
@@ -108,7 +121,10 @@
 		flowJob?: Job | undefined
 		showJobStatus?: boolean
 		suspendStatus?: Record<string, { job: Job; nb: number }>
+		noteMode?: boolean
+		notes?: FlowNote[]
 		chatInputEnabled?: boolean
+		multiSelectEnabled?: boolean
 		onDelete?: (id: string) => void
 		onInsert?: (detail: {
 			sourceId?: string
@@ -138,6 +154,8 @@
 		onHideJobStatus?: () => void
 		onShowModuleDiff?: (moduleId: string) => void
 		flowHasChanged?: boolean
+		exitNoteMode?: () => void
+		onNotePositionUpdate?: (noteId: string, position: { x: number; y: number }) => void
 		// Viewport synchronization props (for diff viewer)
 		sharedViewport?: Viewport
 		onViewportChange?: (viewport: Viewport, isUserInitiated: boolean) => void
@@ -152,7 +170,6 @@
 		onNewBranch = undefined,
 		onSelect = undefined,
 		onChangeId = undefined,
-
 		onUpdateMock = undefined,
 		onSelectedIteration = undefined,
 		success = undefined,
@@ -166,7 +183,7 @@
 		testModuleStates = undefined,
 		moduleActions = undefined,
 		inputSchemaModified = undefined,
-		selectedId = writable<string | undefined>(undefined),
+		selectionManager: selectionManagerProp = undefined,
 		path = undefined,
 		newFlow = false,
 		insertable = false,
@@ -196,17 +213,68 @@
 		showJobStatus = false,
 		suspendStatus = {},
 		flowHasChanged = false,
+		noteMode = false,
+		notes = undefined,
+		exitNoteMode = undefined,
+		onNotePositionUpdate = undefined,
 		chatInputEnabled = false,
 		sharedViewport = undefined,
 		onViewportChange = undefined,
-		leftHeader = undefined
+		leftHeader = undefined,
+		multiSelectEnabled = false
 	}: Props = $props()
 
-	setContext<{
-		selectedId: Writable<string | undefined>
-		useDataflow: Writable<boolean | undefined>
-		showAssets: Writable<boolean | undefined>
-	}>('FlowGraphContext', { selectedId, useDataflow, showAssets })
+	// Initialize note manager with fine-grained reactivity
+	const noteManager = new NoteManager(
+		() => notes ?? [],
+		(newNodes) => {
+			nodes = newNodes
+		},
+		() => nodes
+	)
+
+	// Runtime text height tracking for notes (not stored in FlowNote)
+	let noteTextHeights = $state<Record<string, number>>({})
+
+	// Reference to pane context menu component
+	let paneContextMenu: PaneContextMenu | undefined = $state(undefined)
+	let flowContainer: HTMLDivElement | undefined = $state(undefined)
+
+	// Selection manager - create one if not provided
+	let selectionManager = selectionManagerProp || new SelectionManager()
+	const selectedId = $derived(selectionManager.getSelectedId())
+
+	const noteEditorContext = getNoteEditorContext()
+
+	// Function to calculate extra gap needed for notes below the lowest flow nodes
+	function calculateNoteGap(notes: FlowNote[] | undefined): number {
+		console.log('calculateNoteGap', notes)
+		if (!notes || notes.length === 0) {
+			return 0
+		}
+		let maxNoteBelowGap = 0
+
+		notes.forEach((note) => {
+			if (note.position?.y && note.position.y < 0) {
+				maxNoteBelowGap = Math.max(maxNoteBelowGap, -note.position.y)
+			}
+		})
+
+		return maxNoteBelowGap
+	}
+
+	// Calculate note gap based on current nodes and notes
+	const topPadding = editMode ? 100 : 24
+	const yOffset = calculateNoteGap(notes) + topPadding
+
+	setGraphContext({
+		selectionManager: selectionManager,
+		useDataflow,
+		showAssets,
+		noteManager,
+		clearFlowSelection,
+		yOffset
+	} as any)
 
 	if (triggerContext && allowSimplifiedPoll) {
 		if (isSimplifiable(modules)) {
@@ -235,9 +303,15 @@
 		)
 	}
 
-	type NodeDep = { id: string; parentIds?: string[]; offset?: number }
+	type NodeDep = {
+		id: string
+		parentIds?: string[]
+		offset?: number
+		data?: { assets?: AssetWithAltAccessType[] }
+	}
 	type NodePos = { position: { x: number; y: number } }
 	let lastNodes: [NodeDep[], (NodeDep & NodePos)[]] | undefined = undefined
+
 	function layoutNodes(nodes: NodeDep[]): (NodeDep & NodePos)[] {
 		let lastResult = lastNodes?.[1]
 		if (lastResult && deepEqual(nodes, lastNodes?.[0])) {
@@ -292,7 +366,6 @@
 			boxSize = layout(dag as any)
 		}
 
-		const yOffset = insertable ? 100 : 0
 		const newNodes = dag.descendants().map((des) => ({
 			id: des.data.id,
 			position: {
@@ -306,7 +379,7 @@
 						NODE.width / 2 -
 						(width - fullWidth) / 2
 					: 0,
-				y: (des.y || 0) + yOffset
+				y: des.y || 0
 			}
 		}))
 
@@ -316,7 +389,7 @@
 
 	let eventHandler = {
 		deleteBranch: (detail, label) => {
-			$selectedId = label
+			selectionManager.selectId(label)
 			onDeleteBranch?.(detail)
 		},
 		insert: (detail) => {
@@ -324,9 +397,6 @@
 		},
 		select: (modId) => {
 			if (!notSelectable) {
-				if ($selectedId != modId) {
-					$selectedId = modId
-				}
 				onSelect?.(modId)
 			}
 		},
@@ -387,6 +457,25 @@
 
 	let height = $state(0)
 
+	// Derived nodes with yOffset applied to all nodes uniformly and selectable flag set to false if notSelectable is true
+	const nodesWithOffset = $derived.by(() => {
+		return nodes.map((node) => {
+			if (node.type && !AI_OR_ASSET_NODE_TYPES.includes(node.type)) {
+				return {
+					...node,
+					position: { ...node.position, y: node.position.y + yOffset },
+					selectable: notSelectable ? false : node.selectable
+				}
+			}
+			return {
+				...node,
+				selectable: notSelectable ? false : node.selectable
+			}
+		})
+	})
+
+	// Note feature state
+
 	function isSimplifiable(modules: FlowModule[] | undefined): boolean {
 		if (!modules || modules?.length !== 2) {
 			return false
@@ -399,17 +488,40 @@
 		return false
 	}
 
+	// Clear SvelteFlow's internal selection by creating new nodes array
+	function clearFlowSelection() {
+		nodes = nodes.map((node) => {
+			if (node.selected) {
+				return { ...node, selected: false }
+			}
+			return node
+		})
+	}
+
+	// Keyboard event handling
+	function handleKeyDown(event: KeyboardEvent) {
+		selectionManager.handleKeyDown(event)
+		noteManager.handleKeyDown(event)
+		if (event.key === 'Escape') {
+			if (noteMode) {
+				exitNoteMode?.()
+			}
+		}
+	}
+
 	async function updateStores() {
 		if (graph.error) {
 			return
 		}
+
 		// console.log('compute')
 
 		let layoutedNodes = layoutNodes(
 			Object.values(graph.nodes).map((n) => ({
 				id: n.id,
 				parentIds: n.parentIds,
-				offset: n.data.offset ?? 0
+				offset: n.data.offset ?? 0,
+				data: { assets: (n.data as any).assets }
 			}))
 		)
 		let newNodes: (Node & NodeLayout)[] = layoutedNodes.map((n) => ({ ...n, ...graph.nodes[n.id] }))
@@ -430,11 +542,50 @@
 			}))
 		}
 		let aiToolNodesResult = computeAIToolNodes(newNodes, eventHandler, insertable, flowModuleStates)
-		nodes = [
-			...newNodes.map((n) => ({ ...n, position: aiToolNodesResult.newNodePositions[n.id] })),
+		let nodesAfterAITools = newNodes.map((n) => ({
+			...n,
+			position: aiToolNodesResult.newNodePositions[n.id]
+		}))
+
+		let finalNodes = [
+			...nodesAfterAITools,
 			...(assetNodesResult?.newAssetNodes ?? []),
 			...aiToolNodesResult.toolNodes
 		]
+
+		// Compute note nodes and positions
+		let noteNodesResult = showNotes
+			? computeNoteNodes(
+					finalNodes.map((n) => ({
+						id: n.id,
+						position: n.position,
+						parentIds: n.parentIds,
+						offset: n.data?.offset ?? 0,
+						data: { assets: (n.data as any)?.assets },
+						type: n.type
+					})),
+					notes ?? [],
+					noteTextHeights,
+					(noteId: string, height: number) => {
+						noteTextHeights[noteId] = height
+						noteManager.render()
+					},
+					editMode,
+					noteEditorContext
+				)
+			: undefined
+
+		// Apply note positioning to nodes if notes are enabled
+		if (noteNodesResult) {
+			finalNodes = finalNodes.map((n) => ({
+				...n,
+				position: noteNodesResult.newNodePositions[n.id] || n.position
+			}))
+		}
+
+		// update nodes
+		nodes = [...finalNodes, ...(noteNodesResult?.noteNodes ?? [])]
+
 		edges = [
 			...(assetNodesResult?.newAssetEdges ?? []),
 			...aiToolNodesResult.toolEdges,
@@ -442,7 +593,13 @@
 		]
 
 		await tick()
-		height = Math.max(...nodes.map((n) => n.position.y + NODE.height + 100), minHeight)
+		if (nodes.length === 0) {
+			height = minHeight
+		} else {
+			const minY = Math.min(...nodes.map((n) => n.position.y))
+			const maxBottom = Math.max(...nodes.map((n) => n.position.y + NODE.height + 100))
+			height = Math.max(maxBottom - minY, minHeight)
+		}
 	}
 
 	const nodeTypes = {
@@ -463,7 +620,8 @@
 		asset: AssetNode,
 		assetsOverflowed: AssetsOverflowedNode,
 		aiTool: AiToolNode,
-		newAiTool: NewAiToolNode
+		newAiTool: NewAiToolNode,
+		note: NoteNode
 	} as any
 
 	const edgeTypes = {
@@ -501,7 +659,7 @@
 				testModuleStates: untrack(() => testModuleStates),
 				moduleActions: untrack(() => moduleActions),
 				inputSchemaModified: untrack(() => inputSchemaModified),
-				selectedId: untrack(() => $selectedId),
+				selectedId: untrack(() => selectedId),
 				path,
 				newFlow,
 				cache,
@@ -523,7 +681,7 @@
 			eventHandler,
 			success,
 			$useDataflow,
-			untrack(() => $selectedId),
+			untrack(() => selectedId),
 			moving,
 			simplifiableFlow,
 			triggerNode ? path : undefined,
@@ -533,20 +691,80 @@
 	let hideAssetsToggle = $derived(
 		$showAssets && Object.values(nodes).every((n) => n.type !== 'asset')
 	)
+	let hideNotesToggle = $derived(!notes || notes.length === 0)
 
 	$effect(() => {
-		;[graph, allowSimplifiedPoll, $showAssets]
-		untrack(() => updateStores())
+		;[graph, allowSimplifiedPoll, $showAssets, showNotes, noteManager.renderCount]
+		untrack(async () => {
+			await updateStores()
+		})
+	})
+
+	// Add global keyboard event listener for selection controls
+	onMount(() => {
+		function globalKeyDownHandler(event: KeyboardEvent) {
+			handleKeyDown(event)
+		}
+
+		document.addEventListener('keydown', globalKeyDownHandler)
+
+		return () => {
+			document.removeEventListener('keydown', globalKeyDownHandler)
+		}
+	})
+
+	// DOM event handling for pane clicks in rect-select mode
+	$effect(() => {
+		// Only add manual handling when in rect-select mode
+		if (selectionManager.mode !== 'rect-select') {
+			return
+		}
+
+		function paneClickHandler(event: Event) {
+			// Find the pane within our specific flow container
+			const pane = flowContainer?.querySelector('.svelte-flow__pane')
+			if (!pane || !event.target || !pane.contains(event.target as Element)) {
+				return
+			}
+
+			// Don't trigger if clicking on nodes or UI elements
+			const target = event.target as Element
+			if (
+				target.closest('.svelte-flow__node') ||
+				target.closest('button') ||
+				target.closest('[role="button"]') ||
+				target.closest('.svelte-flow__controls')
+			) {
+				return
+			}
+
+			// Trigger the same logic as onpaneclick
+			document.dispatchEvent(new Event('focus'))
+			selectionManager.clearSelection()
+		}
+
+		const pane = flowContainer?.querySelector('.svelte-flow__pane')
+		if (pane) {
+			pane.addEventListener('click', paneClickHandler)
+		}
+
+		return () => {
+			const pane = flowContainer?.querySelector('.svelte-flow__pane')
+			if (pane) {
+				pane.removeEventListener('click', paneClickHandler)
+			}
+		}
 	})
 
 	let showDataflow = $derived(
-		$selectedId != undefined &&
-			!$selectedId.startsWith('constants') &&
-			!$selectedId.startsWith('settings') &&
-			$selectedId !== 'failure' &&
-			$selectedId !== 'preprocessor' &&
-			$selectedId !== 'Result' &&
-			$selectedId !== 'triggers'
+		selectedId !== undefined &&
+			selectedId !== null &&
+			!selectedId?.startsWith('constants') &&
+			!selectedId?.startsWith('settings') &&
+			selectedId !== 'failure' &&
+			selectedId !== 'preprocessor' &&
+			selectedId !== 'Result' &&
+			selectedId !== 'Trigger'
 	)
 	let debouncedWidth: number | undefined = $state(undefined)
 	let timeout: number | undefined = $state(undefined)
@@ -582,6 +800,14 @@
 	export function zoomOut() {
 		viewportSynchronizer?.zoomOut()
 	}
+
+	export function enableNotes() {
+		if (!showNotes) {
+			showNotes = true
+		}
+	}
+
+	const modifierKey = isMac() ? 'Meta' : 'Control'
 </script>
 
 {#if insertable}
@@ -589,8 +815,9 @@
 {/if}
 <div
 	style={`height: ${height}px; max-height: ${maxHeight}px;`}
-	class="overflow-clip"
+	class="overflow-clip relative"
 	bind:clientWidth={debouncedWidth}
+	bind:this={flowContainer}
 >
 	{#if graph?.error}
 		<div class="center-center p-2">
@@ -615,14 +842,29 @@
 					bind:this={viewportSynchronizer}
 				/>
 			{/if}
+			<PaneContextMenu {editMode} bind:this={paneContextMenu} />
 			<SvelteFlow
-				onpaneclick={(e) => {
+				onpaneclick={() => {
 					document.dispatchEvent(new Event('focus'))
+					selectionManager.clearSelection()
+				}}
+				onpanecontextmenu={({ event }) => {
+					paneContextMenu?.onPaneContextMenu(event)
+				}}
+				onnodedragstop={(event) => {
+					const node = event.targetNode
+					if (node && node.type === 'note') {
+						const positionWithOffset = {
+							x: node.position.x,
+							y: node.position.y - yOffset
+						}
+						onNotePositionUpdate?.(node.id, positionWithOffset)
+					}
 				}}
 				onmove={(event, viewport) => {
 					viewportSynchronizer?.handleLocalViewportChange(event, viewport)
 				}}
-				{nodes}
+				nodes={nodesWithOffset}
 				{edges}
 				{edgeTypes}
 				{nodeTypes}
@@ -633,26 +875,85 @@
 				connectionLineType={ConnectionLineType.SmoothStep}
 				defaultEdgeOptions={{ type: 'smoothstep' }}
 				preventScrolling={scroll}
+				selectionOnDrag={selectionManager.mode === 'rect-select'}
+				elementsSelectable={true}
+				selectionMode={SelectionMode.Partial}
+				selectionKey={selectionManager.mode === 'rect-select' || !editMode ? null : modifierKey}
+				panActivationKey={selectionManager.mode === 'rect-select' ? modifierKey : null}
+				panOnDrag={selectionManager.mode === 'rect-select' ? [1] : true}
 				zoomOnDoubleClick={false}
-				elementsSelectable={false}
+				elevateNodesOnSelect={false}
 				{proOptions}
+				multiSelectionKey={'Shift'}
 				nodesDraggable={false}
 				--background-color={false}
 			>
 				<div class="absolute inset-0 !bg-surface-secondary h-full" id="flow-graph-v2"></div>
+
+				{#if noteMode}
+					<NoteTool {exitNoteMode} {yOffset} />
+				{/if}
+
+				{#if multiSelectEnabled}
+					<SelectionBoundingBox
+						selectedNodes={selectionManager.selectedIds}
+						allNodes={nodesWithOffset as (Node & { type: string })[]}
+					/>
+				{/if}
+
+				<!-- SelectionTool for handling selection changes and filtering -->
+				<SelectionTool {selectionManager} clearGraphSelection={clearFlowSelection} />
+
 				{#if leftHeader}
 					<div class="absolute top-2 left-2 z-10">
 						{@render leftHeader()}
 					</div>
 				{:else}
 					<Controls position="top-right" orientation="horizontal" showLock={false}>
+						{#if multiSelectEnabled}
+							<div class="flex items-center gap-2">
+								<Tooltip>
+									<ControlButton
+										onclick={() => {
+											selectionManager.mode =
+												selectionManager.mode === 'normal' ? 'rect-select' : 'normal'
+										}}
+									>
+										{#if selectionManager.mode === 'rect-select'}
+											<MousePointer size="14" />
+										{:else}
+											<Hand size="14" />
+										{/if}
+									</ControlButton>
+									{#snippet text()}
+										<div class="flex flex-col gap-2">
+											<div class="flex items-center gap-2">
+												<Hand size="14" />
+												<span class="text-secondary"
+													><strong class="text-primary">Grab</strong>: Click and drag to pan. Hold
+													<kbd class="text-primary text-lg">{getModifierKey()}</kbd> to box select.</span
+												>
+											</div>
+											<div class="flex items-center gap-2">
+												<MousePointer size="14" />
+												<span class="text-secondary"
+													><strong class="text-primary">Select</strong> Click and drag to box
+													select. Hold
+													<kbd class="text-primary text-lg">{getModifierKey()}</kbd> to pan.</span
+												>
+											</div>
+										</div>
+									{/snippet}
+								</Tooltip>
+							</div>
+						{/if}
 						{#if download}
 							<ControlButton
 								onclick={() => {
 									try {
 										localStorage.setItem(
 											'svelvet',
-											encodeState({ modules, failureModule, preprocessorModule })
+											encodeState({ modules, failureModule, preprocessorModule, notes })
 										)
 									} catch (e) {
 										console.error('error interacting with local storage', e)
@@ -678,6 +979,9 @@
 						{#if !hideAssetsToggle}
 							<Toggle bind:checked={$showAssets} size="xs" options={{ right: 'Assets' }} />
 						{/if}
+						{#if !hideNotesToggle}
+							<Toggle bind:checked={showNotes} size="xs" options={{ right: 'Notes' }} />
+						{/if}
 						{#if showDataflow}
 							<Toggle bind:checked={$useDataflow} size="xs" options={{ right: 'Dataflow' }} />
 						{/if}
@@ -703,4 +1007,9 @@
 	:global(.svelte-flow__edgelabel-renderer) {
 		@apply z-50;
 	}
+
+	:global(.svelte-flow__selection) {
+		display: none;
+		pointer-events: none;
+	}
 </style>
diff --git a/frontend/src/lib/components/graph/NodeContextMenu.svelte b/frontend/src/lib/components/graph/NodeContextMenu.svelte
new file mode 100644
index 0000000000..034fc2d7da
--- /dev/null
+++ b/frontend/src/lib/components/graph/NodeContextMenu.svelte
@@ -0,0 +1,47 @@
+<script lang="ts">
+	import ContextMenu, { type ContextMenuItem } from '../common/contextmenu/ContextMenu.svelte'
+	import { StickyNote } from 'lucide-svelte'
+	import type { Snippet } from 'svelte'
+	import { getNoteEditorContext } from './noteEditor.svelte'
+	import { getGraphContext } from './graphContext'
+	import { tick } from 'svelte'
+
+	interface Props {
+		children: Snippet
+		selectedNodeIds: string[]
+	}
+
+	let { children, selectedNodeIds }: Props = $props()
+
+	// Get NoteEditor context for group note creation
+	const noteEditorContext = getNoteEditorContext()
+	// Get Graph context for clearFlowSelection function
+	const graphContext = getGraphContext()
+
+	const menuItems: ContextMenuItem[] = $derived([
+		{
+			id: 'create-group-note',
+			label: `Create group note (${selectedNodeIds.length} nodes)`,
+			icon: StickyNote,
+			disabled: selectedNodeIds.length === 0 || !noteEditorContext?.noteEditor,
+			onClick: () => {
+				if (selectedNodeIds.length > 0 && noteEditorContext?.noteEditor && graphContext) {
+					// Create the group note first
+					noteEditorContext.noteEditor.createGroupNote(selectedNodeIds)
+
+					// Wait for next tick to ensure DOM updates
+					tick().then(() => {
+						graphContext?.clearFlowSelection?.()
+						graphContext?.selectionManager.selectId(selectedNodeIds[0])
+					})
+				}
+			}
+		}
+	])
+</script>
+
+{#if noteEditorContext?.noteEditor && selectedNodeIds.length > 1}
+	<ContextMenu items={menuItems}>
+		{@render children()}
+	</ContextMenu>
+{/if}
diff --git a/frontend/src/lib/components/graph/NoteColorPicker.svelte b/frontend/src/lib/components/graph/NoteColorPicker.svelte
new file mode 100644
index 0000000000..d17adb9317
--- /dev/null
+++ b/frontend/src/lib/components/graph/NoteColorPicker.svelte
@@ -0,0 +1,50 @@
+<script lang="ts">
+	import { Palette } from 'lucide-svelte'
+	import Popover from '../meltComponents/Popover.svelte'
+	import { NoteColor, NOTE_COLOR_SWATCHES } from './noteColors'
+	import Button from '../common/button/Button.svelte'
+
+	interface Props {
+		selectedColor: NoteColor
+		onColorChange: (color: NoteColor) => void
+		isOpen?: boolean
+	}
+
+	let { selectedColor, onColorChange, isOpen = $bindable(false) }: Props = $props()
+</script>
+
+<Popover
+	placement="bottom"
+	contentClasses="p-2"
+	floatingConfig={{ strategy: 'absolute' }}
+	usePointerDownOutside
+	bind:isOpen
+>
+	{#snippet trigger()}
+		<Button
+			variant="subtle"
+			unifiedSize="xs"
+			selected={isOpen}
+			nonCaptureEvent
+			title={'Select color'}
+			startIcon={{ icon: Palette }}
+			iconOnly
+		/>
+	{/snippet}
+	{#snippet content()}
+		<div class="grid grid-cols-5 gap-1" style="min-width: 140px">
+			{#each Object.values(NoteColor) as color (color)}
+				<button
+					class="w-6 h-6 rounded-full hover:scale-110 transition-transform duration-100 {NOTE_COLOR_SWATCHES[
+						color
+					]} {selectedColor === color ? 'ring-2 ring-accent' : ' dark:border-gray-600'}"
+					onclick={() => {
+						onColorChange(color)
+					}}
+					title={color.charAt(0).toUpperCase() + color.slice(1)}
+					aria-label={`Select ${color} color`}
+				></button>
+			{/each}
+		</div>
+	{/snippet}
+</Popover>
diff --git a/frontend/src/lib/components/graph/NoteTool.svelte b/frontend/src/lib/components/graph/NoteTool.svelte
new file mode 100644
index 0000000000..ad41bd974a
--- /dev/null
+++ b/frontend/src/lib/components/graph/NoteTool.svelte
@@ -0,0 +1,216 @@
+<script lang="ts">
+	import { useSvelteFlow, type XYPosition } from '@xyflow/svelte'
+	import { getNoteEditorContext } from './noteEditor.svelte'
+	import { DEFAULT_NOTE_COLOR, MIN_NOTE_WIDTH, MIN_NOTE_HEIGHT } from './noteColors'
+	import { StickyNote } from 'lucide-svelte'
+	import ContextMenu, { type ContextMenuItem } from '../common/contextmenu/ContextMenu.svelte'
+
+	interface Props {
+		exitNoteMode?: () => void
+		yOffset: number
+	}
+
+	let { exitNoteMode, yOffset }: Props = $props()
+
+	// Get NoteEditor context for direct note creation
+	const noteEditorContext = getNoteEditorContext()
+
+	const { screenToFlowPosition, getViewport } = useSvelteFlow()
+
+	let isDrawing = $state(false)
+	let startPosition: XYPosition | null = $state(null)
+	let endPosition: XYPosition | null = $state(null)
+	let rect: DOMRect | null = $state(null)
+	let contextMenuPosition: XYPosition | null = $state(null)
+
+	function onPointerDown(event: PointerEvent) {
+		// Capture pointer to continue tracking outside the element
+		const target = event.currentTarget as Element
+		target?.setPointerCapture?.(event.pointerId)
+
+		// Use page coordinates as reference
+		rect = target.getBoundingClientRect()
+		startPosition = {
+			x: event.pageX - rect.left,
+			y: event.pageY - rect.top
+		}
+		isDrawing = true
+	}
+
+	function onPointerMove(event: PointerEvent) {
+		if (event.buttons !== 1) return
+
+		// Use page coordinates as reference
+		const target = event.currentTarget as Element
+		rect = target.getBoundingClientRect()
+		endPosition = {
+			x: event.pageX - rect.left,
+			y: event.pageY - rect.top
+		}
+	}
+
+	function onPointerUp() {
+		if (!isDrawing || !startPosition || !endPosition || !rect) return
+
+		// We need to convert the start and end positions to absolute positions to then convert to flow positions
+		const absoluteStartPosition = {
+			x: startPosition.x + rect.left,
+			y: startPosition.y + rect.top
+		}
+		const absoluteEndPosition = {
+			x: endPosition.x + rect.left,
+			y: endPosition.y + rect.top
+		}
+
+		const flowPosition = screenToFlowPosition({
+			x: Math.min(absoluteStartPosition.x, absoluteEndPosition.x),
+			y: Math.min(absoluteStartPosition.y, absoluteEndPosition.y)
+		})
+		const position = {
+			x: flowPosition.x,
+			y: flowPosition.y - (yOffset || 0)
+		}
+
+		const zoom = getViewport().zoom
+		const size = {
+			width: Math.max(
+				MIN_NOTE_WIDTH,
+				Math.abs(absoluteEndPosition.x - absoluteStartPosition.x) / zoom
+			),
+			height: Math.max(
+				MIN_NOTE_HEIGHT,
+				Math.abs(absoluteEndPosition.y - absoluteStartPosition.y) / zoom
+			)
+		}
+
+		// Create the actual note using NoteEditor context
+		if (noteEditorContext?.noteEditor) {
+			noteEditorContext.noteEditor.addNote({
+				text: '### Free note\nDouble click to edit me',
+				position,
+				size,
+				color: DEFAULT_NOTE_COLOR,
+				type: 'free',
+				locked: false
+			})
+		}
+
+		// Exit note mode after creating note
+		exitNoteMode?.()
+
+		// Reset state
+		isDrawing = false
+		startPosition = null
+	}
+
+	function handleAddStickyNote() {
+		if (!noteEditorContext?.noteEditor || !contextMenuPosition) return
+
+		noteEditorContext.noteEditor.addNote({
+			text: '### Free note\nDouble click to edit me',
+			position: contextMenuPosition,
+			size: { width: 300, height: 200 },
+			color: DEFAULT_NOTE_COLOR,
+			type: 'free',
+			locked: false
+		})
+
+		// Clear the position after use
+		contextMenuPosition = null
+
+		exitNoteMode?.()
+	}
+
+	function handleItemClick(item: ContextMenuItem) {
+		if (item.id === 'add-sticky-note') {
+			handleAddStickyNote()
+		}
+	}
+
+	const contextMenuItems: ContextMenuItem[] = [
+		{
+			id: 'add-sticky-note',
+			label: 'Add sticky note',
+			icon: StickyNote,
+			onClick: handleAddStickyNote
+		}
+	]
+
+	const previewNote = $derived(
+		startPosition && endPosition
+			? {
+					position: {
+						x: Math.min(startPosition['x'], endPosition['x']),
+						y: Math.min(startPosition['y'], endPosition['y'])
+					},
+					size: {
+						width: Math.abs(endPosition['x'] - startPosition['x']),
+						height: Math.abs(endPosition['y'] - startPosition['y'])
+					}
+				}
+			: null
+	)
+</script>
+
+<ContextMenu items={contextMenuItems} onItemClick={handleItemClick}>
+	<div
+		class="tool-overlay"
+		onpointerdown={onPointerDown}
+		onpointermove={onPointerMove}
+		onpointerup={onPointerUp}
+		oncontextmenu={(e) => {
+			// Capture the position when context menu is triggered
+			const flowPosition = screenToFlowPosition({
+				x: e.clientX,
+				y: e.clientY
+			})
+			contextMenuPosition = {
+				x: flowPosition.x,
+				y: flowPosition.y - yOffset
+			}
+		}}
+		role="button"
+		tabindex="0"
+		aria-label="Click and drag to create a note, or right-click to add a sticky note"
+		onkeydown={(e) => {
+			if (e.key === 'Escape') {
+				if (isDrawing) {
+					// Cancel current drawing
+					isDrawing = false
+					startPosition = null
+				} else {
+					// Exit note mode
+					exitNoteMode?.()
+				}
+			}
+		}}
+	>
+		<!-- Preview note while drawing -->
+		{#if previewNote}
+			<div
+				class="absolute border-2 border-dashed border-lime-400 bg-lime-100 bg-opacity-50 rounded-md pointer-events-none"
+				style="
+          width: {previewNote.size.width}px;
+          height: {previewNote.size.height}px;
+          transform: translate({previewNote.position.x}px, {previewNote.position.y}px);
+        "
+			>
+			</div>
+		{/if}
+	</div>
+</ContextMenu>
+
+<style>
+	.tool-overlay {
+		pointer-events: auto;
+		position: absolute;
+		top: 0;
+		left: 0;
+		z-index: 4;
+		height: 100%;
+		width: 100%;
+		transform-origin: top left;
+		cursor: crosshair;
+		touch-action: none;
+	}
+</style>
diff --git a/frontend/src/lib/components/graph/PaneContextMenu.svelte b/frontend/src/lib/components/graph/PaneContextMenu.svelte
new file mode 100644
index 0000000000..b6b6b49ac9
--- /dev/null
+++ b/frontend/src/lib/components/graph/PaneContextMenu.svelte
@@ -0,0 +1,115 @@
+<script lang="ts">
+	import { useSvelteFlow } from '@xyflow/svelte'
+	import { StickyNote } from 'lucide-svelte'
+	import { getNoteEditorContext } from './noteEditor.svelte'
+	import { DEFAULT_NOTE_COLOR } from './noteColors'
+	import { fly } from 'svelte/transition'
+	import {
+		getContextMenuContainerClass,
+		CONTEXT_MENU_ITEM_BASE_CLASS,
+		CONTEXT_MENU_ITEM_HOVER_CLASS
+	} from '../common/contextmenu/contextMenuStyles'
+	import { getGraphContext } from './graphContext'
+
+	interface Props {
+		editMode?: boolean
+	}
+
+	let { editMode = false }: Props = $props()
+
+	const { screenToFlowPosition } = useSvelteFlow()
+	const noteEditorContext = getNoteEditorContext()
+
+	const graphContext = getGraphContext()
+
+	let contextMenuVisible = $state(false)
+	let contextMenuPosition = $state<{ x: number; y: number }>({ x: 0, y: 0 })
+	let pendingFlowPosition = $state<{ x: number; y: number } | null>(null)
+
+	function handlePaneContextMenu(event: MouseEvent) {
+		// Only show context menu in edit mode
+		if (!editMode || !noteEditorContext?.noteEditor) {
+			return
+		}
+
+		event.preventDefault()
+		event.stopPropagation()
+
+		// Store screen coordinates for context menu positioning
+		contextMenuPosition = {
+			x: event.clientX,
+			y: event.clientY
+		}
+
+		// Convert to flow coordinates for note placement
+		pendingFlowPosition = screenToFlowPosition({
+			x: event.clientX,
+			y: event.clientY
+		})
+
+		contextMenuVisible = true
+	}
+
+	function handleAddStickyNote() {
+		if (noteEditorContext?.noteEditor && pendingFlowPosition) {
+			noteEditorContext.noteEditor.addNote({
+				text: '### Free note\nDouble click to edit me',
+				position: {
+					x: pendingFlowPosition.x,
+					y: pendingFlowPosition.y - (graphContext?.yOffset || 0)
+				},
+				size: { width: 300, height: 200 },
+				color: DEFAULT_NOTE_COLOR,
+				type: 'free',
+				locked: false
+			})
+		}
+		contextMenuVisible = false
+	}
+
+	// Export the handler to be used by parent
+	export function onPaneContextMenu(event: MouseEvent) {
+		handlePaneContextMenu(event)
+	}
+</script>
+
+{#if contextMenuVisible}
+	<!-- Context menu -->
+	<div
+		class="fixed {getContextMenuContainerClass('z-[9999]')}"
+		style="left: {contextMenuPosition.x}px; top: {contextMenuPosition.y}px;"
+		transition:fly={{ duration: 150, y: -10 }}
+		role="menu"
+		tabindex="-1"
+		onclick={(e) => {
+			e.stopPropagation()
+		}}
+		onkeydown={(e) => {
+			if (e.key === 'Escape') {
+				contextMenuVisible = false
+			}
+		}}
+	>
+		<button
+			class="{CONTEXT_MENU_ITEM_BASE_CLASS} {CONTEXT_MENU_ITEM_HOVER_CLASS}"
+			onclick={handleAddStickyNote}
+			type="button"
+		>
+			<StickyNote size={14} class="mr-2" />
+			<span>Add sticky note</span>
+		</button>
+	</div>
+
+	<!-- Invisible click catcher to close context menu -->
+	<div
+		class="fixed inset-0 z-[9998]"
+		role="presentation"
+		onclick={() => {
+			contextMenuVisible = false
+		}}
+		oncontextmenu={(e) => {
+			e.preventDefault()
+			contextMenuVisible = false
+		}}
+	></div>
+{/if}
diff --git a/frontend/src/lib/components/graph/SelectionBoundingBox.svelte b/frontend/src/lib/components/graph/SelectionBoundingBox.svelte
new file mode 100644
index 0000000000..5faff92d28
--- /dev/null
+++ b/frontend/src/lib/components/graph/SelectionBoundingBox.svelte
@@ -0,0 +1,82 @@
+<script lang="ts">
+	import { ViewportPortal, type Node } from '@xyflow/svelte'
+	import { calculateNodesBoundsWithOffset } from './util'
+	import { StickyNote } from 'lucide-svelte'
+	import Button from '../common/button/Button.svelte'
+	import { getNoteEditorContext } from './noteEditor.svelte'
+	import { getGraphContext } from './graphContext'
+	import { tick } from 'svelte'
+
+	interface Props {
+		selectedNodes: string[]
+		allNodes: (Node & { type: string })[]
+	}
+
+	let { selectedNodes, allNodes }: Props = $props()
+
+	// Get NoteEditor context for group note creation
+	const noteEditorContext = getNoteEditorContext()
+	// Get Graph context for clearFlowSelection function
+	const graphContext = getGraphContext()
+
+	function handleAddGroupNote() {
+		if (selectedNodes.length > 0 && noteEditorContext?.noteEditor && graphContext) {
+			// Create the group note first
+			noteEditorContext.noteEditor.createGroupNote(selectedNodes)
+
+			// Wait for next tick to ensure DOM updates
+			tick().then(() => {
+				graphContext?.clearFlowSelection?.()
+				graphContext?.selectionManager.clearSelection()
+			})
+		}
+	}
+
+	let bounds = $derived(() => {
+		if (selectedNodes.length === 0) {
+			return null
+		}
+
+		// Calculate flow coordinates bounds, accounting for CSS offset and expanded subflows
+		const { minX, minY, maxX, maxY } = calculateNodesBoundsWithOffset(selectedNodes, allNodes)
+
+		// Add padding in flow coordinates
+		const padding = 4
+
+		// Return flow coordinates directly - ViewportPortal handles transformation
+		return {
+			x: minX - padding,
+			y: minY - padding,
+			width: maxX - minX + 2 * padding,
+			height: maxY - minY + 2 * padding
+		}
+	})
+</script>
+
+{#if bounds() && selectedNodes.length > 1}
+	{@const currentBounds = bounds()!}
+	<ViewportPortal target="front">
+		<div
+			class={'absolute cursor-pointer bg-surface-selected/40 rounded-md pointer-events-none'}
+			style:transform="translate({currentBounds.x}px, {currentBounds.y}px)"
+			style:width="{currentBounds.width}px"
+			style:height="{currentBounds.height}px"
+			style:z-index="10"
+		>
+			<!-- Add Group Note Button positioned in top-right corner -->
+			{#if noteEditorContext?.noteEditor}
+				<div class="absolute -top-4 -right-1 z-20" style="pointer-events: auto;">
+					<Button
+						unifiedSize="sm"
+						variant="accent"
+						title="Create group note ({selectedNodes.length} nodes)"
+						onclick={handleAddGroupNote}
+						startIcon={{ icon: StickyNote }}
+					>
+						Create group note ({selectedNodes.length} nodes)
+					</Button>
+				</div>
+			{/if}
+		</div>
+	</ViewportPortal>
+{/if}
diff --git a/frontend/src/lib/components/graph/SelectionTool.svelte b/frontend/src/lib/components/graph/SelectionTool.svelte
new file mode 100644
index 0000000000..e7af55bc24
--- /dev/null
+++ b/frontend/src/lib/components/graph/SelectionTool.svelte
@@ -0,0 +1,43 @@
+<script lang="ts">
+	import { useOnSelectionChange, useStore, type Node } from '@xyflow/svelte'
+	import type { SelectionManager } from './selectionUtils.svelte'
+	interface Props {
+		selectionManager: SelectionManager
+		clearGraphSelection: () => void
+	}
+
+	let { selectionManager, clearGraphSelection }: Props = $props()
+
+	selectionManager.setClearGraphSelection(clearGraphSelection)
+
+	// Get store to access selectionRect
+	const store = useStore()
+
+	// Handle selection changes from SvelteFlow
+	useOnSelectionChange(({ nodes: selectedNodes, edges: _selectedEdges }) => {
+		// Notes are already non-selectable, so no filtering needed
+		const selectedNodeIds = selectedNodes.map((node: Node) => node.id)
+
+		// Only select nodes if multiple nodes are selected
+		// To avoid conflicting with the node-level click events
+		if (selectedNodeIds.length > 0) {
+			selectionManager.selectNodes(selectedNodes)
+		}
+	})
+</script>
+
+<!-- Render custom selection box during drag selection -->
+{#if store.selectionRect}
+	{@const bounds = store.selectionRect!}
+	<div
+		class="absolute rounded cursor-pointer bg-surface-selected/30 pointer-events-none"
+		style="
+			left: {bounds.x}px;
+			top: {bounds.y}px;
+			width: {bounds.width}px;
+			height: {bounds.height}px;
+			z-index: 10;
+		"
+	>
+	</div>
+{/if}
diff --git a/frontend/src/lib/components/graph/graphBuilder.svelte.ts b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
index a6f0ebdd6a..6dded81b9c 100644
--- a/frontend/src/lib/components/graph/graphBuilder.svelte.ts
+++ b/frontend/src/lib/components/graph/graphBuilder.svelte.ts
@@ -88,6 +88,7 @@ export type NodeLayout = {
 	data: {
 		offset?: number
 	}
+	selectable?: boolean
 } & FlowNode
 
 export type FlowNode =
@@ -447,7 +448,8 @@ export function graphBuilder(
 					moduleAction: extra.moduleActions?.[module.id],
 					onShowModuleDiff: extra.onShowModuleDiff
 				},
-				type: 'module'
+				type: 'module',
+				selectable: true
 			})
 
 			return module.id
@@ -540,7 +542,8 @@ export function graphBuilder(
 					...extra,
 					insertable: extra.insertable && !options?.disableInsert && prefix == undefined,
 					shouldOffsetInsertBtnDueToAssetNode: nodeIdsWithOutputAssets.has(sourceId)
-				}
+				},
+				selectable: false
 			})
 		}
 
@@ -596,7 +599,7 @@ export function graphBuilder(
 		}
 
 		const resultNode: NodeLayout = {
-			id: 'result',
+			id: 'Result',
 			data: {
 				eventHandlers: eventHandlers,
 				success: success,
@@ -1085,14 +1088,14 @@ export function graphBuilder(
 						let pid = x[0]
 
 						if (input?.startsWith('flow_input.iter')) {
-							const parent = dfsByModule(selectedId!, modules ?? [])?.pop()
+							const parent = dfsByModule(selectedId, modules ?? [])?.pop()
 
 							if (parent?.id) {
 								pid = parent.id
 							}
 						}
 
-						addEdge(pid, selectedId!, undefined, undefined, {
+						addEdge(pid, selectedId, undefined, undefined, {
 							customId: `dep-${pid}-${selectedId}-${input}-${index}`,
 							type: 'dataflowedge'
 						})
@@ -1102,7 +1105,7 @@ export function graphBuilder(
 				Object.entries(deps.dependents).forEach((x, i) => {
 					let pid = x[0]
 
-					addEdge(selectedId!, pid, undefined, undefined, {
+					addEdge(selectedId, pid, undefined, undefined, {
 						customId: `dep-${selectedId}-${pid}-${i}`,
 						type: 'dataflowedge'
 					})
diff --git a/frontend/src/lib/components/graph/graphContext.ts b/frontend/src/lib/components/graph/graphContext.ts
new file mode 100644
index 0000000000..176fc5d3bf
--- /dev/null
+++ b/frontend/src/lib/components/graph/graphContext.ts
@@ -0,0 +1,19 @@
+import { getContext, setContext } from 'svelte'
+import type { SelectionManager } from './selectionUtils.svelte'
+import type { NoteManager } from './noteManager.svelte'
+import type { Writable } from 'svelte/store'
+
+export type GraphContext = {
+	selectionManager: SelectionManager
+	useDataflow: Writable<boolean | undefined>
+	showAssets: Writable<boolean | undefined>
+	noteManager?: NoteManager
+	clearFlowSelection?: () => void
+	yOffset?: number
+}
+
+const graphContextKey = 'FlowGraphContext'
+
+//TODO: use https://svelte.dev/docs/svelte/context#Type-safe-context after migrating svelte 5 to latest version
+export const getGraphContext = () => getContext<GraphContext>(graphContextKey)
+export const setGraphContext = (context: GraphContext) => setContext(graphContextKey, context)
diff --git a/frontend/src/lib/components/graph/groupDetectionUtils.ts b/frontend/src/lib/components/graph/groupDetectionUtils.ts
new file mode 100644
index 0000000000..e2c81c4d98
--- /dev/null
+++ b/frontend/src/lib/components/graph/groupDetectionUtils.ts
@@ -0,0 +1,86 @@
+type FlowNode = { id: string; parentIds?: string[] }
+
+/**
+ * Use a simple algorithm to complete a group and split it into connected components
+ */
+export function completeAndSplitGroup(groupNodes: string[], flowNodes: FlowNode[]): string[][] {
+	if (groupNodes.length <= 1) {
+		return groupNodes.length === 1 ? [groupNodes] : []
+	}
+
+	// Build parent map for upward traversal only
+	const parents = new Map<string, string[]>()
+	for (const node of flowNodes) {
+		parents.set(node.id, node.parentIds || [])
+	}
+
+	const groupSet = new Set(groupNodes)
+	const assignedComponent = new Map<string, number>()
+	const components: Array<Set<string>> = []
+
+	const mergeComponents = (fromIdx: number, toIdx: number): void => {
+		if (fromIdx === toIdx) return
+		const target = components[toIdx]
+		const source = components[fromIdx]
+
+		source.forEach((node) => target.add(node))
+		source.clear()
+
+		for (const [nodeId, idx] of assignedComponent.entries()) {
+			if (idx === fromIdx) {
+				assignedComponent.set(nodeId, toIdx)
+			}
+		}
+	}
+
+	for (const startNode of groupNodes) {
+		if (assignedComponent.has(startNode)) continue
+
+		const componentIdx = components.length
+		components.push(new Set([startNode]))
+		assignedComponent.set(startNode, componentIdx)
+
+		const stack: { nodeId: string; path: string[]; seen: Set<string> }[] = [
+			{ nodeId: startNode, path: [startNode], seen: new Set([startNode]) }
+		]
+
+		while (stack.length > 0) {
+			const { nodeId, path, seen } = stack.pop()!
+			const parentIds = parents.get(nodeId) || []
+
+			for (const parentId of parentIds) {
+				if (seen.has(parentId)) continue
+
+				const newPath = [...path, parentId]
+				const newSeen = new Set(seen)
+				newSeen.add(parentId)
+
+				if (groupSet.has(parentId)) {
+					const existingIdx = assignedComponent.get(parentId)
+					if (existingIdx === undefined) {
+						assignedComponent.set(parentId, componentIdx)
+						components[componentIdx].add(parentId)
+						stack.push({ nodeId: parentId, path: [parentId], seen: new Set([parentId]) })
+					} else if (existingIdx !== componentIdx) {
+						mergeComponents(existingIdx, componentIdx)
+					}
+
+					for (const node of newPath) {
+						components[componentIdx].add(node)
+					}
+				} else {
+					stack.push({ nodeId: parentId, path: newPath, seen: newSeen })
+				}
+			}
+		}
+	}
+
+	return components
+		.filter((component) => component.size > 0)
+		.map((component) =>
+			Array.from(component)
+				.filter((nodeId) => !nodeId.startsWith('subflow:'))
+				.sort()
+		)
+		.filter((component) => component.length > 0)
+}
diff --git a/frontend/src/lib/components/graph/noteColors.ts b/frontend/src/lib/components/graph/noteColors.ts
new file mode 100644
index 0000000000..f9024adf7e
--- /dev/null
+++ b/frontend/src/lib/components/graph/noteColors.ts
@@ -0,0 +1,135 @@
+// Note color definitions with Tailwind classes for light and dark mode
+export enum NoteColor {
+	YELLOW = 'yellow',
+	BLUE = 'blue',
+	GREEN = 'green',
+	PURPLE = 'purple',
+	PINK = 'pink',
+	ORANGE = 'orange',
+	RED = 'red',
+	CYAN = 'cyan',
+	LIME = 'lime',
+	GRAY = 'gray'
+}
+
+export interface NoteColorConfig {
+	background: string
+	outline: string
+	outlineHover: string
+	text: string
+	hover: string
+}
+
+// Color configurations for each note color with dark mode support
+export const NOTE_COLORS: Record<NoteColor, NoteColorConfig> = {
+	[NoteColor.YELLOW]: {
+		background: 'bg-yellow-200 dark:bg-yellow-900',
+		outline: 'outline-yellow-300 dark:outline-yellow-600',
+		outlineHover: 'outline-yellow-300/60 dark:outline-yellow-600/60',
+		text: 'text-yellow-900 dark:text-yellow-100',
+		hover: 'hover:bg-yellow-200 dark:hover:bg-yellow-800'
+	},
+	[NoteColor.BLUE]: {
+		background: 'bg-blue-100 dark:bg-blue-950',
+		outline: 'outline-blue-300 dark:outline-blue-600',
+		outlineHover: 'outline-blue-300/60 dark:outline-blue-600/60',
+		text: 'text-blue-900 dark:text-blue-100',
+		hover: 'hover:bg-blue-200 dark:hover:bg-blue-800'
+	},
+	[NoteColor.GREEN]: {
+		background: 'bg-green-200 dark:bg-green-900',
+		outline: 'outline-green-300 dark:outline-green-600',
+		outlineHover: 'outline-green-300/60 dark:outline-green-600/60',
+		text: 'text-green-900 dark:text-green-100',
+		hover: 'hover:bg-green-200 dark:hover:bg-green-800'
+	},
+	[NoteColor.PURPLE]: {
+		background: 'bg-purple-200 dark:bg-purple-900',
+		outline: 'outline-purple-300 dark:outline-purple-600',
+		outlineHover: 'outline-purple-300/60 dark:outline-purple-600/60',
+		text: 'text-purple-900 dark:text-purple-100',
+		hover: 'hover:bg-purple-200 dark:hover:bg-purple-800'
+	},
+	[NoteColor.PINK]: {
+		background: 'bg-pink-200 dark:bg-pink-900',
+		outline: 'outline-pink-300 dark:outline-pink-600',
+		outlineHover: 'outline-pink-300/60 dark:outline-pink-600/60',
+		text: 'text-pink-900 dark:text-pink-100',
+		hover: 'hover:bg-pink-200 dark:hover:bg-pink-800'
+	},
+	[NoteColor.ORANGE]: {
+		background: 'bg-orange-200 dark:bg-orange-900',
+		outline: 'outline-orange-300 dark:outline-orange-600',
+		outlineHover: 'outline-orange-300/60 dark:outline-orange-600/60',
+		text: 'text-orange-900 dark:text-orange-100',
+		hover: 'hover:bg-orange-200 dark:hover:bg-orange-800'
+	},
+	[NoteColor.RED]: {
+		background: 'bg-red-200 dark:bg-red-900',
+		outline: 'outline-red-300 dark:outline-red-600',
+		outlineHover: 'outline-red-300/60 dark:outline-red-600/60',
+		text: 'text-red-900 dark:text-red-100',
+		hover: 'hover:bg-red-200 dark:hover:bg-red-800'
+	},
+	[NoteColor.CYAN]: {
+		background: 'bg-cyan-200 dark:bg-cyan-900',
+		outline: 'outline-cyan-300 dark:outline-cyan-600',
+		outlineHover: 'outline-cyan-300/60 dark:outline-cyan-600/60',
+		text: 'text-cyan-900 dark:text-cyan-100',
+		hover: 'hover:bg-cyan-200 dark:hover:bg-cyan-800'
+	},
+	[NoteColor.LIME]: {
+		background: 'bg-lime-200 dark:bg-lime-900',
+		outline: 'outline-lime-300 dark:outline-lime-600',
+		outlineHover: 'outline-lime-300/60 dark:outline-lime-600/60',
+		text: 'text-lime-900 dark:text-lime-100',
+		hover: 'hover:bg-lime-200 dark:hover:bg-lime-800'
+	},
+	[NoteColor.GRAY]: {
+		background: 'bg-gray-200 dark:bg-gray-800',
+		outline: 'outline-gray-300 dark:outline-gray-600',
+		outlineHover: 'outline-gray-300/60 dark:outline-gray-600/60',
+		text: 'text-gray-900 dark:text-gray-100',
+		hover: 'hover:bg-gray-200 dark:hover:bg-gray-700'
+	}
+}
+
+// Color swatch colors for the picker (solid colors for the palette dots)
+export const NOTE_COLOR_SWATCHES: Record<NoteColor, string> = {
+	[NoteColor.YELLOW]: 'bg-yellow-400',
+	[NoteColor.BLUE]: 'bg-blue-400',
+	[NoteColor.GREEN]: 'bg-green-400',
+	[NoteColor.PURPLE]: 'bg-purple-400',
+	[NoteColor.PINK]: 'bg-pink-400',
+	[NoteColor.ORANGE]: 'bg-orange-400',
+	[NoteColor.RED]: 'bg-red-400',
+	[NoteColor.CYAN]: 'bg-cyan-400',
+	[NoteColor.LIME]: 'bg-lime-400',
+	[NoteColor.GRAY]: 'bg-gray-400'
+}
+
+// Default note color
+export const DEFAULT_NOTE_COLOR = NoteColor.GREEN
+export const DEFAULT_GROUP_NOTE_COLOR = NoteColor.BLUE
+
+/**
+ * Get the next available color that's not in the used colors set
+ * Cycles through all available colors in order
+ */
+export function getNextAvailableColor(usedColors: Set<NoteColor>): NoteColor {
+	const allColors = Object.values(NoteColor)
+
+	// Find first unused color
+	for (const color of allColors) {
+		if (!usedColors.has(color)) {
+			return color
+		}
+	}
+
+	// If all colors are used, return the default
+	return DEFAULT_GROUP_NOTE_COLOR
+}
+
+// Minimum note size constraints
+export const MIN_NOTE_WIDTH = 275
+export const MIN_NOTE_HEIGHT = 60
diff --git a/frontend/src/lib/components/graph/noteEditor.svelte.ts b/frontend/src/lib/components/graph/noteEditor.svelte.ts
new file mode 100644
index 0000000000..4d59cfa480
--- /dev/null
+++ b/frontend/src/lib/components/graph/noteEditor.svelte.ts
@@ -0,0 +1,322 @@
+import type { FlowNote } from '$lib/gen'
+import type { StateStore } from '$lib/utils'
+import type { ExtendedOpenFlow } from '../flows/types'
+import type { NoteColor } from './noteColors'
+import { DEFAULT_GROUP_NOTE_COLOR, getNextAvailableColor } from './noteColors'
+import { generateId } from './util'
+import { getContext, setContext } from 'svelte'
+import { completeAndSplitGroup } from './groupDetectionUtils'
+
+/**
+ * Utility class for editing flow notes via direct flowStore mutations
+ * This class is designed to be used in editor contexts via Svelte context
+ */
+export class NoteEditor {
+	private flowStore: StateStore<ExtendedOpenFlow>
+	private onNoteAdded?: () => void
+
+	constructor(flowStore: StateStore<ExtendedOpenFlow>, onNoteAdded?: () => void) {
+		this.flowStore = flowStore
+		this.onNoteAdded = onNoteAdded
+	}
+
+	/**
+	 * Get the current notes array from the flow store
+	 */
+	private getNotes(): FlowNote[] {
+		return this.flowStore.val.value?.notes || []
+	}
+
+	/**
+	 * Set the notes array in the flow store
+	 */
+	private setNotes(notes: FlowNote[]): void {
+		if (this.flowStore.val.value) {
+			this.flowStore.val.value.notes = notes
+		}
+	}
+
+	/**
+	 * Add a new note to the flow
+	 */
+	addNote(note: Omit<FlowNote, 'id'>): string {
+		const notes = this.getNotes()
+		const newNote: FlowNote = {
+			id: generateId(),
+			...note
+		}
+		this.setNotes([...notes, newNote])
+
+		// Call callback to enable notes display when a note is created
+		this.onNoteAdded?.()
+
+		return newNote.id
+	}
+
+	/**
+	 * Update the text content of a note
+	 */
+	updateText(noteId: string, text: string): void {
+		const notes = this.getNotes()
+		const updatedNotes = notes.map((note) => (note.id === noteId ? { ...note, text } : note))
+		this.setNotes(updatedNotes)
+	}
+
+	/**
+	 * Update the color of a note
+	 */
+	updateColor(noteId: string, color: NoteColor): void {
+		const notes = this.getNotes()
+		const updatedNotes = notes.map((note) => (note.id === noteId ? { ...note, color } : note))
+		this.setNotes(updatedNotes)
+	}
+
+	/**
+	 * Update the position of a note
+	 */
+	updatePosition(noteId: string, position: { x: number; y: number }): void {
+		const notes = this.getNotes()
+		const updatedNotes = notes.map((note) => (note.id === noteId ? { ...note, position } : note))
+		this.setNotes(updatedNotes)
+	}
+
+	/**
+	 * Update the size of a note
+	 */
+	updateSize(noteId: string, size: { width: number; height: number }): void {
+		const notes = this.getNotes()
+		const updatedNotes = notes.map((note) => (note.id === noteId ? { ...note, size } : note))
+		this.setNotes(updatedNotes)
+	}
+
+	/**
+	 * Toggle the locked state of a note
+	 */
+	updateLock(noteId: string, locked: boolean): void {
+		const notes = this.getNotes()
+		const updatedNotes = notes.map((note) => (note.id === noteId ? { ...note, locked } : note))
+		this.setNotes(updatedNotes)
+	}
+
+	/**
+	 * Delete a note from the flow
+	 */
+	deleteNote(noteId: string): void {
+		const notes = this.getNotes()
+		const updatedNotes = notes.filter((note) => note.id !== noteId)
+		this.setNotes(updatedNotes)
+	}
+
+	/**
+	 * Find which nodes from the given list are already in existing group notes
+	 */
+	private findNodesInExistingGroups(nodeIds: string[]): {
+		overlappingGroups: FlowNote[]
+		nodesInGroups: Set<string>
+	} {
+		const notes = this.getNotes()
+		const groupNotes = notes.filter((note) => note.type === 'group')
+		const overlappingGroups: FlowNote[] = []
+		const nodesInGroups = new Set<string>()
+
+		for (const groupNote of groupNotes) {
+			const containedNodeIds = groupNote.contained_node_ids || []
+			const hasOverlap = nodeIds.some((nodeId) => containedNodeIds.includes(nodeId))
+
+			if (hasOverlap) {
+				overlappingGroups.push(groupNote)
+				containedNodeIds.forEach((nodeId) => nodesInGroups.add(nodeId))
+			}
+		}
+
+		return { overlappingGroups, nodesInGroups }
+	}
+
+	/**
+	 * Get smart color for group note based on existing groups
+	 */
+	private getSmartGroupNoteColor(nodeIds: string[]): NoteColor {
+		const { overlappingGroups } = this.findNodesInExistingGroups(nodeIds)
+
+		// If no overlapping groups, use default color
+		if (overlappingGroups.length === 0) {
+			return DEFAULT_GROUP_NOTE_COLOR
+		}
+
+		// Get colors used by overlapping groups
+		const usedColors = new Set<NoteColor>()
+		overlappingGroups.forEach((group) => {
+			if (group.color) {
+				usedColors.add(group.color as NoteColor)
+			}
+		})
+
+		// Return next available color
+		return getNextAvailableColor(usedColors)
+	}
+
+	/**
+	 * Create a group note containing the specified node IDs
+	 */
+	createGroupNote(
+		nodeIds: string[],
+		text: string = '### Group note\nDouble click to edit me'
+	): string {
+		// Filter ids in case they contain subflow nodes
+		let filteredNodeIds: string[] = nodeIds
+		let subflowIds: string[] = []
+		for (const id of nodeIds) {
+			if (id.startsWith('subflow:')) {
+				const match = id.match(/^subflow:([^:]+)/)
+				if (match) {
+					subflowIds.push(match[1])
+				}
+			}
+		}
+		if (subflowIds.length > 0) {
+			filteredNodeIds = filteredNodeIds.filter((id) => !subflowIds.includes(id))
+			filteredNodeIds = [...filteredNodeIds, ...subflowIds]
+		}
+
+		// Position and size will be calculated dynamically by layout
+		const smartColor = this.getSmartGroupNoteColor(filteredNodeIds)
+
+		const groupNote: Omit<FlowNote, 'id'> = {
+			text,
+			color: smartColor,
+			type: 'group',
+			contained_node_ids: filteredNodeIds,
+			locked: false
+		}
+
+		return this.addNote(groupNote)
+	}
+
+	/**
+	 * Check if a node is the only member of an existing group note
+	 */
+	isNodeOnlyMemberOfGroupNote(nodeId: string): boolean {
+		const notes = this.getNotes()
+		const groupNotes = notes.filter((note) => note.type === 'group')
+
+		for (const groupNote of groupNotes) {
+			const containedNodeIds = groupNote.contained_node_ids || []
+			if (containedNodeIds.length === 1 && containedNodeIds.includes(nodeId)) {
+				return true
+			}
+		}
+
+		return false
+	}
+
+	/**
+	 * Check if editing is available (flowStore is properly initialized)
+	 */
+	isAvailable(): boolean {
+		return !!this.flowStore.val.value
+	}
+
+	/**
+	 * Clean up group notes using DAG path completion
+	 */
+	cleanupGroupNotes(flowNodes: { id: string; parentIds?: string[]; offset?: number }[]): void {
+		if (!this.isAvailable()) {
+			return
+		}
+
+		const allNotes = this.getNotes()
+		const groupNotes = allNotes.filter((note) => note.type === 'group')
+		if (groupNotes.length === 0) return
+
+		let hasChanges = false
+		const nodeSet = new Set(flowNodes.map((n) => n.id))
+
+		// Step 1: Clean invalid nodes from existing group notes
+		for (const note of groupNotes) {
+			const originalIds = note.contained_node_ids || []
+			const validIds = originalIds.filter((id) => nodeSet.has(id))
+
+			if (validIds.length !== originalIds.length) {
+				note.contained_node_ids = validIds
+				hasChanges = true
+			}
+		}
+
+		// Step 2: Complete paths for each group using the DAG algorithm
+		const splitGroups: FlowNote[] = []
+
+		for (const note of groupNotes) {
+			const originalNodes = note.contained_node_ids || []
+			if (originalNodes.length === 0) continue
+
+			// Use the DAG path completion and splitting algorithm
+			const completedGroups = completeAndSplitGroup(originalNodes, flowNodes)
+
+			if (completedGroups.length <= 1) {
+				// Single group or no change needed
+				const completeNodes = completedGroups.length > 0 ? completedGroups[0] : []
+				const sortedComplete = completeNodes.sort()
+				const sortedOriginal = originalNodes.sort()
+
+				if (
+					sortedComplete.length !== sortedOriginal.length ||
+					!sortedComplete.every((id, i) => id === sortedOriginal[i])
+				) {
+					note.contained_node_ids = completeNodes
+					hasChanges = true
+				}
+			} else {
+				// Multiple groups - split into separate notes
+				hasChanges = true
+				// Mark original note for removal
+				note.contained_node_ids = []
+
+				// Create new notes for each completed group
+				for (const completedGroup of completedGroups) {
+					splitGroups.push({
+						...note,
+						id: generateId(),
+						contained_node_ids: completedGroup
+					})
+				}
+			}
+		}
+
+		// Remove empty group notes and add split component notes
+		const nonEmptyGroupNotes = groupNotes.filter(
+			(note) => (note.contained_node_ids?.length || 0) > 0
+		)
+
+		if (hasChanges || splitGroups.length > 0) {
+			const updatedNotes = [
+				...allNotes.filter((note) => note.type !== 'group'),
+				...nonEmptyGroupNotes,
+				...splitGroups
+			]
+			this.setNotes(updatedNotes)
+		}
+	}
+}
+
+/**
+ * Context type for NoteEditor
+ */
+export type NoteEditorContext = {
+	noteEditor: NoteEditor
+}
+
+const CONTEXT_KEY = 'NoteEditorContext'
+
+/**
+ * Set the NoteEditor context (used in FlowBuilder)
+ */
+export function setNoteEditorContext(noteEditor: NoteEditor): void {
+	setContext<NoteEditorContext>(CONTEXT_KEY, { noteEditor })
+}
+
+/**
+ * Get the NoteEditor context (used in components that need editing capabilities)
+ */
+export function getNoteEditorContext(): NoteEditorContext | undefined {
+	return getContext<NoteEditorContext | undefined>(CONTEXT_KEY)
+}
diff --git a/frontend/src/lib/components/graph/noteManager.svelte.ts b/frontend/src/lib/components/graph/noteManager.svelte.ts
new file mode 100644
index 0000000000..6e605327a8
--- /dev/null
+++ b/frontend/src/lib/components/graph/noteManager.svelte.ts
@@ -0,0 +1,150 @@
+import type { FlowNote } from '$lib/gen'
+import type { Node } from '@xyflow/svelte'
+import { getLayoutSignature, getPropertySignature } from './noteUtils.svelte'
+import { deepEqual } from 'fast-equals'
+import { untrack } from 'svelte'
+
+/**
+ * Utility class for managing flow note text height caching, selection, and fine-grained reactivity
+ * Handles both fast visual updates and structural changes
+ */
+export class NoteManager {
+	renderCount = $state(0)
+
+	// Track notes for layout change detection
+	#notes: () => FlowNote[]
+	#previousLayoutSignature: ReturnType<typeof getLayoutSignature> = $state({
+		notesCount: 0,
+		noteIds: [],
+		groupMemberships: []
+	})
+	#previousPropertySignature: ReturnType<typeof getPropertySignature> = $state([])
+
+	// Function to update nodes array with reactivity
+	#setNodes: (nodes: Node[]) => void
+	#getNodes: () => Node[]
+
+	// Selection state
+	#selectedNoteId = $state<string | undefined>(undefined)
+
+	constructor(notes: () => FlowNote[], setNodes: (nodes: Node[]) => void, getNodes: () => Node[]) {
+		this.#notes = notes
+		this.#setNodes = setNodes
+		this.#getNodes = getNodes
+
+		// Effect to monitor note changes with dual signature tracking
+		$effect(() => {
+			const currentNotes = this.#notes()
+			const currentLayoutSignature = getLayoutSignature(currentNotes)
+			const currentPropertySignature = getPropertySignature(currentNotes)
+
+			untrack(() => {
+				const hasLayoutChanges = !deepEqual(currentLayoutSignature, this.#previousLayoutSignature)
+				const hasPropertyChanges = !deepEqual(
+					currentPropertySignature,
+					this.#previousPropertySignature
+				)
+
+				if (hasLayoutChanges) {
+					// Structural changes require full re-render
+					this.#previousLayoutSignature = currentLayoutSignature
+					this.#previousPropertySignature = currentPropertySignature
+					this.render()
+				} else if (hasPropertyChanges) {
+					// Property changes can be handled with fast updates
+					this.#updateNodesProperties(currentNotes)
+					this.#previousPropertySignature = currentPropertySignature
+				}
+			})
+		})
+	}
+
+	/**
+	 * Triggers a re-render of the graph by incrementing the render count
+	 */
+	render(): void {
+		this.renderCount++
+	}
+
+	/**
+	 * Update node properties using setter function for proper reactivity
+	 * Only updates visual properties that don't affect layout
+	 */
+	#updateNodesProperties(currentNotes: FlowNote[]): void {
+		const currentNodes = this.#getNodes()
+		if (currentNodes.length === 0) return
+
+		// Create a new array with updated nodes to trigger reactivity
+		const updatedNodes = currentNodes.map((node) => {
+			const note = currentNotes.find((n) => n.id === node.id)
+			if (!note || node.type !== 'note') return node
+
+			// Clone the node to avoid mutation
+			const updatedNode = { ...node, data: { ...node.data } }
+
+			// Update properties that don't affect layout
+			if (updatedNode.data) {
+				updatedNode.data.text = note.text
+				updatedNode.data.color = note.color
+				updatedNode.data.locked = note.locked || false
+			}
+
+			// Update draggable property based on lock state
+			const isGroupNote = note.type === 'group'
+			updatedNode.draggable = isGroupNote ? false : !note.locked
+
+			// Update free note size and position (group notes are calculated differently)
+			if (!isGroupNote && note.size && note.position) {
+				updatedNode.width = note.size.width
+				updatedNode.height = note.size.height
+				updatedNode.position = { ...note.position }
+			}
+
+			return updatedNode
+		})
+
+		// Use setter function to trigger reactivity
+		this.#setNodes(updatedNodes)
+	}
+
+	/**
+	 * Select a note by ID (single selection only)
+	 */
+	selectNote(noteId: string): void {
+		if (this.#selectedNoteId === noteId) {
+			return
+		}
+		this.#selectedNoteId = noteId
+	}
+
+	/**
+	 * Clear note selection
+	 */
+	clearNoteSelection(): void {
+		this.#selectedNoteId = undefined
+	}
+
+	/**
+	 * Deselect a note by ID (single selection only)
+	 */
+	deselectNote(noteId?: string): void {
+		if (this.#selectedNoteId === noteId) {
+			this.#selectedNoteId = undefined
+		}
+	}
+
+	/**
+	 * Check if a note is currently selected
+	 */
+	isNoteSelected(noteId: string): boolean {
+		return this.#selectedNoteId === noteId
+	}
+
+	// Handle keyboard shortcuts
+	handleKeyDown(event: KeyboardEvent) {
+		if (event.key === 'Escape') {
+			// Escape key clears selection regardless of mode
+			this.clearNoteSelection()
+		}
+	}
+}
diff --git a/frontend/src/lib/components/graph/noteUtils.svelte.ts b/frontend/src/lib/components/graph/noteUtils.svelte.ts
new file mode 100644
index 0000000000..d84817a693
--- /dev/null
+++ b/frontend/src/lib/components/graph/noteUtils.svelte.ts
@@ -0,0 +1,420 @@
+import type { FlowNote } from '$lib/gen'
+import type { Node } from '@xyflow/svelte'
+import { deepEqual } from 'fast-equals'
+import { calculateNodesBoundsWithOffset } from './util'
+import { MIN_NOTE_WIDTH, MIN_NOTE_HEIGHT } from './noteColors'
+import type { NodeLayout } from './graphBuilder.svelte'
+import { topologicalSort } from './graphBuilder.svelte'
+import type { AssetWithAltAccessType } from '../assets/lib'
+import type { NoteEditorContext } from './noteEditor.svelte'
+import { StickyNote } from 'lucide-svelte'
+
+export type NodeDep = {
+	id: string
+	position: { x: number; y: number }
+	data?: { assets?: AssetWithAltAccessType[] }
+	parentIds?: string[]
+	offset?: number
+	type?: string
+}
+
+export type NoteComputeResult = {
+	noteNodes: (Node & NodeLayout)[]
+	newNodePositions: Record<string, { x: number; y: number }>
+}
+
+export type AIToolSpacingInfo = {
+	toolNodes: (Node & NodeLayout)[]
+	toolEdges: any[]
+	newNodePositions: Record<string, { x: number; y: number }>
+}
+
+export interface GroupNoteBounds {
+	x: number
+	y: number
+	width: number
+	height: number
+}
+
+let computeNoteNodesCache:
+	| [NodeDep[], FlowNote[], Record<string, number>, NoteComputeResult]
+	| undefined
+
+/**
+ * Extracts layout-affecting signature for change detection
+ * Only includes properties that affect graph layout (structure, grouping)
+ */
+export function getLayoutSignature(notes: FlowNote[]) {
+	return {
+		notesCount: notes.length,
+		noteIds: notes.map((n) => n.id).sort(),
+		// Group memberships affect layout spacing
+		groupMemberships: notes
+			.filter((note) => note.type === 'group')
+			.map((note) => ({
+				id: note.id,
+				containedIds: note.contained_node_ids?.slice().sort() || []
+			}))
+			.sort((a, b) => a.id.localeCompare(b.id))
+	}
+}
+
+/**
+ * Extracts property-only signature for change detection
+ * Only includes visual/content properties that don't affect layout
+ */
+export function getPropertySignature(notes: FlowNote[]) {
+	return notes
+		.map((note) => ({
+			id: note.id,
+			text: note.text,
+			color: note.color,
+			locked: note.locked || false,
+			position: { ...note.position },
+			size: { ...note.size }
+		}))
+		.sort((a, b) => a.id.localeCompare(b.id))
+}
+
+/**
+ * Calculates z-index values for all notes
+ * Group notes are ordered by their topmost node's hierarchy position
+ * Free notes get undefined z-index to use SvelteFlow's native behavior
+ */
+export function calculateAllNoteZIndexes(
+	notes: FlowNote[],
+	nodes: NodeDep[]
+): Record<string, number | undefined> {
+	const zIndexMap: Record<string, number | undefined> = {}
+
+	// Use topological sort to get proper hierarchy order based on parentIds relationships
+	const sortedNodes = topologicalSort(nodes).reverse()
+
+	// Create a mapping from node ID to its hierarchy position (topological order)
+	const nodeHierarchyMap: Record<string, number> = {}
+	sortedNodes.forEach((node, index) => {
+		nodeHierarchyMap[node.id] = index
+	})
+
+	// Process each note
+	for (const note of notes) {
+		if (note.type === 'free') {
+			// Free notes use SvelteFlow's native z-index behavior (last selected on top)
+			zIndexMap[note.id] = undefined
+		} else if (note.type === 'group') {
+			// Group notes get z-index based on topmost contained node's hierarchy
+			// Since sortedNodes is in topological order, the first matching node is the topmost
+			const topmostNode = sortedNodes.find((node) => note.contained_node_ids?.includes(node.id))
+
+			if (topmostNode) {
+				const hierarchyPosition = nodeHierarchyMap[topmostNode.id] ?? 0
+				// Higher hierarchy position = lower z-index (appears behind)
+				// Use negative values starting from -2000 to stay below other elements
+				zIndexMap[note.id] = hierarchyPosition - 2000
+			} else {
+				// Fallback for group notes without valid contained nodes
+				zIndexMap[note.id] = -2000
+			}
+		}
+	}
+
+	return zIndexMap
+}
+
+/**
+ * Calculate extra spacing needed for asset nodes of the topmost node
+ */
+function calculateExtraAssetSpacing(topmostNodeId: string, nodes: NodeDep[]): number {
+	// Find the topmost node position
+	const topmostNode = nodes.find((n) => n.id === topmostNodeId)
+	if (!topmostNode) {
+		return 0
+	}
+
+	// Find actual asset nodes for the topmost node: {topmostNodeId}-asset-in, type 'asset'
+	const assetNodes = nodes.filter((n) => n.id.startsWith(`${topmostNodeId}-asset-in-`))
+
+	if (assetNodes.length === 0) {
+		return 0
+	}
+
+	// Calculate the spacing based on actual asset node positions
+	const assetSpacing = Math.max(
+		...assetNodes.map((assetNode) => {
+			// Calculate how much space the asset node takes above the main node
+			return Math.max(0, -assetNode.position.y)
+		})
+	)
+
+	return assetSpacing
+}
+
+/**
+ * Calculate extra spacing needed for AI tool nodes of the topmost node
+ */
+function calculateExtraAIToolSpacing(topmostNodeId: string, nodes: NodeDep[]): number {
+	// Find the topmost node position
+	const topmostNode = nodes.find((n) => n.id === topmostNodeId)
+	if (!topmostNode) {
+		return 0
+	}
+
+	// Find actual AI tool nodes for the topmost node: {topmostNodeId}-tool-, type 'aiTool'
+	const toolNodes = nodes.filter((n) => n.id.startsWith(`${topmostNodeId}-tool-`))
+
+	if (toolNodes.length === 0) {
+		return 0
+	}
+
+	// Calculate the spacing based on actual AI tool node positions
+	const toolSpacing = Math.max(
+		...toolNodes.map((toolNode) => {
+			// Calculate how much space the tool node takes above/below the main node
+			return Math.max(0, -toolNode.position.y)
+		})
+	)
+
+	return toolSpacing
+}
+
+/**
+ * Calculate position and size for group notes based on contained nodes
+ */
+function calculateGroupNoteLayout(
+	note: FlowNote,
+	nodes: NodeDep[],
+	textHeight: number = 60,
+	topMostNodeId: string
+): { position: { x: number; y: number }; size: { width: number; height: number } } {
+	if (note.type !== 'group' || !note.contained_node_ids?.length) {
+		return {
+			position: note.position ?? { x: 0, y: 0 },
+			size: note.size ?? { width: MIN_NOTE_WIDTH, height: MIN_NOTE_HEIGHT }
+		}
+	}
+
+	const containedNodes = nodes.filter((node) => note.contained_node_ids?.includes(node.id))
+
+	if (containedNodes.length === 0) {
+		return {
+			position: note.position ?? { x: 0, y: 0 },
+			size: note.size ?? { width: MIN_NOTE_WIDTH, height: MIN_NOTE_HEIGHT }
+		}
+	}
+
+	const bounds = calculateNodesBoundsWithOffset(
+		note.contained_node_ids || [],
+		nodes.map((n) => ({
+			id: n.id,
+			position: n.position,
+			data: { offset: n.offset ?? 0 },
+			type: n.type ?? ''
+		}))
+	)
+
+	const padding = 16
+
+	// Calculate extra spacing for asset nodes and AI tool nodes of the topmost node
+	const extraAssetSpacing = topMostNodeId ? calculateExtraAssetSpacing(topMostNodeId, nodes) : 0
+
+	const extraAIToolSpacing = topMostNodeId ? calculateExtraAIToolSpacing(topMostNodeId, nodes) : 0
+
+	const totalTextHeight = textHeight + extraAssetSpacing + extraAIToolSpacing
+
+	return {
+		position: {
+			x: bounds.minX - padding,
+			y: bounds.minY - totalTextHeight - padding
+		},
+		size: {
+			width: bounds.maxX - bounds.minX + 2 * padding,
+			height: bounds.maxY - bounds.minY + totalTextHeight + 2 * padding
+		}
+	}
+}
+
+/**
+ * Create common data object for note nodes
+ */
+function createNoteData(
+	note: FlowNote,
+	onTextHeightChange: (noteId: string, height: number) => void,
+	isGroupNote: boolean,
+	editMode: boolean
+) {
+	return {
+		noteId: note.id,
+		text: note.text,
+		color: note.color,
+		locked: note.locked || false,
+		isGroupNote,
+		editMode,
+		...(isGroupNote && { containedNodeIds: note.contained_node_ids || [] }),
+		onTextHeightChange: (textHeight: number) => {
+			onTextHeightChange(note.id, textHeight)
+		}
+	}
+}
+
+/**
+ * Main function to compute note nodes and adjust nodes position based on group notes
+ */
+export function computeNoteNodes(
+	nodes: NodeDep[],
+	notes: FlowNote[],
+	noteTextHeights: Record<string, number>,
+	onTextHeightChange: (noteId: string, height: number) => void,
+	editMode: boolean = false,
+	noteEditorContext: NoteEditorContext | undefined
+): NoteComputeResult {
+	// Check cache first
+	if (
+		computeNoteNodesCache &&
+		deepEqual(nodes, computeNoteNodesCache[0]) &&
+		deepEqual(notes, computeNoteNodesCache[1]) &&
+		deepEqual(noteTextHeights, computeNoteNodesCache[2])
+	) {
+		return computeNoteNodesCache[3]
+	}
+
+	if (editMode) {
+		if (noteEditorContext?.noteEditor?.isAvailable()) {
+			noteEditorContext.noteEditor.cleanupGroupNotes(nodes)
+		}
+	}
+
+	const allNoteNodes: (Node & NodeLayout)[] = []
+
+	// Build a map of Y positions that need extra spacing for group notes
+	const yPosMap: Record<number, number> = {} // Y position -> spacing needed
+
+	// Group notes that need spacing
+	const groupNotes = notes.filter((n) => n.type === 'group')
+
+	const topMostNodesMap: Record<string, string> = {}
+
+	const sortedNodes = topologicalSort(nodes).reverse()
+
+	for (const groupNote of groupNotes) {
+		if (groupNote.contained_node_ids?.length) {
+			const topmostNodeId = sortedNodes.find((node) =>
+				groupNote.contained_node_ids?.includes(node.id)
+			)?.id
+			const topmostNode = nodes.find((node) => node.id === topmostNodeId)
+			if (topmostNode) {
+				const textHeight = noteTextHeights[groupNote.id] || 60
+				const spacing = textHeight + 16 // padding
+				// Mark this Y position as needing spacing
+				yPosMap[topmostNode.position.y] = Math.max(yPosMap[topmostNode.position.y] || 0, spacing)
+				topMostNodesMap[groupNote.id] = topmostNode.id
+			}
+		}
+	}
+
+	// Calculate new positions for nodes (offset by group notes)
+	const sortedNewNodes = nodes
+		.map((n) => ({ position: { ...n.position }, id: n.id }))
+		.sort((a, b) => a.position.y - b.position.y)
+
+	let currentYOffset = 0
+	let prevYPos = NaN
+
+	for (const node of sortedNewNodes) {
+		if (node.position.y !== prevYPos) {
+			// Add spacing for group notes at this Y level
+			if (yPosMap[node.position.y]) {
+				currentYOffset += yPosMap[node.position.y]
+			}
+			prevYPos = node.position.y
+		}
+		node.position.y += currentYOffset
+	}
+
+	// Create note nodes AFTER calculating adjusted node positions
+	// For group notes, we need to use the adjusted node positions
+	const adjustedNodes = sortedNewNodes.map((n) => {
+		const origNode = nodes.find((orig) => orig.id === n.id)
+		return {
+			...n,
+			data: origNode?.data,
+			offset: origNode?.offset,
+			type: origNode?.type
+		}
+	})
+
+	// Calculate all z-indexes at once using hierarchy information
+	const noteZIndexes = calculateAllNoteZIndexes(notes, nodes)
+
+	for (const note of notes) {
+		const isGroupNote = note.type === 'group'
+		const zIndex = noteZIndexes[note.id]
+
+		// Calculate position and size using adjusted node positions for group notes
+		const { position, size } = isGroupNote
+			? calculateGroupNoteLayout(
+					note,
+					adjustedNodes,
+					noteTextHeights[note.id] || 60,
+					topMostNodesMap[note.id]
+				)
+			: {
+					position: note.position ?? { x: 0, y: 0 },
+					size: note.size ?? { width: MIN_NOTE_WIDTH, height: MIN_NOTE_HEIGHT }
+				}
+
+		// Create the note node
+		const noteNode: Node & NodeLayout = {
+			id: note.id,
+			type: 'note' as any, // Note nodes are handled specially
+			position,
+			width: size.width,
+			height: size.height,
+			zIndex,
+			draggable: isGroupNote ? false : editMode && !note.locked,
+			selectable: false,
+			data: createNoteData(note, onTextHeightChange, isGroupNote, editMode) as any
+		}
+
+		allNoteNodes.push(noteNode)
+	}
+
+	const newNodePositions: Record<string, { x: number; y: number }> = Object.fromEntries(
+		sortedNewNodes.map((n) => [n.id, n.position])
+	)
+
+	const result: NoteComputeResult = {
+		noteNodes: allNoteNodes,
+		newNodePositions
+	}
+
+	// Cache the result
+	computeNoteNodesCache = [
+		structuredClone($state.snapshot(nodes)),
+		structuredClone($state.snapshot(notes)),
+		structuredClone($state.snapshot(noteTextHeights)),
+		result
+	]
+
+	return result
+}
+
+export function addGroupNoteContextMenuItem(
+	nodeId: string,
+	noteEditorContext: NoteEditorContext | undefined
+) {
+	const isDisabled =
+		!noteEditorContext?.noteEditor ||
+		(noteEditorContext?.noteEditor?.isNodeOnlyMemberOfGroupNote(nodeId) ?? false)
+
+	return {
+		id: 'add-group-note',
+		label: 'Add note',
+		icon: StickyNote,
+		disabled: isDisabled,
+		onClick: () => {
+			if (noteEditorContext?.noteEditor && !isDisabled) {
+				noteEditorContext.noteEditor.createGroupNote([nodeId])
+			}
+		}
+	}
+}
diff --git a/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte b/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte
index 568f16c0a0..3010a94325 100644
--- a/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte
+++ b/frontend/src/lib/components/graph/renderers/edges/BaseEdge.svelte
@@ -2,8 +2,6 @@
 	import InsertModulePopover from '$lib/components/flows/map/InsertModulePopover.svelte'
 	import { getBezierPath, BaseEdge, type EdgeProps, EdgeLabel } from '@xyflow/svelte'
 	import { ClipboardCopy, Hourglass } from 'lucide-svelte'
-	import { getContext } from 'svelte'
-	import type { Writable } from 'svelte/store'
 	import type { GraphEventHandlers } from '../../graphBuilder.svelte'
 	import { getStraightLinePath } from '../utils'
 	import { twMerge } from 'tailwind-merge'
@@ -13,11 +11,9 @@
 	import type { Job } from '$lib/gen'
 	import type { GraphModuleState } from '../../model'
 	import InsertModuleButton from '$lib/components/flows/map/InsertModuleButton.svelte'
+	import { getGraphContext } from '../../graphContext'
 
-	const { useDataflow, showAssets } = getContext<{
-		useDataflow: Writable<boolean | undefined>
-		showAssets?: Writable<boolean>
-	}>('FlowGraphContext')
+	const { useDataflow, showAssets } = getGraphContext()
 
 	let {
 		// id,
diff --git a/frontend/src/lib/components/graph/renderers/edges/EmptyEdge.svelte b/frontend/src/lib/components/graph/renderers/edges/EmptyEdge.svelte
index 47a099b7c8..0f622bc65c 100644
--- a/frontend/src/lib/components/graph/renderers/edges/EmptyEdge.svelte
+++ b/frontend/src/lib/components/graph/renderers/edges/EmptyEdge.svelte
@@ -1,8 +1,7 @@
 <script lang="ts">
 	import { getBezierPath, BaseEdge, type Position } from '@xyflow/svelte'
-	import { getContext } from 'svelte'
-	import type { Writable } from 'svelte/store'
 	import { twMerge } from 'tailwind-merge'
+	import { getGraphContext } from '../../graphContext'
 
 	interface Props {
 		sourceX: number
@@ -26,9 +25,7 @@
 		data = {}
 	}: Props = $props()
 
-	const { useDataflow } = getContext<{
-		useDataflow: Writable<boolean | undefined>
-	}>('FlowGraphContext')
+	const { useDataflow } = getGraphContext()
 
 	let [edgePath] = $derived(
 		getBezierPath({
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
index ac56f0920b..06098635d3 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/AIToolNode.svelte
@@ -172,7 +172,8 @@
 								(agentActions
 									? Math.floor(i / MAX_TOOLS_PER_ROW) + 1
 									: totalRows - Math.floor(i / MAX_TOOLS_PER_ROW))
-					}
+					},
+					selectable: false
 				}
 			})
 
@@ -181,7 +182,8 @@
 				source: agentActions ? (n.parentId ?? '') : (n.id ?? ''),
 				target: agentActions ? (n.id ?? '') : (n.parentId ?? ''),
 				type: 'empty',
-				data: { class: '!opacity-35 dark:!opacity-20' }
+				data: { class: '!opacity-35 dark:!opacity-20' },
+				selectable: false
 			}))
 
 			allToolEdges.push(...(toolEdges ?? []))
@@ -197,7 +199,8 @@
 					position: {
 						x: (ROW_WIDTH - NEW_TOOL_NODE_WIDTH) / 2 + node.data.offset,
 						y: baseOffset + rowOffset
-					}
+					},
+					selectable: false
 				} satisfies Node & NewAiToolN)
 			}
 		}
@@ -253,13 +256,12 @@
 	} from '../../graphBuilder.svelte'
 	import { MessageCircle, Play, Plug, Wrench, X } from 'lucide-svelte'
 	import { twMerge } from 'tailwind-merge'
-	import { getContext } from 'svelte'
 	import type { Edge, Node } from '@xyflow/svelte'
 
-	import type { Writable } from 'svelte/store'
 	import type { GraphModuleState } from '../../model'
 	import { getNodeColorClasses } from '../../util'
 	import { deepEqual } from 'fast-equals'
+	import { getGraphContext } from '../../graphContext'
 
 	let hover = $state(false)
 
@@ -269,15 +271,13 @@
 
 	let { data }: Props = $props()
 
-	const { selectedId } = getContext<{
-		selectedId: Writable<string | undefined>
-	}>('FlowGraphContext')
+	const { selectionManager } = getGraphContext()
 
 	const flowModuleState = $derived(data.flowModuleStates?.[data.moduleId])
 	let colorClasses = $derived(
 		getNodeColorClasses(
 			!validateToolName(data.tool) ? 'Failure' : flowModuleState?.type,
-			$selectedId === data.moduleId
+			selectionManager?.getSelectedId() === data.moduleId
 		)
 	)
 </script>
@@ -322,7 +322,7 @@
 				<button
 					class={twMerge(
 						'absolute -top-[8px] -right-[8px] rounded-full h-[16px] w-[16px] center-center text-secondary outline-[1px] outline dark:outline-gray-500 outline-gray-300 bg-surface duration-0 hover:bg-red-400 hover:text-white !hidden',
-						$selectedId === data.moduleId || hover ? '!flex' : ''
+						selectionManager?.getSelectedId() === data.moduleId || hover ? '!flex' : ''
 					)}
 					title="Delete"
 					onclick={() => data.eventHandlers.delete({ id: data.moduleId }, '')}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
index 3d82c81367..9a8eda2a93 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/AssetNode.svelte
@@ -86,7 +86,8 @@
 										? (-ASSETS_OVERFLOWED_NODE_WIDTH - inputAssetXGap) / 2
 										: 0),
 						y: READ_ASSET_Y_OFFSET
-					}
+					},
+					selectable: false
 				}
 			})
 
@@ -122,7 +123,8 @@
 										? (-ASSETS_OVERFLOWED_NODE_WIDTH - outputAssetXGap) / 2
 										: 0),
 						y: WRITE_ASSET_Y_OFFSET
-					}
+					},
+					selectable: false
 				}
 			})
 
diff --git a/frontend/src/lib/components/graph/renderers/nodes/BranchAllEndNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/BranchAllEndNode.svelte
index 6230f631be..7ea1765b26 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/BranchAllEndNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/BranchAllEndNode.svelte
@@ -2,12 +2,15 @@
 	import VirtualItem from '$lib/components/flows/map/VirtualItem.svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { BranchAllEndN } from '../../graphBuilder.svelte'
-
+	import { getGraphContext } from '../../graphContext'
 	interface Props {
 		data: BranchAllEndN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
+
+	const { selectionManager } = getGraphContext()
 </script>
 
 <NodeWrapper offset={data.offset} enableSourceHandle enableTargetHandle>
@@ -16,7 +19,7 @@
 			label={'Collect result from all branches'}
 			id={data.id}
 			selectable={true}
-			selected={false}
+			selected={selectionManager && selectionManager.isNodeSelected(id)}
 			on:select={(e) => {
 				data?.eventHandlers?.select(e.detail)
 			}}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte b/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte
index 8bf4c06225..5f49e62c9f 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/BranchAllStart.svelte
@@ -5,12 +5,15 @@
 	import NodeWrapper from './NodeWrapper.svelte'
 	import { X } from 'lucide-svelte'
 	import type { BranchAllStartN } from '../../graphBuilder.svelte'
-
+	import { getGraphContext } from '../../graphContext'
 	interface Props {
 		data: BranchAllStartN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
+
+	const { selectionManager } = getGraphContext()
 </script>
 
 <NodeWrapper offset={data.offset}>
@@ -18,7 +21,7 @@
 		<VirtualItem
 			label={data.label}
 			selectable
-			selected={false}
+			selected={selectionManager && selectionManager.isNodeSelected(id)}
 			on:select={() => {
 				setTimeout(() => data.eventHandlers.select(data.id))
 			}}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte b/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte
index 7539a4520e..73c5a02b9f 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/BranchOneStart.svelte
@@ -5,12 +5,14 @@
 	import NodeWrapper from './NodeWrapper.svelte'
 	import { X } from 'lucide-svelte'
 	import type { BranchOneStartN } from '../../graphBuilder.svelte'
-
+	import { getGraphContext } from '../../graphContext'
 	interface Props {
 		data: BranchOneStartN['data']
+		id: string
 	}
+	const { selectionManager } = getGraphContext()
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
 </script>
 
 <NodeWrapper offset={data.offset}>
@@ -19,7 +21,7 @@
 			label={data.label}
 			preLabel={data.preLabel}
 			selectable
-			selected={data.selected}
+			selected={selectionManager && selectionManager.isNodeSelected(id)}
 			on:select={() => {
 				setTimeout(() => data?.eventHandlers?.select(data.id))
 			}}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ForLoopEndNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ForLoopEndNode.svelte
index 7e145094cf..aff1c36a65 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ForLoopEndNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ForLoopEndNode.svelte
@@ -2,12 +2,15 @@
 	import VirtualItem from '$lib/components/flows/map/VirtualItem.svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { ForLoopEndN } from '../../graphBuilder.svelte'
-
+	import { getGraphContext } from '../../graphContext'
 	interface Props {
 		data: ForLoopEndN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
+
+	const { selectionManager } = getGraphContext()
 </script>
 
 <NodeWrapper offset={data.offset}>
@@ -27,7 +30,7 @@
 			<VirtualItem
 				label={'Collect result of each iteration'}
 				selectable={true}
-				selected={false}
+				selected={selectionManager && selectionManager.isNodeSelected(id)}
 				id={data.id}
 				on:select={(e) => {
 					setTimeout(() => data?.eventHandlers?.select(e.detail))
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ForLoopStartNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ForLoopStartNode.svelte
index 59e6d648c2..592c459747 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ForLoopStartNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ForLoopStartNode.svelte
@@ -5,12 +5,15 @@
 	import { getContext } from 'svelte'
 	import type { PropPickerContext } from '$lib/components/prop_picker'
 	import type { ForLoopStartN } from '../../graphBuilder.svelte'
-
+	import { getGraphContext } from '../../graphContext'
 	interface Props {
 		data: ForLoopStartN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
+
+	const { selectionManager } = getGraphContext()
 
 	const propPickerContext = getContext<PropPickerContext>('PropPickerContext')
 	const pickablePropertiesFiltered = propPickerContext?.pickablePropertiesFiltered
@@ -58,7 +61,7 @@
 		<VirtualItem
 			label={data.simplifiedTriggerView ? 'For each new event' : 'Do one iteration'}
 			selectable={false}
-			selected={false}
+			selected={selectionManager && selectionManager.isNodeSelected(id)}
 			id={data.id}
 			hideId
 			on:select={(e) => {
diff --git a/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte
index 4bf2bd980a..dc76c013b6 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/InputNode.svelte
@@ -3,7 +3,7 @@
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { InputN } from '../../graphBuilder.svelte'
 	import { getContext } from 'svelte'
-	import type { Writable } from 'svelte/store'
+
 	import InsertModulePopover from '$lib/components/flows/map/InsertModulePopover.svelte'
 	import InsertModuleButton from '$lib/components/flows/map/InsertModuleButton.svelte'
 	import { schemaToObject } from '$lib/schema'
@@ -11,6 +11,7 @@
 	import type { FlowEditorContext } from '$lib/components/flows/types'
 	import { MessageSquare, DiffIcon } from 'lucide-svelte'
 	import { Button } from '$lib/components/common'
+	import { getGraphContext } from '../../graphContext'
 
 	interface Props {
 		data: InputN['data']
@@ -18,9 +19,7 @@
 
 	let { data }: Props = $props()
 
-	const { selectedId } = getContext<{
-		selectedId: Writable<string | undefined>
-	}>('FlowGraphContext')
+	const { selectionManager } = getGraphContext()
 
 	const { previewArgs, flowStore } =
 		getContext<FlowEditorContext | undefined>('FlowEditorContext') || {}
@@ -82,7 +81,7 @@
 			hideId={true}
 			label={inputLabel}
 			selectable
-			selected={$selectedId === 'Input'}
+			selected={selectionManager?.isNodeSelected('Input')}
 			on:insert={(e) => {
 				setTimeout(() => data?.eventHandlers?.insert(e.detail))
 			}}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
index aeaafbb189..dd5d01ab0d 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ModuleNode.svelte
@@ -4,6 +4,9 @@
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { ModuleN } from '../../graphBuilder.svelte'
 	import { jobToGraphModuleState } from '$lib/components/modulesTest.svelte'
+	import { getNoteEditorContext } from '../../noteEditor.svelte'
+	import type { ContextMenuItem } from '../../../common/contextmenu/ContextMenu.svelte'
+	import { addGroupNoteContextMenuItem } from '../../noteUtils.svelte'
 
 	interface Props {
 		data: ModuleN['data']
@@ -11,6 +14,9 @@
 
 	let { data }: Props = $props()
 
+	// Get NoteEditor context for group note creation
+	const noteEditorContext = getNoteEditorContext()
+
 	let state = $derived.by(() => {
 		return data.testModuleState
 			? (jobToGraphModuleState(data.testModuleState) ?? data.flowModuleState)
@@ -35,9 +41,14 @@
 		}
 		return typ
 	})
+
+	// Define context menu items
+	const contextMenuItems: ContextMenuItem[] = $derived(
+		data.editMode ? [addGroupNoteContextMenuItem(data.id, noteEditorContext)] : []
+	)
 </script>
 
-<NodeWrapper offset={data.offset}>
+<NodeWrapper offset={data.offset} {contextMenuItems}>
 	{#snippet children({ darkMode })}
 		<MapItem
 			moduleId={data.id}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NoBranchNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/NoBranchNode.svelte
index 2744fd2ac8..356e1c272a 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/NoBranchNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/NoBranchNode.svelte
@@ -2,7 +2,6 @@
 	import VirtualItem from '$lib/components/flows/map/VirtualItem.svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { NoBranchN } from '../../graphBuilder.svelte'
-
 	interface Props {
 		data: NoBranchN['data']
 	}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte b/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
index 0a0dc4299e..f6905e8430 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/NodeWrapper.svelte
@@ -2,12 +2,14 @@
 	import DarkModeObserver from '$lib/components/DarkModeObserver.svelte'
 	import { Handle, Position } from '@xyflow/svelte'
 	import { twMerge } from 'tailwind-merge'
+	import ContextMenu, { type ContextMenuItem } from '../../../common/contextmenu/ContextMenu.svelte'
 
 	interface Props {
 		enableSourceHandle?: boolean
 		enableTargetHandle?: boolean
 		offset?: number
 		wrapperClass?: string
+		contextMenuItems?: ContextMenuItem[]
 		children?: import('svelte').Snippet<[any]>
 	}
 
@@ -16,6 +18,7 @@
 		enableTargetHandle = true,
 		offset = 0,
 		wrapperClass = '',
+		contextMenuItems = undefined,
 		children
 	}: Props = $props()
 
@@ -24,24 +27,38 @@
 
 <DarkModeObserver bind:darkMode />
 
-<div class={twMerge('relative rounded-md', wrapperClass)} style={`margin-left: ${offset}px;`}>
-	{@render children?.({ darkMode })}
-</div>
+{#if contextMenuItems && contextMenuItems.length > 0}
+	<ContextMenu items={contextMenuItems}>
+		<div class={twMerge('relative rounded-md', wrapperClass)} style={`margin-left: ${offset}px;`}>
+			{@render children?.({ darkMode })}
+		</div>
 
-{#if enableSourceHandle}
-	<Handle
-		type="source"
-		isConnectable={false}
-		position={Position.Bottom}
-		style={`margin-left: ${offset / 2}px;`}
-	/>
+		{@render handles()}
+	</ContextMenu>
+{:else}
+	<div class={twMerge('relative rounded-md', wrapperClass)} style={`margin-left: ${offset}px;`}>
+		{@render children?.({ darkMode })}
+	</div>
+
+	{@render handles()}
 {/if}
 
-{#if enableTargetHandle}
-	<Handle
-		type="target"
-		isConnectable={false}
-		position={Position.Top}
-		style={`margin-left: ${offset / 2}px;`}
-	/>
-{/if}
+{#snippet handles()}
+	{#if enableSourceHandle}
+		<Handle
+			type="source"
+			isConnectable={false}
+			position={Position.Bottom}
+			style={`margin-left: ${offset / 2}px;`}
+		/>
+	{/if}
+
+	{#if enableTargetHandle}
+		<Handle
+			type="target"
+			isConnectable={false}
+			position={Position.Top}
+			style={`margin-left: ${offset / 2}px;`}
+		/>
+	{/if}
+{/snippet}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/NoteNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/NoteNode.svelte
new file mode 100644
index 0000000000..55cac523e3
--- /dev/null
+++ b/frontend/src/lib/components/graph/renderers/nodes/NoteNode.svelte
@@ -0,0 +1,368 @@
+<script lang="ts">
+	import { NodeResizer, ViewportPortal, useSvelteFlow } from '@xyflow/svelte'
+	import { X, Lock, LockOpen } from 'lucide-svelte'
+	import { twMerge } from 'tailwind-merge'
+	import GfmMarkdown from '$lib/components/GfmMarkdown.svelte'
+	import { fade } from 'svelte/transition'
+	import NoteColorPicker from '../../NoteColorPicker.svelte'
+	import {
+		NoteColor,
+		NOTE_COLORS,
+		DEFAULT_NOTE_COLOR,
+		MIN_NOTE_WIDTH,
+		MIN_NOTE_HEIGHT
+	} from '../../noteColors'
+	import { Button } from '$lib/components/common'
+	import { getNoteEditorContext } from '../../noteEditor.svelte'
+	import { getGraphContext } from '../../graphContext'
+	import { clickOutside } from '$lib/utils'
+	import { tick } from 'svelte'
+
+	interface Props {
+		data: {
+			noteId: string
+			text: string
+			color: NoteColor
+			locked?: boolean
+			isGroupNote?: boolean
+			editMode?: boolean
+			// Callback for layout calculations (needed in both edit and view modes)
+			onTextHeightChange?: (height: number) => void
+		}
+		dragging?: boolean
+	}
+
+	let { data, dragging = false }: Props = $props()
+
+	// Get SvelteFlow utilities for accessing node position
+	const { getNode } = useSvelteFlow()
+
+	// Get NoteEditor context for edit mode
+	const noteEditorContext = getNoteEditorContext()
+	const isEditModeAvailable = $derived(!!noteEditorContext?.noteEditor && data.editMode)
+
+	// Get graph context for note selection
+	const graphContext = getGraphContext()
+	const noteManager = graphContext?.noteManager
+	const selected = $derived(noteManager?.isNoteSelected(data.noteId) ?? false)
+
+	// Get the current node with position data
+	const currentNode = $derived(getNode(data.noteId))
+
+	let textareaElement: HTMLTextAreaElement | undefined = $state(undefined)
+	let editMode = $state(false)
+	let hovering = $state(false)
+	let textContent = $state(data.text ?? '')
+	let containerHeight = $state(0)
+
+	// Use data props directly - they're kept in sync by NoteManager observer
+	const color = $derived(data.color ?? DEFAULT_NOTE_COLOR)
+	const locked = $derived(data.locked ?? false)
+	const textForDisplay = $derived(data.text ?? '')
+
+	function handleTextSave() {
+		// Only update when done editing
+		if (isEditModeAvailable && noteEditorContext?.noteEditor) {
+			noteEditorContext.noteEditor.updateText(data.noteId, textContent)
+		}
+	}
+
+	function handleDelete(event?: Event) {
+		event?.preventDefault?.()
+		event?.stopPropagation?.()
+		if (isEditModeAvailable && noteEditorContext?.noteEditor) {
+			noteEditorContext.noteEditor.deleteNote(data.noteId)
+		}
+	}
+
+	function handleColorChange(color: NoteColor) {
+		if (isEditModeAvailable && noteEditorContext?.noteEditor) {
+			noteEditorContext.noteEditor.updateColor(data.noteId, color)
+		}
+	}
+
+	function handleLockToggle(event?: Event) {
+		event?.preventDefault?.()
+		event?.stopPropagation?.()
+		if (isEditModeAvailable && noteEditorContext?.noteEditor) {
+			noteEditorContext.noteEditor.updateLock(data.noteId, !locked)
+		}
+	}
+
+	// Get color configuration for current color
+	const colorConfig = $derived(NOTE_COLORS[color])
+
+	function handleDoubleClick(event: Event) {
+		event.preventDefault()
+		event.stopPropagation()
+
+		// Don't allow editing if note is locked or edit mode is not available
+		if (locked || !isEditModeAvailable) {
+			return
+		}
+
+		editMode = true
+		// Focus the textarea after a short delay to ensure it's rendered
+		tick().then(() => {
+			textareaElement?.focus()
+		})
+	}
+
+	function handleMouseEnter() {
+		hovering = true
+	}
+
+	function handleMouseLeave() {
+		hovering = false
+	}
+
+	// Exit edit mode when note is deselected
+	$effect(() => {
+		if (!selected && editMode) {
+			editMode = false
+		}
+	})
+
+	let colorPickerIsOpen = $state(false)
+
+	function handleNoteClick(event: MouseEvent) {
+		// Only handle selection if not in edit mode and not dragging
+		if (!editMode && !dragging && noteManager) {
+			event.stopPropagation()
+			noteManager.selectNote(data.noteId)
+		}
+	}
+
+	function handleNoteKeydown(event: KeyboardEvent) {
+		// Handle Enter or Space key for selection (accessibility)
+		if ((event.key === 'Enter' || event.key === ' ') && !editMode && !dragging && noteManager) {
+			event.preventDefault()
+			event.stopPropagation()
+			noteManager.selectNote(data.noteId)
+		}
+	}
+
+	function handleTextareaKeydown(event: KeyboardEvent) {
+		// Handle Escape key to exit edit mode
+		if (event.key === 'Escape') {
+			event.preventDefault()
+			event.stopPropagation()
+			handleTextSave() // Save changes before exiting
+			editMode = false
+			textareaElement?.blur() // Remove focus from textarea
+		}
+	}
+</script>
+
+<!-- Snippet for action buttons to avoid code duplication -->
+{#snippet actionButtons()}
+	<div
+		class={twMerge(
+			'hidden group-hover:flex flex-row gap-2 h-fit',
+			hovering || editMode || colorPickerIsOpen || selected ? 'flex' : ''
+		)}
+	>
+		<!-- Lock/Unlock button -->
+		<Button
+			variant="subtle"
+			unifiedSize="xs"
+			title={locked ? 'Unlock note' : 'Lock note'}
+			aria-label={locked ? 'Unlock note' : 'Lock note'}
+			startIcon={{ icon: locked ? Lock : LockOpen }}
+			onClick={handleLockToggle}
+			iconOnly
+		/>
+
+		<!-- Color picker -->
+		{#if !locked}
+			<NoteColorPicker
+				selectedColor={color}
+				onColorChange={handleColorChange}
+				bind:isOpen={colorPickerIsOpen}
+			/>
+		{/if}
+
+		<!-- Delete button -->
+		{#if !locked}
+			<Button
+				variant="subtle"
+				unifiedSize="xs"
+				title="Delete note"
+				aria-label="Delete note"
+				startIcon={{ icon: X }}
+				onClick={handleDelete}
+				iconOnly
+				destructive
+			/>
+		{/if}
+	</div>
+{/snippet}
+
+<div
+	class={twMerge(
+		'relative w-full h-full rounded-md group hover:outline outline-1',
+		colorConfig.background,
+		colorConfig.text,
+		colorConfig.outlineHover,
+		selected ? 'outline' : '',
+		selected ? colorConfig.outline : '',
+		editMode ? 'outline-0' : ''
+	)}
+	onclick={handleNoteClick}
+	onkeydown={handleNoteKeydown}
+	onpointerup={() => {
+		dragging = false
+	}}
+	ondragstart={() => {
+		dragging = true
+	}}
+	ondragend={() => {
+		dragging = false
+	}}
+	onmouseenter={handleMouseEnter}
+	onmouseleave={handleMouseLeave}
+	role="button"
+	tabindex={editMode ? -1 : 0}
+	ondblclick={handleDoubleClick}
+	use:clickOutside={{
+		onClickOutside: () => {
+			noteManager?.deselectNote(data.noteId)
+		}
+	}}
+>
+	<!-- Hover help text -->
+	{#if hovering || selected}
+		{#if !editMode && isEditModeAvailable}
+			<div
+				in:fade={{ duration: 200 }}
+				class="absolute -top-5 h-5 left-0 text-2xs text-secondary rounded-md z-10 transition-opacity duration-300"
+			>
+				{locked
+					? 'Note is locked'
+					: isEditModeAvailable
+						? 'Double click to edit'
+						: 'View only mode'}
+			</div>
+		{:else if !locked && isEditModeAvailable}
+			<div
+				in:fade={{ duration: 200 }}
+				class="absolute -top-5 h-5 left-0 text-2xs text-secondary rounded-md z-10 transition-opacity duration-300"
+				>GH Markdown</div
+			>
+		{/if}
+	{/if}
+
+	<!-- Note content -->
+	<div
+		class={twMerge(
+			'w-full rounded-md ',
+			data.isGroupNote ? 'min-h-[60px] max-h-[400px]' : 'h-full'
+		)}
+	>
+		{#if editMode}
+			<!-- Edit mode: show textarea -->
+			<textarea
+				bind:this={textareaElement}
+				bind:value={textContent}
+				class={twMerge(
+					'windmillapp w-full shadow-none resize-none text-xs overflow-y-auto border-none rounded-md bg-transparent transition-colors p-4 nodrag nowheel',
+					colorConfig.text
+				)}
+				placeholder="Double click to edit me"
+				onblur={handleTextSave}
+				onkeydown={handleTextareaKeydown}
+				spellcheck="false"
+				style:height={data.isGroupNote ? `${containerHeight > 0 ? containerHeight : 60}px` : '100%'}
+			></textarea>
+		{:else}
+			<!-- Render mode: show markdown or empty state -->
+			<div
+				class={twMerge(
+					'w-full h-fit overflow-auto cursor-pointer flex items-start justify-start rounded-md p-4'
+				)}
+				bind:clientHeight={
+					() => containerHeight,
+					(v) => {
+						if (v > 0 && v !== containerHeight) {
+							data.onTextHeightChange?.(v)
+						}
+						containerHeight = v
+					}
+				}
+			>
+				{#if textForDisplay}
+					<div
+						class={twMerge(
+							'w-full text-xs rounded-md break-words overflow-hidden',
+							colorConfig.text
+						)}
+					>
+						<GfmMarkdown md={textForDisplay} noPadding />
+					</div>
+				{:else}
+					<div class={twMerge('text-xs italic opacity-60', colorConfig.text)}>
+						Double click to edit me
+					</div>
+				{/if}
+			</div>
+		{/if}
+	</div>
+
+	<!-- Node resizer - only visible when selected and not locked and edit mode is available -->
+	{#if !locked && isEditModeAvailable}
+		<NodeResizer
+			isVisible={selected && !dragging && !data.isGroupNote}
+			minWidth={MIN_NOTE_WIDTH}
+			minHeight={MIN_NOTE_HEIGHT}
+			lineClass="!border-4 !border-transparent !rounded-md"
+			handleClass="!bg-transparent !w-4 !h-4 !border-none !rounded-md"
+			onResizeEnd={(_, params) => {
+				// Update note size when resizing ends
+				if (params.width !== undefined && params.height !== undefined) {
+					const size = { width: params.width, height: params.height }
+					if (isEditModeAvailable && noteEditorContext?.noteEditor) {
+						// Use NoteEditor context in edit mode
+						noteEditorContext.noteEditor.updateSize(data.noteId, size)
+					}
+				}
+			}}
+		/>
+	{/if}
+
+	<!-- Action buttons - conditional rendering based on note type -->
+	{#if isEditModeAvailable}
+		{#if data.isGroupNote && currentNode?.position}
+			<!-- Group notes: Use ViewportPortal to render above graph edges -->
+			<ViewportPortal target="front">
+				<div
+					class="absolute p-1 w-24 h-8 group flex justify-end"
+					style:transform="translate({currentNode.position.x +
+						(currentNode.measured?.width ?? MIN_NOTE_WIDTH) -
+						100}px , {currentNode.position.y - 30}px)"
+					style:pointer-events="auto"
+					style:z-index="1000"
+				>
+					{@render actionButtons()}
+				</div>
+			</ViewportPortal>
+		{:else}
+			<!-- Standalone notes: Use normal absolute positioning -->
+			<div class="absolute -top-8 -right-2.5 p-2 w-32 h-12 group flex justify-end">
+				{@render actionButtons()}
+			</div>
+		{/if}
+	{/if}
+</div>
+
+<style>
+	textarea::placeholder {
+		color: #6b7280;
+		opacity: 0.7;
+	}
+
+	/* Remove default textarea styling */
+	textarea {
+		font-family: inherit;
+		line-height: 1.4;
+	}
+</style>
diff --git a/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte
index 3917206edb..13ede87991 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/ResultNode.svelte
@@ -1,19 +1,17 @@
 <script lang="ts">
 	import VirtualItem from '$lib/components/flows/map/VirtualItem.svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
-	import type { Writable } from 'svelte/store'
-	import { getContext } from 'svelte'
 	import type { ResultN } from '../../graphBuilder.svelte'
+	import { getGraphContext } from '../../graphContext'
 
 	interface Props {
 		data: ResultN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
 
-	const { selectedId } = getContext<{
-		selectedId: Writable<string | undefined>
-	}>('FlowGraphContext')
+	const { selectionManager } = getGraphContext()
 </script>
 
 <NodeWrapper enableSourceHandle={false}>
@@ -22,7 +20,7 @@
 			id={'Result'}
 			label={'Result'}
 			selectable={true}
-			selected={$selectedId === 'Result'}
+			selected={selectionManager && selectionManager.isNodeSelected(id)}
 			hideId={true}
 			on:select={(e) => {
 				setTimeout(() => data?.eventHandlers?.select(e.detail))
diff --git a/frontend/src/lib/components/graph/renderers/nodes/SubflowBound.svelte b/frontend/src/lib/components/graph/renderers/nodes/SubflowBound.svelte
index bb23d4566a..7e5438dda0 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/SubflowBound.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/SubflowBound.svelte
@@ -5,12 +5,16 @@
 	import NodeWrapper from './NodeWrapper.svelte'
 	import { Minimize2 } from 'lucide-svelte'
 	import type { SubflowBoundN } from '../../graphBuilder.svelte'
+	import { getGraphContext } from '../../graphContext'
 
 	interface Props {
 		data: SubflowBoundN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	let { data, id }: Props = $props()
+
+	const { selectionManager } = getGraphContext()
 </script>
 
 <NodeWrapper offset={data.offset}>
@@ -19,7 +23,7 @@
 			label={data.label}
 			preLabel={data.preLabel}
 			selectable
-			selected={data.selected}
+			selected={selectionManager && selectionManager.isNodeSelected(id)}
 			on:select={() => {
 				setTimeout(() => data.eventHandlers?.select(data.id))
 			}}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte
index 7283739b5f..58f95d4b33 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/TriggersNode.svelte
@@ -1,9 +1,10 @@
 <script lang="ts">
+	import { preventDefault, stopPropagation } from 'svelte/legacy'
+
 	import NodeWrapper from './NodeWrapper.svelte'
 	import TriggersWrapper from '../triggers/TriggersWrapper.svelte'
 	import type { FlowModule, TriggersCount } from '$lib/gen'
 	import { getContext } from 'svelte'
-	import type { Writable } from 'svelte/store'
 	import { Maximize2, Minimize2, Calendar } from 'lucide-svelte'
 	import { getNodeColorClasses } from '../../util'
 	import { setScheduledPollSchedule, type TriggerContext } from '$lib/components/triggers'
@@ -11,24 +12,27 @@
 	import { type Trigger, type TriggerType } from '$lib/components/triggers/utils'
 	import { tick } from 'svelte'
 	import type { GraphEventHandlers, SimplifiableFlow } from '../../graphBuilder.svelte'
+	import { getGraphContext } from '../../graphContext'
 
-	export let data: {
-		path: string
-		isEditor: boolean
-		newFlow: boolean
-		extra_perms: Record<string, any>
-		eventHandlers: GraphEventHandlers
-		modules: FlowModule[]
-		index: number
-		disableAi: boolean
-		simplifiableFlow: SimplifiableFlow
+	interface Props {
+		data: {
+			path: string
+			isEditor: boolean
+			newFlow: boolean
+			extra_perms: Record<string, any>
+			eventHandlers: GraphEventHandlers
+			modules: FlowModule[]
+			index: number
+			disableAi: boolean
+			simplifiableFlow: SimplifiableFlow
+		}
 	}
 
-	const { selectedId } = getContext<{
-		selectedId: Writable<string | undefined>
-	}>('FlowGraphContext')
+	let { data }: Props = $props()
 
-	const { triggersCount, triggersState } = getContext<TriggerContext>('TriggerContext')
+	const { selectionManager } = getGraphContext()
+
+	const { triggersCount, triggersState } = $state(getContext<TriggerContext>('TriggerContext'))
 
 	function getScheduleCfg(primary: Trigger | undefined, triggersCount: TriggersCount | undefined) {
 		return primary?.draftConfig
@@ -44,7 +48,9 @@
 					}
 	}
 
-	$: colorClasses = getNodeColorClasses('_VirtualItem', $selectedId == 'triggers')
+	let colorClasses = $derived(
+		getNodeColorClasses('_VirtualItem', selectionManager?.isNodeSelected('Trigger'))
+	)
 </script>
 
 <NodeWrapper>
@@ -76,26 +82,26 @@
 					const primarySchedule = triggersState.triggers.findIndex((t) => t.isPrimary && !t.isDraft)
 					triggersState.selectedTriggerIndex = primarySchedule
 				}}
-				on:select={() => data?.eventHandlers?.select('triggers')}
+				on:select={() => data?.eventHandlers?.select('Trigger')}
 				onSelect={async (triggerIndex: number) => {
-					data?.eventHandlers?.select('triggers')
+					data?.eventHandlers?.select('Trigger')
 					await tick()
 					triggersState.selectedTriggerIndex = triggerIndex
 				}}
 				onAddDraftTrigger={async (type: TriggerType) => {
 					const newTrigger = triggersState.addDraftTrigger(triggersCount, type)
-					data?.eventHandlers?.select('triggers')
+					data?.eventHandlers?.select('Trigger')
 					await tick()
 					triggersState.selectedTriggerIndex = newTrigger
 				}}
-				selected={$selectedId == 'triggers'}
+				selected={selectionManager?.getSelectedId() === 'Trigger'}
 				newItem={data.newFlow}
 			/>
 		{:else}
 			<VirtualItemWrapper
 				label="Check for new events"
 				selectable={true}
-				id={'triggers'}
+				id={'Trigger'}
 				on:select={(e) => {
 					data?.eventHandlers?.select(e.detail)
 				}}
@@ -116,7 +122,7 @@
 				{:else}
 					<button
 						class="px-2 py-1 hover:bg-surface-inverse w-full hover:text-primary-inverse"
-						on:click={() => {
+						onclick={() => {
 							setScheduledPollSchedule(triggersState, triggersCount)
 						}}
 					>
@@ -129,8 +135,11 @@
 			<button
 				class="absolute -top-[10px] -right-[10px] rounded-full h-[20px] w-[20px] trash center-center text-secondary
 outline-[1px] outline dark:outline-gray-500 outline-gray-300 bg-surface duration-0 hover:bg-nord-950 hover:text-white"
-				on:click|preventDefault|stopPropagation={() =>
-					data?.eventHandlers?.simplifyFlow(!data.simplifiableFlow?.simplifiedFlow)}
+				onclick={stopPropagation(
+					preventDefault(() =>
+						data?.eventHandlers?.simplifyFlow(!data.simplifiableFlow?.simplifiedFlow)
+					)
+				)}
 				title={data.simplifiableFlow?.simplifiedFlow
 					? 'Expand to full flow view'
 					: 'Simplify flow view for scheduled poll'}
diff --git a/frontend/src/lib/components/graph/renderers/nodes/branchOneEndNode.svelte b/frontend/src/lib/components/graph/renderers/nodes/branchOneEndNode.svelte
index 0615d8e0ab..fca971ec92 100644
--- a/frontend/src/lib/components/graph/renderers/nodes/branchOneEndNode.svelte
+++ b/frontend/src/lib/components/graph/renderers/nodes/branchOneEndNode.svelte
@@ -2,12 +2,15 @@
 	import VirtualItem from '$lib/components/flows/map/VirtualItem.svelte'
 	import NodeWrapper from './NodeWrapper.svelte'
 	import type { BranchOneEndN } from '../../graphBuilder.svelte'
-
+	import { getGraphContext } from '../../graphContext'
 	interface Props {
 		data: BranchOneEndN['data']
+		id: string
 	}
 
-	let { data }: Props = $props()
+	const { selectionManager } = getGraphContext()
+
+	let { data, id }: Props = $props()
 </script>
 
 <NodeWrapper offset={data.offset}>
@@ -16,7 +19,7 @@
 			label={'Collect result from chosen branch'}
 			id={data.id}
 			selectable={true}
-			selected={false}
+			selected={selectionManager?.isNodeSelected(id)}
 			on:select={(e) => {
 				setTimeout(() => data?.eventHandlers?.select(e.detail))
 			}}
diff --git a/frontend/src/lib/components/graph/selectionUtils.svelte.ts b/frontend/src/lib/components/graph/selectionUtils.svelte.ts
new file mode 100644
index 0000000000..8abc7fa563
--- /dev/null
+++ b/frontend/src/lib/components/graph/selectionUtils.svelte.ts
@@ -0,0 +1,106 @@
+import type { Node } from '@xyflow/svelte'
+
+export class SelectionManager {
+	#selectedNodes = $state<Node[] | { id: string }[]>([])
+	#selectionMode = $state<'normal' | 'rect-select'>('normal')
+	#clearGraphSelection: () => void = () => {}
+
+	constructor() {}
+
+	setClearGraphSelection(clearGraphSelection: () => void) {
+		this.#clearGraphSelection = clearGraphSelection
+	}
+
+	selectId(id: string) {
+		if (this.#selectedNodes.length === 1 && this.#selectedNodes[0].id === id) {
+			return
+		}
+		this.#clearGraphSelection()
+		this.#selectedNodes = [{ id }]
+	}
+
+	getSelectedId(): string {
+		if (this.#selectedNodes.length === 0) {
+			return 'settings'
+		}
+		const selectedNode = this.#selectedNodes[0]
+
+		if (selectedNode['type'] === 'branchOneEnd') {
+			const id = selectedNode.id.replace(/-end$/, '')
+			if (id !== '') {
+				return id
+			}
+		} else if (selectedNode['type'] === 'branchAllEnd') {
+			const id = selectedNode.id.replace(/-end$/, '')
+			if (id !== '') {
+				return id
+			}
+		} else if (selectedNode['type'] === 'forLoopStart') {
+			const id = selectedNode.id.replace(/-start$/, '')
+			if (id !== '') {
+				return id
+			}
+		} else if (selectedNode['type'] === 'forLoopEnd') {
+			const id = selectedNode.id.replace(/-end$/, '')
+			if (id !== '') {
+				return id
+			}
+		} else if (selectedNode['type'] === 'subflowBound') {
+			const id = selectedNode.id.replace(/-subflow-end$/, '')
+			if (id !== '') {
+				return id
+			}
+		}
+		return selectedNode.id
+	}
+
+	get mode() {
+		return this.#selectionMode
+	}
+
+	set mode(mode: 'normal' | 'rect-select') {
+		this.#selectionMode = mode
+	}
+
+	get selectedIds() {
+		if (this.#selectedNodes.length === 0) {
+			return ['settings']
+		}
+		return [...this.#selectedNodes.map((node) => node.id)]
+	}
+
+	// Select nodes with optional hierarchical selection
+	selectNodes(nodes: Node[]) {
+		// Guard against empty nodeIds or uninitialized state
+		if (!nodes || nodes.length === 0) {
+			this.clearSelection()
+			return
+		}
+
+		// If the new selection is the same as the current selection, do nothing
+		if (JSON.stringify(nodes) === JSON.stringify($state.snapshot(this.#selectedNodes))) {
+			return
+		}
+
+		this.#selectedNodes = nodes
+	}
+
+	// Clear all selections
+	clearSelection() {
+		this.#selectedNodes = [{ id: 'settings' }]
+	}
+
+	// Check if a node is selected
+	isNodeSelected(nodeId: string): boolean {
+		return this.#selectedNodes.some((node) => node.id === nodeId)
+	}
+
+	// Handle keyboard shortcuts
+	handleKeyDown(event: KeyboardEvent) {
+		if (event.key === 'Escape') {
+			// Escape key clears selection regardless of mode
+			this.clearSelection()
+			this.#clearGraphSelection()
+		}
+	}
+}
diff --git a/frontend/src/lib/components/graph/util.ts b/frontend/src/lib/components/graph/util.ts
index e32df15abd..d1bb132515 100644
--- a/frontend/src/lib/components/graph/util.ts
+++ b/frontend/src/lib/components/graph/util.ts
@@ -15,6 +15,9 @@ export type FlowNodeColorClasses = {
 	outline: string
 	badge: string
 }
+
+export const AI_OR_ASSET_NODE_TYPES = ['asset', 'assetsOverflowed', 'newAiTool', 'aiTool']
+
 export type FlowNodeState = FlowStatusModule['type'] | '_VirtualItem' | '_Skipped' | undefined
 
 export function getNodeColorClasses(state: FlowNodeState, selected: boolean): FlowNodeColorClasses {
@@ -126,3 +129,101 @@ export function getNodeColorClasses(state: FlowNodeState, selected: boolean): Fl
 
 	return r
 }
+
+/**
+ * Calculate the bounding box for a collection of nodes, accounting for CSS offset
+ * Also includes expanded subflow nodes when calculating bounds for subflow containers
+ * @param containedIds - Array of node IDs to calculate bounds for
+ * @param allNodes - Array of all nodes to search for expanded subflow nodes
+ * @returns The bounds { minX, minY, maxX, maxY }
+ */
+export function calculateNodesBoundsWithOffset(
+	containedIds: string[],
+	allNodes: Array<{
+		id: string
+		position: { x: number; y: number }
+		data?: { offset?: number }
+		type: string
+	}>
+): {
+	minX: number
+	minY: number
+	maxX: number
+	maxY: number
+} {
+	// Find related subflow nodes
+	const nodesToCalculate = getAllRelatedSubflowNodes(containedIds, allNodes)
+
+	return nodesToCalculate.reduce(
+		(acc, node) => {
+			// Account for CSS offset applied by NodeWrapper
+			const cssOffset = node.data?.offset ?? 0
+			const visualX = node.position.x + cssOffset
+
+			return {
+				minX: Math.min(acc.minX, visualX),
+				minY: Math.min(acc.minY, node.position.y),
+				maxX: Math.max(acc.maxX, visualX + NODE.width),
+				maxY: Math.max(acc.maxY, node.position.y + NODE.height)
+			}
+		},
+		{
+			minX: Infinity,
+			minY: Infinity,
+			maxX: -Infinity,
+			maxY: -Infinity
+		}
+	)
+}
+
+/**
+ * Find all nodes related to the given node IDs, including expanded subflow nodes
+ * @param targetNodeIds - Array of node IDs to find related nodes for
+ * @param allNodes - Array of all available nodes
+ * @returns Array of nodes including original nodes and any related subflow nodes
+ */
+function getAllRelatedSubflowNodes(
+	targetNodeIds: string[],
+	allNodes: Array<{
+		id: string
+		position: { x: number; y: number }
+		data?: { offset?: number }
+		type: string
+	}>
+): Array<{
+	id: string
+	position: { x: number; y: number }
+	data?: { offset?: number }
+}> {
+	const relatedNodeIds = new Set<string>()
+
+	// Add original target nodes
+	targetNodeIds.forEach((id) => relatedNodeIds.add(id))
+
+	// For each target node, check if it's a subflow and find expanded nodes
+	targetNodeIds.forEach((nodeId) => {
+		// Find nodes like "subflow:{nodeId}:*"
+		const subflowNodes = allNodes.filter(
+			(node) =>
+				node.id.startsWith(`subflow:${nodeId}:`) && !AI_OR_ASSET_NODE_TYPES.includes(node.type)
+		)
+
+		// Find end node like "{nodeId}-subflow-end"
+		const endNode = allNodes.find((node) => node.id === `${nodeId}-subflow-end`)
+
+		// Add all found nodes
+		subflowNodes.forEach((node) => relatedNodeIds.add(node.id))
+		if (endNode) relatedNodeIds.add(endNode.id)
+	})
+
+	// Return actual node objects that exist in allNodes
+	return allNodes.filter((node) => relatedNodeIds.has(node.id))
+}
+
+/**
+ * Generate a random unique ID for notes
+ * @returns A random string ID
+ */
+export function generateId(): string {
+	return 'note-' + Math.random().toString(36).substring(2) + Math.random().toString(36).substring(2)
+}
diff --git a/frontend/src/lib/components/text_input/TextInput.svelte b/frontend/src/lib/components/text_input/TextInput.svelte
index 59fc94be18..d19ace6e06 100644
--- a/frontend/src/lib/components/text_input/TextInput.svelte
+++ b/frontend/src/lib/components/text_input/TextInput.svelte
@@ -23,6 +23,11 @@
 	import { ButtonType } from '$lib/components/common/button/model'
 
 	export const inputSizeClasses = {
+		xs: twMerge(
+			ButtonType.UnifiedSizingClasses.xs,
+			ButtonType.UnifiedMinHeightClasses.xs,
+			'px-1 !py-0.5'
+		),
 		sm: twMerge(
 			ButtonType.UnifiedSizingClasses.sm,
 			ButtonType.UnifiedMinHeightClasses.sm,
@@ -42,7 +47,7 @@
 		value?: string
 		class?: string
 		error?: string | boolean
-		size?: 'sm' | 'md' | 'lg'
+		size?: ButtonType.UnifiedSize
 		unifiedHeight?: boolean
 	}
 
diff --git a/frontend/src/lib/components/tutorials/FlowBuilderTutorialForLoop.svelte b/frontend/src/lib/components/tutorials/FlowBuilderTutorialForLoop.svelte
index a5b6d42e58..39d548343d 100644
--- a/frontend/src/lib/components/tutorials/FlowBuilderTutorialForLoop.svelte
+++ b/frontend/src/lib/components/tutorials/FlowBuilderTutorialForLoop.svelte
@@ -8,7 +8,7 @@
 	import { nextId } from '../flows/flowModuleNextId'
 
 	const dispatch = createEventDispatcher()
-	const { flowStore, selectedId, flowStateStore } =
+	const { flowStore, selectionManager, flowStateStore } =
 		getContext<FlowEditorContext>('FlowEditorContext')
 
 	let tutorial: Tutorial | undefined = undefined
@@ -158,7 +158,7 @@
 					title: 'Step of the loop',
 					description: 'We added an action to the loop. Let’s configure it',
 					onNextClick: () => {
-						$selectedId = tempId
+						selectionManager.selectId(tempId)
 
 						dispatch('reload')
 						setTimeout(() => {
diff --git a/frontend/src/routes/flows/dev/+page.svelte b/frontend/src/routes/flows/dev/+page.svelte
index b7a51dad5a..c9be638e48 100644
--- a/frontend/src/routes/flows/dev/+page.svelte
+++ b/frontend/src/routes/flows/dev/+page.svelte
@@ -9,6 +9,7 @@
 		FlowInput,
 		FlowInputEditorState
 	} from '$lib/components/flows/types'
+	import { SelectionManager } from '$lib/components/graph/selectionUtils.svelte'
 	import { writable } from 'svelte/store'
 	import { OpenAPI, type OpenFlow, type TriggersCount } from '$lib/gen'
 	import { initHistory } from '$lib/history.svelte'
@@ -76,7 +77,8 @@
 	const history = initHistory(flowStore.val)
 
 	const stepsInputArgs = new StepsInputArgs()
-	const selectedIdStore = writable('settings-metadata')
+	const selectionManager = new SelectionManager()
+	selectionManager.selectId('settings-metadata')
 	const triggersCount = writable<TriggersCount | undefined>(undefined)
 	setContext<TriggerContext>('TriggerContext', {
 		triggersCount: triggersCount,
@@ -86,7 +88,7 @@
 	})
 
 	setContext<FlowEditorContext>('FlowEditorContext', {
-		selectedId: selectedIdStore,
+		selectionManager,
 		previewArgs: previewArgsStore,
 		scriptEditorDrawer,
 		moving,
@@ -293,7 +295,7 @@
 						on:applyArgs={(ev) => {
 							if (ev.detail.kind === 'preprocessor') {
 								stepsInputArgs.setStepArgs('preprocessor', ev.detail.args ?? {})
-								$selectedIdStore = 'preprocessor'
+								selectionManager.selectId('preprocessor')
 							} else {
 								previewArgsStore.val = ev.detail.args ?? {}
 								flowPreviewButtons?.openPreview()
diff --git a/frontend/src/routes/test_dev/kitchen_sink/+page.svelte b/frontend/src/routes/test_dev/kitchen_sink/+page.svelte
index 82ce3c4287..c1d9c4eb79 100644
--- a/frontend/src/routes/test_dev/kitchen_sink/+page.svelte
+++ b/frontend/src/routes/test_dev/kitchen_sink/+page.svelte
@@ -8,6 +8,8 @@
 	import ClearableInput from '$lib/components/common/clearableInput/ClearableInput.svelte'
 	import DateInput from '$lib/components/DateInput.svelte'
 	import DateTimeInput from '$lib/components/DateTimeInput.svelte'
+	import ContextMenu from '$lib/components/common/contextmenu/ContextMenu.svelte'
+	import { StickyNote } from 'lucide-svelte'
 	import {
 		Pen,
 		GitFork,
@@ -152,6 +154,45 @@
 			disabled: true
 		}
 	]
+
+	// Context menu items
+	const contextMenuItems = [
+		{
+			id: 'create-note',
+			label: 'Create sticky note',
+			icon: StickyNote,
+			onClick: () => console.log('Create sticky note clicked')
+		},
+		{
+			id: 'edit',
+			label: 'Edit item',
+			icon: Pen,
+			onClick: () => console.log('Edit item clicked')
+		},
+		{
+			id: 'divider-1',
+			label: '',
+			divider: true
+		},
+		{
+			id: 'copy',
+			label: 'Copy',
+			icon: Copy,
+			onClick: () => console.log('Copy clicked')
+		},
+		{
+			id: 'share',
+			label: 'Share',
+			icon: Share,
+			onClick: () => console.log('Share clicked')
+		},
+		{
+			id: 'delete',
+			label: 'Delete',
+			icon: Trash,
+			onClick: () => console.log('Delete clicked')
+		}
+	]
 </script>
 
 <div class="p-8 flex flex-col gap-8 max-w-6xl mx-auto bg-surface-secondary min-h-screen pb-32">
@@ -578,6 +619,64 @@
 		</div>
 	</div>
 
+	<!-- CONTEXT MENU SECTION HEADER -->
+	<header class="flex flex-col gap-2 border-b border-gray-200 dark:border-gray-700 pb-4 mt-12">
+		<h2 class="text-lg font-semibold text-emphasis">Context Menus</h2>
+		<p class="text-xs text-secondary"> Right-click triggered menus with contextual actions. </p>
+	</header>
+
+	<!-- Context Menu Examples -->
+	<div class="flex flex-col gap-6">
+		<h3 class="text-sm font-semibold text-emphasis">Context menu tests</h3>
+
+		<div class="grid grid-cols-1 md:grid-cols-2 xl:grid-cols-3 gap-4">
+			<div
+				class="flex flex-col space-y-4 p-6 border border-gray-200 dark:border-gray-700 rounded-lg bg-surface"
+			>
+				<div class="space-y-1">
+					<h4 class="text-xs font-semibold text-emphasis">Basic Context Menu</h4>
+					<p class="text-xs text-secondary">Right-click the area below</p>
+				</div>
+				<ContextMenu items={contextMenuItems}>
+					<div
+						class="w-full h-32 border-2 border-dashed border-gray-300 dark:border-gray-600 rounded-lg flex items-center justify-center text-sm text-secondary bg-surface-tertiary cursor-pointer hover:border-accent hover:text-accent transition-colors"
+					>
+						Right-click me for context menu
+					</div>
+				</ContextMenu>
+			</div>
+
+			<div
+				class="flex flex-col space-y-4 p-6 border border-gray-200 dark:border-gray-700 rounded-lg bg-surface"
+			>
+				<div class="space-y-1">
+					<h4 class="text-xs font-semibold text-emphasis">Text Context Menu</h4>
+					<p class="text-xs text-secondary">Right-click the text below</p>
+				</div>
+				<ContextMenu items={contextMenuItems}>
+					<div class="p-4 border rounded-lg bg-surface-tertiary">
+						<p class="text-sm">
+							Right-click this text to open the context menu. You can test various interactions
+							here.
+						</p>
+					</div>
+				</ContextMenu>
+			</div>
+
+			<div
+				class="flex flex-col space-y-4 p-6 border border-gray-200 dark:border-gray-700 rounded-lg bg-surface"
+			>
+				<div class="space-y-1">
+					<h4 class="text-xs font-semibold text-emphasis">Button Context Menu</h4>
+					<p class="text-xs text-secondary">Right-click the button below</p>
+				</div>
+				<ContextMenu items={contextMenuItems}>
+					<Button variant="accent" size="sm">Right-click this button</Button>
+				</ContextMenu>
+			</div>
+		</div>
+	</div>
+
 	<!-- INPUT SECTION HEADER -->
 	<header class="flex flex-col gap-2 border-b border-gray-200 dark:border-gray-700 pb-4 mt-12">
 		<h2 class="text-lg font-semibold text-emphasis">Input Components</h2>
diff --git a/frontend/src/routes/view_graph/+page.svelte b/frontend/src/routes/view_graph/+page.svelte
index 18b49846a8..86bbba17cf 100644
--- a/frontend/src/routes/view_graph/+page.svelte
+++ b/frontend/src/routes/view_graph/+page.svelte
@@ -4,7 +4,7 @@
 	import { decodeState } from '$lib/utils'
 
 	let content = localStorage.getItem('svelvet')
-	const { modules, failureModule, preprocessorModule } = content
+	const { modules, failureModule, preprocessorModule, notes } = content
 		? decodeState(content)
 		: { modules: [], failureModule: undefined, preprocessorModule: undefined }
 </script>
@@ -15,6 +15,7 @@
 	{modules}
 	{failureModule}
 	{preprocessorModule}
+	{notes}
 />
 <a
 	download="flow.json"
diff --git a/frontend/tailwind.config.cjs b/frontend/tailwind.config.cjs
index 1504b7f801..7b83cf1939 100644
--- a/frontend/tailwind.config.cjs
+++ b/frontend/tailwind.config.cjs
@@ -186,6 +186,45 @@ const config = {
 				900: `rgb(${primitives['purple-900']})`,
 				950: `rgb(${primitives['purple-950']})`
 			},
+			pink: {
+				50: `rgb(${primitives['pink-50']})`,
+				100: `rgb(${primitives['pink-100']})`,
+				200: `rgb(${primitives['pink-200']})`,
+				300: `rgb(${primitives['pink-300']})`,
+				400: `rgb(${primitives['pink-400']})`,
+				500: `rgb(${primitives['pink-500']})`,
+				600: `rgb(${primitives['pink-600']})`,
+				700: `rgb(${primitives['pink-700']})`,
+				800: `rgb(${primitives['pink-800']})`,
+				900: `rgb(${primitives['pink-900']})`,
+				950: `rgb(${primitives['pink-950']})`
+			},
+			lime: {
+				50: `rgb(${primitives['lime-50']})`,
+				100: `rgb(${primitives['lime-100']})`,
+				200: `rgb(${primitives['lime-200']})`,
+				300: `rgb(${primitives['lime-300']})`,
+				400: `rgb(${primitives['lime-400']})`,
+				500: `rgb(${primitives['lime-500']})`,
+				600: `rgb(${primitives['lime-600']})`,
+				700: `rgb(${primitives['lime-700']})`,
+				800: `rgb(${primitives['lime-800']})`,
+				900: `rgb(${primitives['lime-900']})`,
+				950: `rgb(${primitives['lime-950']})`
+			},
+			yellow: {
+				50: `rgb(${primitives['yellow-50']})`,
+				100: `rgb(${primitives['yellow-100']})`,
+				200: `rgb(${primitives['yellow-200']})`,
+				300: `rgb(${primitives['yellow-300']})`,
+				400: `rgb(${primitives['yellow-400']})`,
+				500: `rgb(${primitives['yellow-500']})`,
+				600: `rgb(${primitives['yellow-600']})`,
+				700: `rgb(${primitives['yellow-700']})`,
+				800: `rgb(${primitives['yellow-800']})`,
+				900: `rgb(${primitives['yellow-900']})`,
+				950: `rgb(${primitives['yellow-950']})`
+			},
 			slate: {
 				50: '#f8fafc',
 				100: '#f1f5f9',
@@ -246,18 +285,6 @@ const config = {
 				800: '#92400e',
 				900: '#78350f'
 			},
-			lime: {
-				50: '#f7fee7',
-				100: '#ecfccb',
-				200: '#d9f99d',
-				300: '#bef264',
-				400: '#a3e635',
-				500: '#84cc16',
-				600: '#65a30d',
-				700: '#4d7c0f',
-				800: '#3f6212',
-				900: '#365314'
-			},
 			emerald: {
 				50: '#ecfdf5',
 				100: '#d1fae5',
@@ -330,18 +357,6 @@ const config = {
 				800: '#86198f',
 				900: '#701a75'
 			},
-			pink: {
-				50: '#fdf2f8',
-				100: '#fce7f3',
-				200: '#fbcfe8',
-				300: '#f9a8d4',
-				400: '#f472b6',
-				500: '#ec4899',
-				600: '#db2777',
-				700: '#be185d',
-				800: '#9d174d',
-				900: '#831843'
-			},
 			rose: {
 				50: '#fff1f2',
 				100: '#ffe4e6',
@@ -366,18 +381,6 @@ const config = {
 				800: '#1f2937',
 				900: '#111827'
 			},
-			yellow: {
-				50: '#fefce8',
-				100: '#fef9c3',
-				200: '#fef08a',
-				300: '#fde047',
-				400: '#facc15',
-				500: '#eab308',
-				600: '#ca8a04',
-				700: '#a16207',
-				800: '#854d0e',
-				900: '#713f12'
-			},
 			indigo: {
 				50: '#eef2ff',
 				100: '#e0e7ff',
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 63b52b9f74..ae7e4d3496 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -73,6 +73,11 @@ components:
         chat_input_enabled:
           type: boolean
           description: Whether this flow accepts chat-style input
+        notes:
+          type: array
+          description: Sticky notes attached to the flow
+          items:
+            $ref: "#/components/schemas/FlowNote"
       required:
         - modules
 
@@ -103,6 +108,64 @@ components:
         retry_if:
           $ref: "#/components/schemas/RetryIf"
 
+    FlowNote:
+      type: object
+      description: A sticky note attached to a flow for documentation and annotation
+      properties:
+        id:
+          type: string
+          description: Unique identifier for the note
+        text:
+          type: string
+          description: Content of the note
+        position:
+          type: object
+          description: Position of the note in the flow editor
+          properties:
+            x:
+              type: number
+              description: X coordinate
+            y:
+              type: number
+              description: Y coordinate
+          required:
+            - x
+            - y
+        size:
+          type: object
+          description: Size of the note in the flow editor
+          properties:
+            width:
+              type: number
+              description: Width in pixels
+            height:
+              type: number
+              description: Height in pixels
+          required:
+            - width
+            - height
+        color:
+          type: string
+          description: Color of the note (e.g., "yellow", "#ffff00")
+        type:
+          type: string
+          enum: [free, group]
+          description: Type of note - 'free' for standalone notes, 'group' for notes that group other nodes
+        locked:
+          type: boolean
+          default: false
+          description: Whether the note is locked and cannot be edited or moved
+        contained_node_ids:
+          type: array
+          items:
+            type: string
+          description: For group notes, the IDs of nodes contained within this group
+      required:
+        - id
+        - text
+        - color
+        - type
+
     RetryIf:
       type: object
       properties:

From 3ded94f7fe850a641f45b84d0a57bd5af57bf793 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 21:27:02 +0000
Subject: [PATCH 61/81] nits

---
 ...1f7f387f5055c47f493271d26731336257384.json | 10 ++++----
 ...a90d9206c45d92a0423c0bc2396d0d66a0b0d.json |  4 +--
 ...ba524a2bc1e9047bdde5f568af4d993dbb74c.json | 25 +++++++++++++++++++
 ...8d1e383aeda9a5a71183b7fbaa41deca4e333.json | 16 ------------
 ...6dc628e2ba56eab5e1a50c99481da9793759e.json | 16 ++++++++++++
 ...0cb549a34b96554ae1872355b90304f5dcb76.json |  4 +--
 ...f4a5b962f7803def9ecd6e33d2aec6abce772.json | 25 -------------------
 .../windmill-worker/src/worker_lockfiles.rs   |  1 -
 8 files changed, 49 insertions(+), 52 deletions(-)
 create mode 100644 backend/.sqlx/query-207a0721b6f0b8b6ddd4120343eba524a2bc1e9047bdde5f568af4d993dbb74c.json
 delete mode 100644 backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json
 create mode 100644 backend/.sqlx/query-676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e.json
 delete mode 100644 backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json

diff --git a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
index d29a18c691..e7ed0aee65 100644
--- a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
+++ b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
+      false,
+      false,
+      false,
+      false,
+      false,
       true,
       true
     ]
diff --git a/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json b/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json
index bc15928e38..ecaf828737 100644
--- a/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json
+++ b/backend/.sqlx/query-0a7132202ecf6c4c10340921644a90d9206c45d92a0423c0bc2396d0d66a0b0d.json
@@ -59,9 +59,7 @@
                 "failure",
                 "command",
                 "approval",
-                "preprocessor",
-                "schedule_handler_old",
-                "dynamic_skip"
+                "preprocessor"
               ]
             }
           }
diff --git a/backend/.sqlx/query-207a0721b6f0b8b6ddd4120343eba524a2bc1e9047bdde5f568af4d993dbb74c.json b/backend/.sqlx/query-207a0721b6f0b8b6ddd4120343eba524a2bc1e9047bdde5f568af4d993dbb74c.json
new file mode 100644
index 0000000000..b0cf45284a
--- /dev/null
+++ b/backend/.sqlx/query-207a0721b6f0b8b6ddd4120343eba524a2bc1e9047bdde5f568af4d993dbb74c.json
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        UPDATE\n            flow\n        SET\n            path = $1,\n            summary = $2,\n            description = $3,\n            dependency_job = NULL,\n            lock_error_logs = '',\n            draft_only = NULL,\n            tag = $4,\n            dedicated_worker = $5,\n            visible_to_runner_only = $6,\n            on_behalf_of_email = $7,\n            value = $8,\n            schema = $9::text::json,\n            edited_by = $10,\n            edited_at = now()\n        WHERE\n            path = $11 AND workspace_id = $12",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text",
+        "Varchar",
+        "Bool",
+        "Bool",
+        "Text",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "207a0721b6f0b8b6ddd4120343eba524a2bc1e9047bdde5f568af4d993dbb74c"
+}
diff --git a/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json b/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json
deleted file mode 100644
index 8c0d13fbd1..0000000000
--- a/backend/.sqlx/query-544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333.json
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow \n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at) \n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "544a00afb5c72d2aa24ab4ccfe68d1e383aeda9a5a71183b7fbaa41deca4e333"
-}
\ No newline at end of file
diff --git a/backend/.sqlx/query-676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e.json b/backend/.sqlx/query-676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e.json
new file mode 100644
index 0000000000..11339abea1
--- /dev/null
+++ b/backend/.sqlx/query-676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e.json
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)\n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e"
+}
diff --git a/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json b/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json
index 99269c9851..54e94cfb8f 100644
--- a/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json
+++ b/backend/.sqlx/query-b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76.json
@@ -18,8 +18,8 @@
       "Left": []
     },
     "nullable": [
-      true,
-      false
+      false,
+      true
     ]
   },
   "hash": "b3dbdfb50ee8118bdaed3164b210cb549a34b96554ae1872355b90304f5dcb76"
diff --git a/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json b/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json
deleted file mode 100644
index a13d62402a..0000000000
--- a/backend/.sqlx/query-d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE \n            flow \n        SET\n            path = $1,\n            summary = $2,\n            description = $3,\n            dependency_job = NULL,\n            lock_error_logs = '',\n            draft_only = NULL,\n            tag = $4,\n            dedicated_worker = $5,\n            visible_to_runner_only = $6,\n            on_behalf_of_email = $7,\n            value = $8,\n            schema = $9::text::json,\n            edited_by = $10,\n            edited_at = now()\n        WHERE \n            path = $11 AND workspace_id = $12",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text",
-        "Varchar",
-        "Bool",
-        "Bool",
-        "Text",
-        "Jsonb",
-        "Text",
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "d2acc380c45df31f741bbd420c2f4a5b962f7803def9ecd6e33d2aec6abce772"
-}
\ No newline at end of file
diff --git a/backend/windmill-worker/src/worker_lockfiles.rs b/backend/windmill-worker/src/worker_lockfiles.rs
index cc92955569..824a45c661 100644
--- a/backend/windmill-worker/src/worker_lockfiles.rs
+++ b/backend/windmill-worker/src/worker_lockfiles.rs
@@ -17,7 +17,6 @@ use sqlx::types::Json;
 use tokio::time::timeout;
 use uuid::Uuid;
 use windmill_common::assets::{clear_asset_usage, insert_asset_usage, AssetUsageKind};
-use windmill_common::cache::FlowNotes;
 use windmill_common::error::Error;
 use windmill_common::error::Result;
 use windmill_common::flows::{FlowModule, FlowModuleValue, FlowNodeId};

From cd5827e802680fd0e37e7f201dc584731bbe0223 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 19 Nov 2025 22:29:46 +0100
Subject: [PATCH 62/81] chore(main): release 1.581.0 (#7181)

* chore(main): release 1.581.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 62 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 55 insertions(+), 48 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee09e12696..f97e2859a6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.581.0](https://github.com/windmill-labs/windmill/compare/v1.580.0...v1.581.0) (2025-11-19)
+
+
+### Features
+
+* **frontend:** add notes to flow ([#6628](https://github.com/windmill-labs/windmill/issues/6628)) ([cfeb294](https://github.com/windmill-labs/windmill/commit/cfeb294308ba85763025f3628cbb85144d7f0778))
+
 ## [1.580.0](https://github.com/windmill-labs/windmill/compare/v1.579.2...v1.580.0) (2025-11-18)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index ff91f7063b..dada36c231 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -2094,9 +2094,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.52"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa8120877db0e5c011242f96806ce3c94e0737ab8108532a76a3300a01db2ab8"
+checksum = "c9e340e012a1bf4935f5282ed1436d1489548e8f72308207ea5df0e23d2d03f8"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2104,9 +2104,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.52"
+version = "4.5.53"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02576b399397b659c26064fbc92a75fede9d18ffd5f80ca1cd74ddab167016e1"
+checksum = "d76b5d13eaa18c901fd2f7fca939fefe3a0727a953561fefdf3b2922b8569d00"
 dependencies = [
  "anstream",
  "anstyle",
@@ -15188,7 +15188,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15250,7 +15250,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15371,7 +15371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "regex",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15591,7 +15591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15615,7 +15615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15627,7 +15627,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15638,7 +15638,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15649,7 +15649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15661,7 +15661,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15715,7 +15715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15729,7 +15729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15795,7 +15795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15805,7 +15805,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.580.0"
+version = "1.581.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 20470e42b0..8f3c13c3a2 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.580.0"
+version = "1.581.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.580.0"
+version = "1.581.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 39e23a74db..9254136f72 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.580.0
+  version: 1.581.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 14d0b8ce73..97524c888d 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.580.0";
+export const VERSION = "v1.581.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index c98ad8a997..b74c3e0c0a 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.580.0";
+export const VERSION = "1.581.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 047e89119d..90a8bf7d6e 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.580.0",
+	"version": "1.581.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.580.0",
+			"version": "1.581.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 344c843dcd..706235f31b 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.580.0",
+	"version": "1.581.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index f4c670f6e5..ae5a2377c8 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.580.0"
-wmill_pg = ">=1.580.0"
+wmill = ">=1.581.0"
+wmill_pg = ">=1.581.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index ae7e4d3496..195666f665 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.580.0
+  version: 1.581.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index f993af076d..7a388645c7 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.580.0'
+    ModuleVersion     = '1.581.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 056ef57769..d890a51b05 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.580.0"
+version = "1.581.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 411f60ca58..ced5c27427 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.580.0"
+version = "1.581.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index f2e92959b3..3fb45e9001 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.580.0",
+  "version": "1.581.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index e4892ec746..a122e5ddc2 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.580.0",
+  "version": "1.581.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 98470cba67..629e9b1913 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.580.0
+1.581.0

From 054aeb33271288dc9458b012881164c3c4597280 Mon Sep 17 00:00:00 2001
From: Guilhem <guilhemlemouel@gmail.com>
Date: Thu, 20 Nov 2025 11:33:10 +0000
Subject: [PATCH 63/81] fix(frontend): missing node Result id migration (#7182)

* fix missing id changes

* fix ai tool selection
---
 frontend/src/lib/components/Dev.svelte                        | 2 +-
 frontend/src/lib/components/FlowBuilder.svelte                | 2 +-
 .../src/lib/components/flows/map/FlowModuleSchemaMap.svelte   | 2 +-
 frontend/src/lib/components/graph/FlowGraphV2.svelte          | 4 ++++
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/frontend/src/lib/components/Dev.svelte b/frontend/src/lib/components/Dev.svelte
index 1b6df2a06f..505002cd54 100644
--- a/frontend/src/lib/components/Dev.svelte
+++ b/frontend/src/lib/components/Dev.svelte
@@ -650,7 +650,7 @@
 				job.success &&
 				flowPreviewButtons?.getPreviewMode() === 'whole'
 			) {
-				if (flowModuleSchemaMap?.isNodeVisible('result') && selectedId !== 'Result') {
+				if (flowModuleSchemaMap?.isNodeVisible('Result') && selectedId !== 'Result') {
 					outputPickerOpenFns['Result']?.()
 				}
 			} else {
diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index daaa4d5238..6367779894 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -949,7 +949,7 @@
 				job.success &&
 				flowPreviewButtons?.getPreviewMode() === 'whole'
 			) {
-				if (flowEditor?.isNodeVisible('result') && selectedIdStore !== 'Result') {
+				if (flowEditor?.isNodeVisible('Result') && selectedIdStore !== 'Result') {
 					outputPickerOpenFns['Result']?.()
 				}
 			} else {
diff --git a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
index 1b7af36c41..eab09789b6 100644
--- a/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
+++ b/frontend/src/lib/components/flows/map/FlowModuleSchemaMap.svelte
@@ -484,7 +484,7 @@
 					let targetModules
 					if (
 						detail.sourceId == 'Input' ||
-						detail.targetId == 'result' ||
+						detail.targetId == 'Result' ||
 						detail.kind == 'trigger'
 					) {
 						targetModules = flowStore.val.value.modules
diff --git a/frontend/src/lib/components/graph/FlowGraphV2.svelte b/frontend/src/lib/components/graph/FlowGraphV2.svelte
index 26a3ed2aed..9be2534b9f 100644
--- a/frontend/src/lib/components/graph/FlowGraphV2.svelte
+++ b/frontend/src/lib/components/graph/FlowGraphV2.svelte
@@ -396,6 +396,10 @@
 			onInsert?.(detail)
 		},
 		select: (modId) => {
+			// AI tools are not selectable by the flow. Selection has to be refactored to be simplier.
+			if (nodes.find((n) => n.data?.moduleId === modId)?.type === 'aiTool') {
+				selectionManager.selectId(modId)
+			}
 			if (!notSelectable) {
 				onSelect?.(modId)
 			}

From 3e2935b4ee0dee06486c3e0026b9ff50eba59eb1 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 20 Nov 2025 12:39:41 +0100
Subject: [PATCH 64/81] chore(main): release 1.581.1 (#7183)

* chore(main): release 1.581.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 62 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 55 insertions(+), 48 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f97e2859a6..9dc919ee16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.581.1](https://github.com/windmill-labs/windmill/compare/v1.581.0...v1.581.1) (2025-11-20)
+
+
+### Bug Fixes
+
+* **frontend:** missing node Result id migration ([#7182](https://github.com/windmill-labs/windmill/issues/7182)) ([054aeb3](https://github.com/windmill-labs/windmill/commit/054aeb33271288dc9458b012881164c3c4597280))
+
 ## [1.581.0](https://github.com/windmill-labs/windmill/compare/v1.580.0...v1.581.0) (2025-11-19)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index dada36c231..717b025e28 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -788,9 +788,9 @@ dependencies = [
 
 [[package]]
 name = "aws-credential-types"
-version = "1.2.9"
+version = "1.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86590e57ea40121d47d3f2e131bfd873dea15d78dc2f4604f4734537ad9e56c4"
+checksum = "b01c9521fa01558f750d183c8c68c81b0155b9d193a4ba7f84c36bd1b6d04a06"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -823,9 +823,9 @@ dependencies = [
 
 [[package]]
 name = "aws-runtime"
-version = "1.5.14"
+version = "1.5.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fe0fd441565b0b318c76e7206c8d1d0b0166b3e986cf30e890b61feb6192045"
+checksum = "7ce527fb7e53ba9626fc47824f25e256250556c40d8f81d27dd92aa38239d632"
 dependencies = [
  "aws-credential-types",
  "aws-sigv4",
@@ -15188,7 +15188,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15250,7 +15250,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15371,7 +15371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15386,7 +15386,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15400,7 +15400,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "axum",
@@ -15419,7 +15419,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15507,7 +15507,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "regex",
  "serde",
@@ -15522,7 +15522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15546,7 +15546,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15558,7 +15558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15567,7 +15567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15579,7 +15579,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15591,7 +15591,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15603,7 +15603,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15615,7 +15615,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15627,7 +15627,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15638,7 +15638,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15649,7 +15649,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15661,7 +15661,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15684,7 +15684,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15698,7 +15698,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15715,7 +15715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15729,7 +15729,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15747,7 +15747,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15758,7 +15758,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15795,7 +15795,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15805,7 +15805,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.581.0"
+version = "1.581.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 8f3c13c3a2..666727bf9c 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.581.0"
+version = "1.581.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.581.0"
+version = "1.581.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 9254136f72..9dfcbb25ec 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.581.0
+  version: 1.581.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 97524c888d..70f3b3d53b 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.581.0";
+export const VERSION = "v1.581.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index b74c3e0c0a..de51bb1164 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.581.0";
+export const VERSION = "1.581.1";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 90a8bf7d6e..38cbcfb409 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.581.0",
+	"version": "1.581.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.581.0",
+			"version": "1.581.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 706235f31b..1c7f547522 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.581.0",
+	"version": "1.581.1",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index ae5a2377c8..493c7c1ca9 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.581.0"
-wmill_pg = ">=1.581.0"
+wmill = ">=1.581.1"
+wmill_pg = ">=1.581.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 195666f665..d3e9e0ad99 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.581.0
+  version: 1.581.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 7a388645c7..aba6ec750b 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.581.0'
+    ModuleVersion     = '1.581.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index d890a51b05..9604c22fbf 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.581.0"
+version = "1.581.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index ced5c27427..236f748be7 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.581.0"
+version = "1.581.1"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 3fb45e9001..6c9570044c 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.581.0",
+  "version": "1.581.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index a122e5ddc2..b76c958a06 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.581.0",
+  "version": "1.581.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 629e9b1913..902f26d0c0 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.581.0
+1.581.1

From d6da4a32bf707ecea1a6397906e916d782bc7dff Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Thu, 20 Nov 2025 13:35:44 +0100
Subject: [PATCH 65/81] Fix alignment issues and TextArea min-height taller
 (#7184)

---
 frontend/src/lib/components/ArgInput.svelte   | 61 +++++++---------
 frontend/src/lib/components/Password.svelte   | 63 ++++++++--------
 frontend/src/lib/components/SchemaForm.svelte |  4 +-
 .../components/text_input/TextInput.svelte    | 71 ++++++++++++-------
 4 files changed, 100 insertions(+), 99 deletions(-)

diff --git a/frontend/src/lib/components/ArgInput.svelte b/frontend/src/lib/components/ArgInput.svelte
index b63d3798e5..f912fad49f 100644
--- a/frontend/src/lib/components/ArgInput.svelte
+++ b/frontend/src/lib/components/ArgInput.svelte
@@ -28,7 +28,6 @@
 	import DateTimeInput from './DateTimeInput.svelte'
 	import DateInput from './DateInput.svelte'
 	import CurrencyInput from './apps/components/inputs/currency/CurrencyInput.svelte'
-	import autosize from '$lib/autosize'
 	import PasswordArgInput from './PasswordArgInput.svelte'
 	import Password from './Password.svelte'
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
@@ -46,11 +45,7 @@
 	import { workspaceStore } from '$lib/stores'
 	import { getJsonSchemaFromResource } from './schema/jsonSchemaResource.svelte'
 	import AIProviderPicker from './AIProviderPicker.svelte'
-	import TextInput, {
-		inputBaseClass,
-		inputBorderClass,
-		inputSizeClasses
-	} from './text_input/TextInput.svelte'
+	import TextInput from './text_input/TextInput.svelte'
 	import FileInput from './common/fileInput/FileInput.svelte'
 
 	interface Props {
@@ -1412,45 +1407,39 @@
 						{/if}
 					{:else}
 						{#key extra?.['minRows']}
-							<textarea
-								{autofocus}
-								rows={extra?.['minRows'] ? extra['minRows']?.toString() : '1'}
-								bind:this={el}
-								onfocus={(e) => {
-									dispatch('focus')
+							<TextInput
+								inputProps={{
+									autofocus,
+									onfocus: () => dispatch('focus'),
+									onblur: () => dispatch('blur'),
+									disabled,
+									onkeydown: onKeyDown,
+									placeholder: placeholder ?? defaultValue ?? '',
+									rows: extra?.['minRows'] ? extra['minRows']?.toString() : '1'
 								}}
-								onblur={(e) => {
-									dispatch('blur')
-								}}
-								use:autosize
-								onkeydown={onKeyDown}
-								{disabled}
-								class={twMerge(
-									'w-full',
-									inputBaseClass,
-									inputSizeClasses.md,
-									inputBorderClass({ error: !!error })
-								)}
-								placeholder={placeholder ?? defaultValue ?? ''}
 								bind:value
-							></textarea>
+								{error}
+								unifiedHeight={false}
+								underlyingInputEl="textarea"
+							/>
 						{/key}
 					{/if}
 					{#if !disabled && itemPicker && extra?.['disableVariablePicker'] != true}
-						<!-- svelte-ignore a11y_click_events_have_key_events -->
-						<button
-							class={twMerge(
-								'absolute opacity-0 group-hover:opacity-100 duration-200 py-1 min-w-min !px-2 items-center text-gray-800 bg-surface-secondary border rounded center-center hover:bg-gray-300 transition-all cursor-pointer',
-								password || extra?.['password'] == true ? 'right-16' : 'right-1'
-							)}
-							onclick={() => {
+						<Button
+							iconOnly
+							startIcon={{ icon: DollarSign }}
+							unifiedSize="sm"
+							onClick={() => {
 								pickForField = label
 								itemPicker?.openDrawer?.()
 							}}
+							wrapperClasses={twMerge(
+								'opacity-0 group-hover:opacity-100 transition-opacity absolute bg-surface-input',
+								password || extra?.['password'] == true ? 'right-8	' : 'right-2'
+							)}
+							variant="subtle"
 							title="Insert a Variable"
-						>
-							<DollarSign class="!text-primary" size={14} />
-						</button>
+						/>
 					{/if}
 				</div>
 				{@render variableInput()}
diff --git a/frontend/src/lib/components/Password.svelte b/frontend/src/lib/components/Password.svelte
index f6fd20eb09..c14a654ccb 100644
--- a/frontend/src/lib/components/Password.svelte
+++ b/frontend/src/lib/components/Password.svelte
@@ -1,5 +1,8 @@
 <script lang="ts">
 	import { createBubbler } from 'svelte/legacy'
+	import Button from './common/button/Button.svelte'
+	import TextInput from './text_input/TextInput.svelte'
+	import { Eye, EyeClosed } from 'lucide-svelte'
 
 	const bubble = createBubbler()
 	interface Props {
@@ -25,45 +28,35 @@
 	let red = $derived(required && (password == '' || password == undefined))
 
 	let hideValue = $state(true)
-
-	let randomId = (Math.random() * 10e15).toString(16)
 </script>
 
 <div class="relative w-full {small ? 'max-w-lg' : ''}">
-	<div class="absolute inset-y-0 right-0 flex items-center px-2">
-		<input bind:checked={hideValue} class="!hidden" id={randomId} type="checkbox" />
-		<label
-			class="bg-surface-secondary hover:bg-gray-400 rounded px-2 py-1 text-sm text-primary font-mono cursor-pointer"
-			for={randomId}>{hideValue ? 'show' : 'hide'}</label
-		>
+	<div class="absolute inset-y-0 right-1 flex items-center">
+		<Button
+			unifiedSize="sm"
+			onClick={() => (hideValue = !hideValue)}
+			iconOnly
+			startIcon={{ icon: hideValue ? Eye : EyeClosed }}
+			variant="subtle"
+			wrapperClasses="bg-surface-input"
+		/>
 	</div>
-	{#if hideValue}
-		<input
-			class="block {small ? '!text-2xs' : 'w-full'} px-2 py-1 {red
-				? '!border-red-500'
-				: ''} text-sm h-9"
-			type="password"
-			bind:value={password}
-			onkeydown={onKeyDown}
-			onblur={onBlur}
-			autocomplete="new-password"
-			{placeholder}
-			{disabled}
-		/>
-	{:else}
-		<input
-			class="block {small ? '!text-2xs' : 'w-full'} px-2 py-1 {red
-				? '!border-red-500'
-				: ''} text-sm h-9"
-			type="text"
-			bind:value={password}
-			onkeydown={bubble('keydown')}
-			onblur={onBlur}
-			autocomplete="new-password"
-			{placeholder}
-			{disabled}
-		/>
-	{/if}
+	<TextInput
+		size="md"
+		error={red}
+		bind:value={password}
+		inputProps={{
+			disabled,
+			placeholder,
+			autocomplete: 'new-password',
+			onblur: (e) => onBlur?.(e),
+			onkeydown: (e) => {
+				onKeyDown?.(e)
+				bubble('keydown')(e)
+			},
+			type: hideValue ? 'password' : 'text'
+		}}
+	/>
 </div>
 {#if red}
 	<div class="text-red-600 text-2xs grow">This field is required</div>
diff --git a/frontend/src/lib/components/SchemaForm.svelte b/frontend/src/lib/components/SchemaForm.svelte
index a0fb8b56b5..16494af9b9 100644
--- a/frontend/src/lib/components/SchemaForm.svelte
+++ b/frontend/src/lib/components/SchemaForm.svelte
@@ -415,7 +415,7 @@
 									{#snippet actions()}
 										{@render actions_render?.({ item })}
 										{#if linkedSecretCandidates?.includes(argName)}
-											<div>
+											<div class="relative">
 												<ToggleButtonGroup
 													selected={linkedSecret == argName ? 'secret' : 'inlined'}
 													on:selected={(e) => {
@@ -429,14 +429,12 @@
 													{#snippet children({ item })}
 														<ToggleButton
 															value="inlined"
-															small
 															label="Inlined"
 															tooltip="The value is inlined in the resource and thus has no special treatment."
 															{item}
 														/>
 														<ToggleButton
 															value="secret"
-															small
 															label="Secret"
 															tooltip="The value will be stored in a newly created linked secret variable at the same path. That variable can be permissioned differently, will be treated as a secret the UI, operators will not be able to load it and every access will generate a corresponding audit log."
 															{item}
diff --git a/frontend/src/lib/components/text_input/TextInput.svelte b/frontend/src/lib/components/text_input/TextInput.svelte
index d19ace6e06..9bd226e394 100644
--- a/frontend/src/lib/components/text_input/TextInput.svelte
+++ b/frontend/src/lib/components/text_input/TextInput.svelte
@@ -20,6 +20,7 @@
 	export const inputBaseClass =
 		'rounded-md focus:ring-0 no-default-style text-xs text-primary font-normal !bg-surface-input disabled:!bg-surface-disabled disabled:!border-transparent disabled:!text-disabled disabled:cursor-not-allowed shadow-none !placeholder-hint'
 
+	import autosize from '$lib/autosize'
 	import { ButtonType } from '$lib/components/common/button/model'
 
 	export const inputSizeClasses = {
@@ -38,49 +39,69 @@
 	}
 </script>
 
-<script lang="ts">
-	import type { HTMLInputAttributes } from 'svelte/elements'
+<script lang="ts" generics="UnderlyingInputElT extends 'input' | 'textarea' = 'input'">
+	import type { HTMLInputAttributes, HTMLTextareaAttributes } from 'svelte/elements'
 	import { twMerge } from 'tailwind-merge'
 
-	type Props = {
-		inputProps?: HTMLInputAttributes
+	type Props<UnderlyingInputElT extends 'input' | 'textarea'> = {
+		inputProps?: UnderlyingInputElT extends 'input' ? HTMLInputAttributes : HTMLTextareaAttributes
 		value?: string
 		class?: string
 		error?: string | boolean
 		size?: ButtonType.UnifiedSize
 		unifiedHeight?: boolean
+		underlyingInputEl?: UnderlyingInputElT
 	}
 
 	export function focus() {
 		inputEl?.focus()
 	}
 
-	let inputEl: HTMLInputElement | undefined = $state()
+	let inputEl: HTMLInputElement | HTMLTextAreaElement | undefined = $state()
 
 	let {
-		inputProps,
+		inputProps: _inputProps,
 		value = $bindable(),
 		class: className = '',
 		error,
 		size = 'md',
-		unifiedHeight = true
-	}: Props = $props()
+		unifiedHeight = true,
+		underlyingInputEl: _underlyingInputEl
+	}: Props<UnderlyingInputElT> = $props()
+
+	let underlyingInputEl = $derived(_underlyingInputEl ?? ('input' as const))
+	let inputProps = $derived(_inputProps as any)
+
+	let fullClassName = $derived(
+		twMerge(
+			inputBaseClass,
+			inputSizeClasses[size],
+			'[appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none',
+			inputBorderClass({ error: !!error }),
+			unifiedHeight ? ButtonType.UnifiedHeightClasses[size] : '',
+			'w-full',
+			className
+		)
+	)
 </script>
 
-<input
-	{...inputProps}
-	class={twMerge(
-		inputBaseClass,
-		inputSizeClasses[size],
-		'w-full',
-		'[appearance:textfield] [&::-webkit-outer-spin-button]:appearance-none [&::-webkit-inner-spin-button]:appearance-none',
-		inputBorderClass({ error: !!error }),
-		unifiedHeight ? ButtonType.UnifiedHeightClasses[size] : '',
-		className
-	)}
-	onpointerdown={(e) => {
-		e.stopImmediatePropagation()
-	}}
-	bind:this={inputEl}
-	bind:value
-/>
+{#if underlyingInputEl === 'textarea'}
+	<!-- We hardcode the py value because since textareas can be multiline, we can't rely on
+ 	  	 the fact that it auto-centers -->
+	<textarea
+		class={twMerge('py-[0.45rem]', fullClassName)}
+		{...inputProps}
+		onpointerdown={(e) => e.stopImmediatePropagation()}
+		bind:this={inputEl}
+		bind:value
+		use:autosize
+	></textarea>
+{:else if underlyingInputEl === 'input'}
+	<input
+		{...inputProps}
+		class={fullClassName}
+		onpointerdown={(e) => e.stopImmediatePropagation()}
+		bind:this={inputEl}
+		bind:value
+	/>
+{/if}

From 1b77e2eaaade943620a0aabb137c3776b62870da Mon Sep 17 00:00:00 2001
From: Diego Imbert <70353967+diegoimbert@users.noreply.github.com>
Date: Thu, 20 Nov 2025 15:37:34 +0100
Subject: [PATCH 66/81] fix monaco height (#7186)

---
 frontend/src/lib/components/TemplateEditor.svelte | 2 +-
 frontend/src/lib/components/vscode.ts             | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/src/lib/components/TemplateEditor.svelte b/frontend/src/lib/components/TemplateEditor.svelte
index 9c01537eea..c959773bf5 100644
--- a/frontend/src/lib/components/TemplateEditor.svelte
+++ b/frontend/src/lib/components/TemplateEditor.svelte
@@ -494,7 +494,7 @@
 			const updateHeight = () => {
 				const contentHeight = Math.min(1000, editor.getContentHeight())
 				if (divEl) {
-					divEl.style.height = `${contentHeight + 2}px`
+					divEl.style.height = `${contentHeight}px`
 				}
 				try {
 					editor.layout({ width, height: contentHeight })
diff --git a/frontend/src/lib/components/vscode.ts b/frontend/src/lib/components/vscode.ts
index 14438d1ad1..22e955dc5c 100644
--- a/frontend/src/lib/components/vscode.ts
+++ b/frontend/src/lib/components/vscode.ts
@@ -291,4 +291,4 @@ export function keepModelAroundToAvoidDisposalOfWorkers() {
 	}
 }
 
-export let MONACO_Y_PADDING = 7
+export let MONACO_Y_PADDING = 6.5

From ce5a31865cf6965ec28c449c2a832b93572a8eb6 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Thu, 20 Nov 2025 16:01:54 +0100
Subject: [PATCH 67/81] feat(aichat): handle duckdb scripts (#7187)

* handle duckdb in aichat

* better

* add in gen edit fix

* fix missing entry in yaml

* fix
---
 .../components/copilot/chat/script/core.ts    |  5 ++-
 .../lib/components/copilot/prompts/edit.yaml  | 34 +++++++++++++++
 .../components/copilot/prompts/editPrompt.ts  | 15 ++++---
 .../lib/components/copilot/prompts/fix.yaml   | 41 ++++++++++++++++++-
 .../components/copilot/prompts/fixPrompt.ts   |  7 +++-
 .../lib/components/copilot/prompts/gen.yaml   | 26 +++++++++++-
 .../components/copilot/prompts/genPrompt.ts   | 15 ++++---
 7 files changed, 126 insertions(+), 17 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/script/core.ts b/frontend/src/lib/components/copilot/chat/script/core.ts
index 438fdf45ce..5c14610c45 100644
--- a/frontend/src/lib/components/copilot/chat/script/core.ts
+++ b/frontend/src/lib/components/copilot/chat/script/core.ts
@@ -204,7 +204,8 @@ export const SUPPORTED_CHAT_SCRIPT_LANGUAGES = [
 	'graphql',
 	'powershell',
 	'csharp',
-	'java'
+	'java',
+	'duckdb'
 ]
 
 export function getLangContext(
@@ -310,6 +311,8 @@ export function getLangContext(
 			return 'The user is coding in C#. On Windmill, it is expected the script contains a public static Main method inside a class. The class name is irrelevant. NuGet packages can be added using the format: #r "nuget: PackageName, Version" at the top of the script. The Main method signature should be: public static ReturnType Main(parameter types...)'
 		case 'java':
 			return 'The user is coding in Java. On Windmill, it is expected the script contains a Main public class and a public static main() method. The return type can be Object or void. Dependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script. The method signature should be: public static Object main(parameter types...)'
+		case 'duckdb':
+			return "The user is coding in DuckDB. On Windmill, arguments are defined with comments like `-- $name (text) = default` or `-- $name (text)` (one per line) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes, then perform CRUD operations. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);` and query with `SELECT * FROM db.schema.table;`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage"
 		default:
 			return ''
 	}
diff --git a/frontend/src/lib/components/copilot/prompts/edit.yaml b/frontend/src/lib/components/copilot/prompts/edit.yaml
index e17e8139f1..b3c5d70ba9 100644
--- a/frontend/src/lib/components/copilot/prompts/edit.yaml
+++ b/frontend/src/lib/components/copilot/prompts/edit.yaml
@@ -213,6 +213,30 @@ prompts:
       No need to require autoload, it is already done.
       <contextual_information>
       My instructions: {description}
+  csharp:
+    prompt: |-
+      Here's my C# code:
+      ```csharp
+      {code}
+      ```
+      <contextual_information>
+      You have to write C# code with a public static Main method inside a class. Specify the parameter types. Do not call the main function. You should generally return the result.
+      NuGet packages can be added using the format: #r "nuget: PackageName, Version" at the top of the script.
+      The Main method signature should be: public static ReturnType Main(parameter types...)
+      </contextual_information>
+      My instructions: {description}
+  java:
+    prompt: |-
+      Here's my Java code:
+      ```java
+      {code}
+      ```
+      <contextual_information>
+      You have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.
+      Dependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.
+      The method signature should be: public static Object main(parameter types...)
+      </contextual_information>
+      My instructions: {description}
   frontend:
     prompt: |-
       Here's my client-side javascript code: 
@@ -262,3 +286,13 @@ prompts:
       </helpers>
       </contextual_information>
       My instructions: {description}
+  duckdb:
+    prompt: |-
+      Here's my DuckDB code:
+      ```sql
+      {code}
+      ```
+      <contextual_information>
+      Arguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.
+      </contextual_information>
+      My instructions: {description}
diff --git a/frontend/src/lib/components/copilot/prompts/editPrompt.ts b/frontend/src/lib/components/copilot/prompts/editPrompt.ts
index 6aec87dd35..dcfdd1d07b 100644
--- a/frontend/src/lib/components/copilot/prompts/editPrompt.ts
+++ b/frontend/src/lib/components/copilot/prompts/editPrompt.ts
@@ -46,17 +46,20 @@ export const EDIT_PROMPT = {
     "php": {
       "prompt": "Here's my php code: \n```php\n{code}\n```\n<contextual_information>\nYou have to write a function in php called \"main\". Specify the parameter types. Do not call the main function. You should generally return the result. The script must start with `<?php`.\nYou can take as parameters resources which are classes containing credentials or configuration information. For Windmill to correctly detect the resources to be passed, the resource type name has to be exactly as specified in the following list:\n<resourceTypes>\n{resourceTypes}\n</resourceTypes>\nYou need to define the type of the resources that are needed before the main function, but only include them if they are actually needed to achieve the function purpose.\nBefore defining each type, check if the class already exists using class_exists.\nThe resource type name has to be exactly as specified.\nIf you need to import libraries, you need to specify them as comments in the following manner before the main function:\n```\n// require:\n// mylibrary/mylibrary\n// myotherlibrary/myotherlibrary@optionalversion\n```\nNo need to require autoload, it is already done.\n<contextual_information>\nMy instructions: {description}"
     },
+    "csharp": {
+      "prompt": "Here's my C# code:\n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\n</contextual_information>\nMy instructions: {description}"
+    },
+    "java": {
+      "prompt": "Here's my Java code:\n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\n</contextual_information>\nMy instructions: {description}"
+    },
     "frontend": {
       "prompt": "Here's my client-side javascript code: \n```javascript\n{code}\n```\n<contextual_information>\nYou can access the context object with the ctx global variable. \nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</contextual_information>\nMy instructions: {description}"
     },
-    "csharp": {
-      "prompt": "Here's my C# code: \n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nMy instructions: {description}"
-    },
-    "java": {
-      "prompt": "Here's my Java code: \n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nMy instructions: {description}"
-    },
     "transformer": {
       "prompt": "Here's my client-side javascript code: \n```javascript\n{code}\n```\n\n<contextual_information>\nThe code should process the variable `result` according to my instructions.\nThe variable `result` is available globally.\nAt the end of the code, the processed result has to be returned.\n\n<helpers>\nYou can access the context object with the ctx global variable. \nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</helpers>\n</contextual_information>\nMy instructions: {description}"
+    },
+    "duckdb": {
+      "prompt": "Here's my DuckDB code:\n```sql\n{code}\n```\n<contextual_information>\nArguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.\n</contextual_information>\nMy instructions: {description}"
     }
   }
 };
\ No newline at end of file
diff --git a/frontend/src/lib/components/copilot/prompts/fix.yaml b/frontend/src/lib/components/copilot/prompts/fix.yaml
index 78921857f2..b15e30a9ca 100644
--- a/frontend/src/lib/components/copilot/prompts/fix.yaml
+++ b/frontend/src/lib/components/copilot/prompts/fix.yaml
@@ -61,7 +61,7 @@ prompts:
       pub fn main(...) -> Result<ReturnType, Box<dyn std::error::Error>>
       ```
       but do not call it. Favor idiomatic Rust patterns, ensuring safe handling of ownership and borrowing, robust error handling with `Result`, and concurrency if needed (`async`/`tokio` or std threading). 
-      
+
       - Include necessary imports and modules only when needed.
       - Add comments explaining important operations and any unsafe usage (if absolutely required).
       - The generated code should be easily executable and testable in an integrated terminal.
@@ -229,3 +229,42 @@ prompts:
       <contextual_information>
       I get the following error: {error}
       Fix my code.
+  csharp:
+    prompt: |-
+      Here's my C# code:
+      ```csharp
+      {code}
+      ```
+      <contextual_information>
+      You have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.
+      NuGet packages can be added using the format: #r "nuget: PackageName, Version" at the top of the script.
+      The Main method signature should be: public static ReturnType Main(parameter types...)
+      Arguments are used to generate the input specification and create the frontend UI for the script.
+      </contextual_information>
+      I get the following error: {error}
+      Fix my code.
+  java:
+    prompt: |-
+      Here's my Java code:
+      ```java
+      {code}
+      ```
+      <contextual_information>
+      You have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.
+      Dependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.
+      The method signature should be: public static Object main(parameter types...)
+      Arguments are used to generate the input specification and create the frontend UI for the script.
+      </contextual_information>
+      I get the following error: {error}
+      Fix my code.
+  duckdb:
+    prompt: |-
+      Here's my DuckDB code:
+      ```sql
+      {code}
+      ```
+      <contextual_information>
+      Arguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.
+      </contextual_information>
+      I get the following error: {error}
+      Fix my code.
diff --git a/frontend/src/lib/components/copilot/prompts/fixPrompt.ts b/frontend/src/lib/components/copilot/prompts/fixPrompt.ts
index 4fc6ed3227..9f3d48309c 100644
--- a/frontend/src/lib/components/copilot/prompts/fixPrompt.ts
+++ b/frontend/src/lib/components/copilot/prompts/fixPrompt.ts
@@ -47,10 +47,13 @@ export const FIX_PROMPT = {
       "prompt": "Here's my php code: \n```php\n{code}\n```\n<contextual_information>\nYou have to write a function in php called \"main\". Specify the parameter types. Do not call the main function. You should generally return the result. The script must start with `<?php`.\nYou can take as parameters resources which are classes containing credentials or configuration information. For Windmill to correctly detect the resources to be passed, the resource type name has to be exactly as specified in the following list:\n<resourceTypes>\n{resourceTypes}\n</resourceTypes>\nYou need to define the type of the resources that are needed before the main function, but only include them if they are actually needed to achieve the function purpose.\nBefore defining each type, check if the class already exists using class_exists.\nThe resource type name has to be exactly as specified.\nIf you need to import libraries, you need to specify them as comments in the following manner before the main function:\n```\n// require:\n// mylibrary/mylibrary\n// myotherlibrary/myotherlibrary@optionalversion\n```\nNo need to require autoload, it is already done.\n<contextual_information>\nI get the following error: {error}\nFix my code."
     },
     "csharp": {
-      "prompt": "Here's my C# code: \n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nI get the following error: {error}\nFix my code."
+      "prompt": "Here's my C# code:\n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\n</contextual_information>\nI get the following error: {error}\nFix my code."
     },
     "java": {
-      "prompt": "Here's my Java code: \n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nI get the following error: {error}\nFix my code."
+      "prompt": "Here's my Java code:\n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\n</contextual_information>\nI get the following error: {error}\nFix my code."
+    },
+    "duckdb": {
+      "prompt": "Here's my DuckDB code:\n```sql\n{code}\n```\n<contextual_information>\nArguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.\n</contextual_information>\nI get the following error: {error}\nFix my code."
     }
   }
 };
\ No newline at end of file
diff --git a/frontend/src/lib/components/copilot/prompts/gen.yaml b/frontend/src/lib/components/copilot/prompts/gen.yaml
index e7cf420654..d22a6e1473 100644
--- a/frontend/src/lib/components/copilot/prompts/gen.yaml
+++ b/frontend/src/lib/components/copilot/prompts/gen.yaml
@@ -151,6 +151,24 @@ prompts:
       No need to require autoload, it is already done.
       <contextual_information>
       My instructions: {description}
+  csharp:
+    prompt: |-
+      <contextual_information>
+      You have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.
+      NuGet packages can be added using the format: #r "nuget: PackageName, Version" at the top of the script.
+      The Main method signature should be: public static ReturnType Main(parameter types...)
+      Arguments are used to generate the input specification and create the frontend UI for the script.
+      </contextual_information>
+      My instructions: {description}
+  java:
+    prompt: |-
+      <contextual_information>
+      You have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.
+      Dependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.
+      The method signature should be: public static Object main(parameter types...)
+      Arguments are used to generate the input specification and create the frontend UI for the script.
+      </contextual_information>
+      My instructions: {description}
   frontend:
     prompt: |-
       Write client-side javascript code that should {description}. 
@@ -176,7 +194,7 @@ prompts:
       At the end of the code, the processed result has to be returned.
 
       <contextual_information>
-      You can access the context object with the ctx global variable. 
+      You can access the context object with the ctx global variable.
       The app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'
       You can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)
       You can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)
@@ -189,3 +207,9 @@ prompts:
       You can validate all fields of a form: validateAll(id: string, key: string)
       You can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)
       </contextual_information>
+  duckdb:
+    prompt: |-
+      <contextual_information>
+      You have to write a statement for DuckDB. Arguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.
+      </contextual_information>
+      My instructions: {description}
diff --git a/frontend/src/lib/components/copilot/prompts/genPrompt.ts b/frontend/src/lib/components/copilot/prompts/genPrompt.ts
index a318c55e12..478ef99f92 100644
--- a/frontend/src/lib/components/copilot/prompts/genPrompt.ts
+++ b/frontend/src/lib/components/copilot/prompts/genPrompt.ts
@@ -46,17 +46,20 @@ export const GEN_PROMPT = {
     "php": {
       "prompt": "<contextual_information>\nYou have to write a function in php called \"main\". Specify the parameter types. Do not call the main function. You should generally return the result. The script must start with `<?php`.\nYou can take as parameters resources which are classes containing credentials or configuration information. For Windmill to correctly detect the resources to be passed, the resource type name has to be exactly as specified in the following list:\n<resourceTypes>\n{resourceTypes}\n</resourceTypes>\nYou need to define the type of the resources that are needed before the main function, but only include them if they are actually needed to achieve the function purpose.\nBefore defining each type, check if the class already exists using class_exists.\nThe resource type name has to be exactly as specified.\nIf you need to import libraries, you need to specify them as comments in the following manner before the main function:\n```\n// require:\n// mylibrary/mylibrary\n// myotherlibrary/myotherlibrary@optionalversion\n```\nNo need to require autoload, it is already done.\n<contextual_information>\nMy instructions: {description}"
     },
-    "frontend": {
-      "prompt": "Write client-side javascript code that should {description}. \n\n<contextual_information>\nYou can access the context object with the ctx global variable. \nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</contextual_information>"
-    },
-    "transformer": {
-      "prompt": "Write client-side javascript code that should process the variable `result` according to the following instructions: {description}.\nThe variable `result` is available globally.\nAt the end of the code, the processed result has to be returned.\n\n<contextual_information>\nYou can access the context object with the ctx global variable. \nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</contextual_information>"
-    },
     "csharp": {
       "prompt": "<contextual_information>\nYou have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nMy instructions: {description}"
     },
     "java": {
       "prompt": "<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nMy instructions: {description}"
+    },
+    "frontend": {
+      "prompt": "Write client-side javascript code that should {description}. \n\n<contextual_information>\nYou can access the context object with the ctx global variable. \nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</contextual_information>"
+    },
+    "transformer": {
+      "prompt": "Write client-side javascript code that should process the variable `result` according to the following instructions: {description}.\nThe variable `result` is available globally.\nAt the end of the code, the processed result has to be returned.\n\n<contextual_information>\nYou can access the context object with the ctx global variable.\nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</contextual_information>"
+    },
+    "duckdb": {
+      "prompt": "<contextual_information>\nYou have to write a statement for DuckDB. Arguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.\n</contextual_information>\nMy instructions: {description}"
     }
   }
 };
\ No newline at end of file

From c8aef6a44fa77087e61a732298dc4be52321e3ab Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Thu, 20 Nov 2025 16:06:00 +0100
Subject: [PATCH 68/81] fix (#7188)

---
 frontend/src/lib/components/copilot/prompts/edit.yaml     | 8 +++++---
 frontend/src/lib/components/copilot/prompts/editPrompt.ts | 6 +++---
 frontend/src/lib/components/copilot/prompts/fixPrompt.ts  | 4 ++--
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/frontend/src/lib/components/copilot/prompts/edit.yaml b/frontend/src/lib/components/copilot/prompts/edit.yaml
index b3c5d70ba9..22c2d54267 100644
--- a/frontend/src/lib/components/copilot/prompts/edit.yaml
+++ b/frontend/src/lib/components/copilot/prompts/edit.yaml
@@ -57,13 +57,13 @@ prompts:
       pub fn main(...) -> Result<ReturnType, Box<dyn std::error::Error>>
       ```
       but do not call it. Favor idiomatic Rust patterns, ensuring safe handling of ownership and borrowing, robust error handling with `Result`, and concurrency if needed (`async`/`tokio` or std threading). 
-      
+
       Follow these guidelines:
       - Include necessary imports and modules only when needed.
       - Add comments explaining important operations and any unsafe usage (if absolutely required).
       - The generated code should be easily executable and testable in an integrated terminal.
       </contextual_information>
-      My instructions: {description}  
+      My instructions: {description}
   go:
     prompt: |-
       Here's my go code: 
@@ -220,9 +220,10 @@ prompts:
       {code}
       ```
       <contextual_information>
-      You have to write C# code with a public static Main method inside a class. Specify the parameter types. Do not call the main function. You should generally return the result.
+      You have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.
       NuGet packages can be added using the format: #r "nuget: PackageName, Version" at the top of the script.
       The Main method signature should be: public static ReturnType Main(parameter types...)
+      Arguments are used to generate the input specification and create the frontend UI for the script.
       </contextual_information>
       My instructions: {description}
   java:
@@ -235,6 +236,7 @@ prompts:
       You have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.
       Dependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.
       The method signature should be: public static Object main(parameter types...)
+      Arguments are used to generate the input specification and create the frontend UI for the script.
       </contextual_information>
       My instructions: {description}
   frontend:
diff --git a/frontend/src/lib/components/copilot/prompts/editPrompt.ts b/frontend/src/lib/components/copilot/prompts/editPrompt.ts
index dcfdd1d07b..8a5ac5ff4b 100644
--- a/frontend/src/lib/components/copilot/prompts/editPrompt.ts
+++ b/frontend/src/lib/components/copilot/prompts/editPrompt.ts
@@ -8,7 +8,7 @@ export const EDIT_PROMPT = {
       "prompt": "Here's my TypeScript code in a deno running environment:\n```typescript\n{code}\n```\n<contextual_information>\nWe have to export a \"main\" function like this: \"export async function main(...)\" and specify the parameter types but do not call it. You should generally return the result.\nIf needed, the standard fetch method is available globally, do not import it.\nYou can take as parameters resources which are dictionaries containing credentials or configuration information. Name the resource parameters like this: \"{resource_type}Resource\". \nThe resource type name has to be exactly as specified.\n<resourceTypes>\n{resourceTypes}\n</resourceTypes>\nOnly define the type for resources that are actually needed to achieve the function purpose. If the type name conflicts with the imported object, rename the imported object NOT THE TYPE.\nNaming conventions are guidelines, but follow the user's naming choices in the existing code.\n</contextual_information>\nMy instructions: {description}"
     },
     "rust": {
-      "prompt": "Here's my Rust code:\n```rust\n{code}\n```\n<contextual_information>\nPlease define a `main` function in Rust with this signature:\n```rust\npub fn main(...) -> Result<ReturnType, Box<dyn std::error::Error>>\n```\nbut do not call it. Favor idiomatic Rust patterns, ensuring safe handling of ownership and borrowing, robust error handling with `Result`, and concurrency if needed (`async`/`tokio` or std threading). \n\nFollow these guidelines:\n- Include necessary imports and modules only when needed.\n- Add comments explaining important operations and any unsafe usage (if absolutely required).\n- The generated code should be easily executable and testable in an integrated terminal.\n</contextual_information>\nMy instructions: {description}  "
+      "prompt": "Here's my Rust code:\n```rust\n{code}\n```\n<contextual_information>\nPlease define a `main` function in Rust with this signature:\n```rust\npub fn main(...) -> Result<ReturnType, Box<dyn std::error::Error>>\n```\nbut do not call it. Favor idiomatic Rust patterns, ensuring safe handling of ownership and borrowing, robust error handling with `Result`, and concurrency if needed (`async`/`tokio` or std threading). \n\nFollow these guidelines:\n- Include necessary imports and modules only when needed.\n- Add comments explaining important operations and any unsafe usage (if absolutely required).\n- The generated code should be easily executable and testable in an integrated terminal.\n</contextual_information>\nMy instructions: {description}"
     },
     "go": {
       "prompt": "Here's my go code: \n```go\n{code}\n```\n<contextual_information>\nWe have to export a \"main\" function. Import the packages you need. The return type of the function has to be ({return_type}, error). The file package has to be \"inner\"\n</contextual_information>\nMy instructions: {description}"
@@ -47,10 +47,10 @@ export const EDIT_PROMPT = {
       "prompt": "Here's my php code: \n```php\n{code}\n```\n<contextual_information>\nYou have to write a function in php called \"main\". Specify the parameter types. Do not call the main function. You should generally return the result. The script must start with `<?php`.\nYou can take as parameters resources which are classes containing credentials or configuration information. For Windmill to correctly detect the resources to be passed, the resource type name has to be exactly as specified in the following list:\n<resourceTypes>\n{resourceTypes}\n</resourceTypes>\nYou need to define the type of the resources that are needed before the main function, but only include them if they are actually needed to achieve the function purpose.\nBefore defining each type, check if the class already exists using class_exists.\nThe resource type name has to be exactly as specified.\nIf you need to import libraries, you need to specify them as comments in the following manner before the main function:\n```\n// require:\n// mylibrary/mylibrary\n// myotherlibrary/myotherlibrary@optionalversion\n```\nNo need to require autoload, it is already done.\n<contextual_information>\nMy instructions: {description}"
     },
     "csharp": {
-      "prompt": "Here's my C# code:\n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\n</contextual_information>\nMy instructions: {description}"
+      "prompt": "Here's my C# code:\n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nMy instructions: {description}"
     },
     "java": {
-      "prompt": "Here's my Java code:\n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\n</contextual_information>\nMy instructions: {description}"
+      "prompt": "Here's my Java code:\n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nMy instructions: {description}"
     },
     "frontend": {
       "prompt": "Here's my client-side javascript code: \n```javascript\n{code}\n```\n<contextual_information>\nYou can access the context object with the ctx global variable. \nThe app state is a store that can be used to store data. You can access and update the state object with the state global variable like this: state.foo = 'bar'\nYou can use the goto function to navigate to a specific URL: goto(path: string, newTab?: boolean)\nYou can use the openModal and closeModal functions to open and close a modal: openModal(id: string), closeModal(id: string)\nYou can use the setTab function to manually set the tab of a Tab component: setTab(id: string, index: string)\nYou can use the recompute function to recompute a component: recompute(id: string)\nYou can use the getAgGrid function to get the ag-grid instance of a table: getAgGrid(id: string)\nYou can use the setSelectedIndex function to select a row in a table or an AG Grid table: setSelectedIndex(id: string, index: number)\nThe setValue function is meant to set or force the value of a component: setValue(id: string, value: any)\nYou can validate a specific field of a form: validate(id: string, key: string)\nYou can validate all fields of a form: validateAll(id: string, key: string)\nYou can invalidate a specific field of a form: invalidate(id: string, key: string, error: string)\n</contextual_information>\nMy instructions: {description}"
diff --git a/frontend/src/lib/components/copilot/prompts/fixPrompt.ts b/frontend/src/lib/components/copilot/prompts/fixPrompt.ts
index 9f3d48309c..c66f74dc31 100644
--- a/frontend/src/lib/components/copilot/prompts/fixPrompt.ts
+++ b/frontend/src/lib/components/copilot/prompts/fixPrompt.ts
@@ -47,10 +47,10 @@ export const FIX_PROMPT = {
       "prompt": "Here's my php code: \n```php\n{code}\n```\n<contextual_information>\nYou have to write a function in php called \"main\". Specify the parameter types. Do not call the main function. You should generally return the result. The script must start with `<?php`.\nYou can take as parameters resources which are classes containing credentials or configuration information. For Windmill to correctly detect the resources to be passed, the resource type name has to be exactly as specified in the following list:\n<resourceTypes>\n{resourceTypes}\n</resourceTypes>\nYou need to define the type of the resources that are needed before the main function, but only include them if they are actually needed to achieve the function purpose.\nBefore defining each type, check if the class already exists using class_exists.\nThe resource type name has to be exactly as specified.\nIf you need to import libraries, you need to specify them as comments in the following manner before the main function:\n```\n// require:\n// mylibrary/mylibrary\n// myotherlibrary/myotherlibrary@optionalversion\n```\nNo need to require autoload, it is already done.\n<contextual_information>\nI get the following error: {error}\nFix my code."
     },
     "csharp": {
-      "prompt": "Here's my C# code:\n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\n</contextual_information>\nI get the following error: {error}\nFix my code."
+      "prompt": "Here's my C# code:\n```csharp\n{code}\n```\n<contextual_information>\nYou have to write C# code with a public static Main method inside a class. The class name is irrelevant. Specify the parameter types. Do not call the main function. You should generally return the result.\nNuGet packages can be added using the format: #r \"nuget: PackageName, Version\" at the top of the script.\nThe Main method signature should be: public static ReturnType Main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nI get the following error: {error}\nFix my code."
     },
     "java": {
-      "prompt": "Here's my Java code:\n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\n</contextual_information>\nI get the following error: {error}\nFix my code."
+      "prompt": "Here's my Java code:\n```java\n{code}\n```\n<contextual_information>\nYou have to write Java code with a Main public class and a public static main() method. The return type can be Object or void. Do not call the main function. You should generally return the result.\nDependencies can be added using the format: //requirements://groupId:artifactId:version at the top of the script.\nThe method signature should be: public static Object main(parameter types...)\nArguments are used to generate the input specification and create the frontend UI for the script.\n</contextual_information>\nI get the following error: {error}\nFix my code."
     },
     "duckdb": {
       "prompt": "Here's my DuckDB code:\n```sql\n{code}\n```\n<contextual_information>\nArguments are defined with comments like `-- $age (text) = 20` or `-- $name (text)` (one per row) and used in the statement with $age, $name, etc. To use Ducklake, attach it with `ATTACH 'ducklake' AS dl;` (for main ducklake) or `ATTACH 'ducklake://name' AS dl;` for named ducklakes. To connect to external databases, use `ATTACH '$res:path/to/resource' AS db (TYPE postgres);`. To read S3 files, use `SELECT * FROM read_csv('s3:///path/to/file.csv');` for default storage or `SELECT * FROM read_csv('s3://secondary_storage_name/path/to/file.csv');` for named storage.\n</contextual_information>\nI get the following error: {error}\nFix my code."

From b56e611700f06844dda4f30d02a1119e714d73a4 Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Thu, 20 Nov 2025 17:23:37 +0100
Subject: [PATCH 69/81] fix(aichat): fallback to completion if responses fails
 (#7190)

* fallback to completion if responses fails

* add missing fallbacks

* remove test errors
---
 .../copilot/chat/AIChatManager.svelte.ts      | 52 +++++++++++++------
 frontend/src/lib/components/copilot/lib.ts    | 25 +++++++--
 2 files changed, 56 insertions(+), 21 deletions(-)

diff --git a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
index 149f6930d8..5645792971 100644
--- a/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
+++ b/frontend/src/lib/components/copilot/chat/AIChatManager.svelte.ts
@@ -408,24 +408,42 @@ class AIChatManager {
 				}
 
 				const model = getCurrentModel()
-				const completionFn =
-					model.provider === 'anthropic'
-						? getAnthropicCompletion
-						: model.provider === 'openai' || model.provider === 'azure_openai'
-							? getOpenAIResponsesCompletion
-							: getCompletion
-				const parseFn =
-					model.provider === 'anthropic'
-						? parseAnthropicCompletion
-						: model.provider === 'openai' || model.provider === 'azure_openai'
-							? parseOpenAIResponsesCompletion
-							: parseOpenAICompletion
+				const isOpenAI = model.provider === 'openai' || model.provider === 'azure_openai'
+				const isAnthropic = model.provider === 'anthropic'
 
-				const completion = await completionFn(
-					[systemMessage, ...messages, ...(pendingUserMessage ? [pendingUserMessage] : [])],
-					abortController,
-					tools.map((t) => t.def)
-				)
+				let completion: any
+				let parseFn: any
+
+				const messageParams = [
+					systemMessage,
+					...messages,
+					...(pendingUserMessage ? [pendingUserMessage] : [])
+				]
+				const toolDefs = tools.map((t) => t.def)
+
+				// For OpenAI/Azure, try Responses API first, fallback to Completions API
+				if (isOpenAI) {
+					try {
+						completion = await getOpenAIResponsesCompletion(
+							messageParams,
+							abortController,
+							toolDefs
+						)
+						parseFn = parseOpenAIResponsesCompletion
+					} catch (err) {
+						console.warn('OpenAI Responses API failed, falling back to Completions API:', err)
+						completion = await getCompletion(messageParams, abortController, toolDefs, {
+							forceCompletions: true
+						})
+						parseFn = parseOpenAICompletion
+					}
+				} else if (isAnthropic) {
+					completion = await getAnthropicCompletion(messageParams, abortController, toolDefs)
+					parseFn = parseAnthropicCompletion
+				} else {
+					completion = await getCompletion(messageParams, abortController, toolDefs)
+					parseFn = parseOpenAICompletion
+				}
 
 				if (completion) {
 					const continueCompletion = await parseFn(
diff --git a/frontend/src/lib/components/copilot/lib.ts b/frontend/src/lib/components/copilot/lib.ts
index 3f2686765b..1fa2a0d07c 100644
--- a/frontend/src/lib/components/copilot/lib.ts
+++ b/frontend/src/lib/components/copilot/lib.ts
@@ -675,7 +675,16 @@ export async function getNonStreamingCompletion(
 
 	// Use Responses API for OpenAI and Azure OpenAI
 	if (provider === 'openai' || provider === 'azure_openai') {
-		return getNonStreamingOpenAIResponsesCompletion(messages, abortController, testOptions)
+		try {
+			const response = await getNonStreamingOpenAIResponsesCompletion(
+				messages,
+				abortController,
+				testOptions
+			)
+			return response
+		} catch (error) {
+			console.error('Error using Responses API:', error)
+		}
 	}
 
 	const fetchOptions: {
@@ -793,13 +802,21 @@ export async function getFimCompletion(
 export async function getCompletion(
 	messages: ChatCompletionMessageParam[],
 	abortController: AbortController,
-	tools?: OpenAI.Chat.Completions.ChatCompletionTool[]
+	tools?: OpenAI.Chat.Completions.ChatCompletionTool[],
+	options?: {
+		forceCompletions?: boolean
+	}
 ): Promise<Stream<ChatCompletionChunk>> {
 	const { provider, config } = getProviderAndCompletionConfig({ messages, stream: true, tools })
 
 	// Use Responses API for OpenAI and Azure OpenAI
-	if (provider === 'openai' || provider === 'azure_openai') {
-		return getOpenAIResponsesCompletionStream(messages, abortController, tools) as any
+	if ((provider === 'openai' || provider === 'azure_openai') && !options?.forceCompletions) {
+		try {
+			const stream = getOpenAIResponsesCompletionStream(messages, abortController, tools) as any
+			return stream
+		} catch (error) {
+			console.error('Error using Responses API:', error)
+		}
 	}
 
 	// Use Completions API for other providers

From 338fd8a38cb035de298006ed1b96b6513eab9769 Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Thu, 20 Nov 2025 19:01:39 +0100
Subject: [PATCH 70/81] fix(frontend): show code/lock in flow steps on runs
 page (#7191)

---
 frontend/src/lib/components/runs/JobRunsPreview.svelte | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/frontend/src/lib/components/runs/JobRunsPreview.svelte b/frontend/src/lib/components/runs/JobRunsPreview.svelte
index 8b0a9954fd..5b224ed5f0 100644
--- a/frontend/src/lib/components/runs/JobRunsPreview.svelte
+++ b/frontend/src/lib/components/runs/JobRunsPreview.svelte
@@ -222,7 +222,11 @@
 				{#if job?.type === 'CompletedJob'}
 					{#if job?.job_kind == 'flow' || isFlowPreview(job?.job_kind)}
 						<div class="w-full mt-8 mb-20">
-							<FlowStatusViewer jobId={job.id} workspaceId={job.workspace_id} wideResults
+							<FlowStatusViewer
+								jobId={job.id}
+								workspaceId={job.workspace_id}
+								wideResults
+								initialJob={job}
 							></FlowStatusViewer>
 						</div>
 					{:else}
@@ -301,7 +305,7 @@
 					{#if job?.job_kind == 'flow' || isFlowPreview(job?.job_kind)}
 						<div class="flex flex-col gap-2 w-full">
 							<FlowProgressBar {job} class="py-4" />
-							<FlowStatusViewer jobId={job.id} workspaceId={job.workspace_id} />
+							<FlowStatusViewer jobId={job.id} workspaceId={job.workspace_id} initialJob={job} />
 						</div>
 					{:else}
 						<div class="text-sm font-semibold text-primary mb-1"> Job is still running </div>

From e9691c9eb080236849850a1ea6f3237ae39a2c4c Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 20 Nov 2025 18:58:35 +0000
Subject: [PATCH 71/81] feat(ee): support iamrds

---
 backend/Cargo.lock                        |  26 ++++
 backend/Cargo.toml                        |   1 +
 backend/ee-repo-ref.txt                   |   2 +-
 backend/src/main.rs                       |  18 ++-
 backend/windmill-api/src/resources.rs     |   2 +-
 backend/windmill-api/src/settings.rs      |   3 +-
 backend/windmill-common/Cargo.toml        |   9 +-
 backend/windmill-common/src/lib.rs        | 182 +++++++++++++++++++---
 backend/windmill-common/src/workspaces.rs |   2 +-
 9 files changed, 212 insertions(+), 33 deletions(-)

diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 717b025e28..0d06a86718 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -894,6 +894,31 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "aws-sdk-rds"
+version = "1.116.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7fdc73bba9b0b20e7f3eb35ea692b8f2eb3e3b4ed0e80909a7c4ae81da59dc0"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-query",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "fastrand",
+ "http 0.2.12",
+ "regex-lite",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "aws-sdk-sqs"
 version = "1.77.0"
@@ -15427,6 +15452,7 @@ dependencies = [
  "async-trait",
  "aws-config",
  "aws-credential-types",
+ "aws-sdk-rds",
  "aws-sdk-sts",
  "aws-smithy-types",
  "aws-smithy-types-convert",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 666727bf9c..702d762140 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -268,6 +268,7 @@ regex = "^1"
 semver = "^1"
 aws-sigv4 = "^1.3.4"
 aws-sdk-config = "=1.68.0"
+aws-sdk-rds = "^1"
 async-trait = "0.1.88"
 
 
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index eeaa99bcfe..0f8e46b3e7 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-5dd7ab7ce9e78e1b96ea78fd297da95d9b69e7a3
\ No newline at end of file
+6fedd4b83c41fdbf93d2c3fea4d89720aeccdcda
\ No newline at end of file
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 26e1755fea..4c4a848e4d 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -211,6 +211,7 @@ lazy_static::lazy_static! {
 }
 
 pub fn main() -> anyhow::Result<()> {
+
     // On Windows with enterprise feature, check if running as a service
     #[cfg(all(windows, feature = "enterprise", feature = "private"))]
     {
@@ -317,6 +318,10 @@ async fn cache_hub_scripts(file_path: Option<String>) -> anyhow::Result<()> {
 }
 
 async fn windmill_main() -> anyhow::Result<()> {
+    // windmill_common::db_iam::main().await?;
+
+    // return Ok(());
+    
     let (killpill_tx, mut killpill_rx) = KillpillSender::new(2);
     let mut monitor_killpill_rx = killpill_tx.subscribe();
     let (killpill_phase2_tx, _killpill_phase2_rx) = tokio::sync::broadcast::channel::<()>(2);
@@ -511,7 +516,9 @@ async fn windmill_main() -> anyhow::Result<()> {
         conn
     } else {
         // This time we use a pool of connections
-        let db = windmill_common::connect_db(server_mode, indexer_mode, worker_mode).await?;
+        let db = windmill_common::connect_db(server_mode, indexer_mode, worker_mode, 
+            #[cfg(feature = "private")]
+            killpill_rx.resubscribe()).await?;
 
         // NOTE: Variable/resource cache initialization moved to API server in windmill-api
 
@@ -832,10 +839,10 @@ Windmill Community Edition {GIT_VERSION}
             match conn {
                 Connection::Sql(ref db) => {
                     let base_internal_url = base_internal_url.to_string();
-                    let db_url: String = get_database_url().await?;
+                    let db_url = get_database_url().await?;
                     let db = db.clone();
                     let h = tokio::spawn(async move {
-                        let mut listener = retry_listen_pg(&db_url).await;
+                        let mut listener = retry_listen_pg(&db_url.as_str().await).await;
                         let mut last_listener_refresh = Instant::now();
                         let mut monitor_iteration: u64 = 0;
                         let rd_shift: u8 = rand::rng().random_range(0..200);
@@ -1169,13 +1176,14 @@ Windmill Community Edition {GIT_VERSION}
                                         },
                                         Err(e) => {
                                             tracing::error!(error = %e, "Could not receive notification, attempting to reconnect listener");
+                                            let db_url = db_url.clone();
                                             tokio::select! {
                                                 biased;
                                                 _ = monitor_killpill_rx.recv() => {
                                                     tracing::info!("received killpill for monitor job");
                                                     break;
                                                 },
-                                                new_listener = retry_listen_pg(&db_url) => {
+                                                new_listener = async move { retry_listen_pg(&db_url.as_str().await).await } => {
                                                     listener = new_listener;
                                                     continue;
                                                 }
@@ -1189,7 +1197,7 @@ Windmill Community Edition {GIT_VERSION}
                                         if let Err(e) = listener.unlisten_all().await {
                                             tracing::error!(error = %e, "Could not unlisten to database");
                                         }
-                                        listener = retry_listen_pg(&db_url).await;
+                                        listener = retry_listen_pg(&db_url.as_str().await).await;
                                         initial_load(
                                             &conn,
                                             tx.clone(),
diff --git a/backend/windmill-api/src/resources.rs b/backend/windmill-api/src/resources.rs
index 4aafcb0207..503c60e1f8 100644
--- a/backend/windmill-api/src/resources.rs
+++ b/backend/windmill-api/src/resources.rs
@@ -472,7 +472,7 @@ pub async fn get_resource_value_interpolated_internal(
     // This is a special syntax to help debugging ducklake catalogs stored in the instance
     if let Some(dbname) = path.strip_prefix("INSTANCE_DUCKLAKE_CATALOG/") {
         require_super_admin(db, &authed.email).await?;
-        let pg_creds = parse_postgres_url(&get_database_url().await?)?;
+        let pg_creds = parse_postgres_url(&get_database_url().await?.as_str().await)?;
         return Ok(Some(serde_json::json!({
             "dbname": dbname,
             "host": pg_creds.host,
diff --git a/backend/windmill-api/src/settings.rs b/backend/windmill-api/src/settings.rs
index 8fa6a0138b..bff2b282b6 100644
--- a/backend/windmill-api/src/settings.rs
+++ b/backend/windmill-api/src/settings.rs
@@ -647,8 +647,7 @@ async fn setup_ducklake_catalog_db_inner(
 ) -> Result<()> {
     require_super_admin(db, &authed.email).await?;
     logs.super_admin = "OK".to_string();
-    let pg_creds = &get_database_url().await?;
-    let pg_creds = parse_postgres_url(pg_creds)?;
+    let pg_creds = parse_postgres_url(&get_database_url().await?.as_str().await)?;
     logs.database_credentials = "OK".to_string();
 
     // Validate name to ensure it only contains alphanumeric characters
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 123d1a5ea4..c0a52c6677 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -7,14 +7,14 @@ edition.workspace = true
 [features]
 default = []
 enterprise = []
-private = []
+private = ["dep:aws-sdk-rds"]
 jemalloc = ["dep:tikv-jemalloc-ctl"]
 tantivy = []
 prometheus = ["dep:prometheus"]
 loki = ["dep:tracing-loki"]
 benchmark = []
-parquet = ["dep:object_store", "dep:aws-config", "dep:aws-sdk-sts", "dep:aws-smithy-types-convert", "dep:datafusion"]
-aws_auth = ["dep:aws-sdk-sts", "dep:aws-config"]
+parquet = ["dep:object_store", "dep:aws-sdk-sts", "dep:aws-smithy-types-convert", "dep:datafusion"]
+aws_auth = ["dep:aws-sdk-sts"]
 otel = ["dep:opentelemetry-semantic-conventions", "dep:opentelemetry-otlp", "dep:opentelemetry_sdk",
     "dep:opentelemetry", "dep:tracing-opentelemetry", "dep:opentelemetry-appender-tracing", "dep:tonic"]
 smtp = ["dep:mail-send"]
@@ -62,7 +62,7 @@ tracing-loki = { version = "^0", optional = true }
 magic-crypt.workspace = true
 object_store = { workspace = true, optional = true }
 prometheus = { workspace = true, optional = true }
-aws-config = { workspace = true, optional = true }
+aws-config.workspace = true
 aws-sdk-sts = { workspace = true, optional = true }
 aws-credential-types.workspace = true
 aws-smithy-types.workspace = true
@@ -70,6 +70,7 @@ base64.workspace = true
 bitflags.workspace = true
 
 aws-smithy-types-convert = { workspace = true, optional = true }
+aws-sdk-rds = { workspace = true, optional = true }
 indexmap.workspace = true
 bytes.workspace = true
 mail-send = { workspace = true, optional = true }
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index ada171a230..30c6411305 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -35,6 +35,8 @@ pub mod bench;
 pub mod cache;
 pub mod client;
 pub mod db;
+#[cfg(all(feature = "enterprise", feature = "private"))]
+mod db_iam_ee;
 #[cfg(feature = "private")]
 pub mod ee;
 pub mod ee_oss;
@@ -375,27 +377,120 @@ pub fn parse_postgres_url(url: &str) -> Result<PostgresUrlComponents, Error> {
     })
 }
 
-pub async fn get_database_url() -> Result<String, Error> {
-    use std::env::var;
-    use tokio::fs::File;
-    use tokio::io::AsyncReadExt;
-    match var("DATABASE_URL_FILE") {
-        Ok(file_path) => {
-            let mut file = File::open(file_path).await?;
-            let mut contents = String::new();
-            file.read_to_string(&mut contents).await?;
-            Ok(contents.trim().to_string())
+#[derive(Clone)]
+pub enum DatabaseUrl {
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    IamRds(std::sync::Arc<tokio::sync::RwLock<db_iam_ee::IamRdsUrl>>),
+    Static(String),
+}
+
+impl DatabaseUrl {
+    pub async fn as_str(&self) -> String {
+        match self {
+            #[cfg(all(feature = "enterprise", feature = "private"))]
+            DatabaseUrl::IamRds(rds_url) => {
+                let guard = rds_url.read().await;
+                guard.as_str().to_string()
+            }
+            DatabaseUrl::Static(url) => url.clone(),
         }
-        Err(_) => var("DATABASE_URL").map_err(|_| {
-            Error::BadConfig(
-                "Either DATABASE_URL_FILE or DATABASE_URL env var is missing".to_string(),
-            )
-        }),
     }
+
+    pub async fn refresh(&self) -> anyhow::Result<()> {
+        match self {
+            #[cfg(all(feature = "enterprise", feature = "private"))]
+            DatabaseUrl::IamRds(rds_url) => rds_url.write().await.refresh().await,
+            DatabaseUrl::Static(_) => Ok(()),
+        }
+    }
+
+
+}
+
+static DATABASE_URL_CACHE: tokio::sync::OnceCell<DatabaseUrl> =
+    tokio::sync::OnceCell::const_new();
+
+pub async fn get_database_url() -> Result<DatabaseUrl, Error> {
+    let database_url = DATABASE_URL_CACHE
+        .get_or_try_init(|| async {
+            use std::env::var;
+            use tokio::fs::File;
+            use tokio::io::AsyncReadExt;
+
+            let url = match var("DATABASE_URL_FILE") {
+                Ok(file_path) => {
+                    let mut file = File::open(file_path).await?;
+                    let mut contents = String::new();
+                    file.read_to_string(&mut contents).await?;
+                    Ok(contents.trim().to_string())
+                }
+                Err(_) => var("DATABASE_URL").map_err(|_| {
+                    Error::BadConfig(
+                        "Either DATABASE_URL_FILE or DATABASE_URL env var is missing".to_string(),
+                    )
+                }),
+            }?;
+
+            let parsed_url = url::Url::parse(&url)?;
+
+            if parsed_url.password().is_some_and(|x| x == "iamrds") {
+                let region = var("AWS_REGION").map_err(|_| {
+                    Error::BadConfig(
+                        "AWS_REGION env var is required for IAM RDS authentication".to_string(),
+                    )
+                })?;
+
+                tracing::info!("iamrds mode detected, generating IAM RDS URL for region: {region}");
+                #[cfg(all(feature = "enterprise", feature = "private"))] 
+                {
+                let rds_url = db_iam_ee::generate_database_url(&url, &region)
+                    .await
+                    .map_err(|e| {
+                        Error::InternalErr(format!("Failed to generate IAM database URL: {}", e))
+                    })?;
+                tracing::info!("IAM RDS URL generated successfully");
+                Ok::<DatabaseUrl, Error>(DatabaseUrl::IamRds(
+                    std::sync::Arc::new(tokio::sync::RwLock::new(rds_url))
+                ))
+                }
+
+                #[cfg(not(all(feature = "enterprise", feature = "private")))]
+                {
+                    return Err(Error::BadConfig("IAM RDS authentication is not enabled in OSS mode".to_string()));
+                }
+            } else {
+                Ok::<DatabaseUrl, Error>(DatabaseUrl::Static(url.to_string()))
+            }
+        })
+        .await?;
+
+    // Check if we need to refresh and do so if necessary
+    #[cfg(feature = "enterprise")]
+    if let DatabaseUrl::IamRds(ref rds_url_lock) = database_url {
+        // Check if refresh is needed
+        let needs_refresh = {
+            let read_guard = rds_url_lock.read().await;
+            read_guard.needs_refresh()
+        };
+
+        // If refresh is needed, acquire write lock and refresh
+        if needs_refresh {
+            let mut write_guard = rds_url_lock.write().await;
+            // Double-check after acquiring write lock (another task might have refreshed)
+            if write_guard.needs_refresh() {
+                write_guard.refresh().await.map_err(|e| {
+                    Error::InternalErr(format!("Failed to refresh IAM token: {}", e))
+                })?;
+            }
+        }
+    }
+
+    // Return the URL string
+    Ok(database_url.clone())
 }
 
 pub async fn initial_connection() -> Result<sqlx::Pool<sqlx::Postgres>, error::Error> {
-    let database_url = get_database_url().await?;
+    let database_url = get_database_url().await?.as_str().await;
     sqlx::postgres::PgPoolOptions::new()
         .max_connections(2)
         .connect_with(sqlx::postgres::PgConnectOptions::from_str(&database_url)?)
@@ -407,6 +502,8 @@ pub async fn connect_db(
     server_mode: bool,
     indexer_mode: bool,
     worker_mode: bool,
+    #[cfg(feature = "private")]
+    mut killpill_rx: tokio::sync::broadcast::Receiver<()>,
 ) -> anyhow::Result<sqlx::Pool<sqlx::Postgres>> {
     use anyhow::Context;
 
@@ -431,11 +528,58 @@ pub async fn connect_db(
         }
     };
 
-    Ok(connect(&database_url, max_connections, worker_mode).await?)
+
+    let pool = connect(database_url.clone(), max_connections, worker_mode).await?;
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    let pool2 = pool.clone();
+    #[cfg(all(feature = "enterprise", feature = "private"))]
+    if let DatabaseUrl::IamRds(database_url) = database_url {
+        tokio::spawn(async move {
+            loop {
+                tokio::select! {
+                    _ = killpill_rx.recv() => {
+                        break;
+                    }
+                    _ = tokio::time::sleep(std::time::Duration::from_secs(10)) => {
+                        let needs_refresh = {
+                            let read_guard = database_url.read().await;
+                            read_guard.needs_refresh()
+                        };
+                        if needs_refresh {
+                            let new_url = tokio::time::timeout(std::time::Duration::from_secs(10), get_database_url()).await;
+                            match new_url {
+                                Ok(Ok(new_url)) => {
+                                    let new_url = new_url.as_str().await;
+                                    let connect_options = sqlx::postgres::PgConnectOptions::from_str(&new_url);
+                                    if let Err(e) = connect_options {
+                                        tracing::error!("Error parsing IAM RDS URL as connect options, retrying in 10s: {}", e);
+                                        continue;
+                                    }
+                                    pool2.set_connect_options(connect_options.unwrap());
+                                    tracing::info!("Refreshed IAM RDS URL successfully");
+                                }
+                                Ok(Err(e)) => {
+                                    tracing::error!("Error refreshing IAM RDS URL, trying again in 10s: {}", e);
+                                    continue;
+                                }
+                                Err(e) => {
+                                    tracing::error!("Timeout after 10s refreshing IAM RDS URL, trying again in 10 seconds: {}", e);
+                                    continue;
+                                }
+                            }
+                        }
+                    }
+                }
+                
+            }
+        });
+    }
+
+    Ok(pool)
 }
 
 pub async fn connect(
-    database_url: &str,
+    database_url: DatabaseUrl,
     max_connections: u32,
     worker_mode: bool,
 ) -> Result<sqlx::Pool<sqlx::Postgres>, error::Error> {
@@ -484,7 +628,7 @@ pub async fn connect(
             }
         })
         .connect_with(
-            sqlx::postgres::PgConnectOptions::from_str(database_url)?.statement_cache_capacity(400),
+            sqlx::postgres::PgConnectOptions::from_str(&database_url.as_str().await)?.statement_cache_capacity(400),
         )
         .await
         .map_err(|err| Error::ConnectingToDatabase(err.to_string()))
diff --git a/backend/windmill-common/src/workspaces.rs b/backend/windmill-common/src/workspaces.rs
index edd9c8abe5..0fa8769ffd 100644
--- a/backend/windmill-common/src/workspaces.rs
+++ b/backend/windmill-common/src/workspaces.rs
@@ -208,7 +208,7 @@ pub async fn get_ducklake_from_db_unchecked(
 
     let catalog_resource =
         if ducklake.catalog.resource_type == DucklakeCatalogResourceType::Instance {
-            let pg_creds = parse_postgres_url(&get_database_url().await?)?;
+            let pg_creds = parse_postgres_url(&get_database_url().await?.as_str().await)?;
             json!({
                 "dbname": ducklake.catalog.resource_path,
                 "host": pg_creds.host,

From f51771183604f7759c57983f00ca2b7c93001122 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 20 Nov 2025 19:04:22 +0000
Subject: [PATCH 72/81] nit oss full

---
 backend/windmill-common/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index 30c6411305..04e59cfac9 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -465,7 +465,7 @@ pub async fn get_database_url() -> Result<DatabaseUrl, Error> {
         .await?;
 
     // Check if we need to refresh and do so if necessary
-    #[cfg(feature = "enterprise")]
+    #[cfg(all(feature = "enterprise", feature = "private"))]
     if let DatabaseUrl::IamRds(ref rds_url_lock) = database_url {
         // Check if refresh is needed
         let needs_refresh = {

From ec81696828676319b6904cab0fe8be9621dd04da Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 20 Nov 2025 20:04:48 +0100
Subject: [PATCH 73/81] chore(main): release 1.582.0 (#7189)

* chore(main): release 1.582.0

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  | 14 ++++
 backend/Cargo.lock                            | 68 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 65 insertions(+), 51 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9dc919ee16..13ff519ec2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.582.0](https://github.com/windmill-labs/windmill/compare/v1.581.1...v1.582.0) (2025-11-20)
+
+
+### Features
+
+* **aichat:** handle duckdb scripts ([#7187](https://github.com/windmill-labs/windmill/issues/7187)) ([ce5a318](https://github.com/windmill-labs/windmill/commit/ce5a31865cf6965ec28c449c2a832b93572a8eb6))
+* **ee:** support iamrds ([e9691c9](https://github.com/windmill-labs/windmill/commit/e9691c9eb080236849850a1ea6f3237ae39a2c4c))
+
+
+### Bug Fixes
+
+* **aichat:** fallback to completion if responses fails ([#7190](https://github.com/windmill-labs/windmill/issues/7190)) ([b56e611](https://github.com/windmill-labs/windmill/commit/b56e611700f06844dda4f30d02a1119e714d73a4))
+* **frontend:** show code/lock in flow steps on runs page ([#7191](https://github.com/windmill-labs/windmill/issues/7191)) ([338fd8a](https://github.com/windmill-labs/windmill/commit/338fd8a38cb035de298006ed1b96b6513eab9769))
+
 ## [1.581.1](https://github.com/windmill-labs/windmill/compare/v1.581.0...v1.581.1) (2025-11-20)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 0d06a86718..20e6087422 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -6327,9 +6327,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
 [[package]]
 name = "hashify"
@@ -10311,7 +10311,7 @@ checksum = "7ada44a88ef953a3294f6eb55d2007ba44646015e18613d2f213016379203ef3"
 dependencies = [
  "ahash 0.8.12",
  "equivalent",
- "hashbrown 0.16.0",
+ "hashbrown 0.16.1",
  "parking_lot 0.12.5",
 ]
 
@@ -15213,7 +15213,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15275,7 +15275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15396,7 +15396,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15411,7 +15411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15425,7 +15425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "axum",
@@ -15444,7 +15444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "regex",
  "serde",
@@ -15548,7 +15548,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15572,7 +15572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15710,7 +15710,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15724,7 +15724,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15741,7 +15741,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15755,7 +15755,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15773,7 +15773,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -15784,7 +15784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15821,7 +15821,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15831,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.581.1"
+version = "1.582.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16628,18 +16628,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.27"
+version = "0.8.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0894878a5fa3edfd6da3f88c4805f4c8558e2b996227a3d864f47fe11e38282c"
+checksum = "43fa6694ed34d6e57407afbccdeecfa268c470a7d2a5b0cf49ce9fcc345afb90"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.27"
+version = "0.8.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
+checksum = "c640b22cd9817fae95be82f0d2f90b11f7605f6c319d16705c459b27ac2cbc26"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 702d762140..226d33cdbb 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.581.1"
+version = "1.582.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.581.1"
+version = "1.582.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 9dfcbb25ec..1674a9c6b4 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.581.1
+  version: 1.582.0
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 70f3b3d53b..7d2c420419 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.581.1";
+export const VERSION = "v1.582.0";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index de51bb1164..b86cb08287 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.581.1";
+export const VERSION = "1.582.0";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 38cbcfb409..95a147695c 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.581.1",
+	"version": "1.582.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.581.1",
+			"version": "1.582.0",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 1c7f547522..ea48cee3e4 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.581.1",
+	"version": "1.582.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index 493c7c1ca9..e5a9cd32d7 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.581.1"
-wmill_pg = ">=1.581.1"
+wmill = ">=1.582.0"
+wmill_pg = ">=1.582.0"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index d3e9e0ad99..4f70ab8b32 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.581.1
+  version: 1.582.0
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index aba6ec750b..738b11fb3f 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.581.1'
+    ModuleVersion     = '1.582.0'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 9604c22fbf..7d0f606c67 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.581.1"
+version = "1.582.0"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 236f748be7..2ab6ca2ef5 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.581.1"
+version = "1.582.0"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 6c9570044c..401fcd22cf 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.581.1",
+  "version": "1.582.0",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index b76c958a06..0418d7d989 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.581.1",
+  "version": "1.582.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 902f26d0c0..13ee58993d 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.581.1
+1.582.0

From a3b4cfcb8f11db326b0ebf1777ad7e6479425125 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 07:04:28 +0000
Subject: [PATCH 74/81] fix: fix aws oidc refresh

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 0f8e46b3e7..9f6c5197e8 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-6fedd4b83c41fdbf93d2c3fea4d89720aeccdcda
\ No newline at end of file
+1a15bf2491f33836056595cacd0f2eb59b50bb25
\ No newline at end of file

From 67b3fd6a84a0e5e5c3399df18be8f9f0c1a0cedf Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 08:09:51 +0100
Subject: [PATCH 75/81] chore(main): release 1.582.1 (#7192)

* chore(main): release 1.582.1

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 58 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 53 insertions(+), 46 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 13ff519ec2..40ca0f1d95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.582.1](https://github.com/windmill-labs/windmill/compare/v1.582.0...v1.582.1) (2025-11-21)
+
+
+### Bug Fixes
+
+* fix aws oidc refresh ([a3b4cfc](https://github.com/windmill-labs/windmill/commit/a3b4cfcb8f11db326b0ebf1777ad7e6479425125))
+
 ## [1.582.0](https://github.com/windmill-labs/windmill/compare/v1.581.1...v1.582.0) (2025-11-20)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 20e6087422..9e7882df42 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -896,9 +896,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-rds"
-version = "1.116.0"
+version = "1.117.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7fdc73bba9b0b20e7f3eb35ea692b8f2eb3e3b4ed0e80909a7c4ae81da59dc0"
+checksum = "56b116d0229c41d5b72050dda07aa2cc7d1c571de8f7870c8b87fa297a724982"
 dependencies = [
  "aws-credential-types",
  "aws-runtime",
@@ -15213,7 +15213,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15275,7 +15275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15396,7 +15396,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15411,7 +15411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15425,7 +15425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "axum",
@@ -15444,7 +15444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "regex",
  "serde",
@@ -15548,7 +15548,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15572,7 +15572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15710,7 +15710,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15724,7 +15724,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15741,7 +15741,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15755,7 +15755,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15773,7 +15773,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "serde",
@@ -15784,7 +15784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15821,7 +15821,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15831,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.582.0"
+version = "1.582.1"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 226d33cdbb..f83c5b6818 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.582.0"
+version = "1.582.1"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.582.0"
+version = "1.582.1"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 1674a9c6b4..801e1d10c2 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.582.0
+  version: 1.582.1
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index 7d2c420419..aa8a3b96bb 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.582.0";
+export const VERSION = "v1.582.1";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index b86cb08287..7a7798dbc2 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.582.0";
+export const VERSION = "1.582.1";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 95a147695c..40bb7b2ea8 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.582.0",
+	"version": "1.582.1",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.582.0",
+			"version": "1.582.1",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index ea48cee3e4..13889acaf7 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.582.0",
+	"version": "1.582.1",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index e5a9cd32d7..b80e6df023 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.582.0"
-wmill_pg = ">=1.582.0"
+wmill = ">=1.582.1"
+wmill_pg = ">=1.582.1"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index 4f70ab8b32..bc865ff1a2 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.582.0
+  version: 1.582.1
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index 738b11fb3f..c4e3665c76 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.582.0'
+    ModuleVersion     = '1.582.1'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 7d0f606c67..5e290ed418 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.582.0"
+version = "1.582.1"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index 2ab6ca2ef5..b2ffb6f13a 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.582.0"
+version = "1.582.1"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 401fcd22cf..06ed5254c0 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.582.0",
+  "version": "1.582.1",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index 0418d7d989..c9c8e5bdc6 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.582.0",
+  "version": "1.582.1",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 13ee58993d..69ea07ac25 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.582.0
+1.582.1

From 98bdb6825a1b85c973ddec3e6b933e4a3d6d6972 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 07:12:36 +0000
Subject: [PATCH 76/81] fix: fix aws oidc refresh

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 9f6c5197e8..c8c41644d5 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-1a15bf2491f33836056595cacd0f2eb59b50bb25
\ No newline at end of file
+7f27da56373dde0c37081f38227abc629436819e
\ No newline at end of file

From dd320a6883a9666504fb501f343b993074fa3cc0 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 08:17:41 +0100
Subject: [PATCH 77/81] chore(main): release 1.582.2 (#7193)

* chore(main): release 1.582.2

* Apply automatic changes

---------

Co-authored-by: rubenfiszel <275584+rubenfiszel@users.noreply.github.com>
---
 CHANGELOG.md                                  |  7 +++
 backend/Cargo.lock                            | 54 +++++++++----------
 backend/Cargo.toml                            |  4 +-
 backend/windmill-api/openapi.yaml             |  2 +-
 benchmarks/lib.ts                             |  2 +-
 cli/src/main.ts                               |  2 +-
 frontend/package-lock.json                    |  4 +-
 frontend/package.json                         |  2 +-
 lsp/Pipfile                                   |  4 +-
 openflow.openapi.yaml                         |  2 +-
 .../WindmillClient/WindmillClient.psd1        |  2 +-
 python-client/wmill/pyproject.toml            |  2 +-
 python-client/wmill_pg/pyproject.toml         |  2 +-
 typescript-client/jsr.json                    |  2 +-
 typescript-client/package.json                |  2 +-
 version.txt                                   |  2 +-
 16 files changed, 51 insertions(+), 44 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40ca0f1d95..c42c850475 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.582.2](https://github.com/windmill-labs/windmill/compare/v1.582.1...v1.582.2) (2025-11-21)
+
+
+### Bug Fixes
+
+* fix aws oidc refresh ([98bdb68](https://github.com/windmill-labs/windmill/commit/98bdb6825a1b85c973ddec3e6b933e4a3d6d6972))
+
 ## [1.582.1](https://github.com/windmill-labs/windmill/compare/v1.582.0...v1.582.1) (2025-11-21)
 
 
diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 9e7882df42..7c9a4f373c 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -15213,7 +15213,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15275,7 +15275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15396,7 +15396,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "base64 0.22.1",
  "chrono",
@@ -15411,7 +15411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15425,7 +15425,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "axum",
@@ -15444,7 +15444,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15533,7 +15533,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "regex",
  "serde",
@@ -15548,7 +15548,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -15572,7 +15572,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15584,7 +15584,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15593,7 +15593,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15605,7 +15605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15617,7 +15617,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15629,7 +15629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15641,7 +15641,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15653,7 +15653,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15664,7 +15664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15675,7 +15675,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15687,7 +15687,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15710,7 +15710,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15724,7 +15724,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15741,7 +15741,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15755,7 +15755,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15773,7 +15773,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "serde",
@@ -15784,7 +15784,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15821,7 +15821,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -15831,7 +15831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.582.1"
+version = "1.582.2"
 dependencies = [
  "anyhow",
  "async-once-cell",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index f83c5b6818..45ff97c15e 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.582.1"
+version = "1.582.2"
 authors.workspace = true
 edition.workspace = true
 
@@ -33,7 +33,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.582.1"
+version = "1.582.2"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
diff --git a/backend/windmill-api/openapi.yaml b/backend/windmill-api/openapi.yaml
index 801e1d10c2..10acdee52f 100644
--- a/backend/windmill-api/openapi.yaml
+++ b/backend/windmill-api/openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.582.1
+  version: 1.582.2
   title: Windmill API
 
   contact:
diff --git a/benchmarks/lib.ts b/benchmarks/lib.ts
index aa8a3b96bb..3592faccdd 100644
--- a/benchmarks/lib.ts
+++ b/benchmarks/lib.ts
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";
 
-export const VERSION = "v1.582.1";
+export const VERSION = "v1.582.2";
 
 export async function login(email: string, password: string): Promise<string> {
   return await windmill.UserService.login({
diff --git a/cli/src/main.ts b/cli/src/main.ts
index 7a7798dbc2..157eda767a 100644
--- a/cli/src/main.ts
+++ b/cli/src/main.ts
@@ -68,7 +68,7 @@ export {
 //   }
 // });
 
-export const VERSION = "1.582.1";
+export const VERSION = "1.582.2";
 
 export const WM_FORK_PREFIX = "wm-fork";
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 40bb7b2ea8..50a0547dfa 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
 	"name": "windmill-components",
-	"version": "1.582.1",
+	"version": "1.582.2",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.582.1",
+			"version": "1.582.2",
 			"hasInstallScript": true,
 			"license": "AGPL-3.0",
 			"dependencies": {
diff --git a/frontend/package.json b/frontend/package.json
index 13889acaf7..72ec938dab 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.582.1",
+	"version": "1.582.2",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
diff --git a/lsp/Pipfile b/lsp/Pipfile
index b80e6df023..108c9edfb9 100644
--- a/lsp/Pipfile
+++ b/lsp/Pipfile
@@ -4,8 +4,8 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-wmill = ">=1.582.1"
-wmill_pg = ">=1.582.1"
+wmill = ">=1.582.2"
+wmill_pg = ">=1.582.2"
 sendgrid = "*"
 mysql-connector-python = "*"
 pymongo = "*"
diff --git a/openflow.openapi.yaml b/openflow.openapi.yaml
index bc865ff1a2..d8889ac2e1 100644
--- a/openflow.openapi.yaml
+++ b/openflow.openapi.yaml
@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.582.1
+  version: 1.582.2
   title: OpenFlow Spec
   contact:
     name: Ruben Fiszel
diff --git a/powershell-client/WindmillClient/WindmillClient.psd1 b/powershell-client/WindmillClient/WindmillClient.psd1
index c4e3665c76..b90734f2ba 100644
--- a/powershell-client/WindmillClient/WindmillClient.psd1
+++ b/powershell-client/WindmillClient/WindmillClient.psd1
@@ -12,7 +12,7 @@
     RootModule        = 'WindmillClient.psm1'
 
     # Version number of this module.
-    ModuleVersion     = '1.582.1'
+    ModuleVersion     = '1.582.2'
 
     # Supported PSEditions
     # CompatiblePSEditions = @()
diff --git a/python-client/wmill/pyproject.toml b/python-client/wmill/pyproject.toml
index 5e290ed418..d6b7b52fda 100644
--- a/python-client/wmill/pyproject.toml
+++ b/python-client/wmill/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill"
-version = "1.582.1"
+version = "1.582.2"
 description = "A client library for accessing Windmill server wrapping the Windmill client API"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/python-client/wmill_pg/pyproject.toml b/python-client/wmill_pg/pyproject.toml
index b2ffb6f13a..c0cef5f1e0 100644
--- a/python-client/wmill_pg/pyproject.toml
+++ b/python-client/wmill_pg/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "wmill-pg"
-version = "1.582.1"
+version = "1.582.2"
 description = "An extension client for the wmill client library focused on pg"
 license = "Apache-2.0"
 homepage = "https://windmill.dev"
diff --git a/typescript-client/jsr.json b/typescript-client/jsr.json
index 06ed5254c0..780fd79cd1 100644
--- a/typescript-client/jsr.json
+++ b/typescript-client/jsr.json
@@ -1,6 +1,6 @@
 {
   "name": "@windmill/windmill",
-  "version": "1.582.1",
+  "version": "1.582.2",
   "exports": "./src/index.ts",
   "publish": {
     "exclude": ["!src", "./s3Types.ts", "./client.ts"]
diff --git a/typescript-client/package.json b/typescript-client/package.json
index c9c8e5bdc6..1fb003024e 100644
--- a/typescript-client/package.json
+++ b/typescript-client/package.json
@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.582.1",
+  "version": "1.582.2",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "devDependencies": {
diff --git a/version.txt b/version.txt
index 69ea07ac25..e5791defc6 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-1.582.1
+1.582.2

From 3ae3b40cc7b610548b4528b4759f633717fd284d Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 07:43:23 +0000
Subject: [PATCH 78/81] nit style

---
 backend/ee-repo-ref.txt |  2 +-
 backend/src/main.rs     | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index c8c41644d5..9af7fc595d 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-7f27da56373dde0c37081f38227abc629436819e
\ No newline at end of file
+40f77067886158bc816637004673ea5cf03a51f8
\ No newline at end of file
diff --git a/backend/src/main.rs b/backend/src/main.rs
index 4c4a848e4d..a619572f50 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -211,7 +211,6 @@ lazy_static::lazy_static! {
 }
 
 pub fn main() -> anyhow::Result<()> {
-
     // On Windows with enterprise feature, check if running as a service
     #[cfg(all(windows, feature = "enterprise", feature = "private"))]
     {
@@ -318,10 +317,6 @@ async fn cache_hub_scripts(file_path: Option<String>) -> anyhow::Result<()> {
 }
 
 async fn windmill_main() -> anyhow::Result<()> {
-    // windmill_common::db_iam::main().await?;
-
-    // return Ok(());
-    
     let (killpill_tx, mut killpill_rx) = KillpillSender::new(2);
     let mut monitor_killpill_rx = killpill_tx.subscribe();
     let (killpill_phase2_tx, _killpill_phase2_rx) = tokio::sync::broadcast::channel::<()>(2);
@@ -516,9 +511,14 @@ async fn windmill_main() -> anyhow::Result<()> {
         conn
     } else {
         // This time we use a pool of connections
-        let db = windmill_common::connect_db(server_mode, indexer_mode, worker_mode, 
+        let db = windmill_common::connect_db(
+            server_mode,
+            indexer_mode,
+            worker_mode,
             #[cfg(feature = "private")]
-            killpill_rx.resubscribe()).await?;
+            killpill_rx.resubscribe(),
+        )
+        .await?;
 
         // NOTE: Variable/resource cache initialization moved to API server in windmill-api
 

From 9a2e27533c7b427c1b8eb0ddbb1bdd3da131d6c8 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 09:05:04 +0000
Subject: [PATCH 79/81] nit style

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 9af7fc595d..25b896040a 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-40f77067886158bc816637004673ea5cf03a51f8
\ No newline at end of file
+bb4021e25e3adee47d77041a84365698d4a60241
\ No newline at end of file

From 0aaaed9590b5b8d69d2ea6a2d7c11bfe786f3129 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 21 Nov 2025 09:30:18 +0000
Subject: [PATCH 80/81] nit style

---
 backend/ee-repo-ref.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 25b896040a..5e8cbdea21 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-bb4021e25e3adee47d77041a84365698d4a60241
\ No newline at end of file
+c90bfc11c7c643b2c8c5111f092e7ae142318e9d
\ No newline at end of file

From 1910daeb92d95240e33fc7eecab22f0fa18a22dc Mon Sep 17 00:00:00 2001
From: centdix <40307056+centdix@users.noreply.github.com>
Date: Fri, 21 Nov 2025 12:30:26 +0100
Subject: [PATCH 81/81] update claude code nix (#7195)

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 019aff4b34..57fa428e72 100644
--- a/flake.lock
+++ b/flake.lock
@@ -35,11 +35,11 @@
     },
     "nixpkgs-claude": {
       "locked": {
-        "lastModified": 1753694789,
-        "narHash": "sha256-cKgvtz6fKuK1Xr5LQW/zOUiAC0oSQoA9nOISB0pJZqM=",
+        "lastModified": 1763421233,
+        "narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dc9637876d0dcc8c9e5e22986b857632effeb727",
+        "rev": "89c2b2330e733d6cdb5eae7b899326930c2c0648",
         "type": "github"
       },
       "original": {