chore(main): release 1.426.0 (#4732 )

* chore(main): release 1.426.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>
Add mode to playbook init for discoverability (#4733 )
2026-09-14 16:02:27 +00:00 · 2024-11-18 17:14:55 +01:00 · 2024-11-18 17:09:40 +01:00 · 2024-11-18 17:03:50 +01:00 · 2024-11-18 17:02:38 +01:00 · 2024-11-18 15:34:22 +01:00
167 changed files with 7057 additions and 2283 deletions
@@ -3,8 +3,7 @@ env:
  IMAGE_NAME: ${{ github.repository }}

 name: Build and publish windmill for RHEL9
-on:
-  workflow_dispatch
+on: workflow_dispatch

 permissions: write-all

@@ -65,7 +64,7 @@ jobs:
          platforms: linux/amd64
          push: true
          build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka
          secrets: |
            rh_username=${{ secrets.RH_USERNAME }}
            rh_password=${{ secrets.RH_PASSWORD }}
@@ -74,7 +73,7 @@ jobs:
          labels: |
            ${{ steps.meta-ee-public.outputs.labels }}-amd64
            org.opencontainers.image.licenses=Windmill-Enterprise-License
-      
+
      - name: Build and push publicly ee arm64
        uses: depot/build-push-action@v1
        with:
@@ -82,7 +81,7 @@ jobs:
          platforms: linux/arm64
          push: true
          build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka
          secrets: |
            rh_username=${{ secrets.RH_USERNAME }}
            rh_password=${{ secrets.RH_PASSWORD }}
@@ -108,7 +107,7 @@ jobs:
        run: |
          mv "${{ steps.extract-ee-amd64.outputs.destination }}/windmill" "${{ steps.extract-ee-amd64.outputs.destination }}/windmill-ee-amd64-rhel9"
          mv "${{ steps.extract-ee-arm64.outputs.destination }}/windmill" "${{ steps.extract-ee-arm64.outputs.destination }}/windmill-ee-arm64-rhel9"
-      
+
      - uses: actions/upload-artifact@v4
        with:
          name: RHEL9-amd64 build
@@ -62,7 +62,7 @@ jobs:
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,deno_core,kafka
          tags: |
            ${{ steps.meta-ee-public.outputs.tags }}
          labels: |
@@ -45,7 +45,7 @@ jobs:
          $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
          mkdir frontend/build && cd backend
          New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core
+          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka

      - name: Rename binary with corresponding architecture
        run: |
@@ -1,10 +1,8 @@
 env:
  REGISTRY: ghcr.io
-  IMAGE_NAME:
-    ${{ github.event_name != 'pull_request' && github.repository ||
+  IMAGE_NAME: ${{ github.event_name != 'pull_request' && github.repository ||
    'windmill-labs/windmill-test' }}
-  DEV_SHA:
-    ${{ github.event_name != 'pull_request' && 'dev' || format('pr-{0}',
+  DEV_SHA: ${{ github.event_name != 'pull_request' && 'dev' || format('pr-{0}',
    github.event.number) }}

 name: Build windmill:main
@@ -140,7 +138,7 @@ jobs:
          platforms: linux/amd64,linux/arm64
          push: true
          build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka
          tags: |
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-ee:${{ env.DEV_SHA }}
            ${{ steps.meta-ee-public.outputs.tags }}
@@ -202,7 +200,7 @@ jobs:
          platforms: linux/amd64
          push: true
          build-args: |
-            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core
+            features=enterprise,enterprise_saml,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka
            PYTHON_IMAGE=python:3.12.2-slim-bookworm
          tags: |
            ${{ steps.meta-ee-public-py312.outputs.tags }}
@@ -47,7 +47,7 @@ jobs:
          $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
          mkdir frontend/build && cd backend
          New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core
+          cargo build --release --features=enterprise,stripe,embedding,parquet,prometheus,openidconnect,cloud,jemalloc,tantivy,deno_core,kafka

      - name: Rename binary with corresponding architecture
        run: |
@@ -6,4 +6,4 @@ frontend/src/routes/test.svelte
 CaddyfileRemoteMalo
 *.swp
 **/.idea/
-.direnv
+.direnv
@@ -1,5 +1,50 @@
 # Changelog

+## [1.426.0](https://github.com/windmill-labs/windmill/compare/v1.425.1...v1.426.0) (2024-11-18)
+
+
+### Features
+
+* Add mode (permissions) option to files in ansible ([#4724](https://github.com/windmill-labs/windmill/issues/4724)) ([5e10782](https://github.com/windmill-labs/windmill/commit/5e107827790292d89e51d81138eeef2b5b23a9c2))
+* kafka triggers ([#4713](https://github.com/windmill-labs/windmill/issues/4713)) ([88b8ffa](https://github.com/windmill-labs/windmill/commit/88b8ffab907e662ccca612bf01e6a228566522d2))
+
+
+### Bug Fixes
+
+* do not mount critical alerts modal if user is neither superadmin nor workspace admin ([#4731](https://github.com/windmill-labs/windmill/issues/4731)) ([180809d](https://github.com/windmill-labs/windmill/commit/180809d3466fb62d6692c45cbb012f158f83528f))
+
+## [1.425.1](https://github.com/windmill-labs/windmill/compare/v1.425.0...v1.425.1) (2024-11-16)
+
+
+### Bug Fixes
+
+* revert bool to text support in  pg ([#4727](https://github.com/windmill-labs/windmill/issues/4727)) ([17d8933](https://github.com/windmill-labs/windmill/commit/17d893315bd86942c7895cdb3e9c3ab34977b258))
+
+## [1.425.0](https://github.com/windmill-labs/windmill/compare/v1.424.0...v1.425.0) (2024-11-15)
+
+
+### Features
+
+* Handle `pip install` by `uv` ([#4517](https://github.com/windmill-labs/windmill/issues/4517)) ([f240d13](https://github.com/windmill-labs/windmill/commit/f240d1322a3c1669dfb69ebda6d05effcca26ae3))
+* **monitoring:** workspace critical alerts ([#4684](https://github.com/windmill-labs/windmill/issues/4684)) ([c32038a](https://github.com/windmill-labs/windmill/commit/c32038a76d9d00703d8b865af72f083ac43414e3))
+
+## [1.424.0](https://github.com/windmill-labs/windmill/compare/v1.423.2...v1.424.0) (2024-11-14)
+
+
+### Features
+
+* allow setting password and login type from superadmin UI ([2a1bff3](https://github.com/windmill-labs/windmill/commit/2a1bff3160b65eadba399229b5f53950ec2c0d48))
+* **backend:** monitor minimal version of living workers ([#4704](https://github.com/windmill-labs/windmill/issues/4704)) ([50ff183](https://github.com/windmill-labs/windmill/commit/50ff183baeaa2a39c2b0188ee8dd6172b08ae801))
+* Support mistral anthropic for ai ([#4692](https://github.com/windmill-labs/windmill/issues/4692)) ([556b4a4](https://github.com/windmill-labs/windmill/commit/556b4a41a1d010bb8a1796f485d343c1e412d278))
+
+
+### Bug Fixes
+
+* add countCompletedJobs api ([2a78359](https://github.com/windmill-labs/windmill/commit/2a78359af7b8e4700634c2ad2745c1d14d2da4f7))
+* add queue_couts api ([10b6b1d](https://github.com/windmill-labs/windmill/commit/10b6b1dc04cb2b2d4ec5ceb26a5dbd2ac7bd1394))
+* autoscaling when count &lt; min worker set to min_workers ([180bb82](https://github.com/windmill-labs/windmill/commit/180bb826436f9960def8c6cf3e9692714ffdf917))
+* deployment callbacks have a concurrency limit of 1 on same path ([c44fc4f](https://github.com/windmill-labs/windmill/commit/c44fc4f5ab8bcb5dffec08d5ed4ccd61feb1cb13))
+
 ## [1.423.2](https://github.com/windmill-labs/windmill/compare/v1.423.1...v1.423.2) (2024-11-13)


@@ -2,7 +2,7 @@ target/
 .env
 oauth.json
 oauth2.json
-windmill-api/openapi-deref.yaml
 tracing.folded
 heaptrack*
 index/
+windmill-api/openapi-*.*
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts SET acknowledged_workspace = true, acknowledged = true WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "00588a40dde5189ac1c61505f17acb0f4c244c60477427505bf5bd1b104d3bf9"
+}
@@ -1,12 +1,12 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT openai_resource_path, code_completion_enabled FROM workspace_settings WHERE workspace_id = $1",
+  "query": "SELECT ai_resource, code_completion_enabled FROM workspace_settings WHERE workspace_id = $1",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "openai_resource_path",
-        "type_info": "Varchar"
+        "name": "ai_resource",
+        "type_info": "Jsonb"
      },
      {
        "ordinal": 1,
@@ -24,5 +24,5 @@
      false
    ]
  },
-  "hash": "ceb97024ebf1a1c00ea1ed4952f66b229ca4622c537cc252d8ed52b4d24270ee"
+  "hash": "0230bd64d2b6719c3536a106e18a68c7b43b3a9a9efa92b5517132e9c0d8a25b"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT\n                -- slack_team_id, \n                -- slack_name, \n                -- slack_command_script, \n                -- CASE WHEN slack_email = 'missing@email.xyz' THEN NULL ELSE slack_email END AS slack_email,\n                auto_invite_domain IS NOT NULL AS \"auto_invite_enabled!\",\n                CASE WHEN auto_invite_operator IS TRUE THEN 'operator' ELSE 'developer' END AS \"auto_invite_as!\", \n                CASE WHEN auto_add IS TRUE THEN 'add' ELSE 'invite' END AS \"auto_invite_mode!\", \n                webhook, \n                deploy_to, \n                error_handler, \n                openai_resource_path, \n                code_completion_enabled, \n                error_handler_extra_args, \n                error_handler_muted_on_cancel, \n                large_file_storage, \n                git_sync,\n                default_app,\n                default_scripts,\n                workspace.name\n            FROM workspace_settings\n            LEFT JOIN workspace ON workspace.id = workspace_settings.workspace_id\n            WHERE workspace_id = $1",
+  "query": "SELECT\n                -- slack_team_id, \n                -- slack_name, \n                -- slack_command_script, \n                -- CASE WHEN slack_email = 'missing@email.xyz' THEN NULL ELSE slack_email END AS slack_email,\n                auto_invite_domain IS NOT NULL AS \"auto_invite_enabled!\",\n                CASE WHEN auto_invite_operator IS TRUE THEN 'operator' ELSE 'developer' END AS \"auto_invite_as!\", \n                CASE WHEN auto_add IS TRUE THEN 'add' ELSE 'invite' END AS \"auto_invite_mode!\", \n                webhook, \n                deploy_to, \n                error_handler, \n                ai_resource, \n                code_completion_enabled, \n                error_handler_extra_args, \n                error_handler_muted_on_cancel, \n                large_file_storage, \n                git_sync,\n                default_app,\n                default_scripts,\n                workspace.name\n            FROM workspace_settings\n            LEFT JOIN workspace ON workspace.id = workspace_settings.workspace_id\n            WHERE workspace_id = $1",
  "describe": {
    "columns": [
      {
@@ -35,8 +35,8 @@
      },
      {
        "ordinal": 6,
-        "name": "openai_resource_path",
-        "type_info": "Varchar"
+        "name": "ai_resource",
+        "type_info": "Jsonb"
      },
      {
        "ordinal": 7,
@@ -102,5 +102,5 @@
      false
    ]
  },
-  "hash": "188534f4b29f6461b1a6214d060f183c830b19a403ebb7b8be55a691675010c3"
+  "hash": "0331a81262e2d3c1bcfaeb64617b11eb68ab4599d64e5e5af639a9ac5d791fd0"
 }
@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET openai_resource_path = $1, code_completion_enabled = $2 WHERE workspace_id = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "034583442e6f8ae38d6c4e4aac26f17c8d9d0e657f28276228fc90d3e22e1304"
-}
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO alerts (alert_type, message, acknowledged, acknowledged_workspace, workspace_id, resource)\n        VALUES ('critical_error', $1, $2, $3, $4, $5)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Bool",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "044e2b428ee6e2dd4543c87ad8835e239cf7567d18b8b3fa6608ea3a9d206ca7"
+}
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM healthchecks WHERE check_type = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "0ee63ef2dd5c88edba2a1f56d31f29876724922f148dad7af35b36efbf70207a"
-}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET ai_resource = $1, code_completion_enabled = $2 WHERE workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1610c79b8d238e3a35d795f34a2a0100b933b7f199d41cc2f554d57c811d55f3"
+}
@@ -65,8 +65,8 @@
      },
      {
        "ordinal": 12,
-        "name": "openai_resource_path",
-        "type_info": "Varchar"
+        "name": "ai_resource",
+        "type_info": "Jsonb"
      },
      {
        "ordinal": 13,
@@ -117,6 +117,11 @@
        "ordinal": 22,
        "name": "deploy_ui",
        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 23,
+        "name": "mute_critical_alerts",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -147,6 +152,7 @@
      true,
      false,
      true,
+      true,
      true
    ]
  },
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM kafka_trigger WHERE script_path = $1 AND is_flow = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "2139f1fb1877294bbf55d786000c5c32f582a3911efcf88e437aa90d7d5a49b5"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT value\n            FROM resource\n            WHERE path = $1 AND workspace_id = $2",
+  "query": "SELECT value\n                FROM resource\n                WHERE path = $1 AND workspace_id = $2",
  "describe": {
    "columns": [
      {
@@ -19,5 +19,5 @@
      true
    ]
  },
-  "hash": "acdaa5151f8f7f37bb8c8c5a7d146789887e47db9695fc26b1dfaedd735e1e60"
+  "hash": "286fa00c088df146c08c1934556f06a4243c66787ab8759a8045e60effd2fb77"
 }
@@ -0,0 +1,18 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO alerts (alert_type, message, acknowledged, acknowledged_workspace, workspace_id, resource)\n        VALUES ('recovered_critical_error', $1, $2, $3, $4, $5)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Bool",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "28987898c7e4b172d466bf08f33c2da733e71f8a253b0122c17b9e021919809e"
+}
@@ -0,0 +1,54 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, alert_type, message, created_at, COALESCE(acknowledged, false) AS acknowledged, workspace_id\n                 FROM alerts\n                 WHERE COALESCE(acknowledged, false) = $1\n                 ORDER BY created_at DESC\n                 LIMIT $2 OFFSET $3",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "alert_type",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "message",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "acknowledged",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "workspace_id",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      null,
+      true
+    ]
+  },
+  "hash": "344b3a5d9683273a956b5156fed5ab9fdff1a7252198e4ae290d8c8f937ff177"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM kafka_trigger WHERE workspace_id = $1 AND path = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3997dcf2c11817e59bf50fd896381d870b847a8ba07e6197212fdf85ec901b09"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO alerts (alert_type, message, acknowledged) VALUES ('recovered_critical_error', $1, $2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "3a94ad52c6b7cde844fa868167248cd9ff63e5fdfa1d93d8fbec32a257b6b05e"
-}
@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE kafka_trigger SET enabled = FALSE, error = $1, server_id = NULL, last_server_ping = NULL WHERE workspace_id = $2 AND path = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3e64c894c89ef82c4527180b82c4e82c1b7060ba0ca288dc6a7c7afcd76212e8"
+}
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts SET acknowledged = true, acknowledged_workspace = true WHERE resource = $1 AND alert_type = 'critical_error'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4a3a8207627418ba7b7eabaccd7ec72884f2a1eacf0ab0e0c6ccbf56c654c14a"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO alerts (alert_type, message, acknowledged) VALUES ('critical_error', $1, $2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "4d22084a5d9860832f30e8f08cbfa1848ed3c1336fa4790f45b8189c4ac97d91"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, alert_type, message, created_at, acknowledged \n             FROM alerts \n             WHERE acknowledged = $1\n             ORDER BY created_at DESC \n             LIMIT $2 OFFSET $3",
+  "query": "SELECT id, alert_type, message, created_at, COALESCE(acknowledged, false) AS acknowledged, workspace_id\n                 FROM alerts\n                 ORDER BY created_at DESC\n                 LIMIT $1 OFFSET $2",
  "describe": {
    "columns": [
      {
@@ -27,11 +27,15 @@
        "ordinal": 4,
        "name": "acknowledged",
        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "workspace_id",
+        "type_info": "Text"
      }
    ],
    "parameters": {
      "Left": [
-        "Bool",
        "Int8",
        "Int8"
      ]
@@ -41,8 +45,9 @@
      false,
      false,
      false,
+      null,
      true
    ]
  },
-  "hash": "0b955f2cff82a2d4ba3840588143e08952f029480d4a42503ecc3c5e70437995"
+  "hash": "4d30c5a2894d655741d167f5589f5816583f0bae78a0dd3270dedb377dfa944a"
 }
@@ -65,8 +65,8 @@
      },
      {
        "ordinal": 12,
-        "name": "openai_resource_path",
-        "type_info": "Varchar"
+        "name": "ai_resource",
+        "type_info": "Jsonb"
      },
      {
        "ordinal": 13,
@@ -117,6 +117,11 @@
        "ordinal": 22,
        "name": "deploy_ui",
        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 23,
+        "name": "mute_critical_alerts",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -147,6 +152,7 @@
      true,
      false,
      true,
+      true,
      true
    ]
  },
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE kafka_trigger SET kafka_resource_path = $1, group_id = $2, topics = $3, script_path = $4, path = $5, is_flow = $6, edited_by = $7, email = $8, edited_at = now(), server_id = NULL, last_server_ping = NULL, error = NULL\n            WHERE workspace_id = $9 AND path = $10",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar",
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5962733746c81480abe9ab3a6ccf5664130ae7500279055c08db42d67b2822f6"
+}
@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET openai_resource_path = NULL, code_completion_enabled = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "6268eabd561502a44e273d6391102278974623f7a7bcad6891d7abadf4d3ea03"
-}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts\n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $2::text IS NOT NULL AND workspace_id = $2 THEN true\n             ELSE acknowledged_workspace\n           END\n         WHERE id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "65da41c7ded54cdee8d33211561c068b72294cc99ff44ed0a13179df508ebc6a"
+}
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET ai_resource = NULL, code_completion_enabled = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6940ddc5ee8d2a1048213d46f52d964b199604ba66dedbe9f89cea727d726a2d"
+}
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM kafka_trigger WHERE path = $1 AND workspace_id = $2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "6d418b5cd7a4df54cfe3ec06e2a957c87f2307a218115ca749ea0e71eca2002e"
+}
@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE kafka_trigger SET last_server_ping = now(), error = $1 WHERE workspace_id = $2 AND path = $3 AND server_id = $4 AND enabled IS TRUE RETURNING 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "6e70ebf078ac04a2933d2f83791973e8fc108d9f32be8a8501391052d76e191e"
+}
@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE kafka_trigger SET enabled = $1, email = $2, edited_by = $3, edited_at = now(), server_id = NULL, last_server_ping = NULL, error = NULL\n        WHERE path = $4 AND workspace_id = $5 RETURNING 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Varchar",
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "6eb076afcf11dba0dfe35ee108c64814f95dbe5376f0539195d24a8ca96ca3e2"
+}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT id, alert_type, message, created_at, acknowledged \n             FROM alerts \n             ORDER BY created_at DESC \n             LIMIT $1 OFFSET $2",
+  "query": "SELECT id, alert_type, message, created_at, COALESCE(acknowledged_workspace, false) AS acknowledged, workspace_id\n                 FROM alerts\n                 WHERE workspace_id = $1\n                 ORDER BY created_at DESC\n                 LIMIT $2 OFFSET $3",
  "describe": {
    "columns": [
      {
@@ -27,10 +27,16 @@
        "ordinal": 4,
        "name": "acknowledged",
        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "workspace_id",
+        "type_info": "Text"
      }
    ],
    "parameters": {
      "Left": [
+        "Text",
        "Int8",
        "Int8"
      ]
@@ -40,8 +46,9 @@
      false,
      false,
      false,
+      null,
      true
    ]
  },
-  "hash": "cc5ab80241b88c5befea279f16c4ec68cec17b31dcd277b321f652917346496b"
+  "hash": "777e7084edf9a5d14f299ff479ae43c8ead47a6a531d4b031a1342c9b2f16506"
 }
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts \n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $1::text IS NOT NULL THEN true\n             ELSE acknowledged_workspace\n           END\n         WHERE ($1::text IS NOT NULL AND workspace_id = $1)\n            OR ($1::text IS NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7c32176755c6ea2b6ae531860d436caae3fa256fc0803749ec5107632669adb3"
+}
@@ -0,0 +1,55 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id, alert_type, message, created_at, COALESCE(acknowledged_workspace, false) AS acknowledged, workspace_id\n                 FROM alerts\n                 WHERE workspace_id = $1 AND COALESCE(acknowledged_workspace, false) = $2\n                 ORDER BY created_at DESC\n                 LIMIT $3 OFFSET $4",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "alert_type",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "message",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "acknowledged",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 5,
+        "name": "workspace_id",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool",
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      null,
+      true
+    ]
+  },
+  "hash": "7c5a29de07cbe42326a15d4d7fd9714c20b767508e27368be6de38d7b18a3a4d"
+}
@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts SET acknowledged = true",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a59fae29ebcc9aa53308b777ead3d2b652618ac454f139db738f4499cb4eb079"
+}
@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE alerts SET acknowledged = true WHERE acknowledged = false",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "a7c5008aa7ea43d0afac7d9f19846976ed7af2e90270902f001115e023cb947d"
-}
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT created_by, CONCAT(coalesce(queue.logs, ''), coalesce(job_logs.logs, '')) as logs, job_logs.log_offset, job_logs.log_file_index\n            FROM queue \n            LEFT JOIN job_logs ON job_logs.job_id = queue.id \n            WHERE queue.id = $1 AND queue.workspace_id = $2",
+  "query": "SELECT created_by, CONCAT(coalesce(queue.logs, ''), coalesce(job_logs.logs, '')) as logs, coalesce(job_logs.log_offset, 0) as log_offset, job_logs.log_file_index\n            FROM queue \n            LEFT JOIN job_logs ON job_logs.job_id = queue.id \n            WHERE queue.id = $1 AND queue.workspace_id = $2",
  "describe": {
    "columns": [
      {
@@ -33,9 +33,9 @@
    "nullable": [
      false,
      null,
-      false,
+      null,
      true
    ]
  },
-  "hash": "57111a97ff906fd79ecd8a571212cc4fea9cb9c16fe950f082ad5469bfeefc82"
+  "hash": "b2c30137b3b64f8c3f6aea062e8687e119599641beee0a0d6c89c5d90e82d0db"
 }
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE alerts SET acknowledged = true WHERE id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "be3ae231557e794172336bc27d725f862dcf039bbb3d75ced9d54c86f53d2580"
-}
@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT \n            EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) as \"websocket_used!\", \n            EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) as \"http_routes_used!\",\n            EXISTS(SELECT 1 FROM kafka_trigger WHERE workspace_id = $1) as \"kafka_used!\"",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "websocket_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "http_routes_used!",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "kafka_used!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "cc8a71abdeccf0787695af32aa21fe73aba65cfdc8329c02b4d257de4d2d168a"
+}
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT ai_resource FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "ai_resource",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "ceda377fa534656ac12a7f41db77db1f054ec751855c8db7352b0e9c20b63ef8"
+}
@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE kafka_trigger SET server_id = $1, last_server_ping = now() WHERE enabled IS TRUE AND workspace_id = $2 AND path = $3 AND (server_id IS NULL OR last_server_ping IS NULL OR last_server_ping < now() - interval '15 seconds') RETURNING true",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "?column?",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "d6615719bf8db4b333ed55c9a3c160ad1962668fc3305d8e80ae91ef73614a80"
+}
@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) as \"websocket_used!\", EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) as \"http_routes_used!\"",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "websocket_used!",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 1,
-        "name": "http_routes_used!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null,
-      null
-    ]
-  },
-  "hash": "db24f1f6ef1e26b7de7926bd3f32d1fa673c4970c25ff9ad98f0fdf199801b53"
-}
@@ -1,12 +1,12 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT openai_resource_path FROM workspace_settings WHERE workspace_id = $1",
+  "query": "SELECT mute_critical_alerts FROM workspace_settings WHERE workspace_id = $1",
  "describe": {
    "columns": [
      {
        "ordinal": 0,
-        "name": "openai_resource_path",
-        "type_info": "Varchar"
+        "name": "mute_critical_alerts",
+        "type_info": "Bool"
      }
    ],
    "parameters": {
@@ -18,5 +18,5 @@
      true
    ]
  },
-  "hash": "f8b689ec3e09f14dc02ac9e9f98d252a14d3a2acfadcd9cd6ba27ca9799f4706"
+  "hash": "e05dbe046e846c092a96b6b0a9d872c721169d418586be2d15cee6b929049098"
 }
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_settings SET mute_critical_alerts = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f22168826350797e88153b65a5b1e906a7868f34c062f154b2ee4f24c57aa5c3"
+}
@@ -843,9 +843,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sts"
-version = "1.49.0"
+version = "1.50.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53dcf5e7d9bd1517b8b998e170e650047cea8a2b85fe1835abe3210713e541b7"
+checksum = "6ada54e5f26ac246dc79727def52f7f8ed38915cb47781e2a72213957dc3a7d5"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -1032,9 +1032,9 @@ dependencies = [

 [[package]]
 name = "axum"
-version = "0.7.7"
+version = "0.7.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "504e3947307ac8326a5437504c517c4b56716c9d98fac0028c2acc7ca47d70ae"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
 dependencies = [
 "async-trait",
 "axum-core",
@@ -1378,7 +1378,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2593a3b8b938bd68373196c9832f516be11fa487ef4ae745eb282e6a56a7244"
 dependencies = [
 "once_cell",
- "proc-macro-crate",
+ "proc-macro-crate 3.2.0",
 "proc-macro2",
 "quote",
 "syn 2.0.87",
@@ -1598,9 +1598,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aeb932158bd710538c73702db6945cb68a8fb08c519e6e12706b94263b36db8"
+checksum = "fd9de9f2205d5ef3fd67e685b0df337994ddd4495e2a28d185500d0e1edfea47"
 dependencies = [
 "jobserver",
 "libc",
@@ -1783,9 +1783,9 @@ dependencies = [

 [[package]]
 name = "comfy-table"
-version = "7.1.2"
+version = "7.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0d05af1e006a2407bedef5af410552494ce5be9090444dbbcb57258c1af3d56"
+checksum = "24f165e7b643266ea80cb858aed492ad9280e3e05ce24d4a99d7d7b889b6a4d9"
 dependencies = [
 "strum 0.26.3",
 "strum_macros 0.26.4",
@@ -2776,7 +2776,7 @@ checksum = "22a1abc6bd8af41aa2496ceceef94f4277092c781a9495c437327a17659553a2"
 dependencies = [
 "deno_core",
 "deno_native_certs",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-pemfile 2.2.0",
 "rustls-tokio-stream",
 "rustls-webpki 0.102.8",
@@ -3355,9 +3355,9 @@ dependencies = [

 [[package]]
 name = "flate2"
-version = "1.0.34"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1b589b4dc103969ad3cf85c950899926ec64300a1a46d76c03a6072957036f0"
+checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
 dependencies = [
 "crc32fast",
 "libz-sys",
@@ -4295,7 +4295,7 @@ dependencies = [
 "http 1.1.0",
 "hyper 1.5.0",
 "hyper-util",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-native-certs 0.8.0",
 "rustls-pki-types",
 "tokio",
@@ -4831,9 +4831,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.162"
+version = "0.2.164"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
+checksum = "433bfe06b8c75da9b2e3fbea6e5329ff87748f0b144ef75306e674c3f6f7c13f"

 [[package]]
 name = "libgit2-sys"
@@ -5054,7 +5054,7 @@ dependencies = [
 "base64 0.22.1",
 "gethostname",
 "mail-builder",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-pki-types",
 "smtp-proto",
 "tokio",
@@ -5313,7 +5313,7 @@ dependencies = [
 "darling 0.20.10",
 "heck 0.5.0",
 "num-bigint",
- "proc-macro-crate",
+ "proc-macro-crate 3.2.0",
 "proc-macro-error2",
 "proc-macro2",
 "quote",
@@ -5556,6 +5556,27 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "num_enum"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f646caf906c20226733ed5b1374287eb97e3c2a5c227ce668c1f2ce20ae57c9"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcbff9bc912032c62bf65ef1d5aea88983b420f4f839db1e9b0c281a25c9c799"
+dependencies = [
+ "proc-macro-crate 1.3.1",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
 [[package]]
 name = "number_prefix"
 version = "0.4.0"
@@ -5736,6 +5757,15 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"

+[[package]]
+name = "openssl-src"
+version = "300.4.1+3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faa4eac4138c62414b5622d1b31c5c304f34b406b013c079c2bbc652fdd6678c"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.104"
@@ -5744,6 +5774,7 @@ checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
 dependencies = [
 "cc",
 "libc",
+ "openssl-src",
 "pkg-config",
 "vcpkg",
 ]
@@ -6239,6 +6270,16 @@ dependencies = [
 "elliptic-curve",
 ]

+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.2.0"
@@ -6528,7 +6569,7 @@ dependencies = [
 "quinn-proto",
 "quinn-udp",
 "rustc-hash 2.0.0",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "socket2 0.5.7",
 "thiserror 2.0.3",
 "tokio",
@@ -6546,7 +6587,7 @@ dependencies = [
 "rand 0.8.5",
 "ring 0.17.8",
 "rustc-hash 2.0.0",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-pki-types",
 "slab",
 "thiserror 2.0.3",
@@ -6711,6 +6752,38 @@ dependencies = [
 "crossbeam-utils",
 ]

+[[package]]
+name = "rdkafka"
+version = "0.36.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1beea247b9a7600a81d4cc33f659ce1a77e1988323d7d2809c7ed1c21f4c316d"
+dependencies = [
+ "futures-channel",
+ "futures-util",
+ "libc",
+ "log",
+ "rdkafka-sys",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "slab",
+ "tokio",
+]
+
+[[package]]
+name = "rdkafka-sys"
+version = "4.7.0+2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55e0d2f9ba6253f6ec72385e453294f8618e9e15c2c6aba2a5c01ccf9622d615"
+dependencies = [
+ "cmake",
+ "libc",
+ "libz-sys",
+ "num_enum",
+ "openssl-sys",
+ "pkg-config",
+]
+
 [[package]]
 name = "reborrow"
 version = "0.5.5"
@@ -6918,7 +6991,7 @@ dependencies = [
 "percent-encoding",
 "pin-project-lite",
 "quinn",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-native-certs 0.8.0",
 "rustls-pemfile 2.2.0",
 "rustls-pki-types",
@@ -7219,9 +7292,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.16"
+version = "0.23.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eee87ff5d9b36712a58574e12e9f0ea80f915a5b0ac518d322b24a465617925e"
+checksum = "7f1a745511c54ba6d4465e8d5dfbd81b45791756de28d4981af70d6dca128f1e"
 dependencies = [
 "log",
 "once_cell",
@@ -7304,7 +7377,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "22557157d7395bc30727745b365d923f1ecc230c4c80b176545f3f4f08c46e33"
 dependencies = [
 "futures",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "socket2 0.5.7",
 "tokio",
 ]
@@ -7648,9 +7721,9 @@ dependencies = [

 [[package]]
 name = "serde_json"
-version = "1.0.132"
+version = "1.0.133"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+checksum = "c7fceb2473b9166b2294ef05efcb65a3db80803f0b03ef86a5fc88a2b85ee377"
 dependencies = [
 "indexmap 2.6.0",
 "itoa",
@@ -8196,7 +8269,7 @@ dependencies = [
 "once_cell",
 "paste",
 "percent-encoding",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-pemfile 2.2.0",
 "serde",
 "serde_json",
@@ -9470,7 +9543,7 @@ version = "0.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c7bc40d0e5a97695bb96e27995cd3a08538541b0a846f65bba7a359f36700d4"
 dependencies = [
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-pki-types",
 "tokio",
 ]
@@ -10211,7 +10284,7 @@ dependencies = [
 "log",
 "native-tls",
 "once_cell",
- "rustls 0.23.16",
+ "rustls 0.23.17",
 "rustls-pki-types",
 "serde",
 "serde_json",
@@ -10610,7 +10683,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

 [[package]]
 name = "windmill"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "axum",
@@ -10652,7 +10725,7 @@ dependencies = [

 [[package]]
 name = "windmill-api"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "argon2",
@@ -10695,6 +10768,7 @@ dependencies = [
 "prometheus",
 "quick_cache",
 "rand 0.8.5",
+ "rdkafka",
 "regex",
 "reqwest 0.12.9",
 "rsa 0.7.2",
@@ -10737,7 +10811,7 @@ dependencies = [

 [[package]]
 name = "windmill-api-client"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "base64 0.22.1",
 "chrono",
@@ -10755,7 +10829,7 @@ dependencies = [

 [[package]]
 name = "windmill-audit"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "chrono",
 "serde",
@@ -10768,7 +10842,7 @@ dependencies = [

 [[package]]
 name = "windmill-autoscaling"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "rsmq_async",
@@ -10783,7 +10857,7 @@ dependencies = [

 [[package]]
 name = "windmill-common"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "async-stream",
@@ -10830,7 +10904,7 @@ dependencies = [

 [[package]]
 name = "windmill-git-sync"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "regex",
 "rsmq_async",
@@ -10845,7 +10919,7 @@ dependencies = [

 [[package]]
 name = "windmill-indexer"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "bytes",
@@ -10867,7 +10941,7 @@ dependencies = [

 [[package]]
 name = "windmill-macros"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "itertools 0.13.0",
 "lazy_static",
@@ -10879,7 +10953,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "convert_case 0.6.0",
 "serde",
@@ -10888,7 +10962,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-bash"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -10900,7 +10974,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-go"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "gosyn",
@@ -10912,7 +10986,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-graphql"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -10924,7 +10998,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-php"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "itertools 0.13.0",
@@ -10935,7 +11009,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "itertools 0.13.0",
@@ -10946,7 +11020,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -10964,7 +11038,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-rust"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "convert_case 0.6.0",
@@ -10981,7 +11055,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-sql"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -10993,7 +11067,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-ts"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "lazy_static",
@@ -11011,7 +11085,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-wasm"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "getrandom 0.2.15",
@@ -11032,7 +11106,7 @@ dependencies = [

 [[package]]
 name = "windmill-parser-yaml"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "serde_json",
@@ -11042,7 +11116,7 @@ dependencies = [

 [[package]]
 name = "windmill-queue"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -11075,7 +11149,7 @@ dependencies = [

 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "wasm-bindgen",
 "wasm-bindgen-test",
@@ -11085,7 +11159,7 @@ dependencies = [

 [[package]]
 name = "windmill-worker"
-version = "1.423.2"
+version = "1.426.0"
 dependencies = [
 "anyhow",
 "async-recursion",
@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.423.2"
+version = "1.426.0"
 authors.workspace = true
 edition.workspace = true

@@ -29,7 +29,7 @@ members = [
 ]

 [workspace.package]
-version = "1.423.2"
+version = "1.426.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"

@@ -62,6 +62,7 @@ jemalloc = ["windmill-common/jemalloc", "dep:tikv-jemallocator", "dep:tikv-jemal
 tantivy = ["dep:windmill-indexer", "windmill-api/tantivy"]
 sqlx = ["windmill-worker/sqlx"]
 deno_core = ["windmill-worker/deno_core", "dep:deno_core"]
+kafka = ["windmill-api/kafka"]

 [dependencies]
 anyhow.workspace = true
@@ -266,6 +267,7 @@ tokio-native-tls = "^0"
 openssl = "=0.10"
 mail-parser = "^0"
 matchit = "=0.7.3"
+rdkafka = { version = "0.36.2", features = ["cmake-build", "ssl-vendored"] }

 datafusion = "39.0.0"
 object_store = { version = "0.10.0", features = ["aws", "azure"] }
@@ -1 +1 @@
-0d9c8813acd28848515c736e7b684220b5a785a3
+7cdaac656fde3f3e267dfb9e94dda7f3843aa44e
@@ -0,0 +1,7 @@
+-- Add down migration script here
+ALTER TABLE workspace_settings
+ALTER COLUMN ai_resource TYPE text
+USING ai_resource->>'path';
+
+ALTER TABLE workspace_settings
+RENAME COLUMN ai_resource to openai_resource_path;
@@ -0,0 +1,7 @@
+-- Add up migration script here
+ALTER TABLE workspace_settings
+ALTER COLUMN openai_resource_path TYPE jsonb
+USING jsonb_build_object('provider', 'openai', 'path', openai_resource_path);
+
+ALTER TABLE workspace_settings
+RENAME COLUMN openai_resource_path TO ai_resource;
@@ -0,0 +1,4 @@
+ALTER TABLE alerts DROP COLUMN workspace_id;
+ALTER TABLE alerts DROP COLUMN acknowledged_workspace;
+ALTER TABLE alerts DROP COLUMN resource;
+ALTER TABLE workspace_settings DROP COLUMN mute_critical_alerts;
@@ -0,0 +1,4 @@
+ALTER TABLE alerts ADD COLUMN workspace_id TEXT DEFAULT NULL;
+ALTER TABLE alerts ADD COLUMN acknowledged_workspace BOOL DEFAULT NULL;
+ALTER TABLE alerts ADD COLUMN resource TEXT DEFAULT NULL;
+ALTER TABLE workspace_settings ADD COLUMN mute_critical_alerts BOOL DEFAULT NULL;
@@ -0,0 +1,2 @@
+-- Add down migration script here
+DROP TABLE kafka_trigger;
@@ -0,0 +1,69 @@
+-- Add up migration script here
+-- Add up migration script here
+
+CREATE TABLE kafka_trigger (
+    path VARCHAR(255) NOT NULL,
+    kafka_resource_path VARCHAR(255) NOT NULL,
+    topics VARCHAR(255)[] NOT NULL,
+    group_id VARCHAR(255) NOT NULL,
+    script_path VARCHAR(255) NOT NULL,
+    is_flow BOOLEAN NOT NULL,
+    workspace_id VARCHAR(50) NOT NULL,
+    edited_by VARCHAR(50) NOT NULL,
+    email VARCHAR(255) NOT NULL,
+    edited_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    extra_perms JSONB NOT NULL DEFAULT '{}',
+    server_id VARCHAR(50) NULL,
+    last_server_ping TIMESTAMPTZ NULL,
+    error TEXT NULL,
+    enabled BOOLEAN NOT NULL,
+    PRIMARY KEY (path, workspace_id)
+);
+
+GRANT ALL ON kafka_trigger TO windmill_user;
+GRANT ALL ON kafka_trigger TO windmill_admin;
+
+ALTER TABLE kafka_trigger ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY admin_policy ON kafka_trigger FOR ALL TO windmill_admin USING (true);
+
+CREATE POLICY see_folder_extra_perms_user_select ON kafka_trigger FOR SELECT TO windmill_user
+USING (SPLIT_PART(kafka_trigger.path, '/', 1) = 'f' AND SPLIT_PART(kafka_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_read'), ',')::text[]));
+CREATE POLICY see_folder_extra_perms_user_insert ON kafka_trigger FOR INSERT TO windmill_user
+WITH CHECK (SPLIT_PART(kafka_trigger.path, '/', 1) = 'f' AND SPLIT_PART(kafka_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_write'), ',')::text[]));
+CREATE POLICY see_folder_extra_perms_user_update ON kafka_trigger FOR UPDATE TO windmill_user
+USING (SPLIT_PART(kafka_trigger.path, '/', 1) = 'f' AND SPLIT_PART(kafka_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_write'), ',')::text[]));
+CREATE POLICY see_folder_extra_perms_user_delete ON kafka_trigger FOR DELETE TO windmill_user
+USING (SPLIT_PART(kafka_trigger.path, '/', 1) = 'f' AND SPLIT_PART(kafka_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.folders_write'), ',')::text[]));
+
+CREATE POLICY see_own ON kafka_trigger FOR ALL TO windmill_user
+USING (SPLIT_PART(kafka_trigger.path, '/', 1) = 'u' AND SPLIT_PART(kafka_trigger.path, '/', 2) = current_setting('session.user'));
+CREATE POLICY see_member ON kafka_trigger FOR ALL TO windmill_user
+USING (SPLIT_PART(kafka_trigger.path, '/', 1) = 'g' AND SPLIT_PART(kafka_trigger.path, '/', 2) = any(regexp_split_to_array(current_setting('session.groups'), ',')::text[]));
+
+CREATE POLICY see_extra_perms_user_select ON kafka_trigger FOR SELECT TO windmill_user
+USING (extra_perms ? CONCAT('u/', current_setting('session.user')));
+CREATE POLICY see_extra_perms_user_insert ON kafka_trigger FOR INSERT TO windmill_user
+WITH CHECK ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean);
+CREATE POLICY see_extra_perms_user_update ON kafka_trigger FOR UPDATE TO windmill_user
+USING ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean);
+CREATE POLICY see_extra_perms_user_delete ON kafka_trigger FOR DELETE TO windmill_user
+USING ((extra_perms ->> CONCAT('u/', current_setting('session.user')))::boolean);
+
+CREATE POLICY see_extra_perms_groups_select ON kafka_trigger FOR SELECT TO windmill_user
+USING (extra_perms ?| regexp_split_to_array(current_setting('session.pgroups'), ',')::text[]);
+CREATE POLICY see_extra_perms_groups_insert ON kafka_trigger FOR INSERT TO windmill_user
+WITH CHECK (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms) 
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
+    AND value::boolean));
+CREATE POLICY see_extra_perms_groups_update ON kafka_trigger FOR UPDATE TO windmill_user
+USING (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms) 
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
+    AND value::boolean));
+CREATE POLICY see_extra_perms_groups_delete ON kafka_trigger FOR DELETE  TO windmill_user
+USING (exists(
+    SELECT key, value FROM jsonb_each_text(extra_perms) 
+    WHERE SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
+    AND value::boolean));
@@ -198,6 +198,7 @@ pub enum ResourceOrVariablePath {
 pub struct FileResource {
    pub resource_path: ResourceOrVariablePath,
    pub target_path: String,
+    pub mode: Option<u32>,
 }

 #[derive(Debug, Clone)]
@@ -437,36 +438,65 @@ fn count_consecutive_vs(s: &str) -> usize {

 fn parse_file_resource(yaml: &Yaml) -> anyhow::Result<FileResource> {
    if let Yaml::Hash(f) = yaml {
+        let target_path = f
+            .get(&Yaml::String("target".to_string()))
+            .and_then(|x| x.as_str())
+            .map(|x| x.to_string())
+            .ok_or(anyhow!(
+                "No `target` provided for the file. Please input a target path (only relative paths are allowed) where the ansible playbook can read this file.",
+            ))?;
+
+        let mut mode = None;
+        if let Some(u) = f.get(&Yaml::String("mode".to_string())) {
+            let mode_val: u32 = match u {
+                Yaml::Integer(u) => {
+                    u.clone().try_into().map_err(|e| {
+                        anyhow!(
+                            "Invalid value for `mode` permissions property on targeted file to: {}, err: {e}",
+                            target_path
+                        )
+                    })?
+                }
+                Yaml::String(s) => {
+                    let val = if s.starts_with("0b") {
+                        u32::from_str_radix(&s[2..], 2)
+                    } else if s.starts_with("0o") {
+                        u32::from_str_radix(&s[2..], 8)
+                    } else if s.starts_with("0") {
+                        u32::from_str_radix(&s[1..], 8)
+                    } else {
+                        u32::from_str_radix(s, 8)
+                    };
+
+                    val.map_err(|e| anyhow!("Error parsing permission mode value {s}: {e}"))?
+                }
+                _ => {
+                    return Err(anyhow!("Invalid field in `mode`, expected integer like 0o644"));
+                }
+            };
+            if mode_val <= 0o777 {
+                mode = Some(mode_val);
+            } else {
+                return Err(anyhow!("The provided value for `mode` is too big. Make sure that you are using the octal prefix (0o), e.g. `mode: 0o644`"));
+            }
+        }
+
        if let Some(Yaml::String(resource_path)) = f.get(&Yaml::String("resource".to_string())) {
-            let target_path = f
-                .get(&Yaml::String("target".to_string()))
-                .and_then(|x| x.as_str())
-                .map(|x| x.to_string())
-                .ok_or(anyhow!(
-                    "No `target` provided for file resource {}. Please input a target relative path for the ansible playbook to see this file.",
-                    resource_path
-                ))?;
            return Ok(FileResource {
                resource_path: ResourceOrVariablePath::Resource(resource_path.clone()),
                target_path,
+                mode,
            });
        }
        if let Some(Yaml::String(resource_path)) = f.get(&Yaml::String("variable".to_string())) {
-            let target_path = f
-                .get(&Yaml::String("target".to_string()))
-                .and_then(|x| x.as_str())
-                .map(|x| x.to_string())
-                .ok_or(anyhow!(
-                    "No `target` provided for file resource {}. Please input a target relative path for the ansible playbook to see this file.",
-                    resource_path
-                ))?;
            return Ok(FileResource {
                resource_path: ResourceOrVariablePath::Variable(resource_path.clone()),
                target_path,
+                mode,
            });
        }
        return Err(anyhow!(
-            "File resource should have a `resource` field, linking to a text file resource"
+            "Files should have a `resource` or `variable` field that will be the contents of the local text file"
        ));
    }
    return Err(anyhow!("Invalid file resource: Should be a dictionary."));
@@ -998,13 +998,13 @@ pub async fn run_workers<R: rsmq_async::RsmqConnection + Send + Sync + Clone + '
        LOCK_CACHE_DIR,
        TMP_LOGS_DIR,
        UV_CACHE_DIR,
-        PY311_CACHE_DIR,
-        PIP_CACHE_DIR,
        TAR_PIP_CACHE_DIR,
        DENO_CACHE_DIR,
        DENO_CACHE_DIR_DEPS,
        DENO_CACHE_DIR_NPM,
        BUN_CACHE_DIR,
+        PY311_CACHE_DIR,
+        PIP_CACHE_DIR,
        BUN_DEPSTAR_CACHE_DIR,
        BUN_BUNDLE_CACHE_DIR,
        GO_CACHE_DIR,
@@ -34,12 +34,12 @@ use windmill_common::{
    error,
    flow_status::FlowStatusModule,
    global_settings::{
-        BASE_URL_SETTING, BUNFIG_INSTALL_SCOPES_SETTING, CRITICAL_ERROR_CHANNELS_SETTING,
-        DEFAULT_TAGS_PER_WORKSPACE_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
-        HUB_BASE_URL_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING,
-        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, NPM_CONFIG_REGISTRY_SETTING, OAUTH_SETTING,
-        PIP_INDEX_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING,
+        BASE_URL_SETTING, BUNFIG_INSTALL_SCOPES_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING,
+        CRITICAL_ERROR_CHANNELS_SETTING, DEFAULT_TAGS_PER_WORKSPACE_SETTING,
+        DEFAULT_TAGS_WORKSPACES_SETTING, EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING,
+        EXTRA_PIP_INDEX_URL_SETTING, HUB_BASE_URL_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING,
+        JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, NPM_CONFIG_REGISTRY_SETTING,
+        OAUTH_SETTING, PIP_INDEX_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
        REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
        SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, TIMEOUT_WAIT_RESULT_SETTING,
    },
@@ -54,8 +54,8 @@ use windmill_common::{
        update_min_version, DEFAULT_TAGS_PER_WORKSPACE, DEFAULT_TAGS_WORKSPACES, SMTP_CONFIG,
        WORKER_CONFIG, WORKER_GROUP,
    },
-    BASE_URL, CRITICAL_ERROR_CHANNELS, DB, DEFAULT_HUB_BASE_URL, HUB_BASE_URL, JOB_RETENTION_SECS,
-    METRICS_DEBUG_ENABLED, METRICS_ENABLED, CRITICAL_ALERT_MUTE_UI_ENABLED
+    BASE_URL, CRITICAL_ALERT_MUTE_UI_ENABLED, CRITICAL_ERROR_CHANNELS, DB, DEFAULT_HUB_BASE_URL,
+    HUB_BASE_URL, JOB_RETENTION_SECS, METRICS_DEBUG_ENABLED, METRICS_ENABLED,
 };
 use windmill_queue::cancel_job;
 use windmill_worker::{
@@ -231,13 +231,20 @@ pub async fn load_tag_per_workspace_workspaces(db: &DB) -> error::Result<()> {
 }

 pub async fn reload_critical_alert_mute_ui_setting(db: &DB) -> error::Result<()> {
-    let mute = load_value_from_global_settings(db, CRITICAL_ALERT_MUTE_UI_SETTING).await;
-    match mute {
-        Ok(Some(serde_json::Value::Bool(t))) => {
-            CRITICAL_ALERT_MUTE_UI_ENABLED.store(t, Ordering::Relaxed);
+    if let Ok(Some(serde_json::Value::Bool(t))) =
+        load_value_from_global_settings(db, CRITICAL_ALERT_MUTE_UI_SETTING).await
+    {
+        CRITICAL_ALERT_MUTE_UI_ENABLED.store(t, Ordering::Relaxed);
+
+        if t {
+            if let Err(e) = sqlx::query!("UPDATE alerts SET acknowledged = true")
+                .execute(db)
+                .await
+            {
+                tracing::error!("Error updating alerts: {}", e.to_string());
+            }
        }
-        _ => (),
-    };
+    }
    Ok(())
 }

@@ -1323,7 +1330,7 @@ async fn handle_zombie_jobs<R: rsmq_async::RsmqConnection + Send + Sync + Clone>
                ON CONFLICT (job_id) DO UPDATE SET logs = job_logs.logs || '\nRestarted job after not receiving job''s ping for too long the ' || now() || '\n\n' WHERE job_logs.job_id = $1", r.id)
                .execute(db).await;
            tracing::error!(error_message);
-            report_critical_error(error_message, db.clone()).await;
+            report_critical_error(error_message, db.clone(), Some(&r.workspace_id), None).await;
        }
    }

@@ -1437,7 +1444,7 @@ async fn handle_zombie_flows(
                flow.id, flow.workspace_id
            );
            tracing::error!(error_message);
-            report_critical_error(error_message, db.clone()).await;
+            report_critical_error(error_message, db.clone(), Some(&flow.workspace_id), None).await;
            // if the flow hasn't started and is a zombie, we can simply restart it
            sqlx::query!(
                "UPDATE queue SET running = false, started_at = null WHERE id = $1 AND canceled = false",
@@ -1457,7 +1464,7 @@ async fn handle_zombie_flows(
                    format!("Flow {id} was cancelled because it")
                }
            );
-            report_critical_error(reason.clone(), db.clone()).await;
+            report_critical_error(reason.clone(), db.clone(), Some(&flow.workspace_id), None).await;
            cancel_zombie_flow_job(db, flow, &rsmq, reason).await?;
        }
    }
@@ -19,6 +19,7 @@ parquet = ["dep:datafusion", "dep:object_store", "dep:url", "windmill-common/par
 prometheus = ["windmill-common/prometheus", "windmill-queue/prometheus", "dep:prometheus"]
 openidconnect = ["dep:openidconnect"]
 tantivy = ["dep:windmill-indexer"]
+kafka = ["dep:rdkafka"]

 [dependencies]
 windmill-queue.workspace = true
@@ -96,6 +97,7 @@ url = { workspace = true, optional = true}
 jsonwebtoken = { workspace = true }
 matchit.workspace = true
 tokio-tungstenite.workspace = true
+rdkafka = { workspace = true, optional = true }

 pin-project.workspace = true
 http.workspace = true
@@ -1,7 +1,7 @@
 {
  "openapi": "3.0.3",
  "info": {
-    "version": "1.418.0",
+    "version": "1.423.2",
    "title": "Windmill API",
    "contact": {
      "name": "Windmill Team",
@@ -286,7 +286,7 @@
        }
      }
    },
-    "/w/{workspace}/users/{username}": {
+    "/w/{workspace}/users/get/{username}": {
      "get": {
        "summary": "get user (require admin privilege)",
        "operationId": "getUser",
@@ -436,6 +436,106 @@
        }
      }
    },
+    "/users/set_password_of/{user}": {
+      "post": {
+        "summary": "set password for a specific user (require super admin)",
+        "operationId": "setPasswordForUser",
+        "tags": [
+          "user"
+        ],
+        "parameters": [
+          {
+            "name": "user",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "description": "set password",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "password": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "password"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "password set",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/users/set_login_type/{user}": {
+      "post": {
+        "summary": "set login type for a specific user (require super admin)",
+        "operationId": "setLoginTypeForUser",
+        "tags": [
+          "user"
+        ],
+        "parameters": [
+          {
+            "name": "user",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "description": "set login type",
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "login_type": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "login_type"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "login type set",
+            "content": {
+              "text/plain": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
    "/users/create": {
      "post": {
        "summary": "create user",
@@ -1105,6 +1205,9 @@
                      },
                      "tls_implicit": {
                        "type": "boolean"
+                      },
+                      "disable_tls": {
+                        "type": "boolean"
                      }
                    },
                    "required": [
@@ -1113,7 +1216,8 @@
                      "password",
                      "port",
                      "from",
-                      "tls_implicit"
+                      "tls_implicit",
+                      "disable_tls"
                    ]
                  }
                },
@@ -2460,8 +2564,8 @@
                    "deploy_to": {
                      "type": "string"
                    },
-                    "openai_resource_path": {
-                      "type": "string"
+                    "ai_resource": {
+                      "$ref": "#/components/schemas/AiResource"
                    },
                    "code_completion_enabled": {
                      "type": "boolean"
@@ -2901,8 +3005,8 @@
                  "code_completion_enabled"
                ],
                "properties": {
-                  "openai_resource_path": {
-                    "type": "string"
+                  "ai_resource": {
+                    "$ref": "#/components/schemas/AiResource"
                  },
                  "code_completion_enabled": {
                    "type": "boolean"
@@ -2946,7 +3050,10 @@
                "schema": {
                  "type": "object",
                  "properties": {
-                    "exists_openai_resource_path": {
+                    "ai_provider": {
+                      "type": "string"
+                    },
+                    "exists_ai_resource": {
                      "type": "boolean"
                    },
                    "code_completion_enabled": {
@@ -2954,7 +3061,8 @@
                    }
                  },
                  "required": [
-                    "exists_openai_resource_path",
+                    "ai_provider",
+                    "exists_ai_resource",
                    "code_completion_enabled"
                  ]
                }
@@ -13160,6 +13268,30 @@
        }
      }
    },
+    "/workers/queue_counts": {
+      "get": {
+        "summary": "get counts of jobs waiting for an executor per tag",
+        "operationId": "getCountsOfJobsWaitingPerTag",
+        "tags": [
+          "worker"
+        ],
+        "responses": {
+          "200": {
+            "description": "queue counts",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "additionalProperties": {
+                    "type": "integer"
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
    "/configs/list_worker_groups": {
      "get": {
        "summary": "list worker groups",
@@ -14810,6 +14942,20 @@
            "schema": {
              "type": "string"
            }
+          },
+          {
+            "name": "content_type",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "content_disposition",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
          }
        ],
        "requestBody": {
@@ -16116,6 +16262,21 @@
      }
    },
    "schemas": {
+      "AiResource": {
+        "type": "object",
+        "properties": {
+          "path": {
+            "type": "string"
+          },
+          "provider": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "path",
+          "provider"
+        ]
+      },
      "Script": {
        "type": "object",
        "properties": {
@@ -17226,7 +17387,7 @@
              "jobs.disapproval",
              "jobs.delete",
              "account.delete",
-              "openai.request",
+              "ai.request",
              "resources.create",
              "resources.update",
              "resources.delete",
@@ -18067,6 +18228,23 @@
          "route_path": {
            "type": "string"
          },
+          "static_asset_config": {
+            "type": "object",
+            "properties": {
+              "s3": {
+                "type": "string"
+              },
+              "storage": {
+                "type": "string"
+              },
+              "filename": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "s3"
+            ]
+          },
          "is_flow": {
            "type": "boolean"
          },
@@ -18126,6 +18304,23 @@
          "route_path": {
            "type": "string"
          },
+          "static_asset_config": {
+            "type": "object",
+            "properties": {
+              "s3": {
+                "type": "string"
+              },
+              "storage": {
+                "type": "string"
+              },
+              "filename": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "s3"
+            ]
+          },
          "is_flow": {
            "type": "boolean"
          },
@@ -18168,6 +18363,23 @@
          "route_path": {
            "type": "string"
          },
+          "static_asset_config": {
+            "type": "object",
+            "properties": {
+              "s3": {
+                "type": "string"
+              },
+              "storage": {
+                "type": "string"
+              },
+              "filename": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "s3"
+            ]
+          },
          "is_flow": {
            "type": "boolean"
          },
@@ -18917,6 +19129,12 @@
              "type": "object"
            }
          },
+          "s3_inputs": {
+            "type": "array",
+            "items": {
+              "type": "object"
+            }
+          },
          "execution_mode": {
            "type": "string",
            "enum": [
@@ -1,7 +1,7 @@
 openapi: "3.0.3"

 info:
-  version: 1.423.2
+  version: 1.426.0
  title: Windmill API

  contact:
@@ -1681,8 +1681,8 @@ paths:
                    type: string
                  deploy_to:
                    type: string
-                  openai_resource_path:
-                    type: string
+                  ai_resource:
+                    $ref: "#/components/schemas/AiResource"
                  code_completion_enabled:
                    type: boolean
                  error_handler:
@@ -1701,6 +1701,8 @@ paths:
                    type: string
                  default_scripts:
                    $ref: "#/components/schemas/WorkspaceDefaultScripts"
+                  mute_critical_alerts:
+                    type: boolean
                required:
                  - code_completion_enabled
                  - automatic_billing
@@ -1966,8 +1968,8 @@ paths:
              required:
                - code_completion_enabled
              properties:
-                openai_resource_path:
-                  type: string
+                ai_resource:
+                  $ref: "#/components/schemas/AiResource"
                code_completion_enabled:
                  type: boolean
      responses:
@@ -1995,12 +1997,15 @@ paths:
              schema:
                type: object
                properties:
-                  exists_openai_resource_path:
+                  ai_provider:
+                    type: string
+                  exists_ai_resource:
                    type: boolean
                  code_completion_enabled:
                    type: boolean
                required:
-                  - exists_openai_resource_path
+                  - ai_provider
+                  - exists_ai_resource
                  - code_completion_enabled

  /w/{workspace}/workspaces/edit_error_handler:
@@ -2327,9 +2332,12 @@ paths:
                    type: boolean
                  websocket_used:
                    type: boolean
+                  kafka_used:
+                    type: boolean
                required:
                  - http_routes_used
                  - websocket_used
+                  - kafka_used

  /w/{workspace}/users/list:
    get:
@@ -2714,6 +2722,112 @@ paths:
                items:
                  $ref: "#/components/schemas/ContextualVariable"

+  /w/{workspace}/workspaces/critical_alerts:
+    get:
+      summary: Get all critical alerts for this workspace
+      operationId: workspaceGetCriticalAlerts
+      tags:
+        - setting
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - in: query
+          name: page
+          schema:
+            type: integer
+            default: 1
+            description: The page number to retrieve (minimum value is 1)
+        - in: query
+          name: page_size
+          schema:
+            type: integer
+            default: 10
+            maximum: 100
+            description: Number of alerts per page (maximum is 100)
+        - in: query
+          name: acknowledged
+          schema:
+            type: boolean
+            nullable: true
+            description: Filter by acknowledgment status; true for acknowledged, false for unacknowledged, and omit for all alerts
+      responses:
+        "200":
+          description: Successfully retrieved all critical alerts
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: '#/components/schemas/CriticalAlert'
+
+  /w/{workspace}/workspaces/critical_alerts/{id}/acknowledge:
+    post:
+      summary: Acknowledge a critical alert for this workspace
+      operationId: workspaceAcknowledgeCriticalAlert
+      tags:
+        - setting
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - in: path
+          name: id
+          required: true
+          schema:
+            type: integer
+          description: The ID of the critical alert to acknowledge
+      responses:
+        "200":
+          description: Successfully acknowledged the critical alert
+          content:
+            application/json:
+              schema:
+                type: string
+                example: "Critical alert acknowledged"
+
+  /w/{workspace}/workspaces/critical_alerts/acknowledge_all:
+    post:
+      summary: Acknowledge all unacknowledged critical alerts for this workspace
+      operationId: workspaceAcknowledgeAllCriticalAlerts
+      tags:
+        - setting
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      responses:
+        "200":
+          description: Successfully acknowledged all unacknowledged critical alerts.
+          content:
+            application/json:
+              schema:
+                type: string
+                example: "All unacknowledged critical alerts acknowledged"
+
+  /w/{workspace}/workspaces/critical_alerts/mute:
+    post:
+      summary: Mute critical alert UI for this workspace
+      operationId: workspaceMuteCriticalAlertsUI
+      tags:
+        - setting
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: Boolean flag to mute critical alerts.
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                mute_critical_alerts:
+                  type: boolean
+                  description: Whether critical alerts should be muted.
+                  example: true
+      responses:
+        '200':
+          description: Successfully updated mute critical alert settings.
+          content:
+            application/json:
+              schema:
+                type: string
+                example: "Updated mute critical alert UI settings for workspace: workspace_id"
+
  /oauth/login_callback/{client_name}:
    post:
      security: []
@@ -6051,6 +6165,39 @@ paths:
                required:
                  - database_length

+  /w/{workspace}/jobs/completed/count_jobs:
+    get:
+      summary: count number of completed jobs with filter
+      operationId: countCompletedJobs
+      tags:
+        - job
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - name: completed_after_s_ago
+          in: query
+          schema:
+            type: integer
+        - name: success
+          in: query
+          schema:
+            type: boolean
+        - name: tags
+          in: query
+          schema:
+            type: string
+        - name: all_workspaces
+          in: query
+          schema:
+            type: boolean
+      responses:
+        "200":
+          description: Count of completed jobs
+          content:
+            application/json:
+              schema:
+                type: integer
+
+
  /w/{workspace}/jobs/queue/list_filtered_uuids:
    get:
      summary: get the ids of all jobs matching the given filters
@@ -7541,6 +7688,169 @@ paths:
              schema:
                type: string

+  /w/{workspace}/kafka_triggers/create:
+    post:
+      summary: create kafka trigger
+      operationId: createKafkaTrigger
+      tags:
+        - kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+      requestBody:
+        description: new kafka trigger
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NewKafkaTrigger"
+      responses:
+        "201":
+          description: kafka trigger created
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/kafka_triggers/update/{path}:
+    post:
+      summary: update kafka trigger
+      operationId: updateKafkaTrigger
+      tags:
+        - kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        description: updated trigger
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/EditKafkaTrigger"
+      responses:
+        "200":
+          description: kafka trigger updated
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/kafka_triggers/delete/{path}:
+    delete:
+      summary: delete kafka trigger
+      operationId: deleteKafkaTrigger
+      tags:
+        -  kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: kafka trigger deleted
+          content:
+            text/plain:
+              schema:
+                type: string
+
+  /w/{workspace}/kafka_triggers/get/{path}:
+    get:
+      summary: get kafka trigger
+      operationId: getKafkaTrigger
+      tags:
+        - kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: kafka trigger deleted
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/KafkaTrigger"
+
+  
+  /w/{workspace}/kafka_triggers/list:
+    get:
+      summary: list kafka triggers
+      operationId: listKafkaTriggers
+      tags:
+        - kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+          required: true
+        - $ref: "#/components/parameters/Page"
+        - $ref: "#/components/parameters/PerPage"
+        - name: path
+          description: filter by path
+          in: query
+          schema:
+            type: string
+        - name: is_flow
+          in: query
+          schema:
+            type: boolean
+        - name: path_start
+          in: query
+          schema:
+            type: string
+      responses:
+        "200":
+          description: kafka trigger list
+          content:
+            application/json:
+              schema:
+                type: array
+                items:
+                  $ref: "#/components/schemas/KafkaTrigger"
+
+  
+  /w/{workspace}/kafka_triggers/exists/{path}:
+    get:
+      summary: does kafka trigger exists
+      operationId: existsKafkaTrigger
+      tags:
+        - kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      responses:
+        "200":
+          description: kafka trigger exists
+          content:
+            application/json:
+              schema:
+                type: boolean
+
+  /w/{workspace}/kafka_triggers/setenabled/{path}:
+    post:
+      summary: set enabled kafka trigger
+      operationId: setKafkaTriggerEnabled
+      tags:
+        - kafka_trigger
+      parameters:
+        - $ref: "#/components/parameters/WorkspaceId"
+        - $ref: "#/components/parameters/Path"
+      requestBody:
+        description: updated kafka trigger enable
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                enabled:
+                  type: boolean
+              required:
+                - enabled
+      responses:
+        "200":
+          description: kafka trigger enabled set
+          content:
+            text/plain:
+              schema:
+                type: string
+

  /groups/list:
    get:
@@ -8410,6 +8720,7 @@ paths:
                raw_app,
                http_trigger,
                websocket_trigger,
+                kafka_trigger,
              ]
      responses:
        "200":
@@ -8448,6 +8759,7 @@ paths:
                raw_app,
                http_trigger,
                websocket_trigger,
+                kafka_trigger,
              ]
      requestBody:
        description: acl to add
@@ -8497,6 +8809,7 @@ paths:
                raw_app,
                http_trigger,
                websocket_trigger,
+                kafka_trigger,
              ]
      requestBody:
        description: acl to add
@@ -10194,6 +10507,16 @@ components:
  schemas:
    $ref: "../../openflow.openapi.yaml#/components/schemas"

+    AiResource:
+      type: object
+      properties:
+        path:
+          type: string
+        provider:
+          type: string
+      required:
+        - path
+        - provider
    Script:
      type: object
      properties:
@@ -11012,7 +11335,7 @@ components:
            - "jobs.disapproval"
            - "jobs.delete"
            - "account.delete"
-            - "openai.request"
+            - "ai.request"
            - "resources.create"
            - "resources.update"
            - "resources.delete"
@@ -11778,6 +12101,8 @@ components:
          type: number
        websocket_count:
          type: number
+        kafka_count:
+          type: number

    WebsocketTrigger:
      type: object
@@ -11949,6 +12274,114 @@ components:
          required: 
            - runnable_result

+    KafkaTrigger:
+      type: object
+      properties:
+        path:
+          type: string
+        edited_by:
+          type: string
+        edited_at:
+          type: string
+          format: date-time
+        script_path:
+          type: string
+        kafka_resource_path:
+          type: string
+        group_id:
+          type: string
+        topics:
+          type: array
+          items:
+            type: string
+        is_flow:
+          type: boolean
+        extra_perms:
+          type: object
+          additionalProperties:
+            type: boolean
+        email:
+          type: string
+        workspace_id:
+          type: string
+        server_id:
+          type: string
+        last_server_ping:
+          type: string
+          format: date-time
+        error:
+          type: string
+        enabled:
+          type: boolean
+        
+      required:
+        - path
+        - edited_by
+        - edited_at
+        - script_path
+        - kafka_resource_path
+        - group_id
+        - topics
+        - extra_perms
+        - is_flow
+        - email
+        - workspace_id
+        - enabled
+
+    NewKafkaTrigger:
+      type: object
+      properties:
+        path:
+          type: string
+        script_path:
+          type: string
+        is_flow:
+          type: boolean
+        kafka_resource_path:
+          type: string
+        group_id:
+          type: string
+        topics:
+          type: array
+          items:
+            type: string
+        enabled:
+          type: boolean
+        
+      required:
+        - path
+        - script_path
+        - is_flow
+        - kafka_resource_path
+        - group_id
+        - topics
+
+    EditKafkaTrigger:
+      type: object
+      properties:
+        kafka_resource_path:
+          type: string
+        group_id:
+          type: string
+        topics:
+          type: array
+          items:
+            type: string
+        path:
+          type: string
+        script_path:
+          type: string
+        is_flow:
+          type: boolean
+              
+      required:
+        - path
+        - script_path
+        - kafka_resource_path
+        - group_id
+        - topics
+        - is_flow
+
    Group:
      type: object
      properties:
@@ -12899,3 +13332,7 @@ components:
          type: boolean
          nullable: true
          description: Acknowledgment status of the alert, can be true, false, or null if not set
+        workspace_id:
+          type: string
+          nullable: true
+          description: Workspace id if the alert is in the scope of a workspace
@@ -0,0 +1,507 @@
+use crate::{
+    db::{ApiAuthed, DB},
+    variables::decrypt,
+};
+use anthropic::AnthropicCache;
+use axum::{
+    body::Bytes,
+    extract::{Path, Query},
+    response::IntoResponse,
+    routing::post,
+    Extension, Router,
+};
+use lazy_static::lazy_static;
+use mistral::MistralCache;
+use openai::OpenaiCache;
+use quick_cache::sync::Cache;
+use reqwest::{Client, RequestBuilder};
+use serde::{Deserialize, Deserializer};
+use windmill_audit::audit_ee::audit_log;
+use windmill_audit::ActionKind;
+use windmill_common::error::{to_anyhow, Result};
+use windmill_common::variables::build_crypt;
+
+use windmill_common::error::Error;
+
+use serde_json::value::{RawValue, Value};
+use std::collections::HashMap;
+
+lazy_static::lazy_static! {
+    static ref HTTP_CLIENT: Client = reqwest::ClientBuilder::new()
+        .timeout(std::time::Duration::from_secs(60 * 5))
+        .user_agent("windmill/beta")
+        .build().unwrap();
+}
+
+trait AiRequest {
+    fn prepare_request(self, path: &str, body: Bytes) -> Result<RequestBuilder>;
+}
+
+mod openai {
+    use super::*;
+
+    use super::{get_variable_or_self, KeyCache};
+
+    const API_VERSION: &str = "2023-05-15";
+
+    #[derive(Deserialize, Debug)]
+    struct OpenaiResource {
+        api_key: String,
+        organization_id: Option<String>,
+    }
+
+    #[derive(Deserialize, Debug)]
+    struct OpenaiClientCredentialsOauthResource {
+        client_id: String,
+        client_secret: String,
+        token_url: String,
+        user: Option<String>,
+    }
+
+    #[derive(Deserialize, Debug)]
+    #[serde(untagged, rename_all = "snake_case")]
+    enum OpenaiConfig {
+        Resource(OpenaiResource),
+        ClientCredentialsOauthResource(OpenaiClientCredentialsOauthResource),
+    }
+
+    lazy_static::lazy_static! {
+        pub static ref OPENAI_AZURE_BASE_PATH: Option<String> = std::env::var("OPENAI_AZURE_BASE_PATH").ok();
+    }
+
+    #[derive(Deserialize, Debug)]
+    struct OpenaiCredentials {
+        access_token: String,
+    }
+
+    #[derive(Clone, Debug, Deserialize)]
+    pub struct OpenaiCache {
+        api_key: String,
+        organization_id: Option<String>,
+        azure_base_path: Option<String>,
+        user: Option<String>,
+    }
+
+    impl OpenaiCache {
+        pub fn new(
+            api_key: String,
+            organization_id: Option<String>,
+            azure_base_path: Option<String>,
+            user: Option<String>,
+        ) -> Self {
+            Self { api_key, organization_id, azure_base_path, user }
+        }
+    }
+
+    const BASE_URL: &str = "https://api.openai.com/v1";
+    impl AiRequest for OpenaiCache {
+        fn prepare_request(self, openai_path: &str, mut body: Bytes) -> Result<RequestBuilder> {
+            let OpenaiCache { api_key, azure_base_path, organization_id, user } = self;
+            if user.is_some() {
+                tracing::debug!("Adding user to request body");
+                let mut json_body: HashMap<String, Box<RawValue>> = serde_json::from_slice(&body)
+                    .map_err(|e| {
+                    Error::InternalErr(format!("Failed to parse request body: {}", e))
+                })?;
+
+                let user_json_string = serde_json::Value::String(user.unwrap()).to_string(); // makes sure to escape characters
+
+                json_body.insert(
+                    "user".to_string(),
+                    RawValue::from_string(user_json_string)
+                        .map_err(|e| Error::InternalErr(format!("Failed to parse user: {}", e)))?,
+                );
+
+                body = serde_json::to_vec(&json_body)
+                    .map_err(|e| {
+                        Error::InternalErr(format!("Failed to reserialize request body: {}", e))
+                    })?
+                    .into();
+            }
+
+            let base_url = if let Some(base_url) = azure_base_path {
+                base_url
+            } else {
+                BASE_URL.to_string()
+            };
+            let url = format!("{}/{}", base_url, openai_path);
+            let mut request = HTTP_CLIENT
+                .post(url)
+                .header("content-type", "application/json")
+                .body(body);
+
+            if base_url != BASE_URL {
+                request = request
+                    .header("api-key", api_key)
+                    .query(&[("api-version", API_VERSION)])
+            } else {
+                request = request.header("authorization", format!("Bearer {}", api_key))
+            }
+
+            if let Some(org_id) = organization_id {
+                request = request.header("OpenAI-Organization", org_id);
+            }
+
+            Ok(request)
+        }
+    }
+
+    async fn get_openai_key_using_credentials_flow(
+        mut resource: OpenaiClientCredentialsOauthResource,
+        db: &DB,
+        w_id: &str,
+    ) -> Result<String> {
+        resource.client_id = get_variable_or_self(resource.client_id, db, w_id).await?;
+        resource.client_secret = get_variable_or_self(resource.client_secret, db, w_id).await?;
+        resource.token_url = get_variable_or_self(resource.token_url, db, w_id).await?;
+        let mut params = HashMap::new();
+        params.insert("grant_type", "client_credentials");
+        let response = HTTP_CLIENT
+            .post(resource.token_url)
+            .form(&params)
+            .basic_auth(resource.client_id, Some(resource.client_secret))
+            .send()
+            .await
+            .map_err(|err| {
+                Error::InternalErr(format!(
+                    "Failed to get OpenAI credentials using credentials flow: {}",
+                    err
+                ))
+            })?;
+        let response = response.json::<OpenaiCredentials>().await.map_err(|err| {
+            Error::InternalErr(format!(
+                "Failed to parse OpenAI credentials from credentials flow: {}",
+                err
+            ))
+        })?;
+        Ok(response.access_token)
+    }
+
+    pub async fn get_cached_value(db: &DB, w_id: &str, resource: Value) -> Result<KeyCache> {
+        let config = serde_json::from_value(resource)
+            .map_err(|e| Error::InternalErr(format!("validating openai resource {e:#}")))?;
+
+        let mut user = None::<String>;
+        let mut resource = match config {
+            OpenaiConfig::Resource(resource) => {
+                tracing::debug!("Getting OpenAI key from static resource");
+                resource
+            }
+            OpenaiConfig::ClientCredentialsOauthResource(resource) => {
+                tracing::debug!("Getting OpenAI key with client credentials flow");
+                user = resource.user.clone();
+                let token = get_openai_key_using_credentials_flow(resource, db, w_id).await?;
+                OpenaiResource { api_key: token, organization_id: None }
+            }
+        };
+
+        resource.api_key = get_variable_or_self(resource.api_key, db, w_id).await?;
+
+        if let Some(organization_id) = resource.organization_id {
+            resource.organization_id = Some(get_variable_or_self(organization_id, db, w_id).await?);
+        }
+
+        if user.is_some() {
+            user = Some(get_variable_or_self(user.unwrap(), db, w_id).await?);
+        }
+
+        let azure_base_path = sqlx::query_scalar!(
+            "SELECT value
+            FROM global_settings
+            WHERE name = 'openai_azure_base_path'",
+        )
+        .fetch_optional(db)
+        .await?;
+
+        let azure_base_path = if let Some(azure_base_path) = azure_base_path {
+            Some(
+                serde_json::from_value::<String>(azure_base_path).map_err(|e| {
+                    Error::InternalErr(format!("validating openai azure base path {e:#}"))
+                })?,
+            )
+        } else {
+            OPENAI_AZURE_BASE_PATH.clone()
+        };
+
+        let workspace_cache = OpenaiCache::new(
+            resource.api_key.clone(),
+            resource.organization_id.clone(),
+            azure_base_path.clone(),
+            user.clone(),
+        );
+        Ok(KeyCache::Openai(workspace_cache))
+    }
+}
+
+mod anthropic {
+
+    use super::*;
+
+    #[derive(Clone, Deserialize, Debug)]
+    pub struct AnthropicCache {
+        #[serde(rename = "apiKey")]
+        pub api_key: String,
+    }
+
+    const API_VERSION: &str = "2023-06-01";
+
+    impl AnthropicCache {
+        pub fn new(api_key: String) -> Self {
+            Self { api_key }
+        }
+    }
+
+    const BASE_URL: &str = "https://api.anthropic.com";
+    impl AiRequest for AnthropicCache {
+        fn prepare_request(self, anthropic_path: &str, body: Bytes) -> Result<RequestBuilder> {
+            let AnthropicCache { api_key } = self;
+            let url = format!("{}/{}", BASE_URL, anthropic_path);
+            let request = HTTP_CLIENT
+                .post(url)
+                .header("x-api-key", api_key)
+                .header("anthropic-version", API_VERSION)
+                .header("content-type", "application/json")
+                .body(body);
+            Ok(request)
+        }
+    }
+
+    pub async fn get_cached_value(db: &DB, w_id: &str, resource: Value) -> Result<KeyCache> {
+        let mut resource: AnthropicCache = serde_json::from_value(resource)
+            .map_err(|e| Error::InternalErr(format!("validating anthropic resource {e:#}")))?;
+        resource.api_key = get_variable_or_self(resource.api_key, db, w_id).await?;
+        let workspace_cache = AnthropicCache::new(resource.api_key);
+        Ok(KeyCache::Anthropic(workspace_cache))
+    }
+}
+
+mod mistral {
+    use super::*;
+    #[derive(Deserialize, Clone, Debug)]
+    pub struct MistralCache {
+        #[serde(rename = "apiKey")]
+        pub api_key: String,
+    }
+
+    impl MistralCache {
+        pub fn new(api_key: String) -> Self {
+            Self { api_key }
+        }
+    }
+
+    const BASE_URL: &str = "https://api.mistral.ai";
+    impl AiRequest for MistralCache {
+        fn prepare_request(self, mistral_path: &str, body: Bytes) -> Result<RequestBuilder> {
+            let MistralCache { api_key } = self;
+
+            let url = format!("{}/{}", BASE_URL, mistral_path);
+            let request = HTTP_CLIENT
+                .post(url)
+                .header("content-type", "application/json")
+                .header("Accept", "application/json")
+                .header("authorization", format!("Bearer {}", api_key))
+                .body(body);
+            Ok(request)
+        }
+    }
+
+    pub async fn get_cached_value(db: &DB, w_id: &str, resource: Value) -> Result<KeyCache> {
+        let mut resource: MistralCache = serde_json::from_value(resource)
+            .map_err(|e| Error::InternalErr(format!("validating mistral resource {e:#}")))?;
+        resource.api_key = get_variable_or_self(resource.api_key, db, w_id).await?;
+
+        let workspace_cache = MistralCache::new(resource.api_key);
+        Ok(KeyCache::Mistral(workspace_cache))
+    }
+}
+
+#[derive(Clone, Debug)]
+pub enum KeyCache {
+    Openai(OpenaiCache),
+    Anthropic(AnthropicCache),
+    Mistral(MistralCache),
+}
+
+#[derive(Clone, Debug)]
+pub struct AiCache {
+    pub path: String,
+    pub cached_key: KeyCache,
+    pub expires_at: std::time::Instant,
+}
+
+impl AiCache {
+    pub fn new(path: String, cached_key: KeyCache) -> Self {
+        Self {
+            path,
+            cached_key,
+            expires_at: std::time::Instant::now() + std::time::Duration::from_secs(60),
+        }
+    }
+    fn is_expired(&self) -> bool {
+        self.expires_at < std::time::Instant::now()
+    }
+}
+
+lazy_static! {
+    pub static ref AI_KEY_CACHE: Cache<String, AiCache> = Cache::new(500);
+}
+
+struct Variable {
+    value: String,
+    is_secret: bool,
+}
+
+#[derive(Deserialize, Debug)]
+struct ProxyQueryParams {
+    no_cache: Option<bool>,
+}
+
+async fn get_variable_or_self(path: String, db: &DB, w_id: &str) -> Result<String> {
+    if !path.starts_with("$var:") {
+        return Ok(path);
+    }
+    let path = path.strip_prefix("$var:").unwrap().to_string();
+    let mut variable = sqlx::query_as!(
+        Variable,
+        "SELECT value, is_secret
+        FROM variable
+        WHERE path = $1 AND workspace_id = $2",
+        &path,
+        &w_id
+    )
+    .fetch_one(db)
+    .await?;
+    if variable.is_secret {
+        let mc = build_crypt(db, w_id).await?;
+        variable.value = decrypt(&mc, variable.value)?;
+    }
+    Ok(variable.value)
+}
+
+#[derive(Deserialize, Debug)]
+pub struct AiResource {
+    pub path: String,
+    #[serde(deserialize_with = "check_if_valid_ai_provider")]
+    pub provider: String,
+}
+
+fn check_if_valid_ai_provider<'de, D>(provider: D) -> std::result::Result<String, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let provider = String::deserialize(provider)?;
+    match provider.as_str() {
+        "anthropic" | "openai" | "mistral" => Ok(provider),
+        _ => Err(serde::de::Error::custom(
+            "Only the following Ai providers are supported: openai, anthropic and mistral"
+                .to_string(),
+        )),
+    }
+}
+
+pub fn workspaced_service() -> Router {
+    let router = Router::new().route("/proxy/*ai", post(proxy));
+
+    router
+}
+
+async fn proxy(
+    authed: ApiAuthed,
+    Extension(db): Extension<DB>,
+    Path((w_id, ai_path)): Path<(String, String)>,
+    Query(query_params): Query<ProxyQueryParams>,
+    body: Bytes,
+) -> impl IntoResponse {
+    let workspace_cache = AI_KEY_CACHE.get(&w_id);
+    let ai_cache = match workspace_cache {
+        Some(cache) if !cache.is_expired() && !query_params.no_cache.unwrap_or(false) => {
+            cache.cached_key
+        }
+        _ => {
+            let ai_resource = sqlx::query_scalar!(
+                "SELECT ai_resource FROM workspace_settings WHERE workspace_id = $1",
+                &w_id
+            )
+            .fetch_one(&db)
+            .await?;
+
+            if ai_resource.is_none() {
+                return Err(Error::InternalErr("AI resource not configured".to_string()));
+            }
+
+            let ai_resource = serde_json::from_value::<AiResource>(ai_resource.unwrap())
+                .map_err(|e| Error::BadRequest(e.to_string()))?;
+            let ai_resource_path = ai_resource.path;
+
+            let resource = sqlx::query_scalar!(
+                "SELECT value
+                FROM resource
+                WHERE path = $1 AND workspace_id = $2",
+                &ai_resource_path,
+                &w_id
+            )
+            .fetch_optional(&db)
+            .await?
+            .ok_or_else(|| {
+                Error::InternalErr(format!(
+                    "Could not find the {} resource at path {ai_resource_path}, update the resource path in the workspace settings", ai_resource.provider
+                ))
+            })?;
+
+            if resource.is_none() {
+                return Err(Error::InternalErr(format!(
+                    "{} resource missing value",
+                    ai_resource.provider
+                )));
+            }
+
+            let resource = resource.unwrap();
+
+            let ai_cache = match ai_resource.provider.as_str() {
+                "openai" => openai::get_cached_value(&db, &w_id, resource).await,
+                "anthropic" => anthropic::get_cached_value(&db, &w_id, resource).await,
+                "mistral" => mistral::get_cached_value(&db, &w_id, resource).await,
+                provider => {
+                    return Err(Error::BadRequest(format!("{} is not supported", provider)))
+                }
+            };
+            let ai_cache = ai_cache?;
+            AI_KEY_CACHE.insert(
+                w_id.clone(),
+                AiCache::new(ai_resource_path, ai_cache.clone()),
+            );
+            ai_cache
+        }
+    };
+    let (path, request) = match ai_cache {
+        KeyCache::Openai(cached) => ("openai_path", cached.prepare_request(&ai_path, body)),
+        KeyCache::Anthropic(cached) => ("anthropic_path", cached.prepare_request(&ai_path, body)),
+        KeyCache::Mistral(cached) => ("mistral_path", cached.prepare_request(&ai_path, body)),
+    };
+
+    let response = request?.send().await.map_err(to_anyhow)?;
+
+    let mut tx = db.begin().await?;
+
+    audit_log(
+        &mut *tx,
+        &authed,
+        "ai.request",
+        ActionKind::Execute,
+        &w_id,
+        Some(&authed.email),
+        Some([(path, &format!("{:?}", ai_path)[..])].into()),
+    )
+    .await?;
+    tx.commit().await?;
+
+    if response.error_for_status_ref().is_err() {
+        let err_msg = response.text().await.unwrap_or("".to_string());
+        return Err(Error::AiError(err_msg));
+    }
+
+    let status_code = response.status();
+    let headers = response.headers().clone();
+    let stream = response.bytes_stream();
+    Ok((status_code, headers, axum::body::Body::from_stream(stream)))
+}
@@ -8,11 +8,6 @@ use std::collections::HashMap;
 * LICENSE-AGPL for a copy of the license.
 */

-#[cfg(feature = "parquet")]
-use crate::{job_helpers_ee::{
-    get_random_file_name, get_s3_resource, get_workspace_s3_resource, upload_file_internal,
-    UploadFileResponse,
-}, users::fetch_api_authed_from_permissioned_as};
 use crate::{
    db::{ApiAuthed, DB},
    resources::get_resource_value_interpolated_internal,
@@ -22,6 +17,14 @@ use crate::{
    webhook_util::{WebhookMessage, WebhookShared},
    HTTP_CLIENT,
 };
+#[cfg(feature = "parquet")]
+use crate::{
+    job_helpers_ee::{
+        get_random_file_name, get_s3_resource, get_workspace_s3_resource, upload_file_internal,
+        UploadFileResponse,
+    },
+    users::fetch_api_authed_from_permissioned_as,
+};
 use axum::{
    extract::{Extension, Json, Path, Query},
    response::IntoResponse,
@@ -1288,7 +1291,6 @@ async fn upload_s3_file_from_app() -> Result<()> {
    ));
 }

-
 #[cfg(feature = "parquet")]
 #[derive(Debug, Deserialize, Clone)]
 struct UploadFileToS3Query {
@@ -1353,9 +1355,14 @@ async fn upload_s3_file_from_app(
        let (username, permissioned_as, email) =
            get_on_behalf_details_from_policy_and_authed(&policy, &opt_authed).await?;

-        let on_behalf_authed =
-            fetch_api_authed_from_permissioned_as(permissioned_as, email, &w_id, &db, username)
-                .await?;
+        let on_behalf_authed = fetch_api_authed_from_permissioned_as(
+            permissioned_as,
+            email,
+            &w_id,
+            &db,
+            Some(username),
+        )
+        .await?;

        if let Some(file_key) = query.file_key {
            // file key is provided => requires workspace, user or list policy and must match the regex
@@ -23,7 +23,7 @@ use windmill_common::{
    utils::{not_found_if_none, StripPath},
 };

-const KINDS: [&str; 10] = [
+const KINDS: [&str; 12] = [
    "script",
    "group_",
    "resource",
@@ -34,6 +34,8 @@ const KINDS: [&str; 10] = [
    "app",
    "raw_app",
    "http_trigger",
+    "websocket_trigger",
+    "kafka_trigger",
 ];

 pub fn workspaced_service() -> Router {
@@ -507,7 +507,7 @@ async fn get_http_route_trigger(
        trigger.email.clone(),
        &trigger.workspace_id,
        &db,
-        username_override.unwrap_or("anonymous".to_string()),
+        Some(username_override.unwrap_or("anonymous".to_string())),
    )
    .await?;

@@ -206,6 +206,7 @@ pub fn workspaced_service() -> Router {
        .route("/queue/list_filtered_uuids", get(list_filtered_uuids))
        .route("/queue/cancel_selection", post(cancel_selection))
        .route("/completed/count", get(count_completed_jobs))
+        .route("/completed/count_jobs", get(count_completed_jobs_detail))
        .route(
            "/completed/list",
            get(list_completed_jobs).layer(cors.clone()),
@@ -949,7 +950,7 @@ async fn get_job_logs(
        Ok(content_plain(Body::from(logs)))
    } else {
        let text = sqlx::query!(
-            "SELECT created_by, CONCAT(coalesce(queue.logs, ''), coalesce(job_logs.logs, '')) as logs, job_logs.log_offset, job_logs.log_file_index
+            "SELECT created_by, CONCAT(coalesce(queue.logs, ''), coalesce(job_logs.logs, '')) as logs, coalesce(job_logs.log_offset, 0) as log_offset, job_logs.log_file_index
            FROM queue 
            LEFT JOIN job_logs ON job_logs.job_id = queue.id 
            WHERE queue.id = $1 AND queue.workspace_id = $2",
@@ -970,10 +971,10 @@ async fn get_job_logs(
        log_job_view(&db, opt_authed.as_ref(), &w_id, &id).await?;

        #[cfg(all(feature = "enterprise", feature = "parquet"))]
-        if let Some(r) = get_logs_from_store(text.log_offset, &logs, &text.log_file_index).await {
+        if let Some(r) = get_logs_from_store(text.log_offset.unwrap_or(0), &logs, &text.log_file_index).await {
            return r.map(content_plain);
        }
-        if let Some(r) = get_logs_from_disk(text.log_offset, &logs, &text.log_file_index).await {
+        if let Some(r) = get_logs_from_disk(text.log_offset.unwrap_or(0), &logs, &text.log_file_index).await {
            return r.map(content_plain);
        }

@@ -1592,6 +1593,50 @@ async fn count_queue_jobs(
    ))
 }

+#[derive(Deserialize)]
+pub struct CountCompletedJobsQuery {
+    completed_after_s_ago: Option<i64>,
+    success: Option<bool>,
+    tags: Option<String>,
+    all_workspaces: Option<bool>,
+}
+
+async fn count_completed_jobs_detail(
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    Query(query): Query<CountCompletedJobsQuery>,
+) -> error::JsonResult<i64> {
+    let mut sqlb = SqlBuilder::select_from("completed_job");
+    sqlb
+        .field("COUNT(*) as count");
+
+    if !query.all_workspaces.unwrap_or(false) {
+        sqlb.and_where_eq("workspace_id", "?".bind(&w_id));
+    }
+
+    if let Some(after_s_ago) = query.completed_after_s_ago {
+        let after = Utc::now() - chrono::Duration::seconds(after_s_ago);
+        sqlb.and_where_gt("started_at + duration_ms / 1000 * interval '1 second'", "?".bind(&after.to_rfc3339()));
+    }
+
+    if let Some(success) = query.success {
+        sqlb.and_where_eq("success", "?".bind(&success));
+    }
+
+    if let Some(tags) = query.tags {
+        sqlb.and_where_in("tag", &tags.split(",").map(|t| format!("'{}'", t)).collect::<Vec<_>>());
+    }
+
+    let sql = sqlb.sql()?;
+    let stats = sqlx::query_scalar::<_, i64>(&sql)
+        .fetch_one(&db)
+        .await?;
+
+    Ok(Json(stats))
+}
+
+
+
 async fn count_completed_jobs(
    Extension(db): Extension<DB>,
    Path(w_id): Path<String>,
@@ -0,0 +1,14 @@
+use crate::db::DB;
+use axum::Router;
+
+pub fn workspaced_service() -> Router {
+    Router::new()
+}
+
+pub async fn start_kafka_consumers(
+    _db: DB,
+    _rsmq: Option<rsmq_async::MultiplexedRsmq>,
+    mut _killpill_rx: tokio::sync::broadcast::Receiver<()>,
+) -> () {
+    // implementation is not open source
+}
@@ -62,13 +62,16 @@ mod http_triggers;
 mod indexer_ee;
 mod inputs;
 mod integration;
+mod ai;
+
 #[cfg(feature = "parquet")]
 mod job_helpers_ee;
 pub mod job_metrics;
 pub mod jobs;
+#[cfg(all(feature = "enterprise", feature = "kafka"))]
+mod kafka_triggers_ee;
 pub mod oauth2_ee;
 mod oidc_ee;
-mod openai;
 mod raw_apps;
 mod resources;
 mod saml_ee;
@@ -94,6 +97,7 @@ mod workspaces_ee;

 pub const DEFAULT_BODY_LIMIT: usize = 2097152 * 100; // 200MB

+
 lazy_static::lazy_static! {

    pub static ref REQUEST_SIZE_LIMIT: Arc<RwLock<usize>> = Arc::new(RwLock::new(DEFAULT_BODY_LIMIT));
@@ -233,6 +237,9 @@ pub async fn run_server(
        }
    }

+    // #[cfg(feature = "kafka")]
+    // start_listening().await;
+
    let job_helpers_service = {
        #[cfg(feature = "parquet")]
        {
@@ -245,9 +252,27 @@ pub async fn run_server(
        }
    };

+    let kafka_triggers_service = {
+        #[cfg(all(feature = "enterprise", feature = "kafka"))]
+        {
+            kafka_triggers_ee::workspaced_service()
+        }
+
+        #[cfg(not(all(feature = "enterprise", feature = "kafka")))]
+        {
+            Router::new()
+        }
+    };
+
    if !*CLOUD_HOSTED {
        let ws_killpill_rx = rx.resubscribe();
-        websocket_triggers::start_websockets(db.clone(), rsmq, ws_killpill_rx).await;
+        websocket_triggers::start_websockets(db.clone(), rsmq.clone(), ws_killpill_rx).await;
+
+        #[cfg(all(feature = "enterprise", feature = "kafka"))]
+        {
+            let kafka_killpill_rx = rx.resubscribe();
+            kafka_triggers_ee::start_kafka_consumers(db.clone(), rsmq, kafka_killpill_rx).await;
+        }
    }

    // build our application with a route
@@ -278,7 +303,7 @@ pub async fn run_server(
                        .nest("/job_helpers", job_helpers_service)
                        .nest("/jobs", jobs::workspaced_service())
                        .nest("/oauth", oauth2_ee::workspaced_service())
-                        .nest("/openai", openai::workspaced_service())
+                        .nest("/ai", ai::workspaced_service())
                        .nest("/raw_apps", raw_apps::workspaced_service())
                        .nest("/resources", resources::workspaced_service())
                        .nest("/schedules", schedule::workspaced_service())
@@ -294,7 +319,8 @@ pub async fn run_server(
                        .nest(
                            "/websocket_triggers",
                            websocket_triggers::workspaced_service(),
-                        ),
+                        )
+                        .nest("/kafka_triggers", kafka_triggers_service),
                )
                .nest("/workspaces", workspaces::global_service())
                .nest(
@@ -319,10 +345,7 @@ pub async fn run_server(
                    "/srch/w/:workspace_id/index",
                    indexer_ee::workspaced_service(),
                )
-                .nest(
-                    "/srch/index",
-                    indexer_ee::global_service(),
-                )
+                .nest("/srch/index", indexer_ee::global_service())
                .nest("/oidc", oidc_ee::global_service())
                .nest(
                    "/saml",
@@ -1,344 +0,0 @@
-use std::collections::HashMap;
-
-use crate::db::{ApiAuthed, DB};
-
-use axum::{
-    body::Bytes,
-    extract::{Extension, Path, Query},
-    response::IntoResponse,
-    routing::post,
-    Router,
-};
-use quick_cache::sync::Cache;
-use reqwest::Client;
-use serde_json::value::RawValue;
-use windmill_audit::audit_ee::audit_log;
-use windmill_audit::ActionKind;
-use windmill_common::{
-    error::{to_anyhow, Error},
-    variables::build_crypt,
-};
-
-use crate::variables::decrypt;
-use serde::Deserialize;
-
-lazy_static::lazy_static! {
-    static ref HTTP_CLIENT: Client = reqwest::ClientBuilder::new()
-        .timeout(std::time::Duration::from_secs(60 * 5))
-        .user_agent("windmill/beta")
-        .build().unwrap();
-}
-
-pub fn workspaced_service() -> Router {
-    let router = Router::new().route("/proxy/*openai_path", post(proxy));
-
-    router
-}
-
-#[derive(Deserialize)]
-struct OpenaiResource {
-    api_key: String,
-    organization_id: Option<String>,
-}
-
-#[derive(Deserialize)]
-struct OpenaiClientCredentialsOauthResource {
-    client_id: String,
-    client_secret: String,
-    token_url: String,
-    user: Option<String>,
-}
-
-#[derive(Deserialize)]
-#[serde(untagged)]
-enum OpenaiConfig {
-    Resource(OpenaiResource),
-    ClientCredentialsOauthResource(OpenaiClientCredentialsOauthResource),
-}
-
-struct Variable {
-    value: String,
-    is_secret: bool,
-}
-async fn get_variable_or_self(path: String, db: &DB, w_id: &String) -> Result<String, Error> {
-    if !path.starts_with("$var:") {
-        return Ok(path);
-    }
-    let path = path.strip_prefix("$var:").unwrap().to_string();
-    let mut variable = sqlx::query_as!(
-        Variable,
-        "SELECT value, is_secret
-        FROM variable
-        WHERE path = $1 AND workspace_id = $2",
-        &path,
-        &w_id
-    )
-    .fetch_one(db)
-    .await?;
-    if variable.is_secret {
-        let mc = build_crypt(&db, &w_id).await?;
-        variable.value = decrypt(&mc, variable.value)?;
-    }
-    Ok(variable.value)
-}
-
-lazy_static::lazy_static! {
-    pub static ref OPENAI_AZURE_BASE_PATH: Option<String> = std::env::var("OPENAI_AZURE_BASE_PATH").ok();
-    static ref OPENAI_KEY_CACHE: Cache<String, OpenaiKeyCache> = Cache::new(500);
-}
-
-#[derive(Deserialize)]
-struct OpenaiCredentials {
-    access_token: String,
-}
-async fn get_openai_key_using_credentials_flow(
-    mut resource: OpenaiClientCredentialsOauthResource,
-    db: &DB,
-    w_id: &String,
-) -> Result<String, Error> {
-    resource.client_id = get_variable_or_self(resource.client_id, &db, &w_id).await?;
-    resource.client_secret = get_variable_or_self(resource.client_secret, &db, &w_id).await?;
-    resource.token_url = get_variable_or_self(resource.token_url, &db, &w_id).await?;
-    let mut params = HashMap::new();
-    params.insert("grant_type", "client_credentials");
-    let response = HTTP_CLIENT
-        .post(resource.token_url)
-        .form(&params)
-        .basic_auth(resource.client_id, Some(resource.client_secret))
-        .send()
-        .await
-        .map_err(|err| {
-            Error::InternalErr(format!(
-                "Failed to get OpenAI credentials using credentials flow: {}",
-                err
-            ))
-        })?;
-    let response = response.json::<OpenaiCredentials>().await.map_err(|err| {
-        Error::InternalErr(format!(
-            "Failed to parse OpenAI credentials from credentials flow: {}",
-            err
-        ))
-    })?;
-    Ok(response.access_token)
-}
-
-#[derive(Clone)]
-struct OpenaiKeyCache {
-    api_key: String,
-    organization_id: Option<String>,
-    azure_base_path: Option<String>,
-    user: Option<String>,
-    expires_at: std::time::Instant,
-}
-
-impl OpenaiKeyCache {
-    fn new(
-        api_key: String,
-        organization_id: Option<String>,
-        azure_base_path: Option<String>,
-        expires_at: std::time::Instant,
-        user: Option<String>,
-    ) -> Self {
-        Self { api_key, organization_id, azure_base_path, expires_at, user }
-    }
-    fn is_expired(&self) -> bool {
-        self.expires_at < std::time::Instant::now()
-    }
-}
-
-#[derive(Deserialize)]
-struct ProxyQueryParams {
-    no_cache: Option<bool>,
-}
-async fn proxy(
-    authed: ApiAuthed,
-    Extension(db): Extension<DB>,
-    Path((w_id, openai_path)): Path<(String, String)>,
-    Query(query_params): Query<ProxyQueryParams>,
-    mut body: Bytes,
-) -> impl IntoResponse {
-    let workspace_cache = OPENAI_KEY_CACHE.get(&w_id);
-    let (api_key, organization_id, azure_base_path, user) = if query_params
-        .no_cache
-        .unwrap_or(false)
-        || workspace_cache.is_none()
-        || workspace_cache.clone().unwrap().is_expired()
-    {
-        let openai_resource_path = sqlx::query_scalar!(
-            "SELECT openai_resource_path FROM workspace_settings WHERE workspace_id = $1",
-            &w_id
-        )
-        .fetch_one(&db)
-        .await?;
-
-        if openai_resource_path.is_none() {
-            return Err(Error::InternalErr(
-                "OpenAI resource not configured".to_string(),
-            ));
-        }
-
-        let openai_resource_path = openai_resource_path.unwrap();
-
-        let resource = sqlx::query_scalar!(
-            "SELECT value
-            FROM resource
-            WHERE path = $1 AND workspace_id = $2",
-            &openai_resource_path,
-            &w_id
-        )
-        .fetch_optional(&db)
-        .await?
-        .ok_or_else(|| {
-            Error::InternalErr(format!(
-                "Could not find the OpenAI resource at path {openai_resource_path}, update the resource path in the workspace settings"
-            ))
-        })?;
-
-        if resource.is_none() {
-            return Err(Error::InternalErr(
-                "OpenAI resource missing value".to_string(),
-            ));
-        }
-
-        let config: OpenaiConfig = serde_json::from_value(resource.unwrap())
-            .map_err(|e| Error::InternalErr(format!("validating openai resource {e:#}")))?;
-
-        let mut user = None::<String>;
-        let mut resource = match config {
-            OpenaiConfig::Resource(resource) => {
-                tracing::debug!("Getting OpenAI key from static resource");
-                resource
-            }
-            OpenaiConfig::ClientCredentialsOauthResource(resource) => {
-                tracing::debug!("Getting OpenAI key with client credentials flow");
-                user = resource.user.clone();
-                let token = get_openai_key_using_credentials_flow(resource, &db, &w_id).await?;
-                OpenaiResource { api_key: token, organization_id: None }
-            }
-        };
-
-        resource.api_key = get_variable_or_self(resource.api_key, &db, &w_id).await?;
-
-        if resource.organization_id.is_some() {
-            resource.organization_id =
-                Some(get_variable_or_self(resource.organization_id.unwrap(), &db, &w_id).await?);
-        }
-
-        if user.is_some() {
-            user = Some(get_variable_or_self(user.unwrap(), &db, &w_id).await?);
-        }
-
-        let expires_at = std::time::Instant::now() + std::time::Duration::from_secs(60);
-
-        let azure_base_path = sqlx::query_scalar!(
-            "SELECT value
-            FROM global_settings
-            WHERE name = 'openai_azure_base_path'",
-        )
-        .fetch_optional(&db)
-        .await?;
-
-        let azure_base_path = if let Some(azure_base_path) = azure_base_path {
-            Some(
-                serde_json::from_value::<String>(azure_base_path).map_err(|e| {
-                    Error::InternalErr(format!("validating openai azure base path {e:#}"))
-                })?,
-            )
-        } else {
-            OPENAI_AZURE_BASE_PATH.clone()
-        };
-
-        let workspace_cache = OpenaiKeyCache::new(
-            resource.api_key.clone(),
-            resource.organization_id.clone(),
-            azure_base_path.clone(),
-            expires_at,
-            user.clone(),
-        );
-        OPENAI_KEY_CACHE.insert(w_id.clone(), workspace_cache);
-        (
-            resource.api_key,
-            resource.organization_id,
-            azure_base_path,
-            user,
-        )
-    } else {
-        tracing::debug!("Using cached OpenAI key");
-        let workspace_cache = workspace_cache.unwrap();
-        (
-            workspace_cache.api_key.clone(),
-            workspace_cache.organization_id.clone(),
-            workspace_cache.azure_base_path.clone(),
-            workspace_cache.user.clone(),
-        )
-    };
-
-    if user.is_some() {
-        tracing::debug!("Adding user to request body");
-        let mut json_body: HashMap<String, Box<RawValue>> = serde_json::from_slice(&body)
-            .map_err(|e| Error::InternalErr(format!("Failed to parse request body: {}", e)))?;
-
-        let user_json_string = serde_json::Value::String(user.unwrap()).to_string(); // makes sure to escape characters
-
-        json_body.insert(
-            "user".to_string(),
-            RawValue::from_string(user_json_string)
-                .map_err(|e| Error::InternalErr(format!("Failed to parse user: {}", e)))?,
-        );
-
-        body = serde_json::to_vec(&json_body)
-            .map_err(|e| Error::InternalErr(format!("Failed to reserialize request body: {}", e)))?
-            .into();
-    }
-
-    let base_url = if let Some(base_url) = azure_base_path {
-        base_url
-    } else {
-        "https://api.openai.com/v1".to_string()
-    };
-
-    let url = format!("{}/{}", base_url, openai_path);
-    let mut request = HTTP_CLIENT
-        .post(url)
-        .header("content-type", "application/json")
-        .body(body);
-
-    if base_url != "https://api.openai.com/v1" {
-        request = request
-            .header("api-key", api_key)
-            .query(&[("api-version", "2023-05-15")])
-    } else {
-        request = request.header("authorization", format!("Bearer {}", api_key))
-    }
-
-    if let Some(org_id) = organization_id {
-        request = request.header("OpenAI-Organization", org_id);
-    }
-
-    let response = request.send().await.map_err(to_anyhow)?;
-
-    let mut tx = db.begin().await?;
-    audit_log(
-        &mut *tx,
-        &authed,
-        "openai.request",
-        ActionKind::Execute,
-        &w_id,
-        Some(&authed.email),
-        Some([("openai_path", &format!("{:?}", openai_path)[..])].into()),
-    )
-    .await?;
-    tx.commit().await?;
-
-    if response.error_for_status_ref().is_err() {
-        return Err(Error::OpenAIError(
-            response.text().await.unwrap_or("".to_string()),
-        ));
-    }
-
-    let status_code = response.status();
-    let headers = response.headers().clone();
-    let stream = response.bytes_stream();
-
-    Ok((status_code, headers, axum::body::Body::from_stream(stream)))
-}
@@ -300,7 +300,7 @@ async fn get_resource(
    .await?;
    tx.commit().await?;
    if resource_o.is_none() {
-        explain_resource_perm_error(&path, &w_id, &db).await?;
+        explain_resource_perm_error(&path, &w_id, &db, &authed).await?;
    }
    let resource = not_found_if_none(resource_o, "Resource", path)?;
    Ok(Json(resource))
@@ -343,7 +343,7 @@ async fn get_resource_value(

    tx.commit().await?;
    if value_o.is_none() {
-        explain_resource_perm_error(&path, &w_id, &db).await?;
+        explain_resource_perm_error(&path, &w_id, &db, &authed).await?;
    }

    let value = not_found_if_none(value_o, "Resource", path)?;
@@ -354,6 +354,7 @@ async fn explain_resource_perm_error(
    path: &str,
    w_id: &str,
    db: &sqlx::Pool<Postgres>,
+    authed: &ApiAuthed,
 ) -> windmill_common::error::Result<()> {
    let extra_perms = sqlx::query_scalar!(
        "SELECT extra_perms from resource WHERE path = $1 AND workspace_id = $2",
@@ -378,12 +379,12 @@ async fn explain_resource_perm_error(
        .fetch_optional(db)
        .await?;
        return Err(Error::NotAuthorized(format!(
-            "Resource exists but you don't have access to it:\nresource perms: {}\nfolder perms: {}",
+            "Resource exists but you don't have access to it:\nresource perms: {}\nfolder perms: {}\nauthed as: {authed:?}",
            serde_json::to_string_pretty(&extra_perms).unwrap_or_default(), serde_json::to_string_pretty(&folder_extra_perms).unwrap_or_default()
        )));
    } else {
        return Err(Error::NotAuthorized(format!(
-            "Resource exists but you don't have access to it:\nresource perms: {}",
+            "Resource exists but you don't have access to it:\nresource perms: {}\nauthed as: {authed:?}",
            serde_json::to_string_pretty(&extra_perms).unwrap_or_default()
        )));
    }
@@ -457,7 +458,7 @@ pub async fn get_resource_value_interpolated_internal(
    .await?;
    tx.commit().await?;
    if value_o.is_none() {
-        explain_resource_perm_error(path, workspace, db).await?;
+        explain_resource_perm_error(path, workspace, db, &authed).await?;
    }

    let value = not_found_if_none(value_o, "Resource", path)?;
@@ -434,67 +434,15 @@ pub async fn test_critical_channels() -> Result<String> {
    Ok("Critical channels require EE".to_string())
 }

-use serde::Serialize;
-
-#[derive(Serialize)]
-pub struct CriticalAlert {
-    id: i32,
-    alert_type: String,
-    message: String,
-    created_at: chrono::DateTime<chrono::Utc>,
-    acknowledged: Option<bool>,
-}
-
-#[cfg(feature = "enterprise")]
-#[derive(Deserialize)]
-pub struct AlertQueryParams {
-    pub page: Option<i32>,
-    pub page_size: Option<i32>,
-    pub acknowledged: Option<bool>,
-}
-
 #[cfg(feature = "enterprise")]
 pub async fn get_critical_alerts(
    Extension(db): Extension<DB>,
    authed: ApiAuthed,
-    Query(params): Query<AlertQueryParams>,
-) -> JsonResult<Vec<CriticalAlert>> {
+    Query(params): Query<crate::utils::AlertQueryParams>,
+) -> JsonResult<Vec<crate::utils::CriticalAlert>> {
    require_super_admin(&db, &authed.email).await?;

-    // Default pagination values if not provided
-    let page = params.page.unwrap_or(1).max(1);
-    let page_size = params.page_size.unwrap_or(10).min(100) as i64;
-    let offset = ((page - 1) * page_size as i32) as i64;
-
-    let alerts = if let Some(acknowledged) = params.acknowledged {
-        sqlx::query_as!(
-            CriticalAlert,
-            "SELECT id, alert_type, message, created_at, acknowledged 
-             FROM alerts 
-             WHERE acknowledged = $1
-             ORDER BY created_at DESC 
-             LIMIT $2 OFFSET $3",
-            acknowledged,
-            page_size,
-            offset
-        )
-        .fetch_all(&db)
-        .await?
-    } else {
-        sqlx::query_as!(
-            CriticalAlert,
-            "SELECT id, alert_type, message, created_at, acknowledged 
-             FROM alerts 
-             ORDER BY created_at DESC 
-             LIMIT $1 OFFSET $2",
-            page_size,
-            offset
-        )
-        .fetch_all(&db)
-        .await?
-    };
-
-    Ok(Json(alerts))
+    crate::utils::get_critical_alerts(db, params, None).await
 }

 #[cfg(not(feature = "enterprise"))]
@@ -510,15 +458,7 @@ pub async fn acknowledge_critical_alert(
 ) -> error::Result<String> {
    require_super_admin(&db, &authed.email).await?;
    
-    sqlx::query!(
-        "UPDATE alerts SET acknowledged = true WHERE id = $1",
-        id
-    )
-    .execute(&db)
-    .await?;
-    
-    tracing::info!("Acknowledged critical alert with id: {}", id);
-    Ok("Critical alert acknowledged".to_string())
+    crate::utils::acknowledge_critical_alert(db, None, id).await
 }

 #[cfg(not(feature = "enterprise"))]
@@ -533,14 +473,7 @@ pub async fn acknowledge_all_critical_alerts(
 ) -> error::Result<String> {
    require_super_admin(&db, &authed.email).await?;

-    sqlx::query!(
-        "UPDATE alerts SET acknowledged = true WHERE acknowledged = false"
-    )
-    .execute(&db)
-    .await?;
-
-    tracing::info!("Acknowledged all unacknowledged critical alerts");
-    Ok("All unacknowledged critical alerts acknowledged".to_string())
+    crate::utils::acknowledge_all_critical_alerts(db, None).await
 }

 #[cfg(not(feature = "enterprise"))]
@@ -18,6 +18,7 @@ pub struct TriggersCount {
    webhook_count: i64,
    email_count: i64,
    websocket_count: i64,
+    kafka_count: i64,
 }
 pub(crate) async fn get_triggers_count_internal(
    db: &DB,
@@ -64,6 +65,16 @@ pub(crate) async fn get_triggers_count_internal(
    .await?
    .unwrap_or(0);

+    let kafka_count = sqlx::query_scalar!(
+        "SELECT COUNT(*) FROM kafka_trigger WHERE script_path = $1 AND is_flow = $2 AND workspace_id = $3",
+        path,
+        is_flow,
+        w_id
+    )
+    .fetch_one(db)
+    .await?
+    .unwrap_or(0);
+
    let webhook_count = (if is_flow {
        sqlx::query_scalar!(
            "SELECT COUNT(*) FROM token WHERE label LIKE 'webhook-%' AND workspace_id = $1 AND scopes @> ARRAY['run:flow/' || $2]::text[]",
@@ -105,6 +116,7 @@ pub(crate) async fn get_triggers_count_internal(
        webhook_count,
        email_count,
        websocket_count,
+        kafka_count,
    }))
 }

@@ -746,7 +746,7 @@ pub async fn fetch_api_authed(
    email: String,
    w_id: &str,
    db: &DB,
-    username_override: String,
+    username_override: Option<String>,
 ) -> error::Result<ApiAuthed> {
    let permissioned_as = username_to_permissioned_as(username.as_str());
    fetch_api_authed_from_permissioned_as(permissioned_as, email, w_id, db, username_override).await
@@ -757,7 +757,7 @@ pub async fn fetch_api_authed_from_permissioned_as(
    email: String,
    w_id: &str,
    db: &DB,
-    username_override: String,
+    username_override: Option<String>,
 ) -> error::Result<ApiAuthed> {
    let authed =
        fetch_authed_from_permissioned_as(permissioned_as, email.clone(), w_id, db).await?;
@@ -769,7 +769,7 @@ pub async fn fetch_api_authed_from_permissioned_as(
        groups: authed.groups,
        folders: authed.folders,
        scopes: authed.scopes,
-        username_override: Some(username_override),
+        username_override: username_override,
    })
 }

@@ -16,6 +16,12 @@ use windmill_common::{
    DB,
 };

+#[cfg(feature = "enterprise")]
+use windmill_common::error::JsonResult;
+
+#[cfg(feature = "enterprise")]
+use axum::Json;
+
 #[derive(Deserialize)]
 pub struct WithStarredInfoQuery {
    pub with_starred_info: Option<bool>,
@@ -162,3 +168,159 @@ pub fn content_plain(body: Body) -> Response {
        .body(body)
        .unwrap()
 }
+
+use serde::Serialize;
+
+#[derive(Serialize)]
+pub struct CriticalAlert {
+    id: i32,
+    alert_type: String,
+    message: String,
+    created_at: chrono::DateTime<chrono::Utc>,
+    acknowledged: Option<bool>,
+    workspace_id: Option<String>,
+}
+
+#[cfg(feature = "enterprise")]
+#[derive(Deserialize, Debug)]
+pub struct AlertQueryParams {
+    pub page: Option<i32>,
+    pub page_size: Option<i32>,
+    pub acknowledged: Option<bool>,
+}
+
+#[cfg(feature = "enterprise")]
+pub async fn get_critical_alerts(
+    db: DB,
+    params: AlertQueryParams,
+    workspace_id: Option<String>,
+) -> JsonResult<Vec<CriticalAlert>> {
+    let page = params.page.unwrap_or(1).max(1);
+    let page_size = params.page_size.unwrap_or(10).min(100) as i64;
+    let offset = ((page - 1) * page_size as i32) as i64;
+
+    let alerts = if let Some(workspace_id) = workspace_id {
+        // `workspace_id` is provided => workspace admin
+        if params.acknowledged.is_none() {
+            // Case: return all rows where `workspace_id` matches
+            sqlx::query_as!(
+                CriticalAlert,
+                "SELECT id, alert_type, message, created_at, COALESCE(acknowledged_workspace, false) AS acknowledged, workspace_id
+                 FROM alerts
+                 WHERE workspace_id = $1
+                 ORDER BY created_at DESC
+                 LIMIT $2 OFFSET $3",
+                workspace_id,
+                page_size,
+                offset
+            )
+            .fetch_all(&db)
+            .await?
+        } else {
+            // Case: return rows where `acknowledged_workspace` matches `params.acknowledged`
+            sqlx::query_as!(
+                CriticalAlert,
+                "SELECT id, alert_type, message, created_at, COALESCE(acknowledged_workspace, false) AS acknowledged, workspace_id
+                 FROM alerts
+                 WHERE workspace_id = $1 AND COALESCE(acknowledged_workspace, false) = $2
+                 ORDER BY created_at DESC
+                 LIMIT $3 OFFSET $4",
+                workspace_id,
+                params.acknowledged,
+                page_size,
+                offset
+            )
+            .fetch_all(&db)
+            .await?
+        }
+    } else {
+        // `workspace_id` is not provided => superadmin
+        if params.acknowledged.is_none() {
+            // Case: Return all rows unfiltered with global acknowledged as acknowledged
+            sqlx::query_as!(
+                CriticalAlert,
+                "SELECT id, alert_type, message, created_at, COALESCE(acknowledged, false) AS acknowledged, workspace_id
+                 FROM alerts
+                 ORDER BY created_at DESC
+                 LIMIT $1 OFFSET $2",
+                page_size,
+                offset
+            )
+            .fetch_all(&db)
+            .await?
+        } else {
+            // Case: Return rows where global acknowledged matches params.acknowledged
+            sqlx::query_as!(
+                CriticalAlert,
+                "SELECT id, alert_type, message, created_at, COALESCE(acknowledged, false) AS acknowledged, workspace_id
+                 FROM alerts
+                 WHERE COALESCE(acknowledged, false) = $1
+                 ORDER BY created_at DESC
+                 LIMIT $2 OFFSET $3",
+                params.acknowledged,
+                page_size,
+                offset
+            )
+            .fetch_all(&db)
+            .await?
+        }
+    };
+
+    Ok(Json(alerts))
+}
+
+#[cfg(feature = "enterprise")]
+pub async fn acknowledge_critical_alert(
+    db: DB,
+    workspace_id: Option<String>,
+    id: i32,
+) -> error::Result<String> {
+    sqlx::query!(
+        "UPDATE alerts
+         SET
+           acknowledged = true,
+           acknowledged_workspace = CASE
+             WHEN $2::text IS NOT NULL AND workspace_id = $2 THEN true
+             ELSE acknowledged_workspace
+           END
+         WHERE id = $1",
+        id,
+        workspace_id
+    )
+    .execute(&db)
+    .await?;
+
+    tracing::info!(
+        "Acknowledged critical alert with id: {}{}",
+        id,
+        workspace_id.map_or_else(|| "".to_string(), |w| format!(" for workspace_id: {}", w))
+    );
+    Ok("Critical alert acknowledged".to_string())
+}
+
+#[cfg(feature = "enterprise")]
+pub async fn acknowledge_all_critical_alerts(
+    db: DB,
+    workspace_id: Option<String>,
+) -> error::Result<String> {
+    sqlx::query!(
+        "UPDATE alerts 
+         SET
+           acknowledged = true,
+           acknowledged_workspace = CASE
+             WHEN $1::text IS NOT NULL THEN true
+             ELSE acknowledged_workspace
+           END
+         WHERE ($1::text IS NOT NULL AND workspace_id = $1)
+            OR ($1::text IS NULL)",
+        workspace_id
+    )
+    .execute(&db)
+    .await?;
+
+    tracing::info!(
+        "Acknowledged all unacknowledged critical alerts{}",
+        workspace_id.map_or_else(|| "".to_string(), |w| format!(" for workspace_id: {}", w))
+    );
+    Ok("All unacknowledged critical alerts acknowledged".to_string())
+}
@@ -527,7 +527,7 @@ async fn wait_runnable_result(
        ws_trigger.email.clone(),
        &ws_trigger.workspace_id,
        &db,
-        username_override,
+        Some(username_override),
    )
    .await?;

@@ -754,12 +754,14 @@ async fn disable_with_error(db: &DB, ws_trigger: &WebsocketTrigger, error: Strin
    )
    .execute(db).await {
        Ok(_) => {
-            report_critical_error(format!("Disabling websocket {} because of error: {}", ws_trigger.url, error), db.clone()).await;
+            report_critical_error(format!("Disabling websocket {} because of error: {}", ws_trigger.url, error), db.clone(), Some(&ws_trigger.workspace_id), None).await;
        },
        Err(disable_err) => {
            report_critical_error(
                format!("Could not disable websocket {} with err {}, disabling because of error {}", ws_trigger.path, disable_err, error), 
-                db.clone()
+                db.clone(),
+                Some(&ws_trigger.workspace_id),
+                None,
            ).await;
        }
    }
@@ -771,7 +773,9 @@ async fn listen_to_websocket(
    rsmq: Option<rsmq_async::MultiplexedRsmq>,
    mut killpill_rx: tokio::sync::broadcast::Receiver<()>,
 ) -> () {
-    update_ping(&db, &ws_trigger, Some("Connecting...")).await;
+    if let None = update_ping(&db, &ws_trigger, Some("Connecting...")).await {
+        return;
+    }

    let url = ws_trigger.url.as_str();

@@ -896,7 +900,7 @@ async fn listen_to_websocket(
                                                                }
                                                                if should_handle {
                                                                    if let Err(err) = run_job(&db, rsmq.clone(), &ws_trigger, text).await {
-                                                                        report_critical_error(format!("Failed to trigger job from websocket {}: {:?}", ws_trigger.url, err), db.clone()).await;
+                                                                        report_critical_error(format!("Failed to trigger job from websocket {}: {:?}", ws_trigger.url, err), db.clone(), Some(&ws_trigger.workspace_id), None).await;
                                                                    };
                                                                }
                                                            },
@@ -968,7 +972,7 @@ async fn run_job(
        trigger.email.clone(),
        &trigger.workspace_id,
        db,
-        "anonymous".to_string(),
+        Some("anonymous".to_string()),
    )
    .await?;

@@ -8,6 +8,7 @@

 use std::collections::HashMap;

+use crate::ai::{AiResource, AI_KEY_CACHE};
 use crate::db::ApiAuthed;
 use crate::users_ee::send_email_if_possible;
 use crate::utils::get_instance_username_or_create_pending;
@@ -118,7 +119,11 @@ pub fn workspaced_service() -> Router {
        .route("/change_workspace_name", post(change_workspace_name))
        .route("/change_workspace_id", post(change_workspace_id))
        .route("/usage", get(get_usage))
-        .route("/used_triggers", get(get_used_triggers));
+        .route("/used_triggers", get(get_used_triggers))
+        .route("/critical_alerts", get(get_critical_alerts))
+        .route("/critical_alerts/:id/acknowledge", post(acknowledge_critical_alert))
+        .route("/critical_alerts/acknowledge_all", post(acknowledge_all_critical_alerts))
+        .route("/critical_alerts/mute", post(mute_critical_alerts));

    #[cfg(feature = "stripe")]
    {
@@ -168,7 +173,7 @@ pub struct WorkspaceSettings {
    pub plan: Option<String>,
    pub webhook: Option<String>,
    pub deploy_to: Option<String>,
-    pub openai_resource_path: Option<String>,
+    pub ai_resource: Option<serde_json::Value>,
    pub code_completion_enabled: bool,
    pub error_handler: Option<String>,
    pub error_handler_extra_args: Option<serde_json::Value>,
@@ -179,6 +184,7 @@ pub struct WorkspaceSettings {
    pub default_app: Option<String>,
    pub automatic_billing: bool,
    pub default_scripts: Option<serde_json::Value>,
+    pub mute_critical_alerts: Option<bool>,
 }

 #[derive(FromRow, Serialize, Debug)]
@@ -234,7 +240,7 @@ struct EditWebhook {

 #[derive(Deserialize)]
 struct EditCopilotConfig {
-    openai_resource_path: Option<String>,
+    ai_resource: Option<serde_json::Value>,
    code_completion_enabled: bool,
 }

@@ -645,23 +651,33 @@ async fn edit_copilot_config(

    let mut tx = db.begin().await?;

-    if let Some(openai_resource_path) = &eo.openai_resource_path {
+    if let Some(ai_resource) = &eo.ai_resource {
+        let path = serde_json::from_value::<AiResource>(ai_resource.clone())
+            .map_err(|e| Error::BadRequest(e.to_string()))?
+            .path;
        sqlx::query!(
-            "UPDATE workspace_settings SET openai_resource_path = $1, code_completion_enabled = $2 WHERE workspace_id = $3",
-            openai_resource_path,
+            "UPDATE workspace_settings SET ai_resource = $1, code_completion_enabled = $2 WHERE workspace_id = $3",
+            ai_resource,
            eo.code_completion_enabled,
            &w_id
        )
        .execute(&mut *tx)
        .await?;
+
+        if let Some(cached) = AI_KEY_CACHE.get(&w_id) {
+            if cached.path != path {
+                AI_KEY_CACHE.remove(&w_id);
+            }
+        }
    } else {
        sqlx::query!(
-            "UPDATE workspace_settings SET openai_resource_path = NULL, code_completion_enabled = $1 WHERE workspace_id = $2",
+            "UPDATE workspace_settings SET ai_resource = NULL, code_completion_enabled = $1 WHERE workspace_id = $2",
            eo.code_completion_enabled,
            &w_id,
        )
        .execute(&mut *tx)
        .await?;
+        AI_KEY_CACHE.remove(&w_id);
    }
    audit_log(
        &mut *tx,
@@ -672,10 +688,7 @@ async fn edit_copilot_config(
        Some(&authed.email),
        Some(
            [
-                (
-                    "openai_resource_path",
-                    &format!("{:?}", eo.openai_resource_path)[..],
-                ),
+                ("ai_resource", &format!("{:?}", eo.ai_resource)[..]),
                (
                    "code_completion_enabled",
                    &format!("{:?}", eo.code_completion_enabled)[..],
@@ -692,7 +705,8 @@ async fn edit_copilot_config(

 #[derive(Serialize)]
 struct CopilotInfo {
-    pub exists_openai_resource_path: bool,
+    pub ai_provider: String,
+    pub exists_ai_resource: bool,
    pub code_completion_enabled: bool,
 }
 async fn get_copilot_info(
@@ -701,16 +715,32 @@ async fn get_copilot_info(
 ) -> JsonResult<CopilotInfo> {
    let mut tx = db.begin().await?;
    let record = sqlx::query!(
-        "SELECT openai_resource_path, code_completion_enabled FROM workspace_settings WHERE workspace_id = $1",
+        "SELECT ai_resource, code_completion_enabled FROM workspace_settings WHERE workspace_id = $1",
        &w_id
    )
    .fetch_one(&mut *tx)
    .await
-    .map_err(|e| Error::InternalErr(format!("getting openai_resource_path and code_completion_enabled: {e:#}")))?;
+    .map_err(|e| Error::InternalErr(format!("getting ai_resource and code_completion_enabled: {e:#}")))?;
    tx.commit().await?;

+    let (ai_provider, exists_ai_resource) = if let Some(ai_resource) = record.ai_resource {
+        let ai_resource = serde_json::from_value::<AiResource>(ai_resource);
+        let exist = ai_resource.is_ok();
+        (
+            if exist {
+                ai_resource.unwrap().provider
+            } else {
+                "".to_string()
+            },
+            exist,
+        )
+    } else {
+        ("".to_string(), false)
+    };
+
    Ok(Json(CopilotInfo {
-        exists_openai_resource_path: record.openai_resource_path.is_some(),
+        ai_provider,
+        exists_ai_resource,
        code_completion_enabled: record.code_completion_enabled,
    }))
 }
@@ -1266,6 +1296,7 @@ async fn set_encryption_key(
 struct UsedTriggers {
    pub websocket_used: bool,
    pub http_routes_used: bool,
+    pub kafka_used: bool,
 }

 async fn get_used_triggers(
@@ -1276,7 +1307,10 @@ async fn get_used_triggers(
    let mut tx = user_db.begin(&authed).await?;
    let websocket_used = sqlx::query_as!(
        UsedTriggers,
-        r#"SELECT EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) as "websocket_used!", EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) as "http_routes_used!""#,
+        r#"SELECT 
+            EXISTS(SELECT 1 FROM websocket_trigger WHERE workspace_id = $1) as "websocket_used!", 
+            EXISTS(SELECT 1 FROM http_trigger WHERE workspace_id = $1) as "http_routes_used!",
+            EXISTS(SELECT 1 FROM kafka_trigger WHERE workspace_id = $1) as "kafka_used!""#,
        w_id,
    )
    .fetch_one(&mut *tx)
@@ -2223,7 +2257,7 @@ struct SimplifiedSettings {
    error_handler: Option<String>,
    error_handler_extra_args: Option<Value>,
    error_handler_muted_on_cancel: bool,
-    openai_resource_path: Option<String>,
+    ai_resource: Option<serde_json::Value>,
    code_completion_enabled: bool,
    large_file_storage: Option<Value>,
    git_sync: Option<Value>,
@@ -2588,7 +2622,7 @@ async fn tarball_workspace(
                webhook, 
                deploy_to, 
                error_handler, 
-                openai_resource_path, 
+                ai_resource, 
                code_completion_enabled, 
                error_handler_extra_args, 
                error_handler_muted_on_cancel, 
@@ -3050,3 +3084,93 @@ async fn get_usage(Extension(db): Extension<DB>, Path(w_id): Path<String>) -> Re
    .unwrap_or(0);
    Ok(usage.to_string())
 }
+
+#[cfg(feature = "enterprise")]
+pub async fn get_critical_alerts(
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    authed: ApiAuthed,
+    Query(params): Query<crate::utils::AlertQueryParams>,
+) -> JsonResult<Vec<crate::utils::CriticalAlert>> {
+    require_admin(authed.is_admin, &authed.username)?;
+
+    crate::utils::get_critical_alerts(db, params, Some(w_id)).await
+}
+
+#[cfg(not(feature = "enterprise"))]
+pub async fn get_critical_alerts() -> Error {
+    Error::NotFound("Critical Alerts require EE".to_string())
+}
+
+#[cfg(feature = "enterprise")]
+pub async fn acknowledge_critical_alert(
+    Extension(db): Extension<DB>,
+    Path((w_id, id)): Path<(String, i32)>,
+    authed: ApiAuthed,
+) -> Result<String> {
+    require_admin(authed.is_admin, &authed.username)?;
+    crate::utils::acknowledge_critical_alert(db, Some(w_id), id).await 
+}
+
+#[cfg(not(feature = "enterprise"))]
+pub async fn acknowledge_critical_alert() -> Error {
+    Error::NotFound("Critical Alerts require EE".to_string())
+}
+
+#[cfg(feature = "enterprise")]
+pub async fn acknowledge_all_critical_alerts(
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    authed: ApiAuthed,
+) -> Result<String> {
+    require_admin(authed.is_admin, &authed.username)?;
+    crate::utils::acknowledge_all_critical_alerts(db, Some(w_id)).await
+}
+
+#[cfg(not(feature = "enterprise"))]
+pub async fn acknowledge_all_critical_alerts() -> Error {
+    Error::NotFound("Critical Alerts require EE".to_string())
+}
+
+
+#[cfg(feature = "enterprise")]
+#[derive(Deserialize)]
+pub struct MuteCriticalAlertRequest {
+    pub mute_critical_alerts: Option<bool>,
+}
+
+#[cfg(feature = "enterprise")]
+async fn mute_critical_alerts(
+    Extension(db): Extension<DB>,
+    Path(w_id): Path<String>,
+    ApiAuthed { is_admin, username, .. }: ApiAuthed,
+    Json(m_r): Json<MuteCriticalAlertRequest>,
+) -> Result<String> {
+    require_admin(is_admin, &username)?;
+
+    let mute_alerts = m_r.mute_critical_alerts.unwrap_or(false);
+
+    if mute_alerts {
+        sqlx::query!(
+            "UPDATE alerts SET acknowledged_workspace = true, acknowledged = true WHERE workspace_id = $1",
+            &w_id
+        )
+    .execute(&db)
+    .await?;
+    }
+
+    sqlx::query!(
+        "UPDATE workspace_settings SET mute_critical_alerts = $1 WHERE workspace_id = $2",
+        mute_alerts,
+        &w_id
+    )
+    .execute(&db)
+    .await?;
+
+    Ok(format!("Updated mute criticital alert ui settings for workspace: {}", &w_id))
+}
+
+#[cfg(not(feature = "enterprise"))]
+pub async fn mute_critical_alerts() -> Error {
+    Error::NotFound("Critical Alerts require EE".to_string())
+}
@@ -59,7 +59,7 @@ pub enum Error {
    #[error("Error: {0:#?}")]
    JsonErr(serde_json::Value),
    #[error("{0}")]
-    OpenAIError(String),
+    AiError(String),
    #[error("{0}")]
    AlreadyCompleted(String),
 }
@@ -90,7 +90,7 @@ impl IntoResponse for Error {
            Self::RequireAdmin(_) => axum::http::StatusCode::FORBIDDEN,
            Self::SqlErr(_)
            | Self::BadRequest(_)
-            | Self::OpenAIError(_)
+            | Self::AiError(_)
            | Self::QuotaExceeded(_) => axum::http::StatusCode::BAD_REQUEST,
            _ => axum::http::StatusCode::INTERNAL_SERVER_ERROR,
        };
@@ -29,8 +29,10 @@ pub const DEFAULT_PER_PAGE: usize = 1000;
 pub const GIT_VERSION: &str =
    git_version!(args = ["--tag", "--always"], fallback = "unknown-version");

-use std::sync::atomic::Ordering;
 use crate::CRITICAL_ALERT_MUTE_UI_ENABLED;
+use std::sync::atomic::Ordering;
+
+use crate::worker::CLOUD_HOSTED;

 lazy_static::lazy_static! {
    pub static ref HTTP_CLIENT: Client = reqwest::ClientBuilder::new()
@@ -249,15 +251,40 @@ pub fn generate_lock_id(database_name: &str) -> i64 {
    0x3d32ad9e * (CRC_IEEE.checksum(database_name.as_bytes()) as i64)
 }

-pub async fn report_critical_error(error_message: String, _db: DB) -> () {
+pub async fn report_critical_error(
+    error_message: String,
+    _db: DB,
+    workspace_id: Option<&str>,
+    resource: Option<&str>,
+) -> () {
    tracing::error!("CRITICAL ERROR: {error_message}");

-    let mute = CRITICAL_ALERT_MUTE_UI_ENABLED.load(Ordering::Relaxed);
+    let mute_global = CRITICAL_ALERT_MUTE_UI_ENABLED.load(Ordering::Relaxed);
+    let mute_workspace = if let Some(workspace_id) = workspace_id {
+        match fetch_mute_workspace(&_db, workspace_id).await {
+            Ok(flag) => flag,
+            Err(err) => {
+                tracing::error!("Error fetching mute_workspace: {}", err);
+                false
+            }
+        }
+    } else {
+        false
+    };
+
+    // we ack_global if mute_global is true, or if mute_workspace is true
+    // but we ignore global mute setting for ack_workspace
+    let acknowledge_workspace = mute_workspace;
+    let acknowledge_global = mute_global || mute_workspace || ( workspace_id.is_some() && *CLOUD_HOSTED);

    if let Err(err) = sqlx::query!(
-        "INSERT INTO alerts (alert_type, message, acknowledged) VALUES ('critical_error', $1, $2)",
+        "INSERT INTO alerts (alert_type, message, acknowledged, acknowledged_workspace, workspace_id, resource)
+        VALUES ('critical_error', $1, $2, $3, $4, $5)",
        error_message,
-        mute
+        acknowledge_global,
+        acknowledge_workspace,
+        workspace_id,
+        resource,
    )
    .execute(&_db)
    .await
@@ -266,30 +293,86 @@ pub async fn report_critical_error(error_message: String, _db: DB) -> () {
    }

    #[cfg(feature = "enterprise")]
-    send_critical_alert(error_message, &_db, CriticalAlertKind::CriticalError, None).await;
+    if *CLOUD_HOSTED && workspace_id.is_some() {
+        tracing::error!(error_message)
+    } else {
+        send_critical_alert(error_message, &_db, CriticalAlertKind::CriticalError, None).await;
+    }
 }

-pub async fn report_recovered_critical_error(message: String, _db: DB) -> () {
+pub async fn report_recovered_critical_error(
+    message: String,
+    _db: DB,
+    workspace_id: Option<&str>,
+    resource: Option<&str>,
+) -> () {
    tracing::info!("RECOVERED CRITICAL ERROR: {message}");

-    let mute = CRITICAL_ALERT_MUTE_UI_ENABLED.load(Ordering::Relaxed);
-
    if let Err(err) = sqlx::query!(
-        "INSERT INTO alerts (alert_type, message, acknowledged) VALUES ('recovered_critical_error', $1, $2)",
+        "INSERT INTO alerts (alert_type, message, acknowledged, acknowledged_workspace, workspace_id, resource)
+        VALUES ('recovered_critical_error', $1, $2, $3, $4, $5)",
        message,
-        mute
+        true,
+        true,
+        workspace_id,
+        resource,
    )
    .execute(&_db)
    .await
    {
-        tracing::error!("Failed to save critical error to database: {}", err);
+        tracing::error!("Failed to save recovered critical error to database: {}", err);
    }
+
+    // acknowledge all alerts with the same resource
+    if let Some(resource) = resource {
+        if let Err(err) = sqlx::query!(
+            "UPDATE alerts SET acknowledged = true, acknowledged_workspace = true WHERE resource = $1 AND alert_type = 'critical_error'",
+            resource,
+        )
+        .execute(&_db)
+        .await
+        {
+            tracing::error!("Failed to acknowledge critical error alerts for resource {}: {}", resource, err);
+        }
+    }
+
    #[cfg(feature = "enterprise")]
-    send_critical_alert(
-        message,
-        &_db,
-        CriticalAlertKind::RecoveredCriticalError,
-        None,
+    if *CLOUD_HOSTED && workspace_id.is_some() {
+        tracing::error!(message);
+    } else {
+        send_critical_alert(
+            message,
+            &_db,
+            CriticalAlertKind::RecoveredCriticalError,
+            None,
+        )
+        .await;
+    }
+}
+
+pub async fn fetch_mute_workspace(_db: &DB, workspace_id: &str) -> Result<bool> {
+    match sqlx::query!(
+        "SELECT mute_critical_alerts FROM workspace_settings WHERE workspace_id = $1",
+        workspace_id
    )
-    .await;
+    .fetch_optional(_db)
+    .await
+    {
+        Ok(Some(record)) => Ok(record.mute_critical_alerts.unwrap_or(false)),
+        Ok(None) => {
+            tracing::warn!(
+                "Workspace ID {} not found in workspace_settings table",
+                workspace_id
+            );
+            Ok(false)
+        }
+        Err(err) => {
+            tracing::error!(
+                "Error querying workspace_settings for workspace_id {}: {}",
+                workspace_id,
+                err
+            );
+            Err(Error::SqlErr(err))
+        }
+    }
 }
@@ -1,3 +1,4 @@
+use anyhow::anyhow;
 use const_format::concatcp;
 use itertools::Itertools;
 use regex::Regex;
@@ -201,6 +202,7 @@ pub fn write_file_at_user_defined_location(
    job_dir: &str,
    user_defined_path: &str,
    content: &str,
+    mode: Option<u32>,
 ) -> error::Result<PathBuf> {
    let job_dir = Path::new(job_dir);
    let user_path = PathBuf::from(user_defined_path);
@@ -226,6 +228,13 @@ pub fn write_file_at_user_defined_location(
    }

    let mut file = File::create(full_path)?;
+
+    if let Some(mode) = mode {
+        let perm = std::os::unix::fs::PermissionsExt::from_mode(mode);
+        file.set_permissions(perm)
+            .map_err(|e| anyhow!("Failed to set permissions to {}: {e}", user_defined_path))?;
+    }
+
    file.write_all(content.as_bytes())?;
    file.flush()?;
    Ok(normalized_full_path)
@@ -924,6 +924,8 @@ pub async fn add_completed_job<
                        .unwrap_or("".to_string()),
                ),
                db.clone(),
+                Some(&w_id),
+                None,
            )
            .await;
        } else if queued_job.email == SCHEDULE_ERROR_HANDLER_USER_EMAIL {
@@ -992,7 +994,7 @@ pub async fn add_completed_job<
                            "Could not push workspace error handler for failed job ({base_url}/run/{}?workspace={w_id}): {}",
                            queued_job.id,
                            err
-                        ), db.clone())
+                        ), db.clone(), Some(&w_id), None)
                        .await;
                    }
                }
@@ -1175,10 +1177,10 @@ pub async fn report_error_to_workspace_handler_or_critical_side_channel<
                queued_job.id,
                err
            );
-            report_critical_error(error_message, db.clone()).await;
+            report_critical_error(error_message, db.clone(), Some(&w_id), None).await;
        }
    } else {
-        report_critical_error(error_message, db.clone()).await;
+        report_critical_error(error_message, db.clone(), Some(&w_id), None).await;
    }
 }

@@ -3670,15 +3672,15 @@ pub async fn push<'c, 'd, R: rsmq_async::RsmqConnection + Send + 'c>(
        }
        JobPayload::DeploymentCallback { path } => (
            None,
-            Some(path),
+            Some(path.clone()),
            None,
            JobKind::DeploymentCallback,
            None,
            None,
            None,
-            None,
-            None,
-            None,
+            Some(format!("{workspace_id}:git_sync")),
+            Some(1),
+            Some(0),
            None,
            None,
            None,
@@ -548,6 +548,7 @@ async fn create_file_resources(
                .ok_or(anyhow!(
                    "Invalid inventory resource, `content` field absent or invalid"
                ))?,
+            None,
        )
        .map_err(|e| anyhow!("Couldn't write inventory: {}", e))?;

@@ -564,8 +565,13 @@ async fn create_file_resources(
            get_resource_or_variable_content(client, &file_res.resource_path, job_id.to_string())
                .await?;
        let path = file_res.target_path.clone();
-        let validated_path = write_file_at_user_defined_location(job_dir, path.as_str(), &r)
-            .map_err(|e| anyhow!("Couldn't write text file at {}: {}", path, e))?;
+        let validated_path = write_file_at_user_defined_location(
+            job_dir,
+            path.as_str(),
+            &r,
+            file_res.mode,
+        )
+        .map_err(|e| anyhow!("Couldn't write text file at {}: {}", path, e))?;

        nsjail_mounts.push(
            define_nsjail_mount(job_dir, &validated_path)
@@ -41,7 +41,7 @@ use tokio::{io::AsyncWriteExt, process::Child, time::Instant};

 use crate::{
    AuthedClient, AuthedClientBackgroundTask, JOB_DEFAULT_TIMEOUT, MAX_RESULT_SIZE,
-    MAX_TIMEOUT_DURATION,
+    MAX_TIMEOUT_DURATION, PATH_ENV,
 };

 pub async fn build_args_map<'a>(
@@ -860,11 +860,17 @@ pub async fn save_in_cache(
 }

 fn tentatively_improve_error(err: Error, executable: &str) -> Error {
+    #[cfg(unix)]
+    let err_msg = "No such file or directory (os error 2)";
+
+    #[cfg(windows)]
+    let err_msg = "program not found";
+
    if err
        .to_string()
-        .contains("No such file or directory (os error 2)")
+        .contains(&err_msg)
    {
-        return Error::InternalErr(format!("Executable {executable} not found on worker"));
+        return Error::InternalErr(format!("Executable {executable} not found on worker. PATH: {}", *PATH_ENV));
    }
    return err;
 }
@@ -416,24 +416,32 @@ pub async fn do_postgresql(
 }

 fn map_as_single_type<T>(
-    vec: &Vec<Value>,
+    vec: Option<&Vec<Value>>,
    f: impl Fn(&Value) -> Option<T>,
-) -> anyhow::Result<Vec<Option<T>>> {
-    vec.into_iter()
-        .map(|v| {
-            // allow nulls in arrays
-            if matches!(v, Value::Null) {
-                Some(None)
-            } else {
-                f(v).map(Some)
-            }
-        })
-        .collect::<Option<Vec<Option<T>>>>()
-        .ok_or_else(|| anyhow::anyhow!("Mixed types in array"))
+) -> anyhow::Result<Option<Vec<Option<T>>>> {
+    if let Some(vec) = vec {
+        Ok(Some(
+            vec.into_iter()
+                .map(|v| {
+                    // first option is if the value is of the right type (if none, will stop the collection and throw error)
+                    // second option is if the value is null
+                    // allow nulls in arrays
+                    if matches!(v, Value::Null) {
+                        Some(None)
+                    } else {
+                        f(v).map(Some)
+                    }
+                })
+                .collect::<Option<Vec<Option<T>>>>()
+                .ok_or_else(|| anyhow::anyhow!("Mixed types in array"))?,
+        ))
+    } else {
+        Ok(None)
+    }
 }

 fn convert_vec_val(
-    vec: &Vec<Value>,
+    vec: Option<&Vec<Value>>,
    arg_t: &String,
 ) -> windmill_common::error::Result<Box<dyn ToSql + Sync + Send>> {
    match arg_t.as_str() {
@@ -489,7 +497,9 @@ fn convert_vec_val(
                    .unwrap_or_default()
            })
        })?)),
-        "jsonb" | "json" => Ok(Box::new(vec.clone().into_iter().map(Some).collect_vec())),
+        "jsonb" | "json" => Ok(Box::new(
+            vec.map(|v| v.clone().into_iter().map(Some).collect_vec()),
+        )),
        "bytea" => Ok(Box::new(map_as_single_type(vec, |v| {
            v.as_str().map(|x| {
                engine::general_purpose::STANDARD
@@ -512,9 +522,31 @@ fn convert_val(
    match value {
        Value::Array(vec) if arg_t.ends_with("[]") => {
            let arg_t = arg_t.trim_end_matches("[]").to_string();
-            convert_vec_val(vec, &arg_t)
+            convert_vec_val(Some(vec), &arg_t)
        }
-        Value::Null => Ok(Box::new(None::<bool>)),
+        Value::Null if arg_t.ends_with("[]") => {
+            let arg_t = arg_t.trim_end_matches("[]").to_string();
+            convert_vec_val(None, &arg_t)
+        }
+        Value::Null => match arg_t.as_str() {
+            "bool" | "boolean" => Ok(Box::new(None::<bool>)),
+            "char" | "character" => Ok(Box::new(None::<i8>)),
+            "smallint" | "smallserial" | "int2" | "serial2" => Ok(Box::new(None::<i16>)),
+            "int" | "integer" | "int4" | "serial" => Ok(Box::new(None::<i32>)),
+            "numeric" | "decimal" => Ok(Box::new(None::<Decimal>)),
+            "oid" => Ok(Box::new(None::<u32>)),
+            "bigint" | "bigserial" | "int8" | "serial8" => Ok(Box::new(None::<i64>)),
+            "real" | "float4" => Ok(Box::new(None::<f32>)),
+            "double" | "float8" => Ok(Box::new(None::<f64>)),
+            "uuid" => Ok(Box::new(None::<Uuid>)),
+            "date" => Ok(Box::new(None::<chrono::NaiveDate>)),
+            "time" | "timetz" => Ok(Box::new(None::<chrono::NaiveTime>)),
+            "timestamp" | "timestamptz" => Ok(Box::new(None::<chrono::NaiveDateTime>)),
+            "jsonb" | "json" => Ok(Box::new(None::<Option<Value>>)),
+            "bytea" => Ok(Box::new(None::<Vec<u8>>)),
+            "text" | "varchar" => Ok(Box::new(None::<String>)),
+            _ => Err(anyhow::anyhow!("Unsupported JSON null type"))?,
+        },
        Value::Bool(b) => Ok(Box::new(b.clone())),
        Value::Number(n) if matches!(typ, Typ::Str(_)) => Ok(Box::new(n.to_string())),
        Value::Number(n) if arg_t == "char" && n.is_i64() => {
@@ -583,6 +615,11 @@ fn convert_val(
                .unwrap_or(vec![]);
            Ok(Box::new(bytes))
        }
+        Value::Object(_) if arg_t == "text" || arg_t == "varchar" => {
+            Ok(Box::new(serde_json::to_string(value).map_err(|err| {
+                Error::ExecutionErr(format!("Failed to convert JSON to text: {}", err))
+            })?))
+        }
        Value::Object(_) => Ok(Box::new(value.clone())),
        Value::String(s) => Ok(Box::new(s.clone())),
        _ => Err(Error::ExecutionErr(format!(
@@ -1,4 +1,4 @@
-use std::{collections::HashMap, process::Stdio};
+use std::{collections::HashMap, fs, process::Stdio};

 use itertools::Itertools;
 use regex::Regex;
@@ -320,7 +320,7 @@ pub async fn uv_pip_compile(
            .args(args)
            .stdout(Stdio::piped())
            .stderr(Stdio::piped());
-        let child_process = start_child_process(child_cmd, "/usr/local/bin/uv").await?;
+        let child_process = start_child_process(child_cmd, uv_cmd).await?;
        append_logs(&job_id, &w_id, logs, db).await;
        handle_child(
            job_id,
@@ -1153,7 +1153,11 @@ pub async fn handle_python_reqs(

    for (req, venv_p) in req_with_penv {
        let mut logs1 = String::new();
-        logs1.push_str("\n\n--- UV PIP INSTALL ---\n");
+        if no_uv_install {
+            logs1.push_str("\n\n--- PIP INSTALL ---\n");
+        } else {
+            logs1.push_str("\n\n--- UV PIP INSTALL ---\n");
+        }
        logs1.push_str(&format!("\n{req} is being installed for the first time.\n It will be cached for all ulterior uses."));
        append_logs(&job_id, w_id, logs1, db).await;

@@ -1326,6 +1330,16 @@ pub async fn handle_python_reqs(
            "finished setting up python dependencies {}",
            job_id
        );
+        if child.is_err() {
+            
+            if let Err(e) = fs::remove_dir_all(&venv_p) {
+                tracing::warn!(
+                    workspace_id = %w_id,
+                    "failed to remove cache dir: {:?}",
+                    e
+                );
+            }
+        }
        child?;

        #[cfg(all(feature = "enterprise", feature = "parquet"))]
@@ -2,7 +2,7 @@ import { sleep } from "https://deno.land/x/sleep@v1.2.1/mod.ts";
 import * as windmill from "https://deno.land/x/windmill@v1.174.0/mod.ts";
 import * as api from "https://deno.land/x/windmill@v1.174.0/windmill-api/index.ts";

-export const VERSION = "v1.423.2";
+export const VERSION = "v1.426.0";

 export async function login(email: string, password: string): Promise<string> {
  return await windmill.UserService.login({
@@ -33,10 +33,10 @@
  },
  {
    "kind": "bigrawscript",
-    "jobs": 10000
+    "jobs": 4000
  },
  {
    "kind": "bigscriptinflow",
-    "jobs": 10000
+    "jobs": 4000
  }
 ]
@@ -54,7 +54,7 @@ export const OpenAPI: OpenAPIConfig = {
 	PASSWORD: undefined,
 	TOKEN: getEnv("WM_TOKEN"),
 	USERNAME: undefined,
-	VERSION: '1.407.2',
+	VERSION: '1.425.1',
 	WITH_CREDENTIALS: true,
 	interceptors: {
 		request: new Interceptors(),
@@ -1,5 +1,10 @@
 // This file is auto-generated by @hey-api/openapi-ts

+export type AiResource = {
+    path: string;
+    provider: string;
+};
+
 export type Script = {
    workspace_id?: string;
    hash: string;
@@ -257,18 +262,21 @@ export type TruncatedToken = {
    created_at: string;
    last_used_at: string;
    scopes?: Array<(string)>;
+    email?: string;
 };

 export type NewToken = {
    label?: string;
    expiration?: string;
    scopes?: Array<(string)>;
+    workspace_id?: string;
 };

 export type NewTokenImpersonate = {
    label?: string;
    expiration?: string;
    impersonate_email: string;
+    workspace_id?: string;
 };

 export type ListableVariable = {
@@ -317,7 +325,7 @@ export type AuditLog = {
    id: number;
    timestamp: string;
    username: string;
-    operation: 'jobs.run' | 'jobs.run.script' | 'jobs.run.preview' | 'jobs.run.flow' | 'jobs.run.flow_preview' | 'jobs.run.script_hub' | 'jobs.run.dependencies' | 'jobs.run.identity' | 'jobs.run.noop' | 'jobs.flow_dependencies' | 'jobs' | 'jobs.cancel' | 'jobs.force_cancel' | 'jobs.disapproval' | 'jobs.delete' | 'account.delete' | 'openai.request' | 'resources.create' | 'resources.update' | 'resources.delete' | 'resource_types.create' | 'resource_types.update' | 'resource_types.delete' | 'schedule.create' | 'schedule.setenabled' | 'schedule.edit' | 'schedule.delete' | 'scripts.create' | 'scripts.update' | 'scripts.archive' | 'scripts.delete' | 'users.create' | 'users.delete' | 'users.update' | 'users.login' | 'users.logout' | 'users.accept_invite' | 'users.decline_invite' | 'users.token.create' | 'users.token.delete' | 'users.add_to_workspace' | 'users.add_global' | 'users.setpassword' | 'users.impersonate' | 'users.leave_workspace' | 'oauth.login' | 'oauth.signup' | 'variables.create' | 'variables.delete' | 'variables.update' | 'flows.create' | 'flows.update' | 'flows.delete' | 'flows.archive' | 'apps.create' | 'apps.update' | 'apps.delete' | 'folder.create' | 'folder.update' | 'folder.delete' | 'folder.add_owner' | 'folder.remove_owner' | 'group.create' | 'group.delete' | 'group.edit' | 'group.adduser' | 'group.removeuser' | 'igroup.create' | 'igroup.delete' | 'igroup.adduser' | 'igroup.removeuser' | 'variables.decrypt_secret' | 'workspaces.edit_command_script' | 'workspaces.edit_deploy_to' | 'workspaces.edit_auto_invite_domain' | 'workspaces.edit_webhook' | 'workspaces.edit_copilot_config' | 'workspaces.edit_error_handler' | 'workspaces.create' | 'workspaces.update' | 'workspaces.archive' | 'workspaces.unarchive' | 'workspaces.delete';
+    operation: 'jobs.run' | 'jobs.run.script' | 'jobs.run.preview' | 'jobs.run.flow' | 'jobs.run.flow_preview' | 'jobs.run.script_hub' | 'jobs.run.dependencies' | 'jobs.run.identity' | 'jobs.run.noop' | 'jobs.flow_dependencies' | 'jobs' | 'jobs.cancel' | 'jobs.force_cancel' | 'jobs.disapproval' | 'jobs.delete' | 'account.delete' | 'ai.request' | 'resources.create' | 'resources.update' | 'resources.delete' | 'resource_types.create' | 'resource_types.update' | 'resource_types.delete' | 'schedule.create' | 'schedule.setenabled' | 'schedule.edit' | 'schedule.delete' | 'scripts.create' | 'scripts.update' | 'scripts.archive' | 'scripts.delete' | 'users.create' | 'users.delete' | 'users.update' | 'users.login' | 'users.login_failure' | 'users.logout' | 'users.accept_invite' | 'users.decline_invite' | 'users.token.create' | 'users.token.delete' | 'users.add_to_workspace' | 'users.add_global' | 'users.setpassword' | 'users.impersonate' | 'users.leave_workspace' | 'oauth.login' | 'oauth.login_failure' | 'oauth.signup' | 'variables.create' | 'variables.delete' | 'variables.update' | 'flows.create' | 'flows.update' | 'flows.delete' | 'flows.archive' | 'apps.create' | 'apps.update' | 'apps.delete' | 'folder.create' | 'folder.update' | 'folder.delete' | 'folder.add_owner' | 'folder.remove_owner' | 'group.create' | 'group.delete' | 'group.edit' | 'group.adduser' | 'group.removeuser' | 'igroup.create' | 'igroup.delete' | 'igroup.adduser' | 'igroup.removeuser' | 'variables.decrypt_secret' | 'workspaces.edit_command_script' | 'workspaces.edit_deploy_to' | 'workspaces.edit_auto_invite_domain' | 'workspaces.edit_webhook' | 'workspaces.edit_copilot_config' | 'workspaces.edit_error_handler' | 'workspaces.create' | 'workspaces.update' | 'workspaces.archive' | 'workspaces.unarchive' | 'workspaces.delete';
    action_kind: 'Created' | 'Updated' | 'Delete' | 'Execute';
    resource?: string;
    parameters?: {
@@ -325,7 +333,7 @@ export type AuditLog = {
    };
 };

-export type operation = 'jobs.run' | 'jobs.run.script' | 'jobs.run.preview' | 'jobs.run.flow' | 'jobs.run.flow_preview' | 'jobs.run.script_hub' | 'jobs.run.dependencies' | 'jobs.run.identity' | 'jobs.run.noop' | 'jobs.flow_dependencies' | 'jobs' | 'jobs.cancel' | 'jobs.force_cancel' | 'jobs.disapproval' | 'jobs.delete' | 'account.delete' | 'openai.request' | 'resources.create' | 'resources.update' | 'resources.delete' | 'resource_types.create' | 'resource_types.update' | 'resource_types.delete' | 'schedule.create' | 'schedule.setenabled' | 'schedule.edit' | 'schedule.delete' | 'scripts.create' | 'scripts.update' | 'scripts.archive' | 'scripts.delete' | 'users.create' | 'users.delete' | 'users.update' | 'users.login' | 'users.logout' | 'users.accept_invite' | 'users.decline_invite' | 'users.token.create' | 'users.token.delete' | 'users.add_to_workspace' | 'users.add_global' | 'users.setpassword' | 'users.impersonate' | 'users.leave_workspace' | 'oauth.login' | 'oauth.signup' | 'variables.create' | 'variables.delete' | 'variables.update' | 'flows.create' | 'flows.update' | 'flows.delete' | 'flows.archive' | 'apps.create' | 'apps.update' | 'apps.delete' | 'folder.create' | 'folder.update' | 'folder.delete' | 'folder.add_owner' | 'folder.remove_owner' | 'group.create' | 'group.delete' | 'group.edit' | 'group.adduser' | 'group.removeuser' | 'igroup.create' | 'igroup.delete' | 'igroup.adduser' | 'igroup.removeuser' | 'variables.decrypt_secret' | 'workspaces.edit_command_script' | 'workspaces.edit_deploy_to' | 'workspaces.edit_auto_invite_domain' | 'workspaces.edit_webhook' | 'workspaces.edit_copilot_config' | 'workspaces.edit_error_handler' | 'workspaces.create' | 'workspaces.update' | 'workspaces.archive' | 'workspaces.unarchive' | 'workspaces.delete';
+export type operation = 'jobs.run' | 'jobs.run.script' | 'jobs.run.preview' | 'jobs.run.flow' | 'jobs.run.flow_preview' | 'jobs.run.script_hub' | 'jobs.run.dependencies' | 'jobs.run.identity' | 'jobs.run.noop' | 'jobs.flow_dependencies' | 'jobs' | 'jobs.cancel' | 'jobs.force_cancel' | 'jobs.disapproval' | 'jobs.delete' | 'account.delete' | 'ai.request' | 'resources.create' | 'resources.update' | 'resources.delete' | 'resource_types.create' | 'resource_types.update' | 'resource_types.delete' | 'schedule.create' | 'schedule.setenabled' | 'schedule.edit' | 'schedule.delete' | 'scripts.create' | 'scripts.update' | 'scripts.archive' | 'scripts.delete' | 'users.create' | 'users.delete' | 'users.update' | 'users.login' | 'users.login_failure' | 'users.logout' | 'users.accept_invite' | 'users.decline_invite' | 'users.token.create' | 'users.token.delete' | 'users.add_to_workspace' | 'users.add_global' | 'users.setpassword' | 'users.impersonate' | 'users.leave_workspace' | 'oauth.login' | 'oauth.login_failure' | 'oauth.signup' | 'variables.create' | 'variables.delete' | 'variables.update' | 'flows.create' | 'flows.update' | 'flows.delete' | 'flows.archive' | 'apps.create' | 'apps.update' | 'apps.delete' | 'folder.create' | 'folder.update' | 'folder.delete' | 'folder.add_owner' | 'folder.remove_owner' | 'group.create' | 'group.delete' | 'group.edit' | 'group.adduser' | 'group.removeuser' | 'igroup.create' | 'igroup.delete' | 'igroup.adduser' | 'igroup.removeuser' | 'variables.decrypt_secret' | 'workspaces.edit_command_script' | 'workspaces.edit_deploy_to' | 'workspaces.edit_auto_invite_domain' | 'workspaces.edit_webhook' | 'workspaces.edit_copilot_config' | 'workspaces.edit_error_handler' | 'workspaces.create' | 'workspaces.update' | 'workspaces.archive' | 'workspaces.unarchive' | 'workspaces.delete';

 export type action_kind = 'Created' | 'Updated' | 'Delete' | 'Execute';

@@ -542,6 +550,11 @@ export type HttpTrigger = {
    edited_at: string;
    script_path: string;
    route_path: string;
+    static_asset_config?: {
+        s3: string;
+        storage?: string;
+        filename?: string;
+    };
    is_flow: boolean;
    extra_perms: {
        [key: string]: (boolean);
@@ -559,6 +572,11 @@ export type NewHttpTrigger = {
    path: string;
    script_path: string;
    route_path: string;
+    static_asset_config?: {
+        s3: string;
+        storage?: string;
+        filename?: string;
+    };
    is_flow: boolean;
    http_method: 'get' | 'post' | 'put' | 'delete' | 'patch';
    is_async: boolean;
@@ -569,12 +587,89 @@ export type EditHttpTrigger = {
    path: string;
    script_path: string;
    route_path?: string;
+    static_asset_config?: {
+        s3: string;
+        storage?: string;
+        filename?: string;
+    };
    is_flow: boolean;
    http_method: 'get' | 'post' | 'put' | 'delete' | 'patch';
    is_async: boolean;
    requires_auth: boolean;
 };

+export type TriggersCount = {
+    primary_schedule?: {
+        schedule?: string;
+    };
+    schedule_count?: number;
+    http_routes_count?: number;
+    webhook_count?: number;
+    email_count?: number;
+    websocket_count?: number;
+};
+
+export type WebsocketTrigger = {
+    path: string;
+    edited_by: string;
+    edited_at: string;
+    script_path: string;
+    url: string;
+    is_flow: boolean;
+    extra_perms: {
+        [key: string]: (boolean);
+    };
+    email: string;
+    workspace_id: string;
+    server_id?: string;
+    last_server_ping?: string;
+    error?: string;
+    enabled: boolean;
+    filters: Array<{
+        key: string;
+        value: unknown;
+    }>;
+    initial_messages: Array<WebsocketTriggerInitialMessage>;
+    url_runnable_args: ScriptArgs;
+};
+
+export type NewWebsocketTrigger = {
+    path: string;
+    script_path: string;
+    is_flow: boolean;
+    url: string;
+    enabled?: boolean;
+    filters: Array<{
+        key: string;
+        value: unknown;
+    }>;
+    initial_messages: Array<WebsocketTriggerInitialMessage>;
+    url_runnable_args: ScriptArgs;
+};
+
+export type EditWebsocketTrigger = {
+    url: string;
+    path: string;
+    script_path: string;
+    is_flow: boolean;
+    filters: Array<{
+        key: string;
+        value: unknown;
+    }>;
+    initial_messages: Array<WebsocketTriggerInitialMessage>;
+    url_runnable_args: ScriptArgs;
+};
+
+export type WebsocketTriggerInitialMessage = {
+    raw_message: string;
+} | {
+    runnable_result: {
+        path: string;
+        args: ScriptArgs;
+        is_flow: boolean;
+    };
+};
+
 export type Group = {
    name: string;
    summary?: string;
@@ -660,6 +755,7 @@ export type GlobalUserInfo = {
    name?: string;
    company?: string;
    username?: string;
+    operator_only?: boolean;
 };

 export type login_type = 'password' | 'github';
@@ -722,6 +818,9 @@ export type Policy = {
            [key: string]: unknown;
        };
    };
+    s3_inputs?: Array<{
+        [key: string]: unknown;
+    }>;
    execution_mode?: 'viewer' | 'publisher' | 'anonymous';
    on_behalf_of?: string;
    on_behalf_of_email?: string;
@@ -968,6 +1067,46 @@ export type JobSearchHit = {
    dancer?: string;
 };

+export type LogSearchHit = {
+    dancer?: string;
+};
+
+export type AutoscalingEvent = {
+    id?: number;
+    worker_group?: string;
+    event_type?: string;
+    desired_workers?: number;
+    reason?: string;
+    applied_at?: string;
+};
+
+export type CriticalAlert = {
+    /**
+     * Unique identifier for the alert
+     */
+    id?: number;
+    /**
+     * Type of alert (e.g., critical_error)
+     */
+    alert_type?: string;
+    /**
+     * The message content of the alert
+     */
+    message?: string;
+    /**
+     * Time when the alert was created
+     */
+    created_at?: string;
+    /**
+     * Acknowledgment status of the alert, can be true, false, or null if not set
+     */
+    acknowledged?: (boolean) | null;
+    /**
+     * Workspace id if the alert is in the scope of a workspace
+     */
+    workspace_id?: (string) | null;
+};
+
 export type OpenFlow = {
    summary: string;
    description?: string;
@@ -1073,6 +1212,7 @@ export type RawScript = {
    concurrent_limit?: number;
    concurrency_time_window_s?: number;
    custom_concurrency_key?: string;
+    is_trigger?: boolean;
 };

 export type language2 = 'deno' | 'bun' | 'python3' | 'go' | 'bash' | 'powershell' | 'postgresql' | 'mysql' | 'bigquery' | 'snowflake' | 'mssql' | 'graphql' | 'nativets' | 'php';
@@ -1085,6 +1225,7 @@ export type PathScript = {
    hash?: string;
    type: 'script';
    tag_override?: string;
+    is_trigger?: boolean;
 };

 export type PathFlow = {
@@ -1518,6 +1659,30 @@ export type SetPasswordData = {

 export type SetPasswordResponse = (string);

+export type SetPasswordForUserData = {
+    /**
+     * set password
+     */
+    requestBody: {
+        password: string;
+    };
+    user: string;
+};
+
+export type SetPasswordForUserResponse = (string);
+
+export type SetLoginTypeForUserData = {
+    /**
+     * set login type
+     */
+    requestBody: {
+        login_type: string;
+    };
+    user: string;
+};
+
+export type SetLoginTypeForUserResponse = (string);
+
 export type CreateUserGloballyData = {
    /**
     * user info
@@ -1675,6 +1840,7 @@ export type TestSmtpData = {
            port: number;
            from: string;
            tls_implicit: boolean;
+            disable_tls: boolean;
        };
    };
 };
@@ -1693,6 +1859,25 @@ export type TestCriticalChannelsData = {

 export type TestCriticalChannelsResponse = (string);

+export type GetCriticalAlertsData = {
+    acknowledged?: (boolean) | null;
+    page?: number;
+    pageSize?: number;
+};
+
+export type GetCriticalAlertsResponse = (Array<CriticalAlert>);
+
+export type AcknowledgeCriticalAlertData = {
+    /**
+     * The ID of the critical alert to acknowledge
+     */
+    id: number;
+};
+
+export type AcknowledgeCriticalAlertResponse = (string);
+
+export type AcknowledgeAllCriticalAlertsResponse = (string);
+
 export type TestLicenseKeyData = {
    /**
     * test license key
@@ -1917,6 +2102,10 @@ export type ExistsEmailData = {
 export type ExistsEmailResponse = (boolean);

 export type ListUsersAsSuperAdminData = {
+    /**
+     * filter only active users
+     */
+    activeOnly?: boolean;
    /**
     * which page to return (start at 1, default 1)
     */
@@ -1952,7 +2141,7 @@ export type GetSettingsResponse = ({
    customer_id?: string;
    webhook?: string;
    deploy_to?: string;
-    openai_resource_path?: string;
+    ai_resource?: AiResource;
    code_completion_enabled: boolean;
    error_handler?: string;
    error_handler_extra_args?: ScriptArgs;
@@ -1962,6 +2151,7 @@ export type GetSettingsResponse = ({
    deploy_ui?: WorkspaceDeployUISettings;
    default_app?: string;
    default_scripts?: WorkspaceDefaultScripts;
+    mute_critical_alerts?: boolean;
 });

 export type GetDeployToData = {
@@ -2070,7 +2260,7 @@ export type EditCopilotConfigData = {
     * WorkspaceCopilotConfig
     */
    requestBody: {
-        openai_resource_path?: string;
+        ai_resource?: AiResource;
        code_completion_enabled: boolean;
    };
    workspace: string;
@@ -2083,7 +2273,8 @@ export type GetCopilotInfoData = {
 };

 export type GetCopilotInfoResponse = ({
-    exists_openai_resource_path: boolean;
+    ai_provider: string;
+    exists_ai_resource: boolean;
    code_completion_enabled: boolean;
 });

@@ -2219,6 +2410,15 @@ export type GetWorkspaceUsageData = {

 export type GetWorkspaceUsageResponse = (number);

+export type GetUsedTriggersData = {
+    workspace: string;
+};
+
+export type GetUsedTriggersResponse = ({
+    http_routes_used: boolean;
+    websocket_used: boolean;
+});
+
 export type ListUsersData = {
    workspace: string;
 };
@@ -2382,6 +2582,46 @@ export type ListContextualVariablesData = {

 export type ListContextualVariablesResponse = (Array<ContextualVariable>);

+export type WorkspaceGetCriticalAlertsData = {
+    acknowledged?: (boolean) | null;
+    page?: number;
+    pageSize?: number;
+    workspace: string;
+};
+
+export type WorkspaceGetCriticalAlertsResponse = (Array<CriticalAlert>);
+
+export type WorkspaceAcknowledgeCriticalAlertData = {
+    /**
+     * The ID of the critical alert to acknowledge
+     */
+    id: number;
+    workspace: string;
+};
+
+export type WorkspaceAcknowledgeCriticalAlertResponse = (string);
+
+export type WorkspaceAcknowledgeAllCriticalAlertsData = {
+    workspace: string;
+};
+
+export type WorkspaceAcknowledgeAllCriticalAlertsResponse = (string);
+
+export type WorkspaceMuteCriticalAlertsUiData = {
+    /**
+     * Boolean flag to mute critical alerts.
+     */
+    requestBody: {
+        /**
+         * Whether critical alerts should be muted.
+         */
+        mute_critical_alerts?: boolean;
+    };
+    workspace: string;
+};
+
+export type WorkspaceMuteCriticalAlertsUiResponse = (string);
+
 export type LoginWithOauthData = {
    clientName: string;
    /**
@@ -2474,7 +2714,10 @@ export type DisconnectSlackData = {
 export type DisconnectSlackResponse = (string);

 export type ListOauthLoginsResponse = ({
-    oauth: Array<(string)>;
+    oauth: Array<{
+        type: string;
+        display_name?: string;
+    }>;
    saml?: string;
 });

@@ -3011,6 +3254,20 @@ export type GetScriptByPathData = {

 export type GetScriptByPathResponse = (Script);

+export type GetTriggersCountOfScriptData = {
+    path: string;
+    workspace: string;
+};
+
+export type GetTriggersCountOfScriptResponse = (TriggersCount);
+
+export type ListTokensOfScriptData = {
+    path: string;
+    workspace: string;
+};
+
+export type ListTokensOfScriptResponse = (Array<TruncatedToken>);
+
 export type GetScriptByPathWithDraftData = {
    path: string;
    workspace: string;
@@ -3025,6 +3282,13 @@ export type GetScriptHistoryByPathData = {

 export type GetScriptHistoryByPathResponse = (Array<ScriptHistory>);

+export type GetScriptLatestVersionData = {
+    path: string;
+    workspace: string;
+};
+
+export type GetScriptLatestVersionResponse = (ScriptHistory);
+
 export type UpdateScriptHistoryData = {
    hash: string;
    path: string;
@@ -3378,6 +3642,13 @@ export type GetFlowHistoryData = {

 export type GetFlowHistoryResponse = (Array<FlowVersion>);

+export type GetFlowLatestVersionData = {
+    path: string;
+    workspace: string;
+};
+
+export type GetFlowLatestVersionResponse = (FlowVersion);
+
 export type GetFlowVersionData = {
    path: string;
    version: number;
@@ -3408,6 +3679,20 @@ export type GetFlowByPathData = {

 export type GetFlowByPathResponse = (Flow);

+export type GetTriggersCountOfFlowData = {
+    path: string;
+    workspace: string;
+};
+
+export type GetTriggersCountOfFlowResponse = (TriggersCount);
+
+export type ListTokensOfFlowData = {
+    path: string;
+    workspace: string;
+};
+
+export type ListTokensOfFlowResponse = (Array<TruncatedToken>);
+
 export type ToggleWorkspaceErrorHandlerForFlowData = {
    path: string;
    /**
@@ -3637,6 +3922,13 @@ export type GetAppHistoryByPathData = {

 export type GetAppHistoryByPathResponse = (Array<AppHistory>);

+export type GetAppLatestVersionData = {
+    path: string;
+    workspace: string;
+};
+
+export type GetAppLatestVersionResponse = (AppHistory);
+
 export type UpdateAppHistoryData = {
    id: number;
    /**
@@ -4099,6 +4391,16 @@ export type GetCompletedCountResponse = ({
    database_length: number;
 });

+export type CountCompletedJobsData = {
+    allWorkspaces?: boolean;
+    completedAfterSAgo?: number;
+    success?: boolean;
+    tags?: string;
+    workspace: string;
+};
+
+export type CountCompletedJobsResponse = (number);
+
 export type ListFilteredUuidsData = {
    /**
     * get jobs from all workspaces (only valid if request come from the `admins` workspace)
@@ -4888,11 +5190,80 @@ export type ExistsRouteData = {

 export type ExistsRouteResponse = (boolean);

-export type UsedData = {
+export type CreateWebsocketTriggerData = {
+    /**
+     * new websocket trigger
+     */
+    requestBody: NewWebsocketTrigger;
    workspace: string;
 };

-export type UsedResponse = (boolean);
+export type CreateWebsocketTriggerResponse = (string);
+
+export type UpdateWebsocketTriggerData = {
+    path: string;
+    /**
+     * updated trigger
+     */
+    requestBody: EditWebsocketTrigger;
+    workspace: string;
+};
+
+export type UpdateWebsocketTriggerResponse = (string);
+
+export type DeleteWebsocketTriggerData = {
+    path: string;
+    workspace: string;
+};
+
+export type DeleteWebsocketTriggerResponse = (string);
+
+export type GetWebsocketTriggerData = {
+    path: string;
+    workspace: string;
+};
+
+export type GetWebsocketTriggerResponse = (WebsocketTrigger);
+
+export type ListWebsocketTriggersData = {
+    isFlow?: boolean;
+    /**
+     * which page to return (start at 1, default 1)
+     */
+    page?: number;
+    /**
+     * filter by path
+     */
+    path?: string;
+    pathStart?: string;
+    /**
+     * number of items to return for a given page (default 30, max 100)
+     */
+    perPage?: number;
+    workspace: string;
+};
+
+export type ListWebsocketTriggersResponse = (Array<WebsocketTrigger>);
+
+export type ExistsWebsocketTriggerData = {
+    path: string;
+    workspace: string;
+};
+
+export type ExistsWebsocketTriggerResponse = (boolean);
+
+export type SetWebsocketTriggerEnabledData = {
+    path: string;
+    /**
+     * updated websocket trigger enable
+     */
+    requestBody: {
+        enabled: boolean;
+    };
+    workspace: string;
+};
+
+export type SetWebsocketTriggerEnabledResponse = (string);

 export type ListInstanceGroupsResponse = (Array<InstanceGroup>);

@@ -5201,6 +5572,10 @@ export type GetQueueMetricsResponse = (Array<{
    }>;
 }>);

+export type GetCountsOfJobsWaitingPerTagResponse = ({
+    [key: string]: (number);
+});
+
 export type ListWorkerGroupsResponse = (Array<{
    name: string;
    config: unknown;
@@ -5230,8 +5605,14 @@ export type DeleteConfigResponse = (string);

 export type ListConfigsResponse = (Array<Config>);

+export type ListAutoscalingEventsData = {
+    workerGroup: string;
+};
+
+export type ListAutoscalingEventsResponse = (Array<AutoscalingEvent>);
+
 export type GetGranularAclsData = {
-    kind: 'script' | 'group_' | 'resource' | 'schedule' | 'variable' | 'flow' | 'folder' | 'app' | 'raw_app' | 'http_trigger';
+    kind: 'script' | 'group_' | 'resource' | 'schedule' | 'variable' | 'flow' | 'folder' | 'app' | 'raw_app' | 'http_trigger' | 'websocket_trigger';
    path: string;
    workspace: string;
 };
@@ -5241,7 +5622,7 @@ export type GetGranularAclsResponse = ({
 });

 export type AddGranularAclsData = {
-    kind: 'script' | 'group_' | 'resource' | 'schedule' | 'variable' | 'flow' | 'folder' | 'app' | 'raw_app' | 'http_trigger';
+    kind: 'script' | 'group_' | 'resource' | 'schedule' | 'variable' | 'flow' | 'folder' | 'app' | 'raw_app' | 'http_trigger' | 'websocket_trigger';
    path: string;
    /**
     * acl to add
@@ -5256,7 +5637,7 @@ export type AddGranularAclsData = {
 export type AddGranularAclsResponse = (string);

 export type RemoveGranularAclsData = {
-    kind: 'script' | 'group_' | 'resource' | 'schedule' | 'variable' | 'flow' | 'folder' | 'app' | 'raw_app' | 'http_trigger';
+    kind: 'script' | 'group_' | 'resource' | 'schedule' | 'variable' | 'flow' | 'folder' | 'app' | 'raw_app' | 'http_trigger' | 'websocket_trigger';
    path: string;
    /**
     * acl to add
@@ -5569,6 +5950,8 @@ export type MoveS3FileData = {
 export type MoveS3FileResponse = (unknown);

 export type FileUploadData = {
+    contentDisposition?: string;
+    contentType?: string;
    fileExtension?: string;
    fileKey?: string;
    /**
@@ -5817,4 +6200,44 @@ export type SearchJobsIndexResponse = ({
     * the jobs that matched the query
     */
    hits?: Array<JobSearchHit>;
+});
+
+export type SearchLogsIndexData = {
+    hostname: string;
+    maxTs?: string;
+    minTs?: string;
+    mode: string;
+    searchQuery: string;
+    workerGroup?: string;
+};
+
+export type SearchLogsIndexResponse = ({
+    /**
+     * a list of the terms that couldn't be parsed (and thus ignored)
+     */
+    query_parse_errors?: Array<(string)>;
+    /**
+     * log files that matched the query
+     */
+    hits?: Array<LogSearchHit>;
+});
+
+export type CountSearchLogsIndexData = {
+    hosts: string;
+    maxTs?: string;
+    minTs?: string;
+    searchQuery: string;
+};
+
+export type CountSearchLogsIndexResponse = ({
+    /**
+     * a list of the terms that couldn't be parsed (and thus ignored)
+     */
+    query_parse_errors?: Array<(string)>;
+    /**
+     * count of log lines that matched the query per hostname
+     */
+    count_per_host?: {
+        [key: string]: unknown;
+    };
 });
@@ -60,7 +60,7 @@ export {
 //   }
 // });

-export const VERSION = "1.423.2";
+export const VERSION = "1.426.0";

 const command = new Command()
  .name("wmill")
@@ -4,10 +4,10 @@ import { colors } from "./deps.ts";
 import { yamlParseFile } from "./deps.ts";
 import { log } from "./deps.ts";
 import { compareInstanceObjects, InstanceSyncOptions } from "./instance.ts";
-import { isSuperset, GlobalOptions } from "./types.ts";
+import { isSuperset } from "./types.ts";
 import { deepEqual } from "./utils.ts";
 import * as wmill from "./gen/services.gen.ts";
-import { Config, GlobalSetting } from "./gen/types.gen.ts";
+import { AiResource, Config, GlobalSetting } from "./gen/types.gen.ts";
 import { removeWorkerPrefix } from "./worker_groups.ts";
 import process from "node:process";

@@ -24,7 +24,7 @@ export interface SimplifiedSettings {
  error_handler?: string;
  error_handler_extra_args?: any;
  error_handler_muted_on_cancel?: boolean;
-  openai_resource_path?: string;
+  ai_resource?: AiResource;
  code_completion_enabled: boolean;
  large_file_storage?: any;
  git_sync?: any;
@@ -80,7 +80,7 @@ export async function pushWorkspaceSettings(
      error_handler_extra_args: remoteSettings.error_handler_extra_args,
      error_handler_muted_on_cancel:
        remoteSettings.error_handler_muted_on_cancel,
-      openai_resource_path: remoteSettings.openai_resource_path,
+      ai_resource: remoteSettings.ai_resource,
      code_completion_enabled: remoteSettings.code_completion_enabled,
      large_file_storage: remoteSettings.large_file_storage,
      git_sync: remoteSettings.git_sync,
@@ -153,14 +153,14 @@ export async function pushWorkspaceSettings(
    }
  }
  if (
-    localSettings.openai_resource_path !== settings.openai_resource_path ||
+    localSettings.ai_resource !== settings.ai_resource ||
    localSettings.code_completion_enabled !== settings.code_completion_enabled
  ) {
    log.debug(`Updating openai settings...`);
    await wmill.editCopilotConfig({
      workspace,
      requestBody: {
-        openai_resource_path: localSettings.openai_resource_path,
+        ai_resource: localSettings.ai_resource,
        code_completion_enabled: localSettings.code_completion_enabled,
      },
    });
@@ -1,14 +1,15 @@
 {
 	"name": "windmill-components",
-	"version": "1.423.2",
+	"version": "1.426.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "windmill-components",
-			"version": "1.423.2",
+			"version": "1.426.0",
 			"license": "AGPL-3.0",
 			"dependencies": {
+				"@anthropic-ai/sdk": "^0.32.1",
 				"@aws-crypto/sha256-js": "^4.0.0",
 				"@codingame/monaco-vscode-configuration-service-override": "~8.0.2",
 				"@codingame/monaco-vscode-files-service-override": "~8.0.2",
@@ -21,6 +22,7 @@
 				"@codingame/monaco-vscode-standalone-typescript-language-features": "~8.0.2",
 				"@json2csv/plainjs": "^7.0.6",
 				"@leeoniya/ufuzzy": "^1.0.8",
+				"@mistralai/mistralai": "^1.3.0",
 				"@popperjs/core": "^2.11.6",
 				"@redocly/json-to-json-schema": "^0.0.1",
 				"@tanstack/svelte-table": "^8.9.9",
@@ -175,6 +177,30 @@
 				"node": ">=6.0.0"
 			}
 		},
+		"node_modules/@anthropic-ai/sdk": {
+			"version": "0.32.1",
+			"resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-0.32.1.tgz",
+			"integrity": "sha512-U9JwTrDvdQ9iWuABVsMLj8nJVwAyQz6QXvgLsVhryhCEPkLsbcP/MXxm+jYcAwLoV8ESbaTTjnD4kuAFa+Hyjg==",
+			"license": "MIT",
+			"dependencies": {
+				"@types/node": "^18.11.18",
+				"@types/node-fetch": "^2.6.4",
+				"abort-controller": "^3.0.0",
+				"agentkeepalive": "^4.2.1",
+				"form-data-encoder": "1.7.2",
+				"formdata-node": "^4.3.2",
+				"node-fetch": "^2.6.7"
+			}
+		},
+		"node_modules/@anthropic-ai/sdk/node_modules/@types/node": {
+			"version": "18.19.64",
+			"resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.64.tgz",
+			"integrity": "sha512-955mDqvO2vFf/oL7V3WiUtiz+BugyX8uVbaT2H8oj3+8dRyH2FLiNdowe7eNqRM7IOIZvzDH76EoAT+gwm6aIQ==",
+			"license": "MIT",
+			"dependencies": {
+				"undici-types": "~5.26.4"
+			}
+		},
 		"node_modules/@apidevtools/json-schema-ref-parser": {
 			"version": "11.6.1",
 			"resolved": "https://registry.npmjs.org/@apidevtools/json-schema-ref-parser/-/json-schema-ref-parser-11.6.1.tgz",
@@ -3659,6 +3685,14 @@
 			"resolved": "https://registry.npmjs.org/@mapbox/unitbezier/-/unitbezier-0.0.0.tgz",
 			"integrity": "sha512-HPnRdYO0WjFjRTSwO3frz1wKaU649OBFPX3Zo/2WZvuRi6zMiRGui8SnPQiQABgqCf8YikDe5t3HViTVw1WUzA=="
 		},
+		"node_modules/@mistralai/mistralai": {
+			"version": "1.3.0",
+			"resolved": "https://registry.npmjs.org/@mistralai/mistralai/-/mistralai-1.3.0.tgz",
+			"integrity": "sha512-G5DPCSC8sEhG3LUEZDYLD7qEZWDuZXgaX3IcoC3a/ydm9jFuh2pRZtknsgMx2sU8d7kxRuxblY3fPH5C38wnhQ==",
+			"peerDependencies": {
+				"zod": ">= 3"
+			}
+		},
 		"node_modules/@nodelib/fs.scandir": {
 			"version": "2.1.5",
 			"resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -13738,6 +13772,16 @@
 			"integrity": "sha512-A7AMeJfGefk317I/3tBoUYRcDcNavKEkpiPN/nQsBz/viI2GvT7BtrqdPD6rGqBFN8Ax7v4obf+Cl32JF9DDVw==",
 			"dev": true
 		},
+		"node_modules/zod": {
+			"version": "3.23.8",
+			"resolved": "https://registry.npmjs.org/zod/-/zod-3.23.8.tgz",
+			"integrity": "sha512-XBx9AXhXktjUqnepgTiE5flcKIYWi/rme0Eaj+5Y0lftuGBq+jyRu/md4WnuxqgP1ubdpNCsYEYPxrzVHD8d6g==",
+			"license": "MIT",
+			"peer": true,
+			"funding": {
+				"url": "https://github.com/sponsors/colinhacks"
+			}
+		},
 		"node_modules/zstddec": {
 			"version": "0.1.0",
 			"resolved": "https://registry.npmjs.org/zstddec/-/zstddec-0.1.0.tgz",
@@ -1,6 +1,6 @@
 {
 	"name": "windmill-components",
-	"version": "1.423.2",
+	"version": "1.426.0",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build",
@@ -82,6 +82,7 @@
 	},
 	"type": "module",
 	"dependencies": {
+		"@anthropic-ai/sdk": "^0.32.1",
 		"@aws-crypto/sha256-js": "^4.0.0",
 		"@codingame/monaco-vscode-configuration-service-override": "~8.0.2",
 		"@codingame/monaco-vscode-files-service-override": "~8.0.2",
@@ -94,6 +95,7 @@
 		"@codingame/monaco-vscode-standalone-typescript-language-features": "~8.0.2",
 		"@json2csv/plainjs": "^7.0.6",
 		"@leeoniya/ufuzzy": "^1.0.8",
+		"@mistralai/mistralai": "^1.3.0",
 		"@popperjs/core": "^2.11.6",
 		"@redocly/json-to-json-schema": "^0.0.1",
 		"@tanstack/svelte-table": "^8.9.9",
@@ -39,7 +39,6 @@
 	import { CornerDownLeft, Play } from 'lucide-svelte'
 	import Toggle from './Toggle.svelte'
 	import { setLicense } from '$lib/enterpriseUtils'
-	import { workspacedOpenai } from './copilot/lib'
 	import type { FlowCopilotContext, FlowCopilotModule } from './copilot/flow'
 	import { pickScript } from './flows/flowStateUtils'
 	import {
@@ -49,6 +48,7 @@
 	} from '$lib/relative_imports'
 	import Tooltip from './Tooltip.svelte'
 	import type { ScheduleTrigger, TriggerContext } from './triggers'
+	import { initAllAiWorkspace } from './copilot/lib'
 	import type { FlowPropPickerConfig, PropPickerContext } from './prop_picker'
 	import type { PickableProperties } from './flows/previousResults'
 	$: token = $page.url.searchParams.get('wm_token') ?? undefined
@@ -110,12 +110,13 @@

 	async function setCopilotInfo() {
 		if (workspace) {
-			workspacedOpenai.init(workspace, token)
+			initAllAiWorkspace(workspace)
 			try {
 				copilotInfo.set(await WorkspaceService.getCopilotInfo({ workspace }))
 			} catch (err) {
 				copilotInfo.set({
-					exists_openai_resource_path: false,
+					ai_provider: '',
+					exists_ai_resource: false,
 					code_completion_enabled: false
 				})

@@ -8,6 +8,7 @@
 		cleanValueProperties,
 		orderedJsonStringify,
 		orderedYamlStringify,
+		replaceFalseWithUndefined,
 		type Value
 	} from '$lib/utils'
 	import type { Script } from '$lib/gen'
@@ -54,8 +55,9 @@
 		diffViewer.closeDrawer()
 	}

+
 	function prepareDiff(data: Value) {
-		const metadata = structuredClone(cleanValueProperties(data))
+		const metadata = structuredClone(cleanValueProperties(replaceFalseWithUndefined(data)))
 		const content = metadata['content']
 		if (metadata['content'] !== undefined) {
 			metadata['content'] = 'check content diff'
@@ -171,6 +171,7 @@
 	import { initVim } from './monaco_keybindings'
 	import { buildWorkerDefinition } from '$lib/monaco_workers/build_workers'
 	import { parseTypescriptDeps } from '$lib/relative_imports'
+	import type { AiProviderTypes } from './copilot/lib'

 	// import EditorTheme from './EditorTheme.svelte'

@@ -593,11 +594,13 @@
 							token.onCancellationRequested(() => {
 								abortController?.abort()
 							})
+							const aiProvider = $copilotInfo.ai_provider
 							const insertText = await editorCodeCompletion(
 								textUntilPosition,
 								textAfterPosition,
 								lang,
-								abortController
+								abortController,
+								aiProvider as AiProviderTypes
 							)
 							if (insertText) {
 								items = [
@@ -624,7 +627,7 @@
 		)
 	}

-	$: $copilotInfo.exists_openai_resource_path &&
+	$: $copilotInfo.exists_ai_resource &&
 		$copilotInfo.code_completion_enabled &&
 		$codeCompletionSessionEnabled &&
 		initialized &&
@@ -25,6 +25,7 @@
 		encodeState,
 		formatCron,
 		orderedJsonStringify,
+		replaceFalseWithUndefined,
 		sleep,
 		type Value
 	} from '$lib/utils'
@@ -85,6 +86,7 @@
 	import type { FlowBuilderWhitelabelCustomUi } from './custom_ui'
 	import FlowYamlEditor from './flows/header/FlowYamlEditor.svelte'
 	import { type TriggerContext, type ScheduleTrigger } from './triggers'
+	import type { AiProviderTypes } from './copilot/lib'

 	export let initialPath: string = ''
 	export let pathStoreInit: string | undefined = undefined
@@ -293,12 +295,21 @@
 			// We need it for diff
 			await syncWithDeployed()

-			// Handle through confirmation modal
-			confirmCallback = async () => {
+			if (
+				deployedValue &&
+				$flowStore &&
+				orderedJsonStringify(deployedValue) ===
+					orderedJsonStringify(replaceFalseWithUndefined({ ...$flowStore, path: $pathStore }))
+			) {
 				await saveFlow(deploymentMsg)
+			} else {
+				// Handle through confirmation modal
+				confirmCallback = async () => {
+					await saveFlow(deploymentMsg)
+				}
+				// Open confirmation modal
+				open = true
 			}
-			// Open confirmation modal
-			open = true
 		}
 	}
 	async function syncWithDeployed() {
@@ -307,18 +318,12 @@
 			path: initialPath,
 			withStarredInfo: true
 		})
-		deployedValue = {
+		deployedValue = replaceFalseWithUndefined({
 			...flow,
-			starred: undefined,
-			id: undefined,
 			edited_at: undefined,
 			edited_by: undefined,
-			workspace_id: undefined,
-			archived: undefined,
-			same_worker: undefined,
-			visible_to_runner_only: undefined,
-			ws_error_handler_muted: undefined
-		}
+			workspace_id: undefined
+		})
 		deployedBy = flow.edited_by
 	}

@@ -789,6 +794,7 @@
 		try {
 			push(history, $flowStore)
 			let module = stepOnly ? $copilotModulesStore[0] : $copilotModulesStore[idx]
+			const aiProvider = $copilotInfo.ai_provider as AiProviderTypes

 			copilotLoading = true
 			copilotStatus = "Generating code for step '" + module.id + "'..."
@@ -918,7 +924,8 @@
 						  })
 						: undefined,
 					isFirstInLoop,
-					abortController
+					abortController,
+					aiProvider
 				)
 				unsubscribe()
 			}
@@ -934,7 +941,7 @@
 						pastModule.value.type === 'script')
 				) {
 					const stepSchema: Schema = JSON.parse(JSON.stringify($flowStateStore[module.id].schema)) // deep copy
-					if (isHubStep && pastModule !== undefined && $copilotInfo.exists_openai_resource_path) {
+					if (isHubStep && pastModule !== undefined && $copilotInfo.exists_ai_resource) {
 						// ask AI to set step inputs
 						abortController = new AbortController()
 						const { inputs, allExprs } = await glueCopilot(
@@ -944,7 +951,8 @@
 								value: RawScript | PathScript
 							},
 							isFirstInLoop,
-							abortController
+							abortController,
+							aiProvider
 						)

 						// create flow inputs used by AI for autocompletion
@@ -992,11 +1000,7 @@
 							$shouldUpdatePropertyType[key] = 'javascript'
 						})
 					} else {
-						if (
-							isHubStep &&
-							pastModule !== undefined &&
-							!$copilotInfo.exists_openai_resource_path
-						) {
+						if (isHubStep && pastModule !== undefined && !$copilotInfo.exists_ai_resource) {
 							sendUserToast(
 								'For better input generation, enable Windmill AI in the workspace settings',
 								true
@@ -14,7 +14,7 @@
 	import Alert from './common/alert/Alert.svelte'
 	import { isCloudHosted } from '$lib/cloud'
 	import { capitalize, classNames, sleep } from '$lib/utils'
-	import { enterpriseLicense } from '$lib/stores'
+	import { enterpriseLicense, isCriticalAlertsUIOpen } from '$lib/stores'
 	import CustomOauth from './CustomOauth.svelte'
 	import {
 		AlertCircle,
@@ -43,6 +43,7 @@
 	export let tab: string = 'Core'
 	export let hideTabs: boolean = false
 	export let hideSave: boolean = false
+	export let closeDrawer: (() => void) | undefined = () => {}

 	let values: Record<string, any> = {}
 	let initialOauths: Record<string, any> = {}
@@ -814,6 +815,26 @@
 													placeholder={setting.placeholder}
 													bind:value={values[setting.key]}
 												/>
+											{:else if setting.key == 'critical_alert_mute_ui'}
+												<div class="flex flex-col gap-y-2 my-2 py-2">
+													<Toggle
+														disabled={!$enterpriseLicense}
+														bind:checked={values[setting.key]}
+														options={{ right: setting.description }}
+													/>
+													<div class="flex flex-row">
+														<Button
+															disabled={!$enterpriseLicense}
+															size="sm"
+															on:click={() => {
+																isCriticalAlertsUIOpen.set(true)
+																closeDrawer?.()
+															}}
+														>
+															Show Critical Alerts
+														</Button>
+													</div>
+												</div>
 											{:else if setting.fieldType == 'critical_error_channels'}
 												<div class="w-full flex gap-x-16 flex-wrap">
 													<div class="w-full max-w-lg">
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ruben Fiszelandrubenfiszel	46fae2a6c2	chore(main): release 1.426.0 (#4732 ) * chore(main): release 1.426.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>	2024-11-18 17:14:55 +01:00
wendrul	6b34e316ce	Add mode to playbook init for discoverability (#4733 )	2024-11-18 17:09:40 +01:00
HugoCasa Ruben Fiszel Ruben Fiszel	88b8ffab90	feat: kafka triggers (#4713 ) * feat: kafka triggers * sqlx * fix build * improve error messages on windows * nit * fix build * missing action * nit * maybe fix ssl on windows * nit * update ee ref --------- Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev>	2024-11-18 17:03:50 +01:00
wendrul	5e10782779	feat: Add mode (permissions) option to files in ansible (#4724 ) * Add chmod option to files in ansible * Add 0 prefix if string * Rename chmod to mode	2024-11-18 17:02:38 +01:00
Alexander Petric	180809d346	fix: do not mount critical alerts modal if user is neither superadmin nor workspace admin (#4731 )	2024-11-18 15:34:22 +01:00
Ruben Fiszel	e4583e9b23	fix cli handling of ai resource generalization	2024-11-16 11:27:01 +01:00
Ruben Fiszelandrubenfiszel	93063b1c50	chore(main): release 1.425.1 (#4728 ) * chore(main): release 1.425.1 * Apply automatic changes --------- Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>	2024-11-16 10:04:30 +01:00
HugoCasa	17d893315b	fix: revert bool to text support in pg (#4727 )	2024-11-16 10:01:16 +01:00
Ruben Fiszel	0acd1b4a99	fix error logs on empty get_logs	2024-11-16 09:30:36 +01:00
Ruben Fiszelandrubenfiszel	4b04cc4d1a	chore(main): release 1.425.0 (#4715 ) * chore(main): release 1.425.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>	2024-11-15 22:31:49 +01:00
HugoCasa	d999e91583	unbreak nullable inputs in pg (#4726 )	2024-11-15 22:27:28 +01:00
pyranota	9065716020	Fix ignore confirmation modal if no changes (#4725 )	2024-11-15 19:47:09 +01:00
pyranota	56f70fd7de	Ignore fields with `false` value in DiffViewer (#4712 ) * Convert false to undefined * Remove comments * Make it consistent * Formatting * Apply at downstream	2024-11-15 19:24:57 +01:00
HugoCasa	9ad1afc8f2	unbreak ::text for json in pg (#4722 ) * unbreak ::text for json in pg * better error handling	2024-11-15 18:35:21 +01:00
Alexander Petric	c069969732	cloud_hosted non ee scope (#4723 )	2024-11-15 18:14:11 +01:00
Henri Courdent	9ce1d46459	Result node placeholder (#4721 )	2024-11-15 16:55:53 +01:00
Alexander Petric	ff5fcc59d4	if CLOUD_HOSTED and workspace_id set, autoacknowledge for superadmin (#4719 )	2024-11-15 16:31:42 +01:00
Lucas Abel	f7ce4d1c8b	benchmarks: reduce 'big' task job count (#4718 )	2024-11-15 15:56:41 +01:00
Ruben Fiszel	44f3dcc2b3	improve variable and resource not visible error message	2024-11-15 10:16:58 +01:00
Alexander Petric Ruben Fiszel Alexander Petric Guilhem Ruben Fiszel	c32038a76d	feat(monitoring): workspace critical alerts (#4684 ) * critical alert ui * updating ui, backend logic * revert * type check fix npm * checking out cli files from main * moving alert icon * adding sqlx mock data * more sqlx changes * feat(frontend): nodes from flow can be connected directly in expr input through a plug icon (#4652) * Add flow prop picker # Conflicts: # frontend/src/lib/components/propertyPicker/PropPicker.svelte * fix unwanted copy * cleaning * Fix unset context * move button and always display input * fix unwanted proppicker display * update * update * clean all * clean all --------- Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com> * replace hide/show with toggle * adding mutable setting and navigation to settings to configure channels * merge fix * ee non ee changees * auto-acknowledge when muted * pr comments * fix bad log * user inner modal component * update unaknowledge alerts after acknowledging from modal * aknowledge -> acknowledge * format * adding backend support for workspace critical alerts * immediately check for alerts * immediately check for alerts * adding openapi changes * simplify loading of superadmin/ee * update modal logic * frontend logic update * sqlx prepare * adding mute functionality for workspace critical alerts + show alerts button for instance and workspace settings * npm / rust warnings & errors * reverting non-mac cargo toml * reverting non-mac cargo toml * mute toggles in critical alert ui * ui polish * adding acknowledged_workspace column * sqlx prepare * make sure we wait for all stores to be loaded * adding workspace mute logic to report_critical alert * auto ack recovered alerts * toggle workspace as superadmin and critical alerts in logs menu * adding critical alert button if width < 786px * refresh on change * Move notification to logs (#4698) * Move notification to logs * removing unused button --------- Co-authored-by: Alexander Petric <petric.al@gmail.com> * tailwind typo * auto ack on mute * don't change deref * sqlx prep * avoid renaming db column, keep acknowledged instead of acknowledged_global * hide critical alert menu when not ee * if workspace muted, also acknowledge global when workspace set * removing save button for mute setting and improve ux/responsiveness * fix: deployment callbacks have a concurrency limit of 1 on same path * sqlx prep * ee-repo ref * z-[9999] for modal --------- Co-authored-by: Guilhem <guilhemlemouel@gmail.com> Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev>	2024-11-15 09:48:48 +01:00
Ruben Fiszel	b868e446fc	improve error messages on windows	2024-11-15 09:43:54 +01:00
pyranota	bb937498bb	Fix dirs in uv install (#4717 )	2024-11-15 03:03:05 +01:00
Ruben Fiszel	029462bc57	nits logs	2024-11-15 01:15:51 +01:00
Ruben Fiszel	089826e5b5	delete venv folder if pip install didn't succeed	2024-11-15 01:11:17 +01:00
pyranota Ruben Fiszel Alexander Petric	f240d1322a	feat: Handle `pip install` by `uv` (#4517 ) * feat: Handle `pip install` by `uv` Dirty and untested, but already something working * Integrate with NSJAIL and prepare fallbacks * Refactor fallback no_uv disable compile and install where no_uv_install and no_uv_compile are a bit more specific * Remove `--disable-pip-version-check` Reason: warning: pip's `--disable-pip-version-check` has no effect * Fix backend compilation error * Pip fallback overwrite UV's cache * Initially refactor cache (No S3) * Support S3 * Remove unused import * Handle flags for NSJAIL * Return deleted flag * Update Dockerfile * Update docker-image.yml * Update docker-image.yml * Add --link-mode=copy and remove -v * Fix NSJAIL INDEX_URL * Fix flock and windows * Update python_executor.rs * Remove line from Dockerfile We dont need it and to trigger build * fixing for windows * Dont pin python to specific version * Change TMP for windows * Revert docker-image.yml * Disable UV for ansible Will be enabled later. Needs proper testing and its better to split onto 2 PRs with first modifying python and second ansible --------- Co-authored-by: Ruben Fiszel <ruben@windmill.dev> Co-authored-by: Alexander Petric <petric.al@gmail.com>	2024-11-15 00:12:56 +01:00
Ruben Fiszelandrubenfiszel	47facb3826	chore(main): release 1.424.0 (#4709 ) * chore(main): release 1.424.0 * Apply automatic changes --------- Co-authored-by: rubenfiszel <rubenfiszel@users.noreply.github.com>	2024-11-14 21:28:20 +01:00
Ruben Fiszel	c44fc4f5ab	fix: deployment callbacks have a concurrency limit of 1 on same path	2024-11-14 21:15:26 +01:00
Ruben Fiszel	2a78359af7	fix: add countCompletedJobs api	2024-11-14 20:44:29 +01:00
Ruben Fiszel	15f1b7cf7d	update openapi	2024-11-14 16:21:07 +01:00
Ruben Fiszel	180bb82643	fix: autoscaling when count < min worker set to min_workers	2024-11-14 16:09:34 +01:00
dieriba dieriba Ruben Fiszel Ruben Fiszel	556b4a41a1	feat: Support mistral anthropic for ai (#4692 ) * wip: openai proxy and other ai proxy integration * fixing migration script * wip: support different ai provider in front, fix proxy openai * wip: adding frontend ai provider * updated copilot types * wip: working on anthropic integration * done AI proxy front * adding new type and support for anthropic * updating gitignore * adding streaming response * added streaming prompt * push lib/gen * wip: fixing anthropic * anthropic fully supported * fix backend missing var error and fully support stream event for anthropic * remove gen directory * fixing openapi file * add support for mistral, and update create workspace components * remove deref.json * remove package-json * openapi * fix ui enable code * added utility function for init workspace ai provider * fix workspace switch bug * update anthropic property and fixed frontend error * fix workspace settings * update error message and fix typo migration file * chore: update openapi file * fix dev file * add .sqlx * all * update sqlx --------- Co-authored-by: dieriba <t.dieriba@gmail.com> Co-authored-by: Ruben Fiszel <ruben@windmill.dev> Co-authored-by: Ruben Fiszel <ruben@rubenfiszel.com>	2024-11-14 14:24:35 +01:00