fix: detect zombie flows with NULL pings and cap suspend timeout at retention period

Flows waiting for a suspended child (e.g. approval step) have running=true
but ping=NULL by design. The zombie flow handler required ping IS NOT NULL,
so these flows were invisible to detection and could stay in the queue
indefinitely, blocking retention cleanup of their completed children.

Two fixes:
1. monitor.rs: Add detection for root flows with NULL pings older than the
   retention period. These are cancelled as zombies with a critical error.
2. worker_flow.rs: Cap suspend_until at the retention period to prevent
   flows from being parked longer than retention allows.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -29,3 +29,4 @@ frontend/.svelte-kit
 backend/chrome_profiler.json
 .fast-check/
 __pycache__/
+.playwright-mcp/

CHANGELOG.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## [1.674.0](https://github.com/windmill-labs/windmill/compare/v1.673.0...v1.674.0) (2026-04-03)
+
+
+### Features
+
+* add application-level heartbeat support for websocket triggers ([#8686](https://github.com/windmill-labs/windmill/issues/8686)) ([5b7fa63](https://github.com/windmill-labs/windmill/commit/5b7fa63bf1800313e9b82465b8a4399a48634371))
+* add Azure Key Vault as secret storage backend ([#8704](https://github.com/windmill-labs/windmill/issues/8704)) ([dcd615f](https://github.com/windmill-labs/windmill/commit/dcd615fdc3c66ec2a8e39c01f8142a7e7c82f534))
+* add http/protobuf support for OTEL exporters ([#8702](https://github.com/windmill-labs/windmill/issues/8702)) ([0aea49f](https://github.com/windmill-labs/windmill/commit/0aea49f9607d5cbb5bcfa3068a179c9b7bf9afd6))
+* add optional labels to scripts, flows, apps, schedules, triggers ([#8609](https://github.com/windmill-labs/windmill/issues/8609)) ([c4c9ef5](https://github.com/windmill-labs/windmill/commit/c4c9ef5fd7b41052b08ee941725434e8ca4ac970))
+* add powershell common parameters support ([#8683](https://github.com/windmill-labs/windmill/issues/8683)) ([0317d58](https://github.com/windmill-labs/windmill/commit/0317d5891cfcfbde7b04795c034c088e933ee3d0))
+* sql.raw in Typescript client ([#8706](https://github.com/windmill-labs/windmill/issues/8706)) ([ce290f6](https://github.com/windmill-labs/windmill/commit/ce290f68db866c07b30c97c2c0b3e39fee0a26d8))
+* Support .ducklake() and .datatable() in agent workers ([#8697](https://github.com/windmill-labs/windmill/issues/8697)) ([fda68a7](https://github.com/windmill-labs/windmill/commit/fda68a72e5dfcded2350d1ff33ca4c695ab337b7))
+
+
+### Bug Fixes
+
+* add secretKeyRef support for jwt_secret and rsa_keys ([#8698](https://github.com/windmill-labs/windmill/issues/8698)) ([ba21470](https://github.com/windmill-labs/windmill/commit/ba214709b94f9467738e66b016331e97ac7d5d10))
+* align script push metadata warning with generated locks ([#8690](https://github.com/windmill-labs/windmill/issues/8690)) ([6656b46](https://github.com/windmill-labs/windmill/commit/6656b46f10408e1c15961a72cde4c13b5c5b3923))
+* debounce S3 proxy logs ([#8694](https://github.com/windmill-labs/windmill/issues/8694)) ([a3073ad](https://github.com/windmill-labs/windmill/commit/a3073ad8244efd9043e27f6731f7b53dbda662c1))
+* dedicated worker dispatch, cross-workspace deps, UI improvements ([#8689](https://github.com/windmill-labs/windmill/issues/8689)) ([bffa61e](https://github.com/windmill-labs/windmill/commit/bffa61e33f2305bbeb79a2c91989a47baa7dff31))
+* gate relock_skip tests on private feature and update ee-repo-ref ([#8703](https://github.com/windmill-labs/windmill/issues/8703)) ([adc9fe7](https://github.com/windmill-labs/windmill/commit/adc9fe722d8511a5914d81faac40af757e7f5e3f))
+* hide deprecated cli metadata commands ([#8699](https://github.com/windmill-labs/windmill/issues/8699)) ([b960598](https://github.com/windmill-labs/windmill/commit/b96059843168c072f24072f93fecd80431e5d4cf))
+* optimize S3 proxy performance ([#8685](https://github.com/windmill-labs/windmill/issues/8685)) ([0cfa462](https://github.com/windmill-labs/windmill/commit/0cfa462c379e887fdb5ad5e3bbff7798648d4e91))
+* pipeline DISCARD ALL with first query on cached pg connections ([#8707](https://github.com/windmill-labs/windmill/issues/8707)) ([6d58d1a](https://github.com/windmill-labs/windmill/commit/6d58d1a74d1e69b163210a795502a7b3931001b5))
+* resolve schedule update deadlock ([#8701](https://github.com/windmill-labs/windmill/issues/8701)) ([27ca417](https://github.com/windmill-labs/windmill/commit/27ca417201c99cf6fe0ae5b52a63c0395033e196))
+* support raw app deployment history ([#8657](https://github.com/windmill-labs/windmill/issues/8657)) ([f234df9](https://github.com/windmill-labs/windmill/commit/f234df97ec3cdc480ee9d403370a3512496b024b))
+* use pre-aggregated stats for telemetry job usage queries ([#8688](https://github.com/windmill-labs/windmill/issues/8688)) ([cdf3c29](https://github.com/windmill-labs/windmill/commit/cdf3c29664e4142c0f4487c07e585d1af3f97f91))
+
+## [1.673.0](https://github.com/windmill-labs/windmill/compare/v1.672.0...v1.673.0) (2026-04-02)
+
+
+### Features
+
+* add endpoint to restart workers in a worker group ([#8659](https://github.com/windmill-labs/windmill/issues/8659)) ([f0437eb](https://github.com/windmill-labs/windmill/commit/f0437eba1925a9aa4c430008027d637a0c89ee39))
+* add Entra ID (Azure Workload Identity) database auth ([#8526](https://github.com/windmill-labs/windmill/issues/8526)) ([6a5cfbc](https://github.com/windmill-labs/windmill/commit/6a5cfbc159a0ad7925fd7ce5eefc8eaa21bbb70b))
+* add LIMIT_WINDOWS_TO_1CU env var for Windows worker memory limits ([#8681](https://github.com/windmill-labs/windmill/issues/8681)) ([d2d6810](https://github.com/windmill-labs/windmill/commit/d2d6810db954114f3333853bd3476cb8fc735f92))
+* restore bun for dedicated workers, fix dispatch & serialization, cross-workspace deps ([#8645](https://github.com/windmill-labs/windmill/issues/8645)) ([619ebb6](https://github.com/windmill-labs/windmill/commit/619ebb65ce8dce8264add31c3147919802a8286a))
+
+
+### Bug Fixes
+
+* add HMAC signature verification to Slack interactive callback endpoint ([#8611](https://github.com/windmill-labs/windmill/issues/8611)) ([55e8a5c](https://github.com/windmill-labs/windmill/commit/55e8a5cff1f185b1dbd332d37b877972efa1ed7d))
+* correct raw app flow inputs ([#8667](https://github.com/windmill-labs/windmill/issues/8667)) ([28c0730](https://github.com/windmill-labs/windmill/commit/28c073056c65d4ed1600e39679497e5af964347f))
+* pass selected language to AI agent when generating flow scripts ([#8680](https://github.com/windmill-labs/windmill/issues/8680)) ([381011a](https://github.com/windmill-labs/windmill/commit/381011a4a8e48454e9c146c64db502293e646b99))
+* poll for preview results to avoid undici headers timeout ([#8682](https://github.com/windmill-labs/windmill/issues/8682)) ([ff5fa9f](https://github.com/windmill-labs/windmill/commit/ff5fa9f64fe4aaf33e06b20f02373894b5df0f95))
+* pre-fix trigger edited_by for superadmins not in workspace ([#8669](https://github.com/windmill-labs/windmill/issues/8669)) ([350ffdc](https://github.com/windmill-labs/windmill/commit/350ffdce297ba5b84f9dd247eede6da0c6b0956c))
+* resolve race condition where flow sync push reverts to stale version ([#8673](https://github.com/windmill-labs/windmill/issues/8673)) ([d569e9e](https://github.com/windmill-labs/windmill/commit/d569e9e29c588243a90b1cd25f866efb0d178640))
+* respect disabled fields in JSON input mode ([#8663](https://github.com/windmill-labs/windmill/issues/8663)) ([7fd0bf9](https://github.com/windmill-labs/windmill/commit/7fd0bf974d2ba2644bb01dd5e9ddc84749e166f5))
+* Run typed pg queries in a single protocol conversation ([#8679](https://github.com/windmill-labs/windmill/issues/8679)) ([8581a33](https://github.com/windmill-labs/windmill/commit/8581a3300d056040b7e3ab77d629c74f034c9c97))
+* sanitize MCP tool schemas for JSON Schema draft 2020-12 compliance ([#8666](https://github.com/windmill-labs/windmill/issues/8666)) ([8c3c97f](https://github.com/windmill-labs/windmill/commit/8c3c97f7a670d47019cc666219f8187f48499672))
+* skip generate-metadata confirmation prompt in non-interactive CI ([#8678](https://github.com/windmill-labs/windmill/issues/8678)) ([39af1b7](https://github.com/windmill-labs/windmill/commit/39af1b75afc8458f85dec4fe51dfaed3d0cb000d))
+* strip f/ prefix from folder paths when deploying from workspace forks ([#8662](https://github.com/windmill-labs/windmill/issues/8662)) ([7ab0ea5](https://github.com/windmill-labs/windmill/commit/7ab0ea581d349fbfdb56d22cf9903a90efa045bb))
+* support branch-specific folder.meta.yaml in missing-meta check ([#8661](https://github.com/windmill-labs/windmill/issues/8661)) ([c87a6a0](https://github.com/windmill-labs/windmill/commit/c87a6a0f2c1346bf5e21f128d32d89bdca039243))
+* validate rd redirect on login with same rules as logout ([#8655](https://github.com/windmill-labs/windmill/issues/8655)) ([bcce627](https://github.com/windmill-labs/windmill/commit/bcce62738791a4e9b9f4dbc64731eef163230172))
+
 ## [1.672.0](https://github.com/windmill-labs/windmill/compare/v1.671.0...v1.672.0) (2026-04-01)
 
 

CLAUDE.md

@@ -26,6 +26,7 @@ Open-source platform for internal tools, workflows, API integrations, background
 - **DB**: `psql postgres://postgres:changeme@localhost:5432/windmill`
 - **Login**: `admin@windmill.dev` / `changeme`
 - **Instance settings**: navigate to `/#superadmin-settings`
+- **Migrations**: use `cargo sqlx migrate add -r <name>` from `backend/` to create new migrations (never generate timestamps manually)
 
 ## Banned Patterns
 

backend/.sqlx/query-0f58d4e7e6f3e962e8a86a2d9feb921c308b6a047530eccd8966513ffdc722d0.json

@@ -34,7 +34,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-11fd92de8688ef6b4d524aade507850a9cb3e097f2d957219d04ad134a5e0399.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO websocket_trigger (\n                workspace_id,\n                path,\n                url,\n                script_path,\n                is_flow,\n                mode,\n                filters,\n                filter_logic,\n                initial_messages,\n                url_runnable_args,\n                edited_by,\n                can_return_message,\n                can_return_error_result,\n                permissioned_as,\n                edited_at,\n                error_handler_path,\n                error_handler_args,\n                retry\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, now(), $15, $16, $17\n            )\n            ",
+  "query": "\n            INSERT INTO websocket_trigger (\n                workspace_id,\n                path,\n                url,\n                script_path,\n                is_flow,\n                mode,\n                filters,\n                filter_logic,\n                initial_messages,\n                url_runnable_args,\n                edited_by,\n                can_return_message,\n                can_return_error_result,\n                permissioned_as,\n                edited_at,\n                error_handler_path,\n                error_handler_args,\n                retry,\n                heartbeat\n            ) VALUES (\n                $1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, now(), $15, $16, $17, $18\n            )\n            ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -32,10 +32,11 @@
         "Varchar",
         "Varchar",
         "Jsonb",
+        "Jsonb",
         "Jsonb"
       ]
     },
     "nullable": []
   },
-  "hash": "6948eb5aabf82f2f4a08dd4410eb472080ecab3ed652912397245e5216ae0389"
+  "hash": "11fd92de8688ef6b4d524aade507850a9cb3e097f2d957219d04ad134a5e0399"
 }

backend/.sqlx/query-19478c2a3c05b2ed17b110f8ff58d48ce3ede5fdd7f8d64840f8c62cf89f99e7.json

@@ -33,7 +33,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-1f1e477b27f38f410b7e6f436ced0751f77f9cb41055481bc06af6827d647041.json

@@ -43,7 +43,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-2effe885aafaa0c5fc1f969b8c6ffbd38c53fb586251ba780b75a007e5a47ed6.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO schedule (\n            workspace_id, path, schedule, timezone, edited_by, script_path,\n            is_flow, args, enabled, email, permissioned_as,\n            on_failure, on_failure_times, on_failure_exact, on_failure_extra_args,\n            on_recovery, on_recovery_times, on_recovery_extra_args,\n            on_success, on_success_extra_args,\n            ws_error_handler_muted, retry, summary, no_flow_overlap,\n            tag, paused_until, cron_version, description, dynamic_skip\n        ) VALUES (\n            $1, $2, $3, $4, $5, $6,\n            $7, $8, $9, $10, $11,\n            $12, $13, $14, $15,\n            $16, $17, $18,\n            $19, $20,\n            $21, $22, $23, $24,\n            $25, $26, $27, $28, $29\n        )\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args  AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip\n        ",
+  "query": "\n        INSERT INTO schedule (\n            workspace_id, path, schedule, timezone, edited_by, script_path,\n            is_flow, args, enabled, email, permissioned_as,\n            on_failure, on_failure_times, on_failure_exact, on_failure_extra_args,\n            on_recovery, on_recovery_times, on_recovery_extra_args,\n            on_success, on_success_extra_args,\n            ws_error_handler_muted, retry, summary, no_flow_overlap,\n            tag, paused_until, cron_version, description, dynamic_skip, labels\n        ) VALUES (\n            $1, $2, $3, $4, $5, $6,\n            $7, $8, $9, $10, $11,\n            $12, $13, $14, $15,\n            $16, $17, $18,\n            $19, $20,\n            $21, $22, $23, $24,\n            $25, $26, $27, $28, $29, $30\n        )\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args  AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip,\n            labels\n        ",
   "describe": {
     "columns": [
       {
@@ -162,6 +162,11 @@
         "ordinal": 31,
         "name": "dynamic_skip",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 32,
+        "name": "labels",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -194,7 +199,8 @@
         "Timestamptz",
         "Text",
         "Text",
-        "Varchar"
+        "Varchar",
+        "TextArray"
       ]
     },
     "nullable": [
@@ -229,8 +235,9 @@
       true,
       true,
       true,
+      true,
       true
     ]
   },
-  "hash": "dd20f94d560238096390371c98ded1f80825a11cd61c0bb431678ad9ab4a138e"
+  "hash": "2effe885aafaa0c5fc1f969b8c6ffbd38c53fb586251ba780b75a007e5a47ed6"
 }

backend/.sqlx/query-32f26d69b15a74fc96dd585f9eb3c998447ca8b97894bb1a2b238f984c1dc588.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET versions = array_append(versions, $1) WHERE path = $2 AND workspace_id = $3 AND (versions[array_upper(versions, 1)] IS DISTINCT FROM $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "32f26d69b15a74fc96dd585f9eb3c998447ca8b97894bb1a2b238f984c1dc588"
+}

backend/.sqlx/query-39426bd3018b390ea2073419884cf6cb506c75e84c65438c9026831eb10d340b.json

@@ -1,19 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource\n            (workspace_id, path, value, description, resource_type, created_by, edited_at)\n            VALUES ($1, $2, $3, $4, $5, $6, now()) ON CONFLICT (workspace_id, path)\n            DO UPDATE SET value = EXCLUDED.value, description = EXCLUDED.description, resource_type = EXCLUDED.resource_type, edited_at = now()",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Jsonb",
-        "Text",
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "39426bd3018b390ea2073419884cf6cb506c75e84c65438c9026831eb10d340b"
-}

backend/.sqlx/query-41f2c271514ee254739c3a097871526adcecdd8729f28c15e0db8cd28eaa8cf0.json

@@ -45,31 +45,36 @@
       },
       {
         "ordinal": 8,
+        "name": "labels",
+        "type_info": "TextArray"
+      },
+      {
+        "ordinal": 9,
         "name": "is_expired",
         "type_info": "Bool"
       },
       {
-        "ordinal": 9,
+        "ordinal": 10,
         "name": "is_refreshed",
         "type_info": "Bool"
       },
       {
-        "ordinal": 10,
+        "ordinal": 11,
         "name": "refresh_error",
         "type_info": "Text"
       },
       {
-        "ordinal": 11,
+        "ordinal": 12,
         "name": "is_linked",
         "type_info": "Bool"
       },
       {
-        "ordinal": 12,
+        "ordinal": 13,
         "name": "is_oauth?",
         "type_info": "Bool"
       },
       {
-        "ordinal": 13,
+        "ordinal": 14,
         "name": "account",
         "type_info": "Int4"
       }
@@ -89,6 +94,7 @@
       false,
       true,
       true,
+      true,
       null,
       null,
       true,

backend/.sqlx/query-45e4d13f5806122faecdb1d9ab18159555b652869a036b006f4a151e999b17b7.json

@@ -42,6 +42,11 @@
         "ordinal": 7,
         "name": "created_by",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "labels",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -57,6 +62,7 @@
       false,
       false,
       true,
+      true,
       true
     ]
   },

backend/.sqlx/query-464895f217536bf713ec381b6c3b7c0417161bf69e596e2e34fc8d9384824776.json

@@ -33,7 +33,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-48efd8f89df9c1dd8f8a4eb2b2640fcb380f2470c8488371b207a42cb7d4cd26.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO variable\n            (workspace_id, path, value, is_secret, description, account, is_oauth, expires_at)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
+  "query": "INSERT INTO variable\n            (workspace_id, path, value, is_secret, description, account, is_oauth, expires_at, labels)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,10 +12,11 @@
         "Varchar",
         "Int4",
         "Bool",
-        "Timestamptz"
+        "Timestamptz",
+        "TextArray"
       ]
     },
     "nullable": []
   },
-  "hash": "2be66f23536223549db9b50025932b6b1bad90b8fa47d97acb7d75aa3c37ef86"
+  "hash": "48efd8f89df9c1dd8f8a4eb2b2640fcb380f2470c8488371b207a42cb7d4cd26"
 }

backend/.sqlx/query-492edd53e497a45c314d41044e85a5e3492227b5049dc6870d60817ad929e7af.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE\n            websocket_trigger\n        SET\n            url = $1,\n            script_path = $2,\n            path = $3,\n            is_flow = $4,\n            filters = $5,\n            filter_logic = $6,\n            initial_messages = $7,\n            url_runnable_args = $8,\n            edited_by = $9,\n            permissioned_as = $10,\n            can_return_message = $11,\n            can_return_error_result = $12,\n            edited_at = now(),\n            server_id = NULL,\n            error = NULL,\n            error_handler_path = $15,\n            error_handler_args = $16,\n            retry = $17\n        WHERE\n            workspace_id = $13 AND path = $14\n    ",
+  "query": "\n        UPDATE\n            websocket_trigger\n        SET\n            url = $1,\n            script_path = $2,\n            path = $3,\n            is_flow = $4,\n            filters = $5,\n            filter_logic = $6,\n            initial_messages = $7,\n            url_runnable_args = $8,\n            edited_by = $9,\n            permissioned_as = $10,\n            can_return_message = $11,\n            can_return_error_result = $12,\n            edited_at = now(),\n            server_id = NULL,\n            error = NULL,\n            error_handler_path = $15,\n            error_handler_args = $16,\n            retry = $17,\n            heartbeat = $18\n        WHERE\n            workspace_id = $13 AND path = $14\n    ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -21,10 +21,11 @@
         "Text",
         "Varchar",
         "Jsonb",
+        "Jsonb",
         "Jsonb"
       ]
     },
     "nullable": []
   },
-  "hash": "e3d4f89ce36337af15d237b543eaca47771b480ff194884f9c947dcaf71d6cf9"
+  "hash": "492edd53e497a45c314d41044e85a5e3492227b5049dc6870d60817ad929e7af"
 }

backend/.sqlx/query-4c333861e736b8138162f0ff3bf2844c71b95c75bd8f173eac51336ab176ccc0.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE variable SET labels = $1 WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4c333861e736b8138162f0ff3bf2844c71b95c75bd8f173eac51336ab176ccc0"
+}

backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json

@@ -70,7 +70,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-51f09f073842a6990535b887d8267fab305c21e4d7703bedbadf405b5c2d7582.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, draft_only, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, draft_only, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "51f09f073842a6990535b887d8267fab305c21e4d7703bedbadf405b5c2d7582"
-}

backend/.sqlx/query-5369258383098062e454539be369ea2f0a41771376720fb72c6b3c1fa4972eab.json

@@ -34,7 +34,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-5387fbfd4be55674dcbe9f9b3ce9649d0f5db125776fbdffea993a53a09708de.json

@@ -40,7 +40,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-5425e2c5e29fc5145dde5ea53d5307ca90d8dd76da2ca560b310b12820be2576.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "WITH inserted_job AS (\n            INSERT INTO v2_job (\n                id, -- 1\n                workspace_id, -- 2\n                raw_code, -- 3\n                raw_lock, -- 4\n                raw_flow, -- 5\n                tag, -- 6\n                parent_job, -- 7\n                created_by, -- 8\n                permissioned_as, -- 9\n                runnable_id, -- 10\n                runnable_path, -- 11\n                args, -- 12\n                kind, -- 13\n                trigger, -- 14\n                script_lang, -- 15\n                same_worker, -- 16\n                pre_run_error, -- 17 \n                permissioned_as_email, -- 18\n                visible_to_owner, -- 19\n                flow_innermost_root_job, -- 20\n                root_job, -- 38\n                concurrent_limit, -- 21\n                concurrency_time_window_s, -- 22\n                timeout, -- 23\n                flow_step_id, -- 24\n                cache_ttl, -- 25\n                priority, -- 26\n                trigger_kind, -- 39\n                script_entrypoint_override, -- 12\n                preprocessed -- 27,\n            ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18,\n            $19, $20, $38, $21, $22, $23, $24, $25, $26, $39::job_trigger_kind,\n            ($12::JSONB)->>'_ENTRYPOINT_OVERRIDE', $27)\n        ),\n        inserted_runtime AS (\n            INSERT INTO v2_job_runtime (id, ping) VALUES ($1, null)\n        ),\n        inserted_job_perms AS (\n            INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, end_user_email) \n            values ($1, $32, $33, $34, $35, $36, $37, $2, $41) \n            ON CONFLICT (job_id) DO UPDATE SET email = EXCLUDED.email, username = EXCLUDED.username, is_admin = EXCLUDED.is_admin, is_operator = EXCLUDED.is_operator, folders = EXCLUDED.folders, groups = EXCLUDED.groups, workspace_id = EXCLUDED.workspace_id, end_user_email = EXCLUDED.end_user_email\n        )\n        INSERT INTO v2_job_queue\n            (workspace_id, id, running, scheduled_for, started_at, tag, priority, cache_ignore_s3_path, runnable_settings_handle)\n            VALUES ($2, $1, $28, COALESCE($29, now()), CASE WHEN $27 OR $40 THEN now() END, $30, $31, $42, $43)",
+  "query": "WITH inserted_job AS (\n            INSERT INTO v2_job (\n                id, -- 1\n                workspace_id, -- 2\n                raw_code, -- 3\n                raw_lock, -- 4\n                raw_flow, -- 5\n                tag, -- 6\n                parent_job, -- 7\n                created_by, -- 8\n                permissioned_as, -- 9\n                runnable_id, -- 10\n                runnable_path, -- 11\n                args, -- 12\n                kind, -- 13\n                trigger, -- 14\n                script_lang, -- 15\n                same_worker, -- 16\n                pre_run_error, -- 17 \n                permissioned_as_email, -- 18\n                visible_to_owner, -- 19\n                flow_innermost_root_job, -- 20\n                root_job, -- 38\n                concurrent_limit, -- 21\n                concurrency_time_window_s, -- 22\n                timeout, -- 23\n                flow_step_id, -- 24\n                cache_ttl, -- 25\n                priority, -- 26\n                trigger_kind, -- 39\n                script_entrypoint_override, -- 12\n                preprocessed, -- 27,\n                labels -- 44\n            ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18,\n            $19, $20, $38, $21, $22, $23, $24, $25, $26, $39::job_trigger_kind,\n            ($12::JSONB)->>'_ENTRYPOINT_OVERRIDE', $27, $44)\n        ),\n        inserted_runtime AS (\n            INSERT INTO v2_job_runtime (id, ping) VALUES ($1, null)\n        ),\n        inserted_job_perms AS (\n            INSERT INTO job_perms (job_id, email, username, is_admin, is_operator, folders, groups, workspace_id, end_user_email) \n            values ($1, $32, $33, $34, $35, $36, $37, $2, $41) \n            ON CONFLICT (job_id) DO UPDATE SET email = EXCLUDED.email, username = EXCLUDED.username, is_admin = EXCLUDED.is_admin, is_operator = EXCLUDED.is_operator, folders = EXCLUDED.folders, groups = EXCLUDED.groups, workspace_id = EXCLUDED.workspace_id, end_user_email = EXCLUDED.end_user_email\n        )\n        INSERT INTO v2_job_queue\n            (workspace_id, id, running, scheduled_for, started_at, tag, priority, cache_ignore_s3_path, runnable_settings_handle)\n            VALUES ($2, $1, $28, COALESCE($29, now()), CASE WHEN $27 OR $40 THEN now() END, $30, $31, $42, $43)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -76,7 +76,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }
@@ -131,10 +132,11 @@
         "Bool",
         "Varchar",
         "Bool",
-        "Int8"
+        "Int8",
+        "TextArray"
       ]
     },
     "nullable": []
   },
-  "hash": "14276a040cb4db88d71fccdc3579e8c0bb132b70668301b535872d1632753e30"
+  "hash": "5425e2c5e29fc5145dde5ea53d5307ca90d8dd76da2ca560b310b12820be2576"
 }

backend/.sqlx/query-5bf200f2c8db25ddf231b564503c6c70f7f3958564a79bb0c6b3863b1ebb0cbf.json

@@ -148,7 +148,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-5c0d0c7111b70b119b3182c9195361388ead36dc6ab03c6a7c17fb97d2b60a67.json

@@ -0,0 +1,66 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                SELECT\n                    NULLIF(script_lang, 'other')::script_lang as \"language: _\",\n                    SUM(job_count)::BIGINT as \"count!\",\n                    SUM(total_duration_ms)::BIGINT as \"total_duration!\"\n                FROM worker_group_job_stats\n                WHERE hour >= $1\n                GROUP BY script_lang\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "language: _",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "count!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "total_duration!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "5c0d0c7111b70b119b3182c9195361388ead36dc6ab03c6a7c17fb97d2b60a67"
+}

backend/.sqlx/query-5ec262094e8ddf420b9098f2b3ef6d2c2caa94f39a0e57fe015e19fd1d0ab0ea.json

@@ -43,7 +43,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-6348061d79b0b6b25bda7425f7a37344e04107f060f949cc197b4df9bca18fb8.json

@@ -0,0 +1,67 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                SELECT\n                    NULLIF(script_lang, 'other')::script_lang as \"language: _\",\n                    SUM(job_count)::BIGINT as \"count!\",\n                    SUM(total_duration_ms)::BIGINT as \"total_duration!\"\n                FROM worker_group_job_stats\n                WHERE hour >= $1 AND hour < $2\n                GROUP BY script_lang\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "language: _",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 1,
+        "name": "count!",
+        "type_info": "Int8"
+      },
+      {
+        "ordinal": 2,
+        "name": "total_duration!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "6348061d79b0b6b25bda7425f7a37344e04107f060f949cc197b4df9bca18fb8"
+}

backend/.sqlx/query-642ca096c1c151fc01445593c8d2ed879a9a7be6ff044a9ce1b581ba725665fe.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE schedule SET\n            enabled = $1,\n            email = $2\n        WHERE path = $3 AND workspace_id = $4\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip\n        ",
+  "query": "\n        UPDATE schedule SET\n            enabled = $1,\n            email = $2\n        WHERE path = $3 AND workspace_id = $4\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip,\n            labels\n        ",
   "describe": {
     "columns": [
       {
@@ -162,6 +162,11 @@
         "ordinal": 31,
         "name": "dynamic_skip",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 32,
+        "name": "labels",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -204,8 +209,9 @@
       true,
       true,
       true,
+      true,
       true
     ]
   },
-  "hash": "ad96768ff61fab1cfb9421683bb13b64f5f157fafe114d50fb910dc36ebe0f91"
+  "hash": "642ca096c1c151fc01445593c8d2ed879a9a7be6ff044a9ce1b581ba725665fe"
 }

backend/.sqlx/query-676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at)\n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "676c758d9c4492dada50edd3ad06dc628e2ba56eab5e1a50c99481da9793759e"
-}

backend/.sqlx/query-6d992a933bb878733b7afd7a4295b9ad6f5276b60ce20e0378d6148976e02777.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                                SELECT\n                                    flow_version.id AS version,\n                                    flow_version.value->>'early_return' as early_return,\n                                    flow_version.value->>'preprocessor_module' IS NOT NULL as has_preprocessor,\n                                    (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled,\n                                    flow.tag,\n                                    flow.dedicated_worker,\n                                    flow.on_behalf_of_email,\n                                    flow.edited_by\n                                FROM\n                                    flow_version\n                                INNER JOIN flow\n                                    ON flow.path = flow_version.path AND\n                                       flow.workspace_id = flow_version.workspace_id\n                                WHERE\n                                    flow_version.workspace_id = $1 AND\n                                    flow_version.path = $2 AND\n                                    flow_version.id = $3\n                            ",
+  "query": "\n                                SELECT\n                                    flow_version.id AS version,\n                                    flow_version.value->>'early_return' as early_return,\n                                    flow_version.value->>'preprocessor_module' IS NOT NULL as has_preprocessor,\n                                    (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled,\n                                    flow.tag,\n                                    flow.dedicated_worker,\n                                    flow.on_behalf_of_email,\n                                    flow.edited_by,\n                                    flow.labels\n                                FROM\n                                    flow_version\n                                INNER JOIN flow\n                                    ON flow.path = flow_version.path AND\n                                       flow.workspace_id = flow_version.workspace_id\n                                WHERE\n                                    flow_version.workspace_id = $1 AND\n                                    flow_version.path = $2 AND\n                                    flow_version.id = $3\n                            ",
   "describe": {
     "columns": [
       {
@@ -42,6 +42,11 @@
         "ordinal": 7,
         "name": "edited_by",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 8,
+        "name": "labels",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -59,8 +64,9 @@
       true,
       true,
       true,
-      false
+      false,
+      true
     ]
   },
-  "hash": "209dc4c1b91eeab1c12ffcd9f9e16f315c689ca772c736b333dcdf07c8086087"
+  "hash": "6d992a933bb878733b7afd7a4295b9ad6f5276b60ce20e0378d6148976e02777"
 }

backend/.sqlx/query-71767e6684957af5dff56a1bb64f980f712f92798d11feaeb0832962ad9ddb2e.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of_email, created_by FROM script\n             WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)\n             ORDER BY created_at DESC LIMIT 1",
+  "query": "select hash, tag, concurrency_key, concurrent_limit, concurrency_time_window_s, debounce_key, debounce_delay_s, cache_ttl, cache_ignore_s3_path, runnable_settings_handle, language as \"language: ScriptLang\", dedicated_worker, priority, timeout, on_behalf_of_email, created_by, labels FROM script\n             WHERE path = $1 AND workspace_id = $2 AND archived = false AND (lock IS NOT NULL OR $3 = false)\n             ORDER BY created_at DESC LIMIT 1",
   "describe": {
     "columns": [
       {
@@ -83,7 +83,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }
@@ -113,6 +114,11 @@
         "ordinal": 15,
         "name": "created_by",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 16,
+        "name": "labels",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -138,8 +144,9 @@
       true,
       true,
       true,
-      false
+      false,
+      true
     ]
   },
-  "hash": "a33673ebc4d1eb4c3513987dbc43e2c80974598e1d9fe7203145bfc29928ba65"
+  "hash": "71767e6684957af5dff56a1bb64f980f712f92798d11feaeb0832962ad9ddb2e"
 }

backend/.sqlx/query-78f7c4efd7be2aad03f0ec67ab882e1f9aaa7141ab75046a71ac789ab659bdc6.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO notify_event (channel, payload) VALUES ('restart_worker_group', $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "78f7c4efd7be2aad03f0ec67ab882e1f9aaa7141ab75046a71ac789ab659bdc6"
+}

backend/.sqlx/query-790d79ec7abe6ebe1092afd9de4c5fc383272d2057ac5b47a7425f095f4e8788.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO script (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, draft_only, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39)",
+  "query": "INSERT INTO script (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, draft_only, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, cache_ignore_s3_path, runnable_settings_handle, modules, labels) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9::text::json, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34, $35, $36, $37, $38, $39, $40)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -44,7 +44,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }
@@ -88,10 +89,11 @@
         "Int4",
         "Bool",
         "Int8",
-        "Jsonb"
+        "Jsonb",
+        "TextArray"
       ]
     },
     "nullable": []
   },
-  "hash": "4d983f1e3e63a1a70edf5d867d9f23f2069a7a4ba1dcc1331ecccdf1c6a95cb8"
+  "hash": "790d79ec7abe6ebe1092afd9de4c5fc383272d2057ac5b47a7425f095f4e8788"
 }

backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json

@@ -76,7 +76,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-86c0ef92652085b93979a8836bedb33a366a84426a115c75f58dcc43ab91705e.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE http_trigger SET labels = $1 WHERE workspace_id = $2 AND path = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "86c0ef92652085b93979a8836bedb33a366a84426a115c75f58dcc43ab91705e"
+}

backend/.sqlx/query-8acc8c47123af84d2308042dcd34d04b941e928c7621e66d3bdc510c335f8c20.json

@@ -41,7 +41,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json

@@ -153,7 +153,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-a1745a4f525b251d2f5a602ab2b2ede46b4471e21b11f607573a844013911abe.json

@@ -118,7 +118,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-a450c5d5fe4bc15e13ea389fadd21a769b029b650a334e48bb3198c049bb92fe.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id, path FROM variable WHERE is_secret = true AND value LIKE '$azure_kv:%'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "a450c5d5fe4bc15e13ea389fadd21a769b029b650a334e48bb3198c049bb92fe"
+}

backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json

@@ -133,7 +133,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-a8bcae108af1eda6efe3a4b8c6f8807bc464a81c0883e68f5a69b89b94b0b34b.json

@@ -38,7 +38,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-a969194571dd3f12e628ce0f01b0ddc09bbcf4506eff2290664c295d16fec4ae.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n    INSERT INTO script\n    (workspace_id, hash, path, parent_hashes, summary, description, content, created_by, schema, is_template, extra_perms, lock, language, kind, tag, draft_only, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels)\n\n    SELECT  workspace_id, $1, path, array_prepend($2::bigint, COALESCE(parent_hashes, '{}'::bigint[])), summary, description, content, created_by, schema, is_template, extra_perms, NULL, language, kind, tag, draft_only, envs, concurrent_limit, concurrency_time_window_s, cache_ttl, cache_ignore_s3_path, dedicated_worker, ws_error_handler_muted, priority, restart_unless_cancelled, delete_after_use, timeout, concurrency_key, visible_to_runner_only, auto_kind, codebase, has_preprocessor, on_behalf_of_email, schema_validation, assets, debounce_key, debounce_delay_s, runnable_settings_handle, modules, labels\n\n    FROM script WHERE hash = $2 AND workspace_id = $3;\n            ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a969194571dd3f12e628ce0f01b0ddc09bbcf4506eff2290664c295d16fec4ae"
+}

backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json

@@ -153,7 +153,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json

@@ -123,7 +123,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-b44afcf1b9c047ac525638f0952c2cb01d65b1b46693331ac157dfca0dab6824.json

@@ -43,7 +43,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-b657b718ec381fbb1d41841c88118b88c4d7ea8f0cde663ed8f8226faf75b0f6.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE app SET labels = $1 WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b657b718ec381fbb1d41841c88118b88c4d7ea8f0cde663ed8f8226faf75b0f6"
+}

backend/.sqlx/query-b6f95b3fd1d0431d96d0409424dbb20cb3020f93454978d078082482b86cbebe.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow (\n        workspace_id, path, summary, description,\n        dependency_job, lock_error_logs, draft_only, tag,\n        dedicated_worker, visible_to_runner_only, on_behalf_of_email,\n        ws_error_handler_muted,\n        value, schema, edited_by, edited_at\n    ) VALUES (\n        $1, $2, $3, $4,\n        NULL, '', $5, $6,\n        $7, $8, $9,\n        $10,\n        $11, $12::text::json, $13, now()\n    )",
+  "query": "INSERT INTO flow (\n        workspace_id, path, summary, description,\n        dependency_job, lock_error_logs, draft_only, tag,\n        dedicated_worker, visible_to_runner_only, on_behalf_of_email,\n        ws_error_handler_muted,\n        value, schema, edited_by, edited_at, labels\n    ) VALUES (\n        $1, $2, $3, $4,\n        NULL, '', $5, $6,\n        $7, $8, $9,\n        $10,\n        $11, $12::text::json, $13, now(), $14\n    )",
   "describe": {
     "columns": [],
     "parameters": {
@@ -17,10 +17,11 @@
         "Bool",
         "Jsonb",
         "Text",
-        "Varchar"
+        "Varchar",
+        "TextArray"
       ]
     },
     "nullable": []
   },
-  "hash": "6bde827da007b470b9d0acccfc3e00ce6aac650b9138a236f34c614eed753849"
+  "hash": "b6f95b3fd1d0431d96d0409424dbb20cb3020f93454978d078082482b86cbebe"
 }

backend/.sqlx/query-b782179261b4054289a1a595f6e06ee2035ae9811bc49abce903a04439baf800.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT unnest(labels) as \"label!\" FROM (\n            SELECT labels FROM script WHERE workspace_id = $1 AND labels IS NOT NULL\n            UNION ALL SELECT labels FROM flow WHERE workspace_id = $1 AND labels IS NOT NULL\n            UNION ALL SELECT labels FROM resource WHERE workspace_id = $1 AND labels IS NOT NULL\n            UNION ALL SELECT labels FROM variable WHERE workspace_id = $1 AND labels IS NOT NULL\n            UNION ALL SELECT labels FROM schedule WHERE workspace_id = $1 AND labels IS NOT NULL\n            UNION ALL SELECT labels FROM app WHERE workspace_id = $1 AND labels IS NOT NULL\n        ) t ORDER BY 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "label!",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "b782179261b4054289a1a595f6e06ee2035ae9811bc49abce903a04439baf800"
+}

backend/.sqlx/query-bd2609f999054c5a2a85f2aafe4005bc22731c27f0bf27b3b06ec426a05eda2e.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE schedule SET\n            schedule                = $1,\n            timezone                = $2,\n            args                    = $3,\n            on_failure              = $4,\n            on_failure_times        = $5,\n            on_failure_exact        = $6,\n            on_failure_extra_args   = $7,\n            on_recovery             = $8,\n            on_recovery_times       = $9,\n            on_recovery_extra_args  = $10,\n            on_success              = $11,\n            on_success_extra_args   = $12,\n            ws_error_handler_muted  = $13,\n            retry                   = $14,\n            summary                 = $15,\n            no_flow_overlap         = $16,\n            tag                     = $17,\n            paused_until            = $18,\n            path                    = $19,\n            workspace_id            = $20,\n            cron_version            = COALESCE($21, cron_version),\n            description             = $22,\n            dynamic_skip            = $23,\n            email                   = $24,\n            edited_by               = $25,\n            permissioned_as         = $26\n        WHERE path = $19 AND workspace_id = $20\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip\n        ",
+  "query": "\n        UPDATE schedule SET\n            schedule                = $1,\n            timezone                = $2,\n            args                    = $3,\n            on_failure              = $4,\n            on_failure_times        = $5,\n            on_failure_exact        = $6,\n            on_failure_extra_args   = $7,\n            on_recovery             = $8,\n            on_recovery_times       = $9,\n            on_recovery_extra_args  = $10,\n            on_success              = $11,\n            on_success_extra_args   = $12,\n            ws_error_handler_muted  = $13,\n            retry                   = $14,\n            summary                 = $15,\n            no_flow_overlap         = $16,\n            tag                     = $17,\n            paused_until            = $18,\n            path                    = $19,\n            workspace_id            = $20,\n            cron_version            = COALESCE($21, cron_version),\n            description             = $22,\n            dynamic_skip            = $23,\n            email                   = $24,\n            edited_by               = $25,\n            permissioned_as         = $26,\n            labels                  = COALESCE($27, labels)\n        WHERE path = $19 AND workspace_id = $20\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            permissioned_as,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip,\n            labels\n        ",
   "describe": {
     "columns": [
       {
@@ -162,6 +162,11 @@
         "ordinal": 31,
         "name": "dynamic_skip",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 32,
+        "name": "labels",
+        "type_info": "TextArray"
       }
     ],
     "parameters": {
@@ -191,7 +196,8 @@
         "Varchar",
         "Varchar",
         "Varchar",
-        "Varchar"
+        "Varchar",
+        "TextArray"
       ]
     },
     "nullable": [
@@ -226,8 +232,9 @@
       true,
       true,
       true,
+      true,
       true
     ]
   },
-  "hash": "54b4c762add9b1ebfdb2a6d5abd6d20e86dc0e6544f0bb22fa4ec68aa54a4dc8"
+  "hash": "bd2609f999054c5a2a85f2aafe4005bc22731c27f0bf27b3b06ec426a05eda2e"
 }

backend/.sqlx/query-bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b.json

@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path, value FROM variable\n           WHERE path LIKE ('u/' || $1 || '/%')\n           AND workspace_id = $2\n           AND is_secret = true\n           AND (value LIKE '$vault:%' OR value LIKE '$azure_kv:%')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "value",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "bda9fc0c6e41d8afebee538e6997c6bad7843f93d0a5780632b02fa215aa404b"
+}

backend/.sqlx/query-bdb53068a223c12c2d317635993e8fda531e69a880d0ebc44fb5f13ac976b67d.json

@@ -40,7 +40,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json

@@ -77,7 +77,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-c06796e8647cf278c6e0809562aaaa872403890eae3e606f379343671c2fff02.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE\n            flow\n        SET\n            path = $1,\n            summary = $2,\n            description = $3,\n            dependency_job = NULL,\n            lock_error_logs = '',\n            draft_only = NULL,\n            tag = $4,\n            dedicated_worker = $5,\n            visible_to_runner_only = $6,\n            on_behalf_of_email = $7,\n            ws_error_handler_muted = $8,\n            value = $9,\n            schema = $10::text::json,\n            edited_by = $11,\n            edited_at = now()\n        WHERE\n            path = $12 AND workspace_id = $13",
+  "query": "\n        UPDATE\n            flow\n        SET\n            path = $1,\n            summary = $2,\n            description = $3,\n            dependency_job = NULL,\n            lock_error_logs = '',\n            draft_only = NULL,\n            tag = $4,\n            dedicated_worker = $5,\n            visible_to_runner_only = $6,\n            on_behalf_of_email = $7,\n            ws_error_handler_muted = $8,\n            value = $9,\n            schema = $10::text::json,\n            edited_by = $11,\n            edited_at = now(),\n            labels = COALESCE($14, labels)\n        WHERE\n            path = $12 AND workspace_id = $13",
   "describe": {
     "columns": [],
     "parameters": {
@@ -17,10 +17,11 @@
         "Text",
         "Varchar",
         "Text",
-        "Text"
+        "Text",
+        "TextArray"
       ]
     },
     "nullable": []
   },
-  "hash": "77ac7257be02fb04c4b3213e2221e6f60621b4b2909d770de744ef5671e12ed9"
+  "hash": "c06796e8647cf278c6e0809562aaaa872403890eae3e606f379343671c2fff02"
 }

backend/.sqlx/query-c569535d4aded82ffef5e5066e24948c8fcdb8d36913775449b982782c8583e9.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT value AS \"value!: Json<Box<RawValue>>\" FROM flow WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "value!: Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c569535d4aded82ffef5e5066e24948c8fcdb8d36913775449b982782c8583e9"
+}

backend/.sqlx/query-cb3862634f18160207ee2621ddfca43f00456a27fda32583846497116f92f96c.json

@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH active_users as (SELECT distinct username as email FROM audit WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n        active_authors as (SELECT distinct email FROM usr WHERE usr.operator IS false AND email IN (SELECT email FROM active_users)),\n        active_authors_agg as (SELECT array_agg(email) as authors FROM active_authors),\n        active_ops_agg as (SELECT array_agg(email) as operators from active_users WHERE email NOT IN (SELECT email FROM active_authors))\n        SELECT active_authors_agg.authors, active_ops_agg.operators, array_length(active_authors_agg.authors, 1) as author_count, array_length(active_ops_agg.operators, 1) as operator_count FROM active_authors_agg, active_ops_agg",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "authors",
+        "type_info": "VarcharArray"
+      },
+      {
+        "ordinal": 1,
+        "name": "operators",
+        "type_info": "VarcharArray"
+      },
+      {
+        "ordinal": 2,
+        "name": "author_count",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 3,
+        "name": "operator_count",
+        "type_info": "Int4"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "cb3862634f18160207ee2621ddfca43f00456a27fda32583846497116f92f96c"
+}

backend/.sqlx/query-d1dcc7fc8a1e1bc4dad263ec5163a94fca9dd95cc3b26b33611eab9d2a261141.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT args as \"args: sqlx::types::Json<Box<RawValue>>\"\n                        FROM v2_job\n                        WHERE id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "args: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "d1dcc7fc8a1e1bc4dad263ec5163a94fca9dd95cc3b26b33611eab9d2a261141"
+}

backend/.sqlx/query-d22f81df67d55b2d8f1d15404194a7b4604171d12c6a4620514c6d030086936d.json

@@ -68,7 +68,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json

@@ -77,7 +77,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-ddda19024473b4e5b1d450bf56c667056f6b3696dea7d73758e53f825bfce13e.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n                (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels)\n            SELECT workspace_id, $1, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, labels\n                FROM flow\n                WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "ddda19024473b4e5b1d450bf56c667056f6b3696dea7d73758e53f825bfce13e"
+}

backend/.sqlx/query-deac41298e8b0d0870e314fef0813c24dd55d63bda78a0a5f35ed6f22bea6bef.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource\n            (workspace_id, path, value, description, resource_type, created_by, edited_at, labels)\n            VALUES ($1, $2, $3, $4, $5, $6, now(), $7) ON CONFLICT (workspace_id, path)\n            DO UPDATE SET value = EXCLUDED.value, description = EXCLUDED.description, resource_type = EXCLUDED.resource_type, edited_at = now(), labels = EXCLUDED.labels",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Jsonb",
+        "Text",
+        "Varchar",
+        "Varchar",
+        "TextArray"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "deac41298e8b0d0870e314fef0813c24dd55d63bda78a0a5f35ed6f22bea6bef"
+}

backend/.sqlx/query-e4836a1ee97e4723bddc28b94e23a54b6aa1f458f3ecca8f35432153e54b143d.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO app\n            (workspace_id, path, summary, policy, versions, draft_only, custom_path)\n            VALUES ($1, $2, $3, $4, '{}', $5, $6) RETURNING id",
+  "query": "INSERT INTO app\n            (workspace_id, path, summary, policy, versions, draft_only, custom_path, labels)\n            VALUES ($1, $2, $3, $4, '{}', $5, $6, $7) RETURNING id",
   "describe": {
     "columns": [
       {
@@ -16,12 +16,13 @@
         "Varchar",
         "Jsonb",
         "Bool",
-        "Text"
+        "Text",
+        "TextArray"
       ]
     },
     "nullable": [
       false
     ]
   },
-  "hash": "6b53f7c4bb73177316d6134698f3979f51b53dcd4d8ec50d312c9e7fe31ad5f5"
+  "hash": "e4836a1ee97e4723bddc28b94e23a54b6aa1f458f3ecca8f35432153e54b143d"
 }

backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json

@@ -133,7 +133,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-edd6c09b7f012588788fd3c572d20eb439a80d52ae75ebd25128ffce759cd313.json

@@ -0,0 +1,64 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT workspace_id, name, language AS \"language: windmill_common::scripts::ScriptLang\"\n           FROM workspace_dependencies\n           WHERE archived = false\n           ORDER BY workspace_id, name",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "language: windmill_common::scripts::ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang"
+              ]
+            }
+          }
+        }
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "edd6c09b7f012588788fd3c572d20eb439a80d52ae75ebd25128ffce759cd313"
+}

backend/.sqlx/query-f0858450021df721d8a48b1b5dc887c5424562acd9769c80c5899193ef16b56b.json

@@ -0,0 +1,72 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT ON (workspace_id, path)\n                  workspace_id, path, language AS \"language: windmill_common::scripts::ScriptLang\", content\n           FROM script\n           WHERE archived = false\n             AND dedicated_worker = true\n             AND language = ANY($1::text[]::SCRIPT_LANG[])\n           ORDER BY workspace_id, path, created_at DESC",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "workspace_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "language: windmill_common::scripts::ScriptLang",
+        "type_info": {
+          "Custom": {
+            "name": "script_lang",
+            "kind": {
+              "Enum": [
+                "python3",
+                "deno",
+                "go",
+                "bash",
+                "postgresql",
+                "nativets",
+                "bun",
+                "mysql",
+                "bigquery",
+                "snowflake",
+                "graphql",
+                "powershell",
+                "mssql",
+                "php",
+                "bunnative",
+                "rust",
+                "ansible",
+                "csharp",
+                "oracledb",
+                "nu",
+                "java",
+                "duckdb",
+                "ruby",
+                "rlang"
+              ]
+            }
+          }
+        }
+      },
+      {
+        "ordinal": 3,
+        "name": "content",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false
+    ]
+  },
+  "hash": "f0858450021df721d8a48b1b5dc887c5424562acd9769c80c5899193ef16b56b"
+}

backend/.sqlx/query-f2bd875385052618533c868bee309de8863a5d10a482f012ee790eda64e88211.json

@@ -40,7 +40,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-f2fa27ed5020aa9c085176b25466be1bceb79c82e7b5542f17b23b6d70cc02d6.json

@@ -38,7 +38,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }
@@ -84,7 +85,8 @@
                       "nu",
                       "java",
                       "duckdb",
-                      "ruby"
+                      "ruby",
+                      "rlang"
                     ]
                   }
                 }

backend/.sqlx/query-f4af0affaed3b1d30f5c6f4ddf4114718468fbf75ef13c6087c2f57fbbe0b82f.json

@@ -33,7 +33,8 @@
                 "nu",
                 "java",
                 "duckdb",
-                "ruby"
+                "ruby",
+                "rlang"
               ]
             }
           }

backend/.sqlx/query-f6f850c419771b193f506ceca63de805cbe6bdee314ca40d912010db307bd13e.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE resource SET labels = $1 WHERE path = $2 AND workspace_id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "TextArray",
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f6f850c419771b193f506ceca63de805cbe6bdee314ca40d912010db307bd13e"
+}

backend/Cargo.lock

@@ -2108,7 +2108,7 @@ dependencies = [
  "rayon",
  "safetensors",
  "thiserror 2.0.18",
- "yoke 0.8.1",
+ "yoke 0.8.2",
  "zip",
 ]
 
@@ -2189,9 +2189,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.58"
+version = "1.2.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
+checksum = "b7a4d3ec6524d28a329fc53654bbadc9bdd7b0431f5d65f1a56ffb28a1ee5283"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2373,9 +2373,9 @@ dependencies = [
 
 [[package]]
 name = "cmov"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de0758edba32d61d1fd9f4d69491b47604b91ee2f7e6b33de7e54ca4ebe55dc3"
+checksum = "3f88a43d011fc4a6876cb7344703e297c71dda42494fee094d5f7c76bf13f746"
 
 [[package]]
 name = "codespan-reporting"
@@ -2805,9 +2805,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.0"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1005a6d4446f5120ef475ad3d2af2b30c49c2c9c6904258e3bb30219bebed5e4"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
  "cmov",
 ]
@@ -7224,22 +7224,23 @@ dependencies = [
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
- "yoke 0.8.1",
+ "utf8_iter",
+ "yoke 0.8.2",
  "zerofrom",
  "zerovec",
 ]
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -7250,9 +7251,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -7264,15 +7265,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -7284,20 +7285,20 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
  "writeable",
- "yoke 0.8.1",
+ "yoke 0.8.2",
  "zerofrom",
  "zerotrie",
  "zerovec",
@@ -8046,9 +8047,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.184"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af"
 
 [[package]]
 name = "libffi"
@@ -8204,9 +8205,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "litrs"
@@ -10427,9 +10428,9 @@ dependencies = [
 
 [[package]]
 name = "potential_utf"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -12117,6 +12118,15 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ece8e78b2f38ec51c51f5d475df0a7187ba5111b2a28bdc761ee05b075d40a71"
 
+[[package]]
+name = "scc"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
+dependencies = [
+ "sdd",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -12222,6 +12232,12 @@ dependencies = [
  "untrusted 0.9.0",
 ]
 
+[[package]]
+name = "sdd"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
+
 [[package]]
 name = "seahash"
 version = "4.1.0"
@@ -12558,6 +12574,32 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serial_test"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+dependencies = [
+ "futures-executor",
+ "futures-util",
+ "log",
+ "once_cell",
+ "parking_lot",
+ "scc",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -14235,9 +14277,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -14625,9 +14667,9 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.1.1+spec-1.1.0"
+version = "1.1.2+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39ca317ebc49f06bd748bfba29533eac9485569dc9bf80b849024b025e814fb9"
+checksum = "a2abe9b86193656635d2411dc43050282ca48aa31c2451210f4202550afb7526"
 dependencies = [
  "winnow 1.0.1",
 ]
@@ -15941,7 +15983,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15970,6 +16012,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "serde_yml",
+ "serial_test",
  "sha1",
  "sha2 0.10.9",
  "sql-builder",
@@ -16019,7 +16062,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16032,7 +16075,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -16173,7 +16216,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16196,7 +16239,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16209,7 +16252,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16235,7 +16278,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -16245,7 +16288,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16262,7 +16305,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "base64 0.22.1",
@@ -16285,7 +16328,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16308,7 +16351,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16324,7 +16367,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16344,7 +16387,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16364,7 +16407,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16378,7 +16421,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16409,7 +16452,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16434,7 +16477,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "flate2",
@@ -16452,7 +16495,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16474,7 +16517,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16494,7 +16537,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16524,7 +16567,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16551,7 +16594,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -16563,7 +16606,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "argon2",
  "axum 0.8.4",
@@ -16588,7 +16631,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16602,7 +16645,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "axum 0.8.4",
  "chrono",
@@ -16634,7 +16677,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -16648,7 +16691,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "axum 0.8.4",
@@ -16667,7 +16710,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "aes-gcm",
  "aho-corasick",
@@ -16769,7 +16812,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -16788,7 +16831,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "regex",
  "serde",
@@ -16803,7 +16846,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -16827,7 +16870,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -16844,7 +16887,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -16860,7 +16903,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16881,7 +16924,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16912,7 +16955,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-oauth2",
@@ -16936,7 +16979,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -16970,7 +17013,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -16988,7 +17031,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -16997,7 +17040,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17009,7 +17052,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17021,7 +17064,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -17033,7 +17076,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17045,7 +17088,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17057,7 +17100,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -17068,7 +17111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17079,7 +17122,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -17091,7 +17134,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-asset"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17102,7 +17145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17124,7 +17167,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-r"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -17136,7 +17179,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17150,7 +17193,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -17167,7 +17210,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17180,7 +17223,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql-asset"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -17192,7 +17235,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -17210,7 +17253,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts-asset"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "serde-wasm-bindgen",
@@ -17226,7 +17269,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-wac"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "rustpython-ast",
@@ -17242,7 +17285,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -17253,7 +17296,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17290,7 +17333,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -17328,7 +17371,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "getrandom 0.3.4",
  "wasm-bindgen",
@@ -17339,7 +17382,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17368,7 +17411,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17392,7 +17435,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17425,7 +17468,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17445,7 +17488,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17479,7 +17522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17515,7 +17558,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17538,7 +17581,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17562,7 +17605,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -17586,7 +17629,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17621,7 +17664,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17649,7 +17692,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17672,7 +17715,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "bitflags 2.9.4",
@@ -17691,7 +17734,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -17795,13 +17838,14 @@ dependencies = [
  "windmill-runtime-nativets",
  "windmill-types",
  "windmill-worker-volumes",
+ "windows 0.61.3",
  "x509-parser 0.16.0",
  "yaml-rust",
 ]
 
 [[package]]
 name = "windmill-worker-volumes"
-version = "1.672.0"
+version = "1.674.0"
 dependencies = [
  "bytes",
  "futures",
@@ -18501,9 +18545,9 @@ dependencies = [
 
 [[package]]
 name = "writeable"
-version = "0.6.2"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "wtf8"
@@ -18636,12 +18680,12 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
- "yoke-derive 0.8.1",
+ "yoke-derive 0.8.2",
  "zerofrom",
 ]
 
@@ -18659,9 +18703,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -18691,18 +18735,18 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "69faa1f2a1ea75661980b013019ed6687ed0e83d069bc1114e2cc74c6c04c4df"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -18732,31 +18776,31 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
- "yoke 0.8.1",
+ "yoke 0.8.2",
  "zerofrom",
 ]
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
- "yoke 0.8.1",
+ "yoke 0.8.2",
  "zerofrom",
  "zerovec-derive",
 ]
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.672.0"
+version = "1.674.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -85,7 +85,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal", "./parsers/windmill-parser-wasm"]
 
 [workspace.package]
-version = "1.672.0"
+version = "1.674.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -267,6 +267,7 @@ windmill-types.workspace = true
 opentelemetry = { workspace = true }
 opentelemetry_sdk = { workspace = true }
 windmill-trigger.workspace = true
+serial_test = "3"
 windmill-trigger-websocket.workspace = true
 windmill-trigger-postgres.workspace = true
 windmill-trigger-mqtt.workspace = true
@@ -577,7 +578,7 @@ async-stream = "^0"
 opentelemetry = "0.30.0"
 tracing-opentelemetry = "0.31.0"
 opentelemetry_sdk = { version = "0.30.0", features = ["rt-tokio", "testing"] }
-opentelemetry-otlp = { version = "0.30.0", features = ["grpc-tonic", "tls"] }
+opentelemetry-otlp = { version = "0.30.0", features = ["grpc-tonic", "tls", "http-proto"] }
 opentelemetry-appender-tracing = "0.30.0"
 opentelemetry-semantic-conventions = { version = "0.30.0", features = ["semconv_experimental"] }
 opentelemetry-proto = { version = "0.30.0", features = ["with-serde", "gen-tonic"] }

backend/ee-repo-ref.txt

@@ -1 +1 @@
-e08a87450627bef9013498e40ee93a47bedda7ee
+504dcbc89529fac09af7ce39a14d3ec83555e070

backend/migrations/20260330000000_add_labels.down.sql

@@ -0,0 +1,16 @@
+ALTER TABLE script DROP COLUMN IF EXISTS labels;
+ALTER TABLE flow DROP COLUMN IF EXISTS labels;
+ALTER TABLE app DROP COLUMN IF EXISTS labels;
+ALTER TABLE raw_app DROP COLUMN IF EXISTS labels;
+ALTER TABLE schedule DROP COLUMN IF EXISTS labels;
+ALTER TABLE http_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE websocket_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE kafka_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE nats_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE mqtt_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE postgres_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE sqs_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE gcp_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE email_trigger DROP COLUMN IF EXISTS labels;
+ALTER TABLE resource DROP COLUMN IF EXISTS labels;
+ALTER TABLE variable DROP COLUMN IF EXISTS labels;

backend/migrations/20260330000000_add_labels.up.sql

@@ -0,0 +1,33 @@
+ALTER TABLE script ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE flow ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE app ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE raw_app ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE schedule ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE http_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE websocket_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE kafka_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE nats_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE mqtt_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE postgres_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE sqs_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE gcp_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE email_trigger ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE resource ADD COLUMN IF NOT EXISTS labels text[];
+ALTER TABLE variable ADD COLUMN IF NOT EXISTS labels text[];
+
+CREATE INDEX IF NOT EXISTS idx_script_labels ON script USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_flow_labels ON flow USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_app_labels ON app USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_raw_app_labels ON raw_app USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_schedule_labels ON schedule USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_resource_labels ON resource USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_variable_labels ON variable USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_http_trigger_labels ON http_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_websocket_trigger_labels ON websocket_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_kafka_trigger_labels ON kafka_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_nats_trigger_labels ON nats_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_mqtt_trigger_labels ON mqtt_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_postgres_trigger_labels ON postgres_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_sqs_trigger_labels ON sqs_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_gcp_trigger_labels ON gcp_trigger USING GIN (labels) WHERE labels IS NOT NULL;
+CREATE INDEX IF NOT EXISTS idx_email_trigger_labels ON email_trigger USING GIN (labels) WHERE labels IS NOT NULL;

backend/migrations/20260401101637_bun_dedicated_nodejs_annotation.down.sql

@@ -0,0 +1,6 @@
+-- Remove the //nodejs annotation that was prepended by the up migration.
+-- Only removes it if it's at the very start of the content.
+UPDATE script
+SET content = regexp_replace(content, E'^//nodejs\n// dedicated workers were previously running in nodejs mode by default, remove this annotation to use bun\n', '')
+WHERE language = 'bun'
+  AND dedicated_worker = true;

backend/migrations/20260401101637_bun_dedicated_nodejs_annotation.up.sql

@@ -0,0 +1,10 @@
+-- Bun dedicated workers were previously forced to run in nodejs mode at runtime.
+-- Now that bun is the default again, add the //nodejs annotation to existing
+-- bun dedicated scripts that don't already have it, so their behavior is preserved.
+UPDATE script
+SET content = '//nodejs
+// dedicated workers were previously running in nodejs mode by default, remove this annotation to use bun
+' || content
+WHERE language = 'bun'
+  AND dedicated_worker = true
+  AND content !~ '^//\s*nodejs';

backend/migrations/20260402213045_websocket_heartbeat.down.sql

@@ -0,0 +1 @@
+ALTER TABLE websocket_trigger DROP COLUMN heartbeat;

backend/migrations/20260402213045_websocket_heartbeat.up.sql

@@ -0,0 +1 @@
+ALTER TABLE websocket_trigger ADD COLUMN heartbeat JSONB NULL;

backend/parsers/windmill-parser-bash/src/lib.rs

@@ -22,22 +22,82 @@ pub fn parse_bash_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing bash script".to_string()))
     }
 }
 
+/// PowerShell common parameter names that are automatically added by [CmdletBinding()].
+/// These should be filtered from the parsed signature since they are not user-defined.
+const POWERSHELL_COMMON_PARAMS: &[&str] = &[
+    "verbose",
+    "debug",
+    "erroraction",
+    "errorvariable",
+    "informationaction",
+    "informationvariable",
+    "outvariable",
+    "outbuffer",
+    "pipelinevariable",
+    "warningaction",
+    "warningvariable",
+    "whatif",
+    "confirm",
+    "progressaction",
+];
+
+/// Detects whether the script uses [CmdletBinding()] and whether it declares SupportsShouldProcess.
+fn detect_cmdlet_binding(code: &str) -> (bool, bool) {
+    let attr_region = match extract_powershell_param_block_with_attributes(code, true) {
+        Some((region, _)) => region,
+        None => return (false, false),
+    };
+    // Strip comment lines to avoid false positives from commented-out [CmdletBinding()]
+    let uncommented: String = attr_region
+        .lines()
+        .filter(|line| !line.trim_start().starts_with('#'))
+        .collect::<Vec<_>>()
+        .join("\n");
+    let lower = uncommented.to_lowercase();
+    let has_cmd_binding = lower.contains("[cmdletbinding");
+    let supports_should_process = has_cmd_binding
+        && lower.contains("supportsshouldprocess")
+        && !lower.contains("supportsshouldprocess=$false")
+        && !lower.contains("supportsshouldprocess = $false");
+    (has_cmd_binding, supports_should_process)
+}
+
 pub fn parse_powershell_sig(code: &str) -> anyhow::Result<MainArgSignature> {
     let parsed = parse_powershell_file(&code)?;
-    if let Some(x) = parsed {
-        let args = x;
+    if let Some(args) = parsed {
+        let (has_cmd_binding, supports_should_process) = detect_cmdlet_binding(code);
+
+        // Filter out common parameters only when CmdletBinding is present
+        // (without CmdletBinding, $Verbose etc. are regular user-defined parameters)
+        let args = if has_cmd_binding {
+            args.into_iter()
+                .filter(|arg| !POWERSHELL_COMMON_PARAMS.contains(&arg.name.to_lowercase().as_str()))
+                .collect()
+        } else {
+            args
+        };
+
         Ok(MainArgSignature {
             star_args: false,
             star_kwargs: false,
             args,
             auto_kind: None,
             has_preprocessor: None,
+            has_cmd_binding: if has_cmd_binding { Some(true) } else { None },
+            supports_should_process: if supports_should_process {
+                Some(true)
+            } else {
+                None
+            },
+
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing powershell script".to_string()))
@@ -96,7 +156,10 @@ fn parse_bash_file(code: &str) -> anyhow::Result<Option<Vec<Arg>>> {
 /// This function uses the existing extract_powershell_param_block validation, which already
 /// ensures that only comments, whitespace, and attributes appear before param. So we can
 /// simply return everything from the beginning to the end of the param block.
-pub fn extract_powershell_param_block_with_attributes(code: &str, include_attributes: bool) -> Option<(&str, &str)> {
+pub fn extract_powershell_param_block_with_attributes(
+    code: &str,
+    include_attributes: bool,
+) -> Option<(&str, &str)> {
     // First, use the existing function to validate and find the param block
     let param_block = extract_powershell_param_block(code, true)?;
 
@@ -450,11 +513,15 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
 
                                 // Check if this is a Parameter attribute with Mandatory (case-insensitive)
                                 let lower = bracket_content.to_lowercase();
-                                if lower.starts_with("parameter(") || lower.starts_with("parameter ") {
+                                if lower.starts_with("parameter(")
+                                    || lower.starts_with("parameter ")
+                                {
                                     // Check for Mandatory (case-insensitive)
                                     if lower.contains("mandatory") {
                                         // Check if it's explicitly set to false
-                                        if !lower.contains("mandatory=$false") && !lower.contains("mandatory = $false") {
+                                        if !lower.contains("mandatory=$false")
+                                            && !lower.contains("mandatory = $false")
+                                        {
                                             is_mandatory = true;
                                         }
                                     }
@@ -471,7 +538,11 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
                                 // Check if this looks like a type (simple word, possibly with [])
                                 let is_type = !bracket_content.contains('(')
                                     && !bracket_content.contains('=')
-                                    && (bracket_content.chars().next().unwrap_or(' ').is_alphabetic()
+                                    && (bracket_content
+                                        .chars()
+                                        .next()
+                                        .unwrap_or(' ')
+                                        .is_alphabetic()
                                         || bracket_content.starts_with('['));
 
                                 if is_type && !found_dollar {
@@ -529,7 +600,9 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
 
                         while let Some((i, ch)) = chars.peek().copied() {
                             if in_string {
-                                if ch == string_char && content.chars().nth(i.saturating_sub(1)) != Some('`') {
+                                if ch == string_char
+                                    && content.chars().nth(i.saturating_sub(1)) != Some('`')
+                                {
                                     in_string = false;
                                     default_end = i + 1;
                                     chars.next();
@@ -544,7 +617,9 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
                                 chars.next();
                             } else if ch == ',' {
                                 break;
-                            } else if ch.is_whitespace() && chars.clone().skip(1).next().map(|(_, c)| c) == Some(',') {
+                            } else if ch.is_whitespace()
+                                && chars.clone().skip(1).next().map(|(_, c)| c) == Some(',')
+                            {
                                 break;
                             } else {
                                 default_end = i + 1;
@@ -552,12 +627,19 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
                             }
                         }
 
-                        default_value = Some(content[default_start..default_end].trim().to_string());
+                        default_value =
+                            Some(content[default_start..default_end].trim().to_string());
                     }
                     ',' => {
                         // End of parameter, finalize it
                         if let Some(name) = var_name.take() {
-                            args.push(finalize_parameter(name, type_annotation.take(), default_value.take(), is_mandatory, validate_set.take())?);
+                            args.push(finalize_parameter(
+                                name,
+                                type_annotation.take(),
+                                default_value.take(),
+                                is_mandatory,
+                                validate_set.take(),
+                            )?);
                         }
 
                         // Reset for next parameter
@@ -576,7 +658,13 @@ fn parse_powershell_parameters(content: &str) -> anyhow::Result<Vec<Arg>> {
 
     // Finalize last parameter
     if let Some(name) = var_name {
-        args.push(finalize_parameter(name, type_annotation, default_value, is_mandatory, validate_set)?);
+        args.push(finalize_parameter(
+            name,
+            type_annotation,
+            default_value,
+            is_mandatory,
+            validate_set,
+        )?);
     }
 
     Ok(args)
@@ -722,7 +810,8 @@ non_required="${5:-}"
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                ..Default::default()
             }
         );
 
@@ -813,14 +902,19 @@ non_required="${5:-}"
                     Arg {
                         otyp: Some("string".to_string()), // [string] (last type bracket with Mandatory and ValidateSet)
                         name: "Message".to_string(),
-                        typ: Typ::Str(Some(vec!["Green".to_string(), "Blue".to_string(), "Red".to_string()])), // ValidateSet enum
+                        typ: Typ::Str(Some(vec![
+                            "Green".to_string(),
+                            "Blue".to_string(),
+                            "Red".to_string()
+                        ])), // ValidateSet enum
                         default: None,
                         has_default: false, // Required (Mandatory attribute)
                         oidx: None
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                ..Default::default()
             }
         );
         Ok(())
@@ -970,19 +1064,13 @@ non_required="${5:-}"
 
         // Valid: CmdletBinding with comments
         assert_eq!(
-            extract_powershell_param_block(
-                "# My function\n[CmdletBinding()]\nparam($Name)",
-                false
-            ),
+            extract_powershell_param_block("# My function\n[CmdletBinding()]\nparam($Name)", false),
             Some("$Name")
         );
 
         // Valid: CmdletBinding with whitespace variations
         assert_eq!(
-            extract_powershell_param_block(
-                "[CmdletBinding()]  \n  param($Name)",
-                false
-            ),
+            extract_powershell_param_block("[CmdletBinding()]  \n  param($Name)", false),
             Some("$Name")
         );
 
@@ -1204,17 +1292,32 @@ param(
         // Test with CmdletBinding with parameters
         let code3 = "[CmdletBinding(DefaultParameterSetName='ByName')]\nparam($Name, $Id)";
         let result3 = extract_powershell_param_block_with_attributes(code3, true);
-        assert_eq!(result3, Some(("[CmdletBinding(DefaultParameterSetName='ByName')]\nparam($Name, $Id)", "")));
+        assert_eq!(
+            result3,
+            Some((
+                "[CmdletBinding(DefaultParameterSetName='ByName')]\nparam($Name, $Id)",
+                ""
+            ))
+        );
 
         // Test with multiple attributes
         let code4 = "[CmdletBinding()]\n[OutputType([string])]\nparam($Value)";
         let result4 = extract_powershell_param_block_with_attributes(code4, true);
-        assert_eq!(result4, Some(("[CmdletBinding()]\n[OutputType([string])]\nparam($Value)", "")));
+        assert_eq!(
+            result4,
+            Some((
+                "[CmdletBinding()]\n[OutputType([string])]\nparam($Value)",
+                ""
+            ))
+        );
 
         // Test with comment before attributes
         let code5 = "# My function\n[CmdletBinding()]\nparam($Name)";
         let result5 = extract_powershell_param_block_with_attributes(code5, true);
-        assert_eq!(result5, Some(("# My function\n[CmdletBinding()]\nparam($Name)", "")));
+        assert_eq!(
+            result5,
+            Some(("# My function\n[CmdletBinding()]\nparam($Name)", ""))
+        );
 
         // Test with include_attributes = false (should only get param block, not attributes)
         let code6 = "[CmdletBinding()]\nparam($Name)";
@@ -1224,7 +1327,10 @@ param(
         // Test with code after param
         let code7 = "[CmdletBinding()]\nparam($Name)\nWrite-Host 'Hello'";
         let result7 = extract_powershell_param_block_with_attributes(code7, true);
-        assert_eq!(result7, Some(("[CmdletBinding()]\nparam($Name)", "\nWrite-Host 'Hello'")));
+        assert_eq!(
+            result7,
+            Some(("[CmdletBinding()]\nparam($Name)", "\nWrite-Host 'Hello'"))
+        );
 
         // Test with code after param (without attributes)
         let code8 = "[CmdletBinding()]\nparam($Name)\nWrite-Host 'Hello'";
@@ -1392,10 +1498,85 @@ param(
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                ..Default::default()
             }
         );
 
         Ok(())
     }
+
+    #[test]
+    fn test_detect_cmdlet_binding() {
+        // Basic CmdletBinding
+        let (has_cb, has_ssp) = detect_cmdlet_binding("[CmdletBinding()]\nparam($Name)");
+        assert!(has_cb);
+        assert!(!has_ssp);
+
+        // CmdletBinding with SupportsShouldProcess
+        let (has_cb, has_ssp) =
+            detect_cmdlet_binding("[CmdletBinding(SupportsShouldProcess=$true)]\nparam($Path)");
+        assert!(has_cb);
+        assert!(has_ssp);
+
+        // CmdletBinding with SupportsShouldProcess=false
+        let (has_cb, has_ssp) =
+            detect_cmdlet_binding("[CmdletBinding(SupportsShouldProcess=$false)]\nparam($Path)");
+        assert!(has_cb);
+        assert!(!has_ssp);
+
+        // No CmdletBinding
+        let (has_cb, has_ssp) = detect_cmdlet_binding("param($Name)");
+        assert!(!has_cb);
+        assert!(!has_ssp);
+
+        // Case insensitive
+        let (has_cb, has_ssp) =
+            detect_cmdlet_binding("[cmdletbinding(supportsshouldprocess=$true)]\nparam($X)");
+        assert!(has_cb);
+        assert!(has_ssp);
+
+        // Commented out CmdletBinding should NOT be detected
+        let (has_cb, has_ssp) =
+            detect_cmdlet_binding("# [CmdletBinding(SupportsShouldProcess=$true)]\nparam($Path)");
+        assert!(!has_cb);
+        assert!(!has_ssp);
+    }
+
+    #[test]
+    fn test_powershell_common_param_filtering() -> anyhow::Result<()> {
+        // Common parameters declared in param() should be filtered out
+        let code = r#"[CmdletBinding()]
+param(
+    [string]$Name,
+    [switch]$Verbose,
+    [string]$ErrorAction,
+    [int]$Age
+)"#;
+        let sig = parse_powershell_sig(code)?;
+        assert_eq!(sig.args.len(), 2);
+        assert_eq!(sig.args[0].name, "Name");
+        assert_eq!(sig.args[1].name, "Age");
+        assert_eq!(sig.has_cmd_binding, Some(true));
+        assert_eq!(sig.supports_should_process, None);
+        Ok(())
+    }
+
+    #[test]
+    fn test_powershell_sig_cmdlet_binding_metadata() -> anyhow::Result<()> {
+        // Script without CmdletBinding
+        let code = "param([string]$Name)";
+        let sig = parse_powershell_sig(code)?;
+        assert_eq!(sig.has_cmd_binding, None);
+        assert_eq!(sig.supports_should_process, None);
+
+        // Script with CmdletBinding + SupportsShouldProcess
+        let code = "[CmdletBinding(SupportsShouldProcess=$true)]\nparam([string]$Path)";
+        let sig = parse_powershell_sig(code)?;
+        assert_eq!(sig.has_cmd_binding, Some(true));
+        assert_eq!(sig.supports_should_process, Some(true));
+        assert_eq!(sig.args.len(), 1);
+        assert_eq!(sig.args[0].name, "Path");
+        Ok(())
+    }
 }

backend/parsers/windmill-parser-csharp/src/lib.rs

@@ -89,6 +89,7 @@ pub fn parse_csharp_sig_meta(code: &str) -> anyhow::Result<CsharpMainSigMeta> {
         args,
         has_preprocessor: None,
         auto_kind,
+        ..Default::default()
     };
 
     Ok(CsharpMainSigMeta { is_async, returns_void, class_name, main_sig, is_public })

backend/parsers/windmill-parser-go/src/lib.rs

@@ -43,6 +43,7 @@ pub fn parse_go_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Ok(MainArgSignature {
@@ -51,6 +52,7 @@ pub fn parse_go_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args: vec![],
             auto_kind: Some("lib".to_string()),
             has_preprocessor: None,
+            ..Default::default()
         })
     }
 }
@@ -244,7 +246,8 @@ func main(x int, y string, z bool, l []string, o struct { Name string `json:"nam
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 

backend/parsers/windmill-parser-graphql/src/lib.rs

@@ -21,6 +21,7 @@ pub fn parse_graphql_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -126,7 +127,8 @@ query($i: Int, $arr: [String]!, $wahoo: String = "wahoo") {
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                ..Default::default()
             }
         );
 

backend/parsers/windmill-parser-java/src/lib.rs

@@ -81,6 +81,7 @@ pub fn parse_java_sig_meta(code: &str) -> anyhow::Result<JavaMainSigMeta> {
         args,
         has_preprocessor: None,
         auto_kind,
+        ..Default::default()
     };
 
     Ok(JavaMainSigMeta { returns_void, class_name, main_sig, is_public })

backend/parsers/windmill-parser-nu/tests/tests.rs

@@ -56,6 +56,7 @@ mod test {
                 ],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -83,6 +84,7 @@ mod test {
                 },],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -120,6 +122,7 @@ mod test {
                 ],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -232,6 +235,7 @@ mod test {
                 ],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -279,6 +283,7 @@ mod test {
                 ],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -343,6 +348,7 @@ mod test {
     //             },],
     //             auto_kind: None,
     //             has_preprocessor: None,
+    //             ..Default::default()
     //         },
     //         sig
     //     );
@@ -373,6 +379,7 @@ mod test {
                 },],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -420,6 +427,7 @@ mod test {
                 ],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -448,6 +456,7 @@ mod test {
                 },],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -480,6 +489,7 @@ mod test {
     //             },],
     //             auto_kind: None,
     //             has_preprocessor: None,
+    //             ..Default::default()
     //         },
     //         sig
     //     );
@@ -542,6 +552,7 @@ mod test {
                 ],
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             sig
         );
@@ -635,6 +646,7 @@ mod test {
     //             ],
     //             auto_kind: None,
     //             has_preprocessor: None,
+    //             ..Default::default()
     //         },
     //         sig
     //     );

backend/parsers/windmill-parser-php/src/lib.rs

@@ -101,6 +101,7 @@ pub fn parse_php_signature(
             args,
             auto_kind: None,
             has_preprocessor,
+            ..Default::default()
         })
     } else {
         Ok(MainArgSignature {
@@ -109,6 +110,7 @@ pub fn parse_php_signature(
             args: vec![],
             auto_kind: Some("lib".to_string()),
             has_preprocessor,
+            ..Default::default()
         })
     }
 }
@@ -180,7 +182,8 @@ function main(string $input1 = \"hey\", bool $input2 = false, int $input3 = 3, f
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                ..Default::default()
             }
         );
 

backend/parsers/windmill-parser-py/src/lib.rs

@@ -366,6 +366,7 @@ pub fn parse_python_signature(
                 Some("lib".to_string())
             },
             has_preprocessor: Some(has_preprocessor),
+            ..Default::default()
         });
     }
 
@@ -477,6 +478,7 @@ pub fn parse_python_signature(
                 .collect(),
             auto_kind: None,
             has_preprocessor: Some(has_preprocessor),
+            ..Default::default()
         })
     } else {
         Ok(MainArgSignature {
@@ -489,6 +491,7 @@ pub fn parse_python_signature(
                 None
             },
             has_preprocessor: Some(has_preprocessor),
+            ..Default::default()
         })
     }
 }
@@ -755,7 +758,8 @@ def main(test1: str, name: datetime.datetime = datetime.now(), byte: bytes = byt
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -820,7 +824,8 @@ def main(test1: str,
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -880,7 +885,8 @@ def main(test1: str,
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -924,7 +930,8 @@ def main(test1: Literal["foo", "bar"], test2: List[Literal["foo", "bar"]]): retu
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -955,7 +962,8 @@ def main(test1: DynSelect_foo): return
                     oidx: None
                 }],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -979,7 +987,8 @@ def hello(): return
                 star_kwargs: false,
                 args: vec![],
                 auto_kind: Some("lib".to_string()),
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -1007,7 +1016,8 @@ def main(): return
                 star_kwargs: false,
                 args: vec![],
                 auto_kind: None,
-                has_preprocessor: Some(true)
+                has_preprocessor: Some(true),
+                            ..Default::default()
             }
         );
 
@@ -1072,7 +1082,8 @@ def main(a: list, e: List[int], b: list = [1,2,3,4], c = [1,2,3,4], d = ["a", "b
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 
@@ -1121,7 +1132,8 @@ def main(a: str, b: Optional[str], c: str | None): return
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: Some(false)
+                has_preprocessor: Some(false),
+                            ..Default::default()
             }
         );
 

backend/parsers/windmill-parser-r/src/lib.rs

@@ -30,6 +30,7 @@ pub fn parse_r_sig_meta(code: &str) -> anyhow::Result<MainArgSignature> {
         args: args.unwrap_or_default(),
         has_preprocessor: None,
         auto_kind: None,
+        ..Default::default()
     };
 
     Ok(main_sig)

backend/parsers/windmill-parser-ruby/src/lib.rs

@@ -41,6 +41,7 @@ pub fn parse_ruby_sig_meta(code: &str) -> anyhow::Result<MainArgSignature> {
         args: args.unwrap_or_default(),
         has_preprocessor: None,
         auto_kind,
+        ..Default::default()
     };
 
     Ok(main_sig)

backend/parsers/windmill-parser-rust/src/lib.rs

@@ -30,6 +30,7 @@ pub fn parse_rust_signature(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Ok(MainArgSignature {
@@ -38,6 +39,7 @@ pub fn parse_rust_signature(code: &str) -> anyhow::Result<MainArgSignature> {
             args: vec![],
             auto_kind: Some("lib".to_string()),
             has_preprocessor: None,
+            ..Default::default()
         })
     }
 }

backend/parsers/windmill-parser-sql/src/lib.rs

@@ -30,6 +30,7 @@ pub fn parse_mysql_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -46,6 +47,7 @@ pub fn parse_oracledb_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -67,6 +69,7 @@ pub fn parse_pgsql_sig_with_typed_schema(code: &str) -> anyhow::Result<(MainArgS
                 args,
                 auto_kind: None,
                 has_preprocessor: None,
+                ..Default::default()
             },
             typed_schema,
         ))
@@ -85,6 +88,7 @@ pub fn parse_bigquery_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -100,6 +104,7 @@ pub fn parse_duckdb_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -116,6 +121,7 @@ pub fn parse_snowflake_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -132,6 +138,7 @@ pub fn parse_mssql_sig(code: &str) -> anyhow::Result<MainArgSignature> {
             args,
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         })
     } else {
         Err(anyhow!("Error parsing sql".to_string()))
@@ -944,7 +951,8 @@ SELECT * FROM table WHERE token=$1::TEXT AND image=$2::BIGINT
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -993,7 +1001,8 @@ SELECT $2::TEXT;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1120,7 +1129,8 @@ SELECT ?, ?;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1168,7 +1178,8 @@ SELECT :param2;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1208,7 +1219,8 @@ SELECT @token;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1256,7 +1268,8 @@ SELECT ?;
                     }
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1304,7 +1317,8 @@ SELECT @P2;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1353,7 +1367,8 @@ SELECT * FROM table_name WHERE thing = :name4;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1391,7 +1406,8 @@ SELECT * FROM users WHERE id = $1 AND email = $2::text;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1429,7 +1445,8 @@ SELECT * FROM users LIMIT $1 OFFSET $2;
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1479,7 +1496,8 @@ WHERE id = $1
                     },
                 ],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1506,7 +1524,8 @@ SELECT * FROM users WHERE id = ANY($1);
                     oidx: Some(1),
                 },],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1535,7 +1554,8 @@ SELECT $1::integer;
                     oidx: Some(1),
                 },],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 
@@ -1567,7 +1587,8 @@ SELECT x
                     oidx: None,
                 },],
                 auto_kind: None,
-                has_preprocessor: None
+                has_preprocessor: None,
+                            ..Default::default()
             }
         );
 

backend/parsers/windmill-parser-ts-asset/src/lib.rs

@@ -106,6 +106,28 @@ fn extract_wmill_datatable_call(expr: &Expr) -> Option<(AssetKind, String, Optio
     }
     None
 }
+
+/// Check if an expression is `tag.raw(...)` where `tag` matches the given tag name.
+/// Returns true for patterns like `sql.raw(x)`.
+fn is_raw_call(expr: &Expr, tag_name: &str) -> bool {
+    if let Expr::Call(call_expr) = expr {
+        if let Some(Expr::Member(member)) = call_expr.callee.as_expr().map(AsRef::as_ref) {
+            let is_tag = matches!(
+                member.obj.as_ref(),
+                Expr::Ident(ident) if ident.sym.as_str() == tag_name
+            );
+            if is_tag {
+                if let MemberProp::Ident(prop) = &member.prop {
+                    return prop.sym.as_str() == "raw";
+                }
+            }
+        }
+    }
+    false
+}
+
+const WM_SQL_RAW_PLACEHOLDER: &str = "__WM_SQL_RAW__";
+
 impl Visit for AssetsFinder {
     // visit_call_expr will not recurse if it detects an asset,
     // so this will only be called when no further context was found
@@ -230,21 +252,31 @@ impl Visit for AssetsFinder {
             return;
         };
 
-        // Extract the SQL query from the template quasis (string parts)
-        // Substitute ${} with $1, $2, etc.
-        let sql: String = node
+        // Determine which interpolations are sql.raw() calls
+        let raw_flags: Vec<bool> = node
             .tpl
-            .quasis
+            .exprs
             .iter()
-            .map(|quasi| quasi.raw.as_str())
-            .enumerate()
-            .fold(String::new(), |acc, (i, s)| {
-                if i == 0 {
-                    s.to_string()
+            .map(|expr| is_raw_call(expr.as_ref(), tag_name))
+            .collect();
+        let has_raw_interpolation = raw_flags.iter().any(|&r| r);
+
+        // Extract the SQL query from the template quasis (string parts)
+        // Substitute ${} with $N for normal args, __WM_SQL_RAW__ for raw args
+        let mut sql = String::new();
+        let mut arg_index = 0usize;
+        for (i, quasi) in node.tpl.quasis.iter().enumerate() {
+            if i > 0 {
+                let is_raw = raw_flags.get(i - 1).copied().unwrap_or(false);
+                if is_raw {
+                    sql.push_str(WM_SQL_RAW_PLACEHOLDER);
                 } else {
-                    format!("{}${}{}", acc, i, s)
+                    arg_index += 1;
+                    sql.push_str(&format!("${}", arg_index));
                 }
-            });
+            }
+            sql.push_str(quasi.raw.as_str());
+        }
 
         // Capture SQL query details before transforming for SQL parser
         let span = node.span();
@@ -256,6 +288,7 @@ impl Visit for AssetsFinder {
             source_kind: *kind,
             source_name: asset_name.clone(),
             source_schema: schema.clone(),
+            has_raw_interpolation,
         });
 
         // We use the SQL parser to detect RW, specific tables, etc.
@@ -266,7 +299,11 @@ impl Visit for AssetsFinder {
             &sql,
         );
         match sql_assets {
-            Ok(Some(sql_assets)) => self.assets.extend(sql_assets),
+            Ok(Some(sql_assets)) => self.assets.extend(
+                sql_assets
+                    .into_iter()
+                    .filter(|a| !a.path.contains(WM_SQL_RAW_PLACEHOLDER)),
+            ),
             _ => {}
         }
     }
@@ -629,6 +666,7 @@ mod tests {
         assert_eq!(query_detail.source_kind, AssetKind::DataTable);
         assert_eq!(query_detail.source_name, "dt");
         assert_eq!(query_detail.source_schema, None);
+        assert_eq!(query_detail.has_raw_interpolation, false);
         // Span should be non-zero
         assert!(query_detail.span.0 > 0);
         assert!(query_detail.span.1 > query_detail.span.0);
@@ -692,5 +730,86 @@ mod tests {
         assert_eq!(query_detail.source_kind, AssetKind::Ducklake);
         assert_eq!(query_detail.source_name, "my_lake");
         assert_eq!(query_detail.source_schema, None);
+        assert_eq!(query_detail.has_raw_interpolation, false);
+    }
+
+    #[test]
+    fn test_ts_asset_parser_sql_raw_basic() {
+        let input = r#"
+            import * as wmill from "windmill-client"
+            export async function main(table: string) {
+                let sql = wmill.datatable('dt')
+                return await sql`SELECT * FROM ${sql.raw(table)}`.fetch()
+            }
+        "#;
+        let result = parse_assets(input).unwrap();
+
+        // sql.raw in table position => the __WM_SQL_RAW__ asset gets filtered out,
+        // but the datatable itself is still tracked as "used" (without specific table info)
+        assert_eq!(
+            result.assets,
+            vec![ParseAssetsResult {
+                kind: AssetKind::DataTable,
+                path: "dt".to_string(),
+                access_type: None,
+                columns: None,
+            }]
+        );
+
+        // Check SQL query details
+        assert_eq!(result.sql_queries.len(), 1);
+        let q = &result.sql_queries[0];
+        assert!(q.query_string.contains("__WM_SQL_RAW__"));
+        assert!(!q.query_string.contains("$1"));
+        assert_eq!(q.has_raw_interpolation, true);
+        assert_eq!(q.source_kind, AssetKind::DataTable);
+        assert_eq!(q.source_name, "dt");
+    }
+
+    #[test]
+    fn test_ts_asset_parser_sql_raw_mixed() {
+        let input = r#"
+            import * as wmill from "windmill-client"
+            export async function main(name: string, col: string, val: number) {
+                let sql = wmill.datatable('dt')
+                return await sql`SELECT * FROM users WHERE name = ${name} AND ${sql.raw(col)} = ${val}`.fetch()
+            }
+        "#;
+        let result = parse_assets(input).unwrap();
+
+        // "users" table should still be detected
+        assert_eq!(result.assets.len(), 1);
+        assert_eq!(result.assets[0].path, "dt/users");
+        assert_eq!(result.assets[0].access_type, Some(R));
+
+        // Check SQL query details — arg numbering skips the raw interpolation
+        assert_eq!(result.sql_queries.len(), 1);
+        let q = &result.sql_queries[0];
+        assert_eq!(
+            q.query_string,
+            "SELECT * FROM users WHERE name = $1 AND __WM_SQL_RAW__ = $2"
+        );
+        assert_eq!(q.has_raw_interpolation, true);
+    }
+
+    #[test]
+    fn test_ts_asset_parser_sql_raw_no_false_positive() {
+        // Ensure that a normal query (no sql.raw) still has has_raw_interpolation=false
+        let input = r#"
+            import * as wmill from "windmill-client"
+            export async function main(x: number) {
+                let sql = wmill.datatable('dt')
+                return await sql`SELECT * FROM friends WHERE age = ${x}`.fetch()
+            }
+        "#;
+        let result = parse_assets(input).unwrap();
+        assert_eq!(result.sql_queries.len(), 1);
+        assert_eq!(result.sql_queries[0].has_raw_interpolation, false);
+        assert_eq!(
+            result.sql_queries[0].query_string,
+            "SELECT * FROM friends WHERE age = $1"
+        );
+        assert_eq!(result.assets.len(), 1);
+        assert_eq!(result.assets[0].path, "dt/friends");
     }
 }

backend/parsers/windmill-parser-ts/src/lib.rs

@@ -462,6 +462,7 @@ pub fn parse_deno_signature(
         },
         auto_kind,
         has_preprocessor: Some(has_preprocessor),
+        ..Default::default()
     };
     Ok(r)
 }

backend/parsers/windmill-parser-ts/tests/tests.rs

@@ -47,6 +47,7 @@ mod tests {
                 args: vec![],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -105,6 +106,7 @@ mod tests {
                 ],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -154,6 +156,7 @@ mod tests {
                 ],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -203,6 +206,7 @@ mod tests {
                 ],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -234,6 +238,7 @@ mod tests {
                 },],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -265,6 +270,7 @@ mod tests {
                 },],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -305,6 +311,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -343,6 +350,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -401,6 +409,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -459,6 +468,7 @@ mod tests {
                 ],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -508,6 +518,7 @@ mod tests {
                 ],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -557,6 +568,7 @@ mod tests {
                 args: vec![],
                 auto_kind: Some("lib".to_string()),
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -584,6 +596,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -613,6 +626,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -642,6 +656,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -691,6 +706,7 @@ mod tests {
                 ],
                 auto_kind: None,
                 has_preprocessor: Some(false),
+                ..Default::default()
             }
         );
     }
@@ -731,6 +747,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(true),
+                ..Default::default()
             }
         );
     }
@@ -761,6 +778,7 @@ mod tests {
                 }],
                 auto_kind: None,
                 has_preprocessor: Some(true),
+                ..Default::default()
             }
         );
     }

backend/parsers/windmill-parser-wasm/tests/wasm.rs

@@ -141,7 +141,8 @@ export function main(test1?: string, test2: string = \"burkina\",
                 }
             ],
             auto_kind: None,
-            has_preprocessor: Some(false)
+            has_preprocessor: Some(false),
+            ..Default::default()
         }
     );
 
@@ -220,7 +221,8 @@ export function main(test2 = \"burkina\",
                 }
             ],
             auto_kind: None,
-            has_preprocessor: Some(false)
+            has_preprocessor: Some(false),
+            ..Default::default()
         }
     );
 
@@ -271,7 +273,8 @@ export function main(foo: FooBar, {a, b}: FooBar, {c, d}: FooBar = {a: \"foo\",
                 }
             ],
             auto_kind: None,
-            has_preprocessor: Some(false)
+            has_preprocessor: Some(false),
+            ..Default::default()
         }
     );
 
@@ -303,7 +306,8 @@ export function main(foo: (\"foo\" | \"bar\")[]) {
                 oidx: None
             }],
             auto_kind: None,
-            has_preprocessor: Some(false)
+            has_preprocessor: Some(false),
+            ..Default::default()
         }
     );
 
@@ -447,7 +451,8 @@ Write-Output 'Testing...'
                 }
             ],
             auto_kind: None,
-            has_preprocessor: None
+            has_preprocessor: None,
+            ..Default::default()
         }
     );
 

backend/parsers/windmill-parser-yaml/src/lib.rs

@@ -27,6 +27,7 @@ pub fn parse_ansible_sig(inner_content: &str) -> anyhow::Result<MainArgSignature
             args: vec![],
             auto_kind: None,
             has_preprocessor: None,
+            ..Default::default()
         });
     }
 
@@ -94,6 +95,7 @@ pub fn parse_ansible_sig(inner_content: &str) -> anyhow::Result<MainArgSignature
         args,
         auto_kind: None,
         has_preprocessor: None,
+        ..Default::default()
     })
 }
 

backend/parsers/windmill-parser/src/asset_parser.rs

@@ -39,6 +39,8 @@ pub struct SqlQueryDetails {
     pub source_name: String,  // e.g., "main", "dt"
     #[serde(skip_serializing_if = "Option::is_none")]
     pub source_schema: Option<String>, // e.g., Some("public"), None
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub has_raw_interpolation: bool, // true if any ${sql.raw(...)} was used
 }
 
 #[derive(Serialize, Debug, Default)]

backend/parsers/windmill-parser/src/lib.rs

@@ -38,6 +38,10 @@ pub struct MainArgSignature {
     pub args: Vec<Arg>,
     pub auto_kind: Option<String>,
     pub has_preprocessor: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub has_cmd_binding: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub supports_should_process: Option<bool>,
 }
 
 #[derive(Serialize, Clone, Debug, PartialEq)]

backend/src/db_connect.rs

@@ -41,50 +41,69 @@ pub async fn connect_db(
     };
 
     let pool = connect(database_url.clone(), max_connections, worker_mode).await?;
+
     #[cfg(all(feature = "enterprise", feature = "private"))]
-    let pool2 = pool.clone();
-    #[cfg(all(feature = "enterprise", feature = "private"))]
-    if let DatabaseUrl::IamRds(database_url) = database_url {
-        tokio::spawn(async move {
-            loop {
-                tokio::select! {
-                    _ = killpill_rx.recv() => {
-                        break;
-                    }
-                    _ = tokio::time::sleep(std::time::Duration::from_secs(10)) => {
-                        let needs_refresh = {
-                            let read_guard = database_url.read().await;
-                            read_guard.needs_refresh()
-                        };
-                        if needs_refresh {
-                            let new_url = tokio::time::timeout(std::time::Duration::from_secs(10), get_database_url()).await;
+    {
+        let needs_token_refresh = matches!(
+            database_url,
+            DatabaseUrl::IamRds(_) | DatabaseUrl::EntraId(_)
+        );
+        let label = match &database_url {
+            DatabaseUrl::IamRds(_) => "IAM RDS",
+            DatabaseUrl::EntraId(_) => "Entra ID",
+            DatabaseUrl::Static(_) => "",
+        };
+        if needs_token_refresh {
+            let pool2 = pool.clone();
+            let database_url2 = database_url.clone();
+            tokio::spawn(async move {
+                loop {
+                    tokio::select! {
+                        _ = killpill_rx.recv() => {
+                            break;
+                        }
+                        _ = tokio::time::sleep(std::time::Duration::from_secs(10)) => {
+                            if !database_url2.needs_refresh().await {
+                                continue;
+                            }
+                            let new_url = tokio::time::timeout(
+                                std::time::Duration::from_secs(10),
+                                get_database_url(),
+                            )
+                            .await;
                             match new_url {
                                 Ok(Ok(new_url)) => {
                                     match new_url.connect_options().await {
                                         Ok(connect_options) => {
                                             pool2.set_connect_options(connect_options);
-                                            tracing::info!("Refreshed IAM RDS URL successfully");
+                                            tracing::info!("Refreshed {label} URL successfully");
                                         }
                                         Err(e) => {
-                                            tracing::error!("Error getting IAM RDS connect options, retrying in 10s: {}", e);
+                                            tracing::error!(
+                                                "Error getting {label} connect options, retrying in 10s: {e}"
+                                            );
                                             continue;
                                         }
                                     }
                                 }
                                 Ok(Err(e)) => {
-                                    tracing::error!("Error refreshing IAM RDS URL, trying again in 10s: {}", e);
+                                    tracing::error!(
+                                        "Error refreshing {label} URL, trying again in 10s: {e}"
+                                    );
                                     continue;
                                 }
                                 Err(e) => {
-                                    tracing::error!("Timeout after 10s refreshing IAM RDS URL, trying again in 10 seconds: {}", e);
+                                    tracing::error!(
+                                        "Timeout after 10s refreshing {label} URL, trying again in 10s: {e}"
+                                    );
                                     continue;
                                 }
                             }
                         }
                     }
                 }
-            }
-        });
+            });
+        }
     }
 
     Ok(pool)

backend/src/main.rs

@@ -1597,6 +1597,12 @@ async fn process_notify_event(
                 tracing::debug!("config changed but did not target this server/worker");
             }
         }
+        "restart_worker_group" => {
+            if worker_mode && payload == *WORKER_GROUP {
+                tracing::info!("Restart requested for worker group '{payload}'");
+                spawn_graceful_killpill(tx, db, 10, "worker group restart requested").await;
+            }
+        }
         "notify_webhook_change" => {
             tracing::info!(
                 "Webhook change detected, invalidating webhook cache: {}",

backend/src/monitor.rs

@@ -3305,6 +3305,49 @@ Please check your worker logs for more details and feel free to report it to the
         }
     }
 
+    // Detect flows with NULL pings that have been running longer than the retention period.
+    // This catches parent flows/flownodes waiting for a suspended child (e.g. approval step)
+    // where no worker is actively processing them. The normal zombie detection above requires
+    // ping IS NOT NULL so these flows would otherwise stay in the queue indefinitely.
+    let job_retention_secs = *JOB_RETENTION_SECS.read().await;
+    if job_retention_secs > 0 {
+        let stale_null_ping_flows = sqlx::query!(
+            r#"
+            SELECT j.id AS "id!", j.workspace_id AS "workspace_id!"
+            FROM v2_job_queue q
+            JOIN v2_job j USING (id)
+            LEFT JOIN v2_job_runtime r USING (id)
+            WHERE q.running = true
+                AND (j.kind = 'flow' OR j.kind = 'flowpreview' OR j.kind = 'flownode')
+                AND r.ping IS NULL
+                AND j.parent_job IS NULL
+                AND j.created_at < NOW() - ($1::bigint::text || ' s')::interval
+                AND q.canceled_by IS NULL
+            "#,
+            job_retention_secs
+        )
+        .fetch_all(db)
+        .await?;
+
+        for flow in &stale_null_ping_flows {
+            let base_url = BASE_URL.read().await;
+            let reason = format!(
+                "Flow {} ({}/run/{}?workspace={}) has been running with no active worker (NULL ping) for longer than the retention period ({}s). \
+                 This typically happens when a sub-flow is suspended (e.g. approval step) and the parent flow's worker was interrupted before recording a ping.",
+                flow.id, base_url, flow.id, flow.workspace_id, job_retention_secs
+            );
+            report_critical_error(reason.clone(), db.clone(), Some(&flow.workspace_id), None).await;
+            cancel_zombie_flow_job(db, flow.id, &flow.workspace_id, reason).await?;
+        }
+
+        if !stale_null_ping_flows.is_empty() {
+            tracing::info!(
+                "Cancelled {} stale flows with NULL pings older than retention period",
+                stale_null_ping_flows.len()
+            );
+        }
+    }
+
     let flows2 = sqlx::query!(
         r#"
         DELETE

backend/summarized_schema.txt

@@ -38,7 +38,7 @@ account: workspace_id(char), id(int), expires_at(ts), refresh_token(char), clien
 agent_token_blacklist: token(char), expires_at(ts), blacklisted_at(ts), blacklisted_by(char)
 ai_agent_memory: workspace_id(char), conversation_id(uuid), step_id(char), messages(jsonb), created_at(ts), updated_at(ts)
 alerts: id(int), alert_type(char), message(text), created_at(ts), acknowledged(bool), workspace_id(text), acknowledged_workspace(bool), resource(text)
-app: id(bigint), workspace_id(char), path(char), summary(char), policy(jsonb), versions(bigint[]), extra_perms(jsonb), draft_only(bool), custom_path(text)
+app: id(bigint), workspace_id(char), path(char), summary(char), policy(jsonb), versions(bigint[]), extra_perms(jsonb), draft_only(bool), custom_path(text), labels(text[])
   FK: (workspace_id) -> workspace(id)
 app_bundles: app_version_id(bigint), w_id(char), file_type(char), data(bytes)
 app_script: id(bigint), app(bigint), hash(char(64)), lock(text), code(text), code_sha256(char(64))
@@ -72,9 +72,9 @@ deployment_metadata: workspace_id(char), path(char), script_hash(bigint), app_ve
 draft: workspace_id(char), path(char), typ(draft_type), value(json), created_at(ts)
   FK: (workspace_id) -> workspace(id)
 email_to_igroup: email(char), igroup(char)
-email_trigger: path(char), local_part(char), workspaced_local_part(bool), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode)
+email_trigger: path(char), local_part(char), workspaced_local_part(bool), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
 favorite: usr(char), workspace_id(char), path(char), favorite_kind(favorite_kind)
-flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of_email(text), lock_error_logs(text)
+flow: workspace_id(char), path(char), summary(text), description(text), value(jsonb), edited_by(char), edited_at(ts), archived(bool), schema(json), extra_perms(jsonb), dependency_job(uuid), draft_only(bool), tag(char), ws_error_handler_muted(bool), dedicated_worker(bool), timeout(int), visible_to_runner_only(bool), concurrency_key(char), versions(bigint[]), on_behalf_of_email(text), lock_error_logs(text), labels(text[])
   FK: (workspace_id) -> workspace(id)
 flow_conversation: id(uuid), workspace_id(char), flow_path(char), title(char), created_at(ts), updated_at(ts), created_by(char)
   FK: (workspace_id) -> workspace(id)
@@ -91,14 +91,14 @@ folder: name(char), workspace_id(char), display_name(char), owners(char), extra_
   FK: (workspace_id) -> workspace(id)
 folder_permission_history: id(bigint), workspace_id(char), folder_name(char), changed_by(char), changed_at(ts), change_type(char), affected(char)
   FK: (workspace_id, folder_name) -> folder(workspace_id, name)
-gcp_trigger: gcp_resource_path(char), topic_id(char), subscription_id(char), delivery_type(delivery_mode), delivery_config(jsonb), path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), subscription_mode(gcp_subscription_mode), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), auto_acknowledge_msg(bool), ack_deadline(int), mode(trigger_mode)
+gcp_trigger: gcp_resource_path(char), topic_id(char), subscription_id(char), delivery_type(delivery_mode), delivery_config(jsonb), path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), subscription_mode(gcp_subscription_mode), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), auto_acknowledge_msg(bool), ack_deadline(int), mode(trigger_mode), labels(text[])
 global_settings: name(char), value(jsonb), updated_at(ts)
 group_: workspace_id(char), name(char), summary(text), extra_perms(jsonb)
   FK: (workspace_id) -> workspace(id)
 group_permission_history: id(bigint), workspace_id(char), group_name(char), changed_by(char), changed_at(ts), change_type(char), member_affected(char)
   FK: (workspace_id, group_name) -> group_(workspace_id, name)
 healthchecks: id(bigint), check_type(char), healthy(bool), created_at(ts)
-http_trigger: path(char), route_path(char), route_path_key(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), authentication_method(authentication_method), http_method(http_method), static_asset_config(jsonb), is_static_website(bool), workspaced_route(bool), wrap_body(bool), raw_string(bool), authentication_resource_path(char), summary(char), description(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), request_type(request_type), mode(trigger_mode)
+http_trigger: path(char), route_path(char), route_path_key(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), authentication_method(authentication_method), http_method(http_method), static_asset_config(jsonb), is_static_website(bool), workspaced_route(bool), wrap_body(bool), raw_string(bool), authentication_resource_path(char), summary(char), description(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), request_type(request_type), mode(trigger_mode), labels(text[])
 input: id(uuid), workspace_id(char), runnable_id(char), runnable_type(runnable_type), name(text), args(jsonb), created_at(ts), created_by(char), is_public(bool)
   FK: (workspace_id) -> workspace(id)
 instance_group: name(char), summary(char), id(char), scim_display_name(char), external_id(char)
@@ -111,7 +111,7 @@ job_stats: workspace_id(char), job_id(uuid), metric_id(char), metric_name(char),
   FK: (workspace_id) -> workspace(id)
 kafka_pending_commits: id(bigint), workspace_id(char), kafka_trigger_path(char), topic(char), partition(int), offset(bigint), created_at(ts)
   FK: (workspace_id, kafka_trigger_path) -> kafka_trigger(workspace_id, path)
-kafka_trigger: path(char), kafka_resource_path(char), topics(char), group_id(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), filters(jsonb[]), auto_commit(bool)
+kafka_trigger: path(char), kafka_resource_path(char), topics(char), group_id(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), filters(jsonb[]), auto_commit(bool), labels(text[])
 log_file: hostname(char), log_ts(ts), ok_lines(bigint), err_lines(bigint), mode(log_mode), worker_group(char), file_path(char), json_fmt(bool)
 magic_link: email(char), token(char), expiration(ts)
 mcp_oauth_client: mcp_server_url(text), client_id(text), client_secret(text), client_secret_expires_at(ts), token_endpoint(text), created_at(ts)
@@ -121,10 +121,10 @@ mcp_oauth_server_client: client_id(char), client_name(char), redirect_uris(text[
 mcp_oauth_server_code: code(char), client_id(char), user_email(char), workspace_id(char), scopes(text[]), redirect_uri(text), code_challenge(char), code_challenge_method(char), created_at(ts), expires_at(ts)
   FK: (client_id) -> mcp_oauth_server_client(client_id)
 metrics: id(char), value(jsonb), created_at(ts)
-mqtt_trigger: mqtt_resource_path(char), subscribe_topics(jsonb[]), client_version(mqtt_client_version), v5_config(jsonb), v3_config(jsonb), client_id(char), path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode)
+mqtt_trigger: mqtt_resource_path(char), subscribe_topics(jsonb[]), client_version(mqtt_client_version), v5_config(jsonb), v3_config(jsonb), client_id(char), path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
 native_trigger: external_id(char), workspace_id(char), service_name(native_trigger_service), script_path(char), is_flow(bool), webhook_token_hash(char), service_config(jsonb), error(text), created_at(ts), updated_at(ts)
   FK: (workspace_id) -> workspace(id)
-nats_trigger: path(char), nats_resource_path(char), subjects(char), stream_name(char), consumer_name(char), use_jetstream(bool), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode)
+nats_trigger: path(char), nats_resource_path(char), subjects(char), stream_name(char), consumer_name(char), use_jetstream(bool), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
   FK: (workspace_id) -> workspace(id)
 notify_event: id(bigint), channel(text), payload(text), created_at(ts)
 otel_traces: trace_id(bytes), span_id(bytes), trace_state(text), parent_span_id(bytes), flags(int), name(text), kind(int), start_time_unix_nano(bigint), end_time_unix_nano(bigint), attributes(jsonb), dropped_attributes_count(int), events(jsonb), dropped_events_count(int), links(jsonb), dropped_links_count(int), status(jsonb)
@@ -133,23 +133,23 @@ parallel_monitor_lock: parent_flow_id(uuid), job_id(uuid), last_ping(ts)
 password: email(char), password_hash(char), login_type(char), super_admin(bool), verified(bool), name(char), company(char), first_time_user(bool), username(char), devops(bool)
 pending_user: email(char), created_at(ts), username(char)
 pip_resolution_cache: hash(char), expiration(ts), lockfile(text)
-postgres_trigger: path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), postgres_resource_path(char), error(text), server_id(char), last_server_ping(ts), replication_slot_name(char), publication_name(char), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode)
+postgres_trigger: path(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), postgres_resource_path(char), error(text), server_id(char), last_server_ping(ts), replication_slot_name(char), publication_name(char), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
   FK: (workspace_id) -> workspace(id)
-raw_app: path(char), version(int), workspace_id(char), summary(char), edited_at(ts), data(text), extra_perms(jsonb)
+raw_app: path(char), version(int), workspace_id(char), summary(char), edited_at(ts), data(text), extra_perms(jsonb), labels(text[])
   FK: (workspace_id) -> workspace(id)
-resource: workspace_id(char), path(char), value(jsonb), description(text), resource_type(char), extra_perms(jsonb), edited_at(ts), created_by(char)
+resource: workspace_id(char), path(char), value(jsonb), description(text), resource_type(char), extra_perms(jsonb), edited_at(ts), created_by(char), labels(text[])
   FK: (workspace_id) -> workspace(id)
 resource_type: workspace_id(char), name(char), schema(jsonb), description(text), edited_at(ts), created_by(char), format_extension(char), is_fileset(bool)
   FK: (workspace_id) -> workspace(id)
 resume_job: id(uuid), job(uuid), flow(uuid), created_at(ts), value(jsonb), approver(char), resume_id(int), approved(bool)
   FK: (flow) -> v2_job_queue(id)
 runnable_settings: hash(bigint), debouncing_settings(bigint), concurrency_settings(bigint)
-schedule: workspace_id(char), path(char), edited_by(char), edited_at(ts), schedule(char), enabled(bool), script_path(char), args(jsonb), extra_perms(jsonb), is_flow(bool), email(char), error(text), timezone(char), on_failure(char), on_recovery(char), on_failure_times(int), on_failure_exact(bool), on_failure_extra_args(jsonb), on_recovery_times(int), on_recovery_extra_args(jsonb), ws_error_handler_muted(bool), retry(jsonb), summary(char), no_flow_overlap(bool), tag(char), paused_until(ts), on_success(char), on_success_extra_args(jsonb), cron_version(text), description(text), dynamic_skip(char)
+schedule: workspace_id(char), path(char), edited_by(char), edited_at(ts), schedule(char), enabled(bool), script_path(char), args(jsonb), extra_perms(jsonb), is_flow(bool), email(char), error(text), timezone(char), on_failure(char), on_recovery(char), on_failure_times(int), on_failure_exact(bool), on_failure_extra_args(jsonb), on_recovery_times(int), on_recovery_extra_args(jsonb), ws_error_handler_muted(bool), retry(jsonb), summary(char), no_flow_overlap(bool), tag(char), paused_until(ts), on_success(char), on_success_extra_args(jsonb), cron_version(text), description(text), dynamic_skip(char), labels(text[])
   FK: (workspace_id) -> workspace(id)
-script: workspace_id(char), hash(bigint), path(char), parent_hashes(bigint[]), summary(text), description(text), content(text), created_by(char), created_at(ts), archived(bool), schema(json), deleted(bool), is_template(bool), extra_perms(jsonb), lock(text), lock_error_logs(text), language(script_lang), kind(script_kind), tag(char), draft_only(bool), envs(char), concurrent_limit(int), concurrency_time_window_s(int), cache_ttl(int), dedicated_worker(bool), ws_error_handler_muted(bool), priority(smallint), timeout(int), delete_after_use(bool), restart_unless_cancelled(bool), concurrency_key(char), visible_to_runner_only(bool), auto_kind(varchar), codebase(char), has_preprocessor(bool), on_behalf_of_email(text), schema_validation(bool), assets(jsonb), debounce_key(char), debounce_delay_s(int), cache_ignore_s3_path(bool), runnable_settings_handle(bigint)
+script: workspace_id(char), hash(bigint), path(char), parent_hashes(bigint[]), summary(text), description(text), content(text), created_by(char), created_at(ts), archived(bool), schema(json), deleted(bool), is_template(bool), extra_perms(jsonb), lock(text), lock_error_logs(text), language(script_lang), kind(script_kind), tag(char), draft_only(bool), envs(char), concurrent_limit(int), concurrency_time_window_s(int), cache_ttl(int), dedicated_worker(bool), ws_error_handler_muted(bool), priority(smallint), timeout(int), delete_after_use(bool), restart_unless_cancelled(bool), concurrency_key(char), visible_to_runner_only(bool), auto_kind(varchar), codebase(char), has_preprocessor(bool), on_behalf_of_email(text), schema_validation(bool), assets(jsonb), debounce_key(char), debounce_delay_s(int), cache_ignore_s3_path(bool), runnable_settings_handle(bigint), labels(text[])
   FK: (workspace_id) -> workspace(id)
 skip_workspace_diff_tally: workspace_id(char), added_at(ts)
-sqs_trigger: path(char), queue_url(char), aws_resource_path(char), message_attributes(text[]), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error(text), server_id(char), last_server_ping(ts), aws_auth_resource_type(aws_auth_resource_type), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode)
+sqs_trigger: path(char), queue_url(char), aws_resource_path(char), message_attributes(text[]), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), error(text), server_id(char), last_server_ping(ts), aws_auth_resource_type(aws_auth_resource_type), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), mode(trigger_mode), labels(text[])
   FK: (workspace_id) -> workspace(id)
 trashbin: id(bigint), workspace_id(char), item_kind(char), item_path(char), item_data(jsonb), deleted_by(char), deleted_at(ts), expires_at(ts)
   FK: (workspace_id) -> workspace(id)
@@ -173,9 +173,9 @@ v2_job_runtime: id(uuid), ping(ts), memory_peak(int)
   FK: (id) -> v2_job_queue(id)
 v2_job_status: id(uuid), flow_status(jsonb), flow_leaf_jobs(jsonb), workflow_as_code_status(jsonb)
   FK: (id) -> v2_job_queue(id)
-variable: workspace_id(char), path(char), value(char), is_secret(bool), description(char), extra_perms(jsonb), account(int), is_oauth(bool), expires_at(ts)
+variable: workspace_id(char), path(char), value(char), is_secret(bool), description(char), extra_perms(jsonb), account(int), is_oauth(bool), expires_at(ts), labels(text[])
   FK: (workspace_id) -> workspace(id)
-websocket_trigger: path(char), url(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), filters(jsonb[]), initial_messages(jsonb[]), url_runnable_args(jsonb), can_return_message(bool), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), can_return_error_result(bool), mode(trigger_mode)
+websocket_trigger: path(char), url(char), script_path(char), is_flow(bool), workspace_id(char), edited_by(char), email(char), edited_at(ts), extra_perms(jsonb), server_id(char), last_server_ping(ts), error(text), filters(jsonb[]), initial_messages(jsonb[]), url_runnable_args(jsonb), can_return_message(bool), error_handler_path(char), error_handler_args(jsonb), retry(jsonb), can_return_error_result(bool), mode(trigger_mode), labels(text[])
 windmill_migrations: name(text), created_at(ts)
 worker_group_job_stats: hour(bigint), worker_group(text), script_lang(char), workspace_id(char), job_count(int), total_duration_ms(bigint)
   FK: (workspace_id) -> workspace(id)

backend/tests/bun_jobs.rs

@@ -429,6 +429,59 @@ export function main() {
     Ok(())
 }
 
+#[sqlx::test(fixtures("base"))]
+async fn test_bun_job_syntax_error_unclosed_bracket(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+
+    // Reproduces the "Unexpected end of file at main.ts:0" error reported
+    // when a TS file has a missing closing bracket — Bun's bundler gives no
+    // useful location info.
+    let content = r#"
+export async function main() {
+    if (true) {
+        return "hello";
+    // missing closing bracket for the function
+"#
+    .to_owned();
+
+    let job = JobPayload::Code(RawCode {
+        hash: None,
+        content,
+        path: None,
+        language: ScriptLang::Bun,
+        lock: None,
+        concurrency_settings: windmill_common::runnable_settings::ConcurrencySettings::default()
+            .into(),
+        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
+        cache_ttl: None,
+        cache_ignore_s3_path: None,
+        dedicated_worker: None,
+        modules: None,
+    });
+
+    let completed = run_job_in_new_worker_until_complete(&db, false, job, port).await;
+
+    assert!(!completed.success);
+    let result = completed
+        .result
+        .as_ref()
+        .and_then(|v| v.get("error"))
+        .and_then(|v| v.get("message"))
+        .and_then(|v| v.as_str())
+        .unwrap_or("");
+    assert!(
+        result.contains("Unexpected end of file"),
+        "should contain bun parser error, got: {result}"
+    );
+    assert!(
+        result.contains("syntax error"),
+        "should contain helpful hint about syntax errors, got: {result}"
+    );
+    Ok(())
+}
+
 // ============================================================================
 // Annotation Mode Tests
 // ============================================================================
@@ -1013,8 +1066,8 @@ mod dedicated_worker_protocol {
         let mut results = Vec::new();
 
         for job_args in jobs {
-            // Protocol: exec:<script_path>:<json_args>
-            writeln!(stdin, "exec:{}:{}", TEST_SCRIPT_PATH, job_args.to_string()).unwrap();
+            // Protocol: execd:<json_args> (single-script, no path needed)
+            writeln!(stdin, "execd:{}", job_args.to_string()).unwrap();
             stdin.flush().unwrap();
 
             let mut response = String::new();
@@ -1600,8 +1653,6 @@ mod dedicated_worker_protocol_deno {
     use windmill_test_utils::{parse_dedicated_worker_line, DedicatedWorkerResult};
     use windmill_worker::{generate_deno_dedicated_worker_wrapper, DENO_PATH};
 
-    const TEST_SCRIPT_PATH: &str = "f/test/script";
-
     fn run_deno_worker_test(
         script: &str,
         jobs: Vec<serde_json::Value>,
@@ -1651,7 +1702,7 @@ mod dedicated_worker_protocol_deno {
 
         let mut results = Vec::new();
         for job_args in jobs {
-            writeln!(stdin, "exec:{}:{}", TEST_SCRIPT_PATH, job_args.to_string()).unwrap();
+            writeln!(stdin, "execd:{}", job_args.to_string()).unwrap();
             stdin.flush().unwrap();
 
             loop {
@@ -1772,7 +1823,13 @@ export function main(msg: string): never {
         let mut results = Vec::new();
 
         for (cmd, args) in &commands {
-            writeln!(stdin, "{}:{}:{}", cmd, TEST_SCRIPT_PATH, args).unwrap();
+            // Single-script Deno wrapper uses execd:/execd_preprocess: (no path)
+            let direct_cmd = if *cmd == "exec_preprocess" {
+                "execd_preprocess"
+            } else {
+                "execd"
+            };
+            writeln!(stdin, "{}:{}", direct_cmd, args).unwrap();
             stdin.flush().unwrap();
 
             let expected_lines = if *cmd == "exec_preprocess" { 2 } else { 1 };