fix: resolve skip check crash when first flow node has both skip_if and stop_after_if

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude/settings.json

@@ -100,4 +100,4 @@
     "typescript-lsp@claude-plugins-official": true,
     "code-review@claude-plugins-official": true
   }
-}
+}

.claude/skills/svelte-frontend/SKILL.md

@@ -226,4 +226,93 @@ When generating Svelte 5 code, prioritize frontend performance by applying the f
       Hello
     </div>
     ```
-5.  **Stay Updated**: Keep Svelte and its related packages up to date to benefit from the latest features, performance improvements, and security fixes.
+5.  **Stay Updated**: Keep Svelte and its related packages up to date to benefit from the latest features, performance improvements, and security fixes.
+
+## Windmill UI Component Rules (MUST follow)
+
+Always use Windmill's own design-system components instead of raw HTML elements. Using raw HTML elements produces inconsistent styling and breaks the design language.
+
+### Icons — use `lucide-svelte`
+
+**Never** write inline SVGs. Import icons from `lucide-svelte`.
+
+```svelte
+<script>
+  import { ChevronLeft, ChevronRight, X } from 'lucide-svelte'
+</script>
+
+<ChevronLeft size={16} />
+```
+
+### Buttons — use `<Button>`
+
+**Never** use `<button>`. Import and use `Button` from `$lib/components/common`.
+
+```svelte
+<script>
+  import { Button } from '$lib/components/common'
+  import { ChevronLeft, ChevronRight } from 'lucide-svelte'
+</script>
+
+<!-- Regular button -->
+<Button variant="default" onclick={handleClick}>Label</Button>
+
+<!-- Icon-only button (no label) -->
+<Button startIcon={{ icon: ChevronLeft }} iconOnly onclick={prevMonth} />
+<Button startIcon={{ icon: ChevronRight }} iconOnly onclick={nextMonth} />
+```
+
+Key `Button` props:
+- `variant?: 'accent' | 'accent-secondary' | 'default' | 'subtle'`
+- `unifiedSize?: 'sm' | 'md' | 'lg'`
+- `startIcon?: { icon: SvelteComponent }` — renders an icon before the label
+- `iconOnly?: boolean` — renders icon with no surrounding label text
+- `disabled?: boolean`
+
+### Text inputs — use `<TextInput>`
+
+**Never** use `<input>`. Import and use `TextInput` from `$lib/components/common`.
+
+```svelte
+<script>
+  import { TextInput } from '$lib/components/common'
+  let val = $state('')
+</script>
+
+<TextInput bind:value={val} placeholder="Enter value" />
+```
+
+Key `TextInput` props:
+- `value?: string | number` (bindable)
+- `placeholder?: string`
+- `disabled?: boolean`
+- `error?: string | boolean`
+- `size?: 'sm' | 'md' | 'lg'`
+- `inputProps?` — forwarded to the underlying `<input>`
+
+### Selects — use `<Select>`
+
+**Never** use `<select>`. Import and use `Select` from `$lib/components/select/Select.svelte`.
+
+```svelte
+<script>
+  import Select from '$lib/components/select/Select.svelte'
+
+  const monthItems = [
+    { label: 'January', value: 1 },
+    { label: 'February', value: 2 },
+    // ...
+  ]
+  let selectedMonth = $state(1)
+</script>
+
+<Select items={monthItems} bind:value={selectedMonth} />
+```
+
+Key `Select` props:
+- `items?: Array<{ label?: string; value: any; subtitle?: string; disabled?: boolean }>`
+- `value` (bindable) — the currently selected `.value`
+- `placeholder?: string`
+- `clearable?: boolean`
+- `disabled?: boolean`
+- `size?: 'sm' | 'md' | 'lg'`

.github/workflows/backend-test.yml

@@ -19,7 +19,7 @@ defaults:
 
 jobs:
   cargo_test:
-    runs-on: blacksmith-16vcpu-ubuntu-2404
+    runs-on: ubicloud-standard-16
     services:
       postgres:
         image: postgres
@@ -86,22 +86,8 @@ jobs:
         working-directory: /
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-          cache: false
+          cache-workspaces: backend
           toolchain: 1.93.0
-      - name: Cache cargo target directory
-        uses: useblacksmith/stickydisk@v1
-        with:
-          key: cargo-target
-          path: ./backend/target
-      - name: Cache cargo registry
-        uses: useblacksmith/cache@v1
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-registry-${{ hashFiles('backend/Cargo.lock') }}
-          restore-keys: |
-            cargo-registry-
       - name: Read EE repo commit hash
         run: |
           echo "ee_repo_ref=$(cat ./ee-repo-ref.txt)" >> "$GITHUB_ENV"
@@ -229,7 +215,7 @@ jobs:
           fi
           echo "Verified: Package requires authentication for @windmill-test/private-pkg"
       - name: Cache DuckDB FFI module build
-        uses: useblacksmith/cache@v1
+        uses: actions/cache@v3
         with:
           path: ./backend/windmill-duckdb-ffi-internal/target
           key: ${{ runner.os }}-duckdb-ffi-${{ hashFiles('./backend/windmill-duckdb-ffi-internal/src/**/*.rs', './backend/windmill-duckdb-ffi-internal/Cargo.toml', './backend/windmill-duckdb-ffi-internal/Cargo.lock') }}
@@ -245,7 +231,6 @@ jobs:
           RUST_LOG_STYLE: never
           CARGO_NET_GIT_FETCH_WITH_CLI: true
           CARGO_BUILD_JOBS: 12
-          CARGO_INCREMENTAL: 1
           WMDEBUG_FORCE_V0_WORKSPACE_DEPENDENCIES: 1
           WMDEBUG_FORCE_RUNNABLE_SETTINGS_V0: 1
           WMDEBUG_FORCE_NO_LEGACY_DEBOUNCING_COMPAT: 1

.mcp.json

@@ -4,11 +4,5 @@
       "type": "http",
       "url": "https://mcp.svelte.dev/mcp"
     }
-  },
-  "playwright": {
-    "command": "npx",
-    "args": [
-      "@playwright/mcp@latest"
-    ]
   }
 }

.wmdev.yaml

@@ -0,0 +1,79 @@
+services:
+  - name: BE
+    portEnv: BACKEND_PORT
+  - name: FE
+    portEnv: FRONTEND_PORT
+
+profiles:
+  default:
+    name: default
+
+  sandbox:
+    name: sandbox
+    image: windmill-sandbox
+    envPassthrough:
+      - AWS_ACCESS_KEY_ID
+      - AWS_SECRET_ACCESS_KEY
+      - R2_ENDPOINT
+      - R2_BUCKET
+      - R2_PUBLIC_URL
+    extraMounts:
+      - hostPath: ~/.codex
+        guestPath: /root/.codex
+        writable: true
+      - hostPath: ~/windmill-ee-private
+        writable: true
+      - hostPath: ~/windmill-ee-private__worktrees
+        writable: true
+    systemPrompt: >
+      You are running inside a sandboxed container with full permissions.
+      This worktree is configured with the following ports:
+
+      - Backend: port ${BACKEND_PORT}.
+        Start with: cd backend && PORT=${BACKEND_PORT}
+        DATABASE_URL=postgres://postgres:changeme@localhost:5432/windmill
+        cargo watch -x run
+
+      - Frontend: port ${FRONTEND_PORT}.
+        Start with: cd frontend && REMOTE=http://localhost:${BACKEND_PORT}
+        npm run dev -- --port ${FRONTEND_PORT} --host 0.0.0.0
+
+      --- Screenshots ---
+      You can take screenshots of the frontend UI and upload them to R2
+      for use in PR descriptions.
+      1) Take a screenshot:
+         bunx playwright screenshot --browser chromium
+         http://localhost:${FRONTEND_PORT}/path/to/page /tmp/screenshot.png
+      2) Upload to R2:
+         aws s3 cp /tmp/screenshot.png
+         "s3://$(printenv R2_BUCKET)/$(git rev-parse --abbrev-ref HEAD)/screenshot.png"
+         --endpoint-url "$(printenv R2_ENDPOINT)"
+      3) The public URL will be:
+         $(printenv R2_PUBLIC_URL)/<branch>/screenshot.png
+      4) Include screenshots in PR descriptions as markdown images:
+         ![description]($(printenv R2_PUBLIC_URL)/<branch>/screenshot.png)
+
+      --- Terminal Recordings (asciinema) ---
+      You can record terminal sessions and upload them for sharing.
+      asciinema is pre-installed at /usr/local/bin/asciinema.
+
+      1) Write a shell script with the commands to demo. Add sleep
+          delays for readable pacing:
+          - 0.5s after printing a "$ command" line (lets viewer read it)
+          - 1.5-2s after command output (lets viewer absorb the result)
+          - Set GIT_PAGER=cat and PAGER=cat to prevent pager hangs
+
+      2) Record headlessly:
+          asciinema rec --headless --overwrite \
+            -c "bash /tmp/demo.sh" \
+            --window-size 120x50 \
+            --title "Description of demo" \
+            /tmp/demo.cast
+
+      3) Upload to asciinema.org:
+          XDG_DATA_HOME=/tmp/.local/share \
+            asciinema upload --server-url https://asciinema.org /tmp/demo.cast
+
+linkedRepos:
+  - repo: windmill-labs/windmill-ee-private
+    alias: ee

.workmux.yaml

@@ -11,7 +11,7 @@ worktree_prefix: ""
 window_prefix: "wm-"
 
 auto_name:
-  model: "claude-sonnet-4.6"
+  model: "gemini-2.5-flash-lite"
   system_prompt: |
     Generate a concise git branch name based on the task description.
 
@@ -47,7 +47,7 @@ pre_remove:
 
 panes:
   - command: >-
-      claude --append-system-prompt
+      claude --dangerously-skip-permissions  --append-system-prompt
       "You are running inside a tmux session with other panes running services.\n
       Pane layout (current window):\n
       - Pane 0: this pane (claude agent)\n
@@ -57,9 +57,9 @@ panes:
       When restarting backend or frontend, make sure to use the ports listed in .env.local.\n
       Because we are running backend with cargo watch, to verify your changes, just check the logs in the backend pane. No need for cargo check."
     focus: true
-  - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/backend" && PORT=${BACKEND_PORT:-8000} cargo watch -x run'
+  - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/backend" && PORT=${BACKEND_PORT:-8000} cargo watch -x "run ${CARGO_FEATURES:+--features $CARGO_FEATURES}"'
     split: horizontal
-  - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/frontend" && npm install && npm run generate-backend-client && REMOTE=${REMOTE:-http://localhost:${BACKEND_PORT:-8000}} npm run dev -- --port ${FRONTEND_PORT:-3000} --host 0.0.0.0'
+  - command: 'ROOT="$(git rev-parse --show-toplevel)"; [ -f "$ROOT/.env.local" ] && source "$ROOT/.env.local"; cd "$ROOT/frontend" && npm run generate-backend-client && REMOTE=${REMOTE:-http://localhost:${BACKEND_PORT:-8000}} npm run dev -- --port ${FRONTEND_PORT:-3000} --host 0.0.0.0'
     split: vertical
 
 files:
@@ -70,6 +70,3 @@ files:
 sandbox:
   enabled: false
   toolchain: off
-  # image, host_commands, and extra_mounts configured in global
-  # ~/.config/workmux/config.yaml — see README_WORKMUX_DEV.md for required
-  # extra_mounts (windmill-ee-private access in sandbox)

CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [1.644.0](https://github.com/windmill-labs/windmill/compare/v1.643.0...v1.644.0) (2026-02-24)
+
+
+### Features
+
+* **cli:** detect missing folders on sync push and add 'wmill folder add-missing' ([#8011](https://github.com/windmill-labs/windmill/issues/8011)) ([835db5d](https://github.com/windmill-labs/windmill/commit/835db5d290a151f38f4e879ed7ffbda5d1c4b24f))
+
+
+### Bug Fixes
+
+* prevent concurrent index migrations from re-running on every startup ([#8069](https://github.com/windmill-labs/windmill/issues/8069)) ([8ff2340](https://github.com/windmill-labs/windmill/commit/8ff2340c0c08ce49a809c8958a9862ffb1681642))
+
+## [1.643.0](https://github.com/windmill-labs/windmill/compare/v1.642.0...v1.643.0) (2026-02-24)
+
+
+### Features
+
+* add fileset resource type support ([32c4b47](https://github.com/windmill-labs/windmill/commit/32c4b474f92f3dbbd2077fab70bdf9e407581626))
+* add fileset resource type support ([#8063](https://github.com/windmill-labs/windmill/issues/8063)) ([c15b9ab](https://github.com/windmill-labs/windmill/commit/c15b9abe5eb2a1566a7ce4b18784c961d178a669))
+* add light mode for navigation sidebar ([#8057](https://github.com/windmill-labs/windmill/issues/8057)) ([0935bf9](https://github.com/windmill-labs/windmill/commit/0935bf9fc460c03c6d8469b93036e43714517ef2))
+* **aiagent:** handle ai agent as tool ([#8031](https://github.com/windmill-labs/windmill/issues/8031)) ([de6fd16](https://github.com/windmill-labs/windmill/commit/de6fd160d56c1037adbbe785f195483c25982e1c))
+* Unified filters and new runs page ([#8027](https://github.com/windmill-labs/windmill/issues/8027)) ([9b28c85](https://github.com/windmill-labs/windmill/commit/9b28c85469d6b2a8590810b313b030d9f00ee9e3))
+
+
+### Bug Fixes
+
+* address code review findings for fileset feature ([1b4489a](https://github.com/windmill-labs/windmill/commit/1b4489acac3b050f0a783548bacfc9bdf33ee593))
+* address second round of review findings ([753c05a](https://github.com/windmill-labs/windmill/commit/753c05a03089b95b4ade68d3bf61c8818de422ce))
+* **backend:** decimal between 0 and -1  in mssql ([#8051](https://github.com/windmill-labs/windmill/issues/8051)) ([9686608](https://github.com/windmill-labs/windmill/commit/9686608355615a50c8395f6e2fd51dcc25498226))
+* **backend:** use filename instead of content_type to detect file fields in multipart form data ([#8054](https://github.com/windmill-labs/windmill/issues/8054)) ([0aa885d](https://github.com/windmill-labs/windmill/commit/0aa885db67d77202205fc1609e841b8ffd9a8121))
+* exclude app_theme resources from workspace tab ([9c513b2](https://github.com/windmill-labs/windmill/commit/9c513b2c62acc369179fb9e404e1f4007cd854c6))
+* fileset editor takes full height with matching header ([9ac0789](https://github.com/windmill-labs/windmill/commit/9ac07897cf99f3af27801e435c7376a46ef760c9))
+* prevent iframe from overriding file selection after file creation ([7f3ddd7](https://github.com/windmill-labs/windmill/commit/7f3ddd7edd3ea993642aadd55cdba0ac2ea1eb9f))
+* resolve svelte warnings and type error in fileset components ([4c06d74](https://github.com/windmill-labs/windmill/commit/4c06d74bd01ca2dda848be421d70dd5268520992))
+* restore full-width file tree items in raw app sidebar ([5bac8b0](https://github.com/windmill-labs/windmill/commit/5bac8b093dbe913a563b02573959c64dd405ff61))
+* suppress iframe setActiveDocument during file population ([1abfeea](https://github.com/windmill-labs/windmill/commit/1abfeea81a645c59934d62257ad869ed7b475634))
+* update git sync init script to hub version 28158 ([#8061](https://github.com/windmill-labs/windmill/issues/8061)) ([705e186](https://github.com/windmill-labs/windmill/commit/705e186f3d4c7d8f8a88fc84b379ed9fe800a6b2))
+* use correct column name completed_at instead of ended_at in count_completed_jobs_detail ([#8066](https://github.com/windmill-labs/windmill/issues/8066)) ([3aba0ed](https://github.com/windmill-labs/windmill/commit/3aba0ed2508debdc78a6631e49b074a97635f21d))
+
 ## [1.642.0](https://github.com/windmill-labs/windmill/compare/v1.641.0...v1.642.0) (2026-02-22)
 
 

Dockerfile.sandbox

@@ -58,8 +58,10 @@ RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
     ln -s /usr/local/lib/cargo/bin/* /usr/local/bin/
 RUN cargo install sqlx-cli --no-default-features --features native-tls,postgres && \
     cargo install cargo-watch && \
+    cargo install --locked --git https://github.com/asciinema/asciinema && \
     ln -sf /usr/local/lib/cargo/bin/sqlx /usr/local/bin/sqlx && \
-    ln -sf /usr/local/lib/cargo/bin/cargo-watch /usr/local/bin/cargo-watch
+    ln -sf /usr/local/lib/cargo/bin/cargo-watch /usr/local/bin/cargo-watch && \
+    ln -sf /usr/local/lib/cargo/bin/asciinema /usr/local/bin/asciinema
 
 # ── Register dynamic runtime users ───────────────────────────────────────────
 RUN cat <<'SCRIPT' > /usr/local/bin/register-dynamic-user.sh
@@ -173,7 +175,8 @@ RUN curl -fsSL https://claude.ai/install.sh | bash && \
     mv /root/.local/share/claude /usr/local/lib/claude && \
     ln -s "/usr/local/lib/claude/versions/$(basename "$target")" /usr/local/bin/claude && \
     mkdir -p /tmp/.local/bin && \
-    ln -s /usr/local/bin/claude /tmp/.local/bin/claude
+    ln -s /usr/local/bin/claude /tmp/.local/bin/claude && \
+    chmod -R a+rwX /tmp/.local
 
 # ── Codex ─────────────────────────────────────────────────────────────────────
 RUN npm i -g @openai/codex
@@ -189,6 +192,7 @@ ENV PLAYWRIGHT_BROWSERS_PATH=/usr/local/lib/playwright-browsers
 RUN bun add -g @playwright/test \
     && bunx playwright install chromium --with-deps \
     && chmod -R a+rwX /usr/local/lib/playwright-browsers \
+    && chmod -R a+rwX /usr/local/lib/bun/install \
     && rm -rf /var/lib/apt/lists/* /tmp/bunx-*
 
 # ── AWS CLI (for S3-compatible uploads to R2) ─────────────────────────────────
@@ -231,4 +235,4 @@ fi
 exec "$@"
 ENTRY
 RUN chmod +x /usr/local/bin/entrypoint.sh
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

README_WORKMUX_DEV.md

@@ -65,7 +65,7 @@ Setting up zsh autocomplete is also recommended — see the [workmux docs](https
 Each worktree is assigned a **slot** that determines its ports:
 
 | Slot | Backend | Frontend |
-|------|---------|----------|
+| ---- | ------- | -------- |
 | 0    | 8000    | 3000     |
 | 1    | 8010    | 3010     |
 | 2    | 8020    | 3020     |
@@ -170,7 +170,8 @@ The setup is defined in `.workmux.yaml` at the repo root. Key sections:
 - **`post_create`**: Runs `scripts/worktree-env` to generate `.env.local` with port assignments
 - **`panes`**: Defines the tmux layout (agent, backend, frontend)
 - **`files.copy`**: Copies `backend/.env` and `scripts/` into each worktree
-- **`files.symlink`**: Symlinks `node_modules` and `.svelte-kit` to avoid reinstalling per worktree
+
+The `post_create` hook also copies `frontend/node_modules` using `cp -a` (preserves `.bin/` symlinks that `cp -r` would dereference).
 
 ## Enterprise (EE) Code Access
 
@@ -191,6 +192,98 @@ sandbox:
 
 This mounts both the main EE repo (used by the main worktree) and the EE worktrees directory (used by feature worktrees) into every sandbox container.
 
+## Cursor SSH Integration (`wmc`)
+
+`wm-cursor` (aliased as `wmc`) gives each worktree its own Cursor SSH remote window with an independently-focused tmux session. All windows are visible in the status bar across all Cursor terminals, but each one is focused on its own worktree.
+
+This uses **grouped tmux sessions** — multiple sessions that share the same window list but track focus independently:
+
+```
+tmux session: main          <-- your main Cursor terminal
+tmux session: cursor-feat-a <-- Cursor window for feat-a (focused on wm-feat-a)
+tmux session: cursor-feat-b <-- Cursor window for feat-b (focused on wm-feat-b)
+    \__ all three share the same windows in the status bar
+```
+
+### Setup
+
+Run once from inside tmux on the remote:
+
+```bash
+./scripts/wm-cursor setup /home/hugo/projects/windmill
+```
+
+This:
+
+1. **Merges `.vscode/settings.json`** — adds the `wm-tmux` terminal profile (auto-attaches to the `main` tmux session), disables auto port forwarding, configures forwarding for ports 8000/3000/5432, and stops rust-analyzer from auto-starting. Existing settings are preserved.
+2. **Creates `.vscode/tasks.json`** — auto-starts the dev database (`start-dev-db.sh`) when the folder opens.
+3. **Adds `wmc` alias to `~/.zshrc`** — so you can use `wmc` from any tmux window.
+4. **Adds `eval "$(wmc completions)"`** to `~/.zshrc` — provides tab-completion for subcommands and worktree names (for `open`, `open-ee`, and `close`).
+
+After setup, reopen Cursor's terminal to pick up the new profile.
+
+### Usage
+
+All commands run from inside a tmux session (i.e., from Cursor's integrated terminal after setup).
+
+**Create a new worktree + open Cursor:**
+
+```bash
+wmc add -A -p "implement feature X"
+```
+
+This runs `workmux add`, creates a grouped tmux session, writes `.vscode/settings.json` in the worktree (with port forwarding matching the worktree's assigned ports), and opens a new Cursor window.
+
+**Open Cursor for an existing worktree:**
+
+```bash
+wmc open my-feature
+```
+
+**Open the EE worktree in Cursor (no tmux session):**
+
+```bash
+wmc open-ee my-feature
+```
+
+This finds the matching `windmill-ee-private__worktrees/<name>` directory and opens it in a new Cursor window.
+
+**Close a worktree's Cursor window and tmux window (keeps the worktree):**
+
+```bash
+wmc close my-feature
+```
+
+This kills the grouped tmux session and calls `workmux close` to close the tmux window. The worktree and branch are preserved. Grouped sessions are also automatically cleaned up when you `workmux rm` a worktree (via `scripts/worktree-cleanup`).
+
+## Cargo Features
+
+To build the backend with specific Cargo features (e.g., `enterprise`, `parquet`), pass them via `CARGO_FEATURES`. The backend pane reads this from `.env.local` and appends `--features <value>` to the `cargo watch` command.
+
+**With `wm` (workmux):**
+
+Set `CARGO_FEATURES` as an environment variable before creating the worktree:
+
+```bash
+CARGO_FEATURES="enterprise,parquet" wm add my-feature
+```
+
+This gets written to `.env.local` by the `post_create` hook (`scripts/worktree-env`), and the backend pane picks it up automatically.
+
+**With `wmc` (wm-cursor):**
+
+Use the `--features` flag:
+
+```bash
+# Create a new worktree with features
+wmc add --features "enterprise,parquet" -A -p "implement feature X"
+
+# Open an existing worktree with different features
+wmc open my-feature --features "enterprise,parquet"
+```
+
+The `--features` flag exports `CARGO_FEATURES` so the `post_create` hook writes it to `.env.local`. When using `wmc open`, it updates the existing `.env.local` with the new features.
+
 ## Login
 
 Default credentials: `admin@windmill.dev` / `changeme`

backend/.sqlx/query-02e526146f3584cd599dec708e1be48db3b0cd1c74adbfa2e4039377daa016f0.json

@@ -20,7 +20,8 @@
                       "resource",
                       "variable",
                       "ducklake",
-                      "datatable"
+                      "datatable",
+                      "volume"
                     ]
                   }
                 }

backend/.sqlx/query-03d63d2e64b012f624d2731b5bcb8849c74a9474777be61edf0ed43ddda07ef3.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -52,7 +57,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "03d63d2e64b012f624d2731b5bcb8849c74a9474777be61edf0ed43ddda07ef3"

backend/.sqlx/query-075d4749299af2cb81162bf396bec6aa89de43ec201c911196763e03e644ca7a.json

@@ -1,28 +1,29 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT name, format_extension FROM resource_type WHERE format_extension IS NOT NULL AND (workspace_id = $1 OR workspace_id = 'admins')",
+  "query": "SELECT email, edited_by FROM websocket_trigger WHERE path = $1 AND workspace_id = $2",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "name",
+        "name": "email",
         "type_info": "Varchar"
       },
       {
         "ordinal": 1,
-        "name": "format_extension",
+        "name": "edited_by",
         "type_info": "Varchar"
       }
     ],
     "parameters": {
       "Left": [
+        "Text",
         "Text"
       ]
     },
     "nullable": [
       false,
-      true
+      false
     ]
   },
-  "hash": "cf1cef7e0fe2e7e3db96b0ec005360361b9eec023a6fc2a4a7a917f59d86af4d"
+  "hash": "075d4749299af2cb81162bf396bec6aa89de43ec201c911196763e03e644ca7a"
 }

backend/.sqlx/query-14276a040cb4db88d71fccdc3579e8c0bb132b70668301b535872d1632753e30.json

@@ -43,8 +43,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-17aafb72843659df9594d6d2466d2afaf26e666ffe52e0ea85792ea31b63410c.json

@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, edited_by FROM schedule WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "edited_by",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "17aafb72843659df9594d6d2466d2afaf26e666ffe52e0ea85792ea31b63410c"
+}

backend/.sqlx/query-1c2157ce14e90f0751d7f0a9f2dbb3c5a5789a32423e75260098a5300a4af986.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset\n         FROM resource_type\n         WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1c2157ce14e90f0751d7f0a9f2dbb3c5a5789a32423e75260098a5300a4af986"
+}

backend/.sqlx/query-2768622b76ad92c05f4f44d997aff285707e1a43ce85e5bb8e87849d78a0637f.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT schema, description, format_extension\n         FROM resource_type\n         WHERE workspace_id = $1 AND name = $2",
+  "query": "SELECT schema, description, format_extension, is_fileset\n         FROM resource_type\n         WHERE workspace_id = $1 AND name = $2",
   "describe": {
     "columns": [
       {
@@ -17,6 +17,11 @@
         "ordinal": 2,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -28,8 +33,9 @@
     "nullable": [
       true,
       true,
-      true
+      true,
+      false
     ]
   },
-  "hash": "7bc9fc05dbd162866bef1fdd3e7faeb50429881ed1bc962903f06e4b3d5f8d44"
+  "hash": "2768622b76ad92c05f4f44d997aff285707e1a43ce85e5bb8e87849d78a0637f"
 }

backend/.sqlx/query-2d6607b3c38fe72b5663c32de58dacbabed4c5ae28101e3ae2694f96fd055a91.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE workspace_id = $1 AND label IS DISTINCT FROM 'session' RETURNING token",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "token",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "2d6607b3c38fe72b5663c32de58dacbabed4c5ae28101e3ae2694f96fd055a91"
+}

backend/.sqlx/query-48a41e1ad0ad8fc51624af4de34964c72fe4b3cf2497644d514c5c00d6d71bf3.json

@@ -42,8 +42,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json

@@ -38,8 +38,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-5899c7614f195fdd23e38389e52b004f957aafa2201b80638b5f87a625373f00.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type\n            (workspace_id, name, schema, description, created_by, format_extension, edited_at)\n            VALUES ($1, $2, $3, $4, $5, $6, now())",
+  "query": "INSERT INTO resource_type\n            (workspace_id, name, schema, description, created_by, format_extension, is_fileset, edited_at)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, now())",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,10 +10,11 @@
         "Jsonb",
         "Text",
         "Varchar",
-        "Varchar"
+        "Varchar",
+        "Bool"
       ]
     },
     "nullable": []
   },
-  "hash": "ffedbb3a2676a6d7b71f81f89109a02a8dba90d40144e942527f8a3fc36dfbc1"
+  "hash": "5899c7614f195fdd23e38389e52b004f957aafa2201b80638b5f87a625373f00"
 }

backend/.sqlx/query-5bf200f2c8db25ddf231b564503c6c70f7f3958564a79bb0c6b3863b1ebb0cbf.json

@@ -77,8 +77,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-61b37cb4db6e60c2d35f7d23db5afbe04e040a8dcd1d93afaaaa320665c8779a.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            WITH prev_sd AS (\n                DELETE FROM debounce_stale_data WHERE job_id = $1 RETURNING to_relock\n            ) INSERT INTO debounce_stale_data (job_id, to_relock)\n                VALUES ($2, array_cat((SELECT to_relock FROM prev_sd), $3))\n                ON CONFLICT (job_id) DO UPDATE SET to_relock = EXCLUDED.to_relock\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Uuid",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "61b37cb4db6e60c2d35f7d23db5afbe04e040a8dcd1d93afaaaa320665c8779a"
-}

backend/.sqlx/query-7aaa5b0bd873c2029e2201d287ea0aaae04678ac105374bbe387e534a6cb6333.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT runnable_id as \"runnable_id: ScriptHash\", raw_flow as \"raw_flow: _\", kind as \"kind: _\" FROM v2_job WHERE id = $1",
+  "query": "SELECT runnable_id as \"runnable_id: ScriptHash\", raw_flow as \"raw_flow: _\", kind as \"kind: _\", parent_job, flow_step_id FROM v2_job WHERE id = $1",
   "describe": {
     "columns": [
       {
@@ -42,12 +42,21 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }
         }
+      },
+      {
+        "ordinal": 3,
+        "name": "parent_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 4,
+        "name": "flow_step_id",
+        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -58,8 +67,10 @@
     "nullable": [
       true,
       true,
-      false
+      false,
+      true,
+      true
     ]
   },
-  "hash": "805d633de90fee335f1726284eda0dbc200d45960fb8dea867492c8c7dd096d5"
+  "hash": "7aaa5b0bd873c2029e2201d287ea0aaae04678ac105374bbe387e534a6cb6333"
 }

backend/.sqlx/query-7abd579d3ec97853ac36cc8dad29013eb133a28cd848bf8fdf9571b2ee402a3e.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension)\n         SELECT $2, name, schema, description, edited_at, created_by, format_extension\n         FROM resource_type\n         WHERE workspace_id = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "7abd579d3ec97853ac36cc8dad29013eb133a28cd848bf8fdf9571b2ee402a3e"
-}

backend/.sqlx/query-7b1239ad6460e8f5fb41bfe12f662a779528784ec8cf3f6dcce5545ab90bf234.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -51,7 +56,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "7b1239ad6460e8f5fb41bfe12f662a779528784ec8cf3f6dcce5545ab90bf234"

backend/.sqlx/query-7bb8ff3426ec73672fb572cd1ce36f495a84e0ad7d60fd39eddcccbc129d43c8.json

@@ -44,8 +44,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-8311a553c44221751ffdbbe6a997d6feba8d43292daf6c5433b66bd8450e8854.json

@@ -0,0 +1,29 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, edited_by FROM http_trigger WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "edited_by",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "8311a553c44221751ffdbbe6a997d6feba8d43292daf6c5433b66bd8450e8854"
+}

backend/.sqlx/query-842775bcf91d747abb11ffe9c98fa1208595e012590606ef6667ea3a78105883.json

@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT name, format_extension, is_fileset FROM resource_type WHERE (format_extension IS NOT NULL OR is_fileset = true) AND (workspace_id = $1 OR workspace_id = 'admins')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "format_extension",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "is_fileset",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false
+    ]
+  },
+  "hash": "842775bcf91d747abb11ffe9c98fa1208595e012590606ef6667ea3a78105883"
+}

backend/.sqlx/query-85a6a85fd126a8bfedd65d6b38d22c65911ab9cf0414c33a3321a1d43af49795.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of_email FROM flow WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "85a6a85fd126a8bfedd65d6b38d22c65911ab9cf0414c33a3321a1d43af49795"
+}

backend/.sqlx/query-886a921adc115f0a9c6f3a68381bd8f5a16866135120175d9073b9b2c41bbd51.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT email FROM password WHERE ($2::text = '*' OR email LIKE CONCAT('%', $2::text)) AND NOT EXISTS (\n                    SELECT 1 FROM usr WHERE workspace_id = $1::text AND email = password.email\n                )",
+  "query": "SELECT email FROM password WHERE ($2::text = '*' OR email LIKE CONCAT('%@', $2::text)) AND NOT EXISTS (\n                    SELECT 1 FROM usr WHERE workspace_id = $1::text AND email = password.email\n                )",
   "describe": {
     "columns": [
       {
@@ -19,5 +19,5 @@
       false
     ]
   },
-  "hash": "0ef37117c369f03236e18f9dbb1f3d52776c8cb73f2507199c6ca16d4d2405ba"
+  "hash": "886a921adc115f0a9c6f3a68381bd8f5a16866135120175d9073b9b2c41bbd51"
 }

backend/.sqlx/query-8d444380516faf56369cdbff645904e20477aa597e30891926af42eee56ab081.json

@@ -102,8 +102,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-8d4ad4ee75fb149c36a9f6a0c4cf5fd981473f45d1b71b4b8236e021f7c8682d.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM _sqlx_migrations WHERE\n        version=20250131115248 OR version=20250902085503 OR version=20250201145630 OR\n        version=20250201145631 OR version=20250201145632 OR version=20251006143821 OR\n        version=20260207000001 OR version=20260207000002 OR version=20260207000003 OR version=20260207000004",
+  "query": "DELETE FROM _sqlx_migrations WHERE\n        version=20250131115248 OR version=20250902085503 OR version=20250201145630 OR\n        version=20250201145631 OR version=20250201145632 OR version=20251006143821",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "c6bcf0d9e211bc03e3338682295f4995e1d622917367c478742addd073245ad5"
+  "hash": "8d4ad4ee75fb149c36a9f6a0c4cf5fd981473f45d1b71b4b8236e021f7c8682d"
 }

backend/.sqlx/query-92c7c961198e506426bf3f97a8ddbb34af450041c675b30b708fed3ef9e01d2d.json

@@ -32,8 +32,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-987d79f7c6d7bc148cc8aab67e47161cfca045966e995e28c7a7ad090cffeda0.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE schedule SET\n            schedule                = $1,\n            timezone                = $2,\n            args                    = $3,\n            on_failure              = $4,\n            on_failure_times        = $5,\n            on_failure_exact        = $6,\n            on_failure_extra_args   = $7,\n            on_recovery             = $8,\n            on_recovery_times       = $9,\n            on_recovery_extra_args  = $10,\n            on_success              = $11,\n            on_success_extra_args   = $12,\n            ws_error_handler_muted  = $13,\n            retry                   = $14,\n            summary                 = $15,\n            no_flow_overlap         = $16,\n            tag                     = $17,\n            paused_until            = $18,\n            path                    = $19,\n            workspace_id            = $20,\n            cron_version            = COALESCE($21, cron_version),\n            description             = $22,\n            dynamic_skip        = $23\n        WHERE path = $19 AND workspace_id = $20\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip\n        ",
+  "query": "\n        UPDATE schedule SET\n            schedule                = $1,\n            timezone                = $2,\n            args                    = $3,\n            on_failure              = $4,\n            on_failure_times        = $5,\n            on_failure_exact        = $6,\n            on_failure_extra_args   = $7,\n            on_recovery             = $8,\n            on_recovery_times       = $9,\n            on_recovery_extra_args  = $10,\n            on_success              = $11,\n            on_success_extra_args   = $12,\n            ws_error_handler_muted  = $13,\n            retry                   = $14,\n            summary                 = $15,\n            no_flow_overlap         = $16,\n            tag                     = $17,\n            paused_until            = $18,\n            path                    = $19,\n            workspace_id            = $20,\n            cron_version            = COALESCE($21, cron_version),\n            description             = $22,\n            dynamic_skip            = $23,\n            email                   = COALESCE($24, email),\n            edited_by               = $25\n        WHERE path = $19 AND workspace_id = $20\n        RETURNING\n            workspace_id,\n            path,\n            edited_by,\n            edited_at,\n            schedule,\n            timezone,\n            enabled,\n            script_path,\n            is_flow,\n            args AS \"args: _\",\n            extra_perms,\n            email,\n            error,\n            on_failure,\n            on_failure_times,\n            on_failure_exact,\n            on_failure_extra_args AS \"on_failure_extra_args: _\",\n            on_recovery,\n            on_recovery_times,\n            on_recovery_extra_args AS \"on_recovery_extra_args: _\",\n            on_success,\n            on_success_extra_args AS \"on_success_extra_args: _\",\n            ws_error_handler_muted,\n            retry,\n            no_flow_overlap,\n            summary,\n            description,\n            tag,\n            paused_until,\n            cron_version,\n            dynamic_skip\n        ",
   "describe": {
     "columns": [
       {
@@ -183,6 +183,8 @@
         "Text",
         "Text",
         "Text",
+        "Varchar",
+        "Varchar",
         "Varchar"
       ]
     },
@@ -220,5 +222,5 @@
       true
     ]
   },
-  "hash": "4144c87c25a939aafb2f57da189d94d038bcad7a36fbf87e0403c89a979c5b3f"
+  "hash": "987d79f7c6d7bc148cc8aab67e47161cfca045966e995e28c7a7ad090cffeda0"
 }

backend/.sqlx/query-a1745a4f525b251d2f5a602ab2b2ede46b4471e21b11f607573a844013911abe.json

@@ -72,8 +72,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-a4b6371d33206010b2f3ffd2b09e33244fe8ab9a803248fc23f334034d24aad4.json

@@ -77,8 +77,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-a9c805423e700b0acceb7c3dc43d1d3f9d4f56da25f588d281638e449d99a0d9.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow_version (workspace_id, path, value, schema, created_by) \n        VALUES ($1, $2, $3, $4::text::json, $5)\n        RETURNING id",
+  "query": "INSERT INTO flow_version (workspace_id, path, value, schema, created_by)\n        VALUES ($1, $2, $3, $4::text::json, $5)\n        RETURNING id",
   "describe": {
     "columns": [
       {
@@ -22,5 +22,5 @@
       false
     ]
   },
-  "hash": "07f5290e90533eac50b890a0d7f4a5e73ac111c838f687fe8647636827aae8b5"
+  "hash": "a9c805423e700b0acceb7c3dc43d1d3f9d4f56da25f588d281638e449d99a0d9"
 }

backend/.sqlx/query-a9e29764b5b9d94269e2b8aa755c71b61774c8ff8ae218d7a8d6ed0ac0169366.json

@@ -16,7 +16,8 @@
                 "resource",
                 "variable",
                 "ducklake",
-                "datatable"
+                "datatable",
+                "volume"
               ]
             }
           }

backend/.sqlx/query-b12fba75788e44daefd9b3540a3aebe9167431aaa0a902b4558bc141c85ed825.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT policy FROM app WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "policy",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "b12fba75788e44daefd9b3540a3aebe9167431aaa0a902b4558bc141c85ed825"
+}

backend/.sqlx/query-b23784ed2737c01aaf05efe42bcdcfc9579aa203005ead60322fb71fd33b15b0.json

@@ -102,8 +102,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-b3771b690c5966272b1f42c9965bb6a8f961c119516e4c33dc928cd3b4f4edbc.json

@@ -72,8 +72,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-b8d392ccfcccafe0c19511b3567bc11779b1052b0948c410468a8aeba1d26d33.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -51,7 +56,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "b8d392ccfcccafe0c19511b3567bc11779b1052b0948c410468a8aeba1d26d33"

backend/.sqlx/query-be6d2c92a62b7b284651c45af809746147aa9b8d0a81642a7b7cb4738a0cad66.json

@@ -41,8 +41,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-c0fad64e5d707ffa29d236f558e23b608168dc3a1b3857d2ad33ec20627acbff.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace_invite\n            (workspace_id, email, is_admin, operator)\n            SELECT $1::text, email, false, $3 FROM password WHERE ($2::text = '*' OR email LIKE CONCAT('%', $2::text)) AND NOT EXISTS (\n                SELECT 1 FROM usr WHERE workspace_id = $1::text AND email = password.email\n            )\n            ON CONFLICT DO NOTHING",
+  "query": "INSERT INTO workspace_invite\n            (workspace_id, email, is_admin, operator)\n            SELECT $1::text, email, false, $3 FROM password WHERE ($2::text = '*' OR email LIKE CONCAT('%@', $2::text)) AND NOT EXISTS (\n                SELECT 1 FROM usr WHERE workspace_id = $1::text AND email = password.email\n            )\n            ON CONFLICT DO NOTHING",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,5 +12,5 @@
     },
     "nullable": []
   },
-  "hash": "2e1d1c59bfc53d58962251822c85cf9a26e3b2888702e5e9d5fc1b082901df09"
+  "hash": "c0fad64e5d707ffa29d236f558e23b608168dc3a1b3857d2ad33ec20627acbff"
 }

backend/.sqlx/query-d32448f6b329cf98dad42b218a630c0cf40a99edb4ae9fe3e9be485ab1077b3a.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO token (token, email, label, expiration, scopes, workspace_id)\n         VALUES ($1, $2, $3, now() + ($4 || ' seconds')::interval, $5, $6)",
+  "query": "INSERT INTO token (token, email, label, expiration, scopes, workspace_id)\n         SELECT $1::varchar, $2::varchar, $3::varchar, now() + ($4 || ' seconds')::interval, $5::text[], $6::varchar\n         WHERE NOT EXISTS(SELECT 1 FROM workspace WHERE id = $6 AND deleted = true)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -15,5 +15,5 @@
     },
     "nullable": []
   },
-  "hash": "7e4aa6b19b110bca423b3a3f428826d92b9808c64ef989fef2142bc8e02d6630"
+  "hash": "d32448f6b329cf98dad42b218a630c0cf40a99edb4ae9fe3e9be485ab1077b3a"
 }

backend/.sqlx/query-d41ea93fd58381b89e151c965eae1ea2fe96a1b94f5a92953fb1c1642d15c016.json

@@ -41,8 +41,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-dda45bcc53e94659838e98b6b9e7a55be0e31aee3008d5190f09c1f15e5b47dd.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO group_\n            VALUES ($1, 'wm_deployers', 'Members can preserve the original author when deploying to this workspace')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dda45bcc53e94659838e98b6b9e7a55be0e31aee3008d5190f09c1f15e5b47dd"
+}

backend/.sqlx/query-e1f10f940d7ba6b1652e3d6505e12b16394f9632fd535febb008ebfe9fe0b7c8.json

@@ -31,8 +31,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-e1f43cb65201b4f0965a4e18f0c918ae51fee667472d0cc2796ffdba4138d2ee.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2 ORDER BY created_at DESC LIMIT 1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "e1f43cb65201b4f0965a4e18f0c918ae51fee667472d0cc2796ffdba4138d2ee"
+}

backend/.sqlx/query-e2905bca184696a80357d8e4126832a902b3088d91fbbb858f6c0aa9de8a5ff7.json

@@ -37,8 +37,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-e33be0991702ae3a295db7defc6d19d914307a95d72bb0fb447e5b367d52f6a0.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO token\n            (token, email, label, expiration, super_admin, scopes, workspace_id)\n            VALUES ($1, $2, $3, $4, $5, $6, $7)",
+  "query": "INSERT INTO token\n            (token, email, label, expiration, super_admin, scopes, workspace_id)\n            SELECT $1, $2, $3, $4, $5, $6, $7\n            WHERE $7::varchar IS NULL OR NOT EXISTS(\n                SELECT 1 FROM workspace WHERE id = $7 AND deleted = true\n            )",
   "describe": {
     "columns": [],
     "parameters": {
@@ -16,5 +16,5 @@
     },
     "nullable": []
   },
-  "hash": "c624f15f3e321b1eecf123da9bf0b18e8c1d16ef25ffb9d04e5447d0d583d55c"
+  "hash": "e33be0991702ae3a295db7defc6d19d914307a95d72bb0fb447e5b367d52f6a0"
 }

backend/.sqlx/query-e4d71278fb80126a7a9da73f1889352d4d1e3cb3a8a08f1c9c03055a1cab1235.json

@@ -77,8 +77,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/.sqlx/query-e8d948274840699c5f7485ee4bc00b72c11bd226f99eade7e9a0da4605539283.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT on_behalf_of_email FROM script WHERE path = $1 AND workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "on_behalf_of_email",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "e8d948274840699c5f7485ee4bc00b72c11bd226f99eade7e9a0da4605539283"
+}

backend/.sqlx/query-eb1f7f01461f5a7540c273b37e5d578c31cf151ab3ef813f7aada76533761e12.json

@@ -37,6 +37,11 @@
         "ordinal": 6,
         "name": "format_extension",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 7,
+        "name": "is_fileset",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -49,7 +54,8 @@
       true,
       true,
       true,
-      true
+      true,
+      false
     ]
   },
   "hash": "eb1f7f01461f5a7540c273b37e5d578c31cf151ab3ef813f7aada76533761e12"

backend/.sqlx/query-fbd38c9c4f4ecba2d3e3d79433327fd4280466eec443aff4f1e8c1ab810cca7e.json

@@ -32,8 +32,7 @@
                 "aiagent",
                 "unassigned_script",
                 "unassigned_flow",
-                "unassigned_singlestepflow",
-                "snapshotbuild"
+                "unassigned_singlestepflow"
               ]
             }
           }

backend/Cargo.lock

@@ -2259,9 +2259,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.43"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -5588,7 +5588,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
 dependencies = [
  "cfg-if",
- "rustix 1.1.3",
+ "rustix 1.1.4",
  "windows-sys 0.59.0",
 ]
 
@@ -5804,7 +5804,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8640e34b88f7652208ce9e88b1a37a2ae95227d84abec377ccd3c5cfeb141ed4"
 dependencies = [
- "rustix 1.1.3",
+ "rustix 1.1.4",
  "windows-sys 0.59.0",
 ]
 
@@ -8092,9 +8092,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.23"
+version = "1.1.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15d118bbf3771060e7311cc7bb0545b01d08a8b4a7de949198dec1fa0ca1c0f7"
+checksum = "4735e9cbde5aac84a5ce588f6b23a90b9b0b528f6c5a8db8a4aff300463a0839"
 dependencies = [
  "cc",
  "libc",
@@ -8116,9 +8116,9 @@ checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
@@ -9729,9 +9729,9 @@ dependencies = [
 
 [[package]]
 name = "owo-colors"
-version = "4.2.3"
+version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c6901729fa79e91a0913333229e9ca5dc725089d1c363b2f4b4760709dc4a52"
+checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
 
 [[package]]
 name = "p224"
@@ -11598,14 +11598,14 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags 2.9.4",
  "errno",
  "libc",
- "linux-raw-sys 0.11.0",
+ "linux-raw-sys 0.12.1",
  "windows-sys 0.61.2",
 ]
 
@@ -13838,14 +13838,14 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.25.0"
+version = "3.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1"
+checksum = "82a72c767771b47409d2345987fda8628641887d5466101319899796367354a0"
 dependencies = [
  "fastrand",
  "getrandom 0.4.1",
  "once_cell",
- "rustix 1.1.3",
+ "rustix 1.1.4",
  "windows-sys 0.61.2",
 ]
 
@@ -13864,7 +13864,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "60b8cb979cb11c32ce1603f8137b22262a9d131aaa5c37b5678025f22b8becd0"
 dependencies = [
- "rustix 1.1.3",
+ "rustix 1.1.4",
  "windows-sys 0.60.2",
 ]
 
@@ -15725,7 +15725,7 @@ dependencies = [
 
 [[package]]
 name = "windmill"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -15789,7 +15789,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-alerting"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -15802,7 +15802,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15940,7 +15940,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-agent-workers"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -15963,7 +15963,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-assets"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -15976,7 +15976,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-auth"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -16002,7 +16002,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -16012,7 +16012,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-configs"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16029,7 +16029,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-debug"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "base64 0.22.1",
@@ -16052,7 +16052,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-embeddings"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -16075,7 +16075,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flow-conversations"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16091,7 +16091,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-flows"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16111,7 +16111,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-groups"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16131,7 +16131,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-inputs"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16145,7 +16145,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-integration-tests"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -16171,7 +16171,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-jobs"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -16196,7 +16196,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-npm-proxy"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "flate2",
@@ -16213,7 +16213,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-openapi"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -16234,7 +16234,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-schedule"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16254,7 +16254,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-scripts"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16284,7 +16284,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-settings"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -16311,7 +16311,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-sse"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "lazy_static",
  "serde",
@@ -16323,7 +16323,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-users"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "argon2",
  "axum 0.7.9",
@@ -16346,7 +16346,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workers"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16360,7 +16360,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-workspaces"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "axum 0.7.9",
  "chrono",
@@ -16390,7 +16390,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -16404,7 +16404,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -16423,7 +16423,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "aes-gcm",
  "anyhow",
@@ -16522,7 +16522,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-dep-map"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "chrono",
  "itertools 0.14.0",
@@ -16541,7 +16541,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "regex",
  "serde",
@@ -16556,7 +16556,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -16580,7 +16580,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-jseval"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -16597,7 +16597,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -16613,7 +16613,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16634,7 +16634,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-native-triggers"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -16665,7 +16665,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-oauth2",
@@ -16689,7 +16689,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-object-store"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -16723,7 +16723,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-operator"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "futures",
@@ -16741,7 +16741,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -16750,7 +16750,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16762,7 +16762,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16774,7 +16774,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -16786,7 +16786,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16798,7 +16798,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -16810,7 +16810,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -16821,7 +16821,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16832,7 +16832,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -16845,7 +16845,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16869,7 +16869,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16883,7 +16883,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -16900,7 +16900,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16915,7 +16915,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16934,7 +16934,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16945,7 +16945,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16982,7 +16982,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-runtime-nativets"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "const_format",
@@ -17020,7 +17020,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -17030,7 +17030,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-store"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -17059,7 +17059,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-test-utils"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -17082,7 +17082,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17115,7 +17115,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-email"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17135,7 +17135,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-gcp"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17169,7 +17169,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-http"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17204,7 +17204,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-kafka"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17227,7 +17227,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-mqtt"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17251,7 +17251,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-nats"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-nats",
@@ -17275,7 +17275,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-postgres"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17310,7 +17310,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-sqs"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17338,7 +17338,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-trigger-websocket"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -17361,7 +17361,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-types"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "bitflags 2.9.4",
@@ -17379,7 +17379,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.642.0"
+version = "1.644.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -18252,7 +18252,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix 1.1.3",
+ "rustix 1.1.4",
 ]
 
 [[package]]

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.642.0"
+version = "1.644.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -76,7 +76,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.642.0"
+version = "1.644.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 

backend/ee-repo-ref.txt

@@ -1 +1 @@
-0fede4b1086bc1456be9cc55b203228c979c5c5e
+2fb7884849a563bae023574baa2d55fa1fab1176

backend/migrations/20260223000000_resource_type_is_fileset.down.sql

@@ -0,0 +1 @@
+ALTER TABLE resource_type DROP COLUMN is_fileset;

backend/migrations/20260223000000_resource_type_is_fileset.up.sql

@@ -0,0 +1 @@
+ALTER TABLE resource_type ADD COLUMN is_fileset BOOLEAN NOT NULL DEFAULT FALSE;

backend/migrations/20260224000000_create_wm_deployers_group.up.sql

@@ -0,0 +1,5 @@
+INSERT INTO group_ (workspace_id, name, summary, extra_perms)
+SELECT id, 'wm_deployers', 'Members can preserve the original author when deploying to this workspace', '{}'::jsonb
+FROM workspace
+WHERE NOT deleted
+ON CONFLICT (workspace_id, name) DO UPDATE SET summary = EXCLUDED.summary;

backend/migrations/20260225000000_custom_instance_user_replication.down.sql

@@ -0,0 +1,10 @@
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_user') THEN
+    ALTER ROLE custom_instance_user NOREPLICATION;
+  END IF;
+EXCEPTION
+    WHEN others THEN
+        RAISE NOTICE 'Error revoking REPLICATION from custom_instance_user: %', SQLERRM;
+END
+$$;

backend/migrations/20260225000000_custom_instance_user_replication.up.sql

@@ -0,0 +1,10 @@
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'custom_instance_user') THEN
+    ALTER ROLE custom_instance_user REPLICATION;
+  END IF;
+EXCEPTION
+    WHEN others THEN
+        RAISE NOTICE 'Error granting REPLICATION to custom_instance_user: %', SQLERRM;
+END
+$$;

backend/migrations/20260225100000_asset_covering_index.down.sql

@@ -0,0 +1,5 @@
+DROP INDEX IF EXISTS idx_asset_ws_path_kind_recent;
+
+-- Restore the dropped indexes
+CREATE INDEX IF NOT EXISTS idx_asset_workspace_created_id ON asset (workspace_id, created_at DESC, id DESC);
+CREATE INDEX IF NOT EXISTS idx_asset_kind_path ON asset (workspace_id, kind, path);

backend/migrations/20260225100000_asset_covering_index.up.sql

@@ -0,0 +1,11 @@
+-- Covering index for the list_assets CTE: GROUP BY (path, kind) + MAX(created_at, id) + ORDER BY
+-- Includes usage_kind and usage_path to allow full index-only scan (avoiding heap lookups for filter conditions)
+CREATE INDEX IF NOT EXISTS idx_asset_ws_path_kind_recent
+    ON asset (workspace_id, path, kind, created_at DESC, id DESC)
+    INCLUDE (usage_kind, usage_path);
+
+-- Drop indexes now subsumed by idx_asset_ws_path_kind_recent:
+-- idx_asset_workspace_created_id (workspace_id, created_at DESC, id DESC) - only used by list_assets CTE
+-- idx_asset_kind_path (workspace_id, kind, path) - only used by list_assets CTE/outer join, covered by new index + PK
+DROP INDEX IF EXISTS idx_asset_workspace_created_id;
+DROP INDEX IF EXISTS idx_asset_kind_path;

backend/summarized_schema.txt

@@ -137,7 +137,7 @@ raw_app: path(char), version(int), workspace_id(char), summary(char), edited_at(
   FK: (workspace_id) -> workspace(id)
 resource: workspace_id(char), path(char), value(jsonb), description(text), resource_type(char), extra_perms(jsonb), edited_at(ts), created_by(char)
   FK: (workspace_id) -> workspace(id)
-resource_type: workspace_id(char), name(char), schema(jsonb), description(text), edited_at(ts), created_by(char), format_extension(char)
+resource_type: workspace_id(char), name(char), schema(jsonb), description(text), edited_at(ts), created_by(char), format_extension(char), is_fileset(bool)
   FK: (workspace_id) -> workspace(id)
 resume_job: id(uuid), job(uuid), flow(uuid), created_at(ts), value(jsonb), approver(char), resume_id(int), approved(bool)
   FK: (flow) -> v2_job_queue(id)

backend/tests/dependency_map.rs

@@ -447,6 +447,7 @@ def main():
                 deployment_message: None,
                 visible_to_runner_only: None,
                 on_behalf_of_email: None,
+                preserve_on_behalf_of: None,
                 ws_error_handler_muted: None,
             })
             .send()
@@ -508,6 +509,7 @@ def main():
                 policy: None,
                 deployment_message: None,
                 custom_path: None,
+                preserve_on_behalf_of: None,
             })
             .send()
             .await

backend/tests/fixtures/preserve_on_behalf_of.sql

@@ -0,0 +1,186 @@
+-- Fixture for preserve_on_behalf_of integration tests
+-- Extends base.sql with a deployer user in the wm_deployers group
+
+-- Include all base setup (workspace, admin user, etc.)
+INSERT INTO workspace
+            (id,               name,             owner)
+     VALUES ('test-workspace', 'test-workspace', 'test-user')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test@windmill.dev', 'test-user', true, 'Admin')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO workspace_key(workspace_id, kind, key) VALUES
+	('test-workspace', 'cloud', 'test-key')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO workspace_settings (workspace_id) VALUES
+	('test-workspace')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+	('test-workspace', 'all', 'All users', '{}')
+ON CONFLICT DO NOTHING;
+
+-- Create the wm_deployers group
+INSERT INTO group_ (workspace_id, name, summary, extra_perms) VALUES
+	('test-workspace', 'wm_deployers', 'Users allowed to deploy and preserve on_behalf_of', '{}')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name, username)
+    VALUES ('test@windmill.dev', 'not-a-real-hash', 'password', true, true, 'Test User', 'test-user')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('test2@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Test User 2')
+ON CONFLICT DO NOTHING;
+
+-- Deployer user (non-admin but in wm_deployers group)
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('deployer@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Deployer User')
+ON CONFLICT DO NOTHING;
+
+-- Original user whose on_behalf_of should be preserved
+INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
+    VALUES ('original@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Original User')
+ON CONFLICT DO NOTHING;
+
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'test2@windmill.dev', 'test-user-2', false, 'User')
+ON CONFLICT DO NOTHING;
+
+-- Deployer user in workspace
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'deployer@windmill.dev', 'deployer-user', false, 'User')
+ON CONFLICT DO NOTHING;
+
+-- Original user in workspace (whose on_behalf_of should be preserved)
+INSERT INTO usr(workspace_id, email, username, is_admin, role) VALUES
+	('test-workspace', 'original@windmill.dev', 'original-user', false, 'User')
+ON CONFLICT DO NOTHING;
+
+-- Add deployer user to wm_deployers group
+INSERT INTO usr_to_group(workspace_id, group_, usr) VALUES
+	('test-workspace', 'wm_deployers', 'deployer-user')
+ON CONFLICT DO NOTHING;
+
+-- Tokens for all users
+INSERT INTO token(token, email, label, super_admin) VALUES ('SECRET_TOKEN', 'test@windmill.dev', 'test token', true)
+ON CONFLICT DO NOTHING;
+INSERT INTO token(token, email, label, super_admin) VALUES ('SECRET_TOKEN_2', 'test2@windmill.dev', 'test token 2', false)
+ON CONFLICT DO NOTHING;
+INSERT INTO token(token, email, label, super_admin) VALUES ('DEPLOYER_TOKEN', 'deployer@windmill.dev', 'deployer token', false)
+ON CONFLICT DO NOTHING;
+INSERT INTO token(token, email, label, super_admin) VALUES ('ORIGINAL_TOKEN', 'original@windmill.dev', 'original token', false)
+ON CONFLICT DO NOTHING;
+
+GRANT ALL PRIVILEGES ON TABLE workspace_key TO windmill_admin;
+GRANT ALL PRIVILEGES ON TABLE workspace_key TO windmill_user;
+
+CREATE OR REPLACE FUNCTION "notify_insert_on_completed_job" ()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('completed', NEW.id::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE PLPGSQL;
+
+DROP TRIGGER IF EXISTS "notify_insert_on_completed_job" ON "v2_job_completed";
+CREATE TRIGGER "notify_insert_on_completed_job"
+ AFTER INSERT ON "v2_job_completed"
+    FOR EACH ROW
+EXECUTE FUNCTION "notify_insert_on_completed_job" ();
+
+CREATE OR REPLACE FUNCTION "notify_queue" ()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('queued', NEW.id::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE PLPGSQL;
+
+DROP TRIGGER IF EXISTS "notify_queue_after_insert" ON "v2_job_queue";
+CREATE TRIGGER "notify_queue_after_insert"
+ AFTER INSERT ON "v2_job_queue"
+    FOR EACH ROW
+EXECUTE FUNCTION "notify_queue" ();
+
+DROP TRIGGER IF EXISTS "notify_queue_after_flow_status_update" ON "v2_job_status";
+CREATE TRIGGER "notify_queue_after_flow_status_update"
+ AFTER UPDATE ON "v2_job_status"
+    FOR EACH ROW
+            WHEN (NEW.flow_status IS DISTINCT FROM OLD.flow_status)
+EXECUTE FUNCTION "notify_queue" ();
+
+-- Apply phase 4:
+DROP FUNCTION IF EXISTS v2_job_after_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_completed_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_completed_before_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_queue_after_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_queue_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_queue_before_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_runtime_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_runtime_before_update CASCADE;
+DROP FUNCTION IF EXISTS v2_job_status_before_insert CASCADE;
+DROP FUNCTION IF EXISTS v2_job_status_before_update CASCADE;
+
+DROP VIEW IF EXISTS completed_job, completed_job_view, job, queue, queue_view CASCADE;
+
+ALTER TABLE v2_job_queue
+    DROP COLUMN IF EXISTS __parent_job CASCADE,
+    DROP COLUMN IF EXISTS __created_by CASCADE,
+    DROP COLUMN IF EXISTS __script_hash CASCADE,
+    DROP COLUMN IF EXISTS __script_path CASCADE,
+    DROP COLUMN IF EXISTS __args CASCADE,
+    DROP COLUMN IF EXISTS __logs CASCADE,
+    DROP COLUMN IF EXISTS __raw_code CASCADE,
+    DROP COLUMN IF EXISTS __canceled CASCADE,
+    DROP COLUMN IF EXISTS __last_ping CASCADE,
+    DROP COLUMN IF EXISTS __job_kind CASCADE,
+    DROP COLUMN IF EXISTS __env_id CASCADE,
+    DROP COLUMN IF EXISTS __schedule_path CASCADE,
+    DROP COLUMN IF EXISTS __permissioned_as CASCADE,
+    DROP COLUMN IF EXISTS __flow_status CASCADE,
+    DROP COLUMN IF EXISTS __raw_flow CASCADE,
+    DROP COLUMN IF EXISTS __is_flow_step CASCADE,
+    DROP COLUMN IF EXISTS __language CASCADE,
+    DROP COLUMN IF EXISTS __same_worker CASCADE,
+    DROP COLUMN IF EXISTS __raw_lock CASCADE,
+    DROP COLUMN IF EXISTS __pre_run_error CASCADE,
+    DROP COLUMN IF EXISTS __email CASCADE,
+    DROP COLUMN IF EXISTS __visible_to_owner CASCADE,
+    DROP COLUMN IF EXISTS __mem_peak CASCADE,
+    DROP COLUMN IF EXISTS __root_job CASCADE,
+    DROP COLUMN IF EXISTS __leaf_jobs CASCADE,
+    DROP COLUMN IF EXISTS __concurrent_limit CASCADE,
+    DROP COLUMN IF EXISTS __concurrency_time_window_s CASCADE,
+    DROP COLUMN IF EXISTS __timeout CASCADE,
+    DROP COLUMN IF EXISTS __flow_step_id CASCADE,
+    DROP COLUMN IF EXISTS __cache_ttl CASCADE;
+
+LOCK TABLE v2_job_queue IN ACCESS EXCLUSIVE MODE;
+ALTER TABLE v2_job_completed
+    DROP COLUMN IF EXISTS __parent_job CASCADE,
+    DROP COLUMN IF EXISTS __created_by CASCADE,
+    DROP COLUMN IF EXISTS __created_at CASCADE,
+    DROP COLUMN IF EXISTS __success CASCADE,
+    DROP COLUMN IF EXISTS __script_hash CASCADE,
+    DROP COLUMN IF EXISTS __script_path CASCADE,
+    DROP COLUMN IF EXISTS __args CASCADE,
+    DROP COLUMN IF EXISTS __logs CASCADE,
+    DROP COLUMN IF EXISTS __raw_code CASCADE,
+    DROP COLUMN IF EXISTS __canceled CASCADE,
+    DROP COLUMN IF EXISTS __job_kind CASCADE,
+    DROP COLUMN IF EXISTS __env_id CASCADE,
+    DROP COLUMN IF EXISTS __schedule_path CASCADE,
+    DROP COLUMN IF EXISTS __permissioned_as CASCADE,
+    DROP COLUMN IF EXISTS __raw_flow CASCADE,
+    DROP COLUMN IF EXISTS __is_flow_step CASCADE,
+    DROP COLUMN IF EXISTS __language CASCADE,
+    DROP COLUMN IF EXISTS __is_skipped CASCADE,
+    DROP COLUMN IF EXISTS __raw_lock CASCADE,
+    DROP COLUMN IF EXISTS __email CASCADE,
+    DROP COLUMN IF EXISTS __visible_to_owner CASCADE,
+    DROP COLUMN IF EXISTS __tag CASCADE,
+    DROP COLUMN IF EXISTS __priority CASCADE;

backend/tests/protection_rules.rs

@@ -0,0 +1,306 @@
+//! Integration tests for workspace protection rulesets.
+//!
+//! Tests verify that DisableDirectDeployment protection rules correctly
+//! block/allow operations based on user permissions.
+
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+use windmill_common::workspaces::invalidate_protection_rules_cache;
+
+use windmill_test_utils::*;
+
+fn client() -> reqwest::Client {
+    reqwest::Client::new()
+}
+
+fn authed(builder: reqwest::RequestBuilder, token: &str) -> reqwest::RequestBuilder {
+    builder.header("Authorization", format!("Bearer {}", token))
+}
+
+fn new_script(path: &str, summary: &str) -> serde_json::Value {
+    json!({
+        "path": path,
+        "summary": summary,
+        "description": "",
+        "content": "export async function main() { return 42; }",
+        "language": "deno",
+        "schema": {
+            "$schema": "https://json-schema.org/draft/2020-12/schema",
+            "type": "object",
+            "properties": {},
+            "required": []
+        }
+    })
+}
+
+fn new_flow(path: &str, summary: &str) -> serde_json::Value {
+    json!({
+        "path": path,
+        "summary": summary,
+        "description": "",
+        "value": { "modules": [] },
+        "schema": {
+            "$schema": "https://json-schema.org/draft/2020-12/schema",
+            "type": "object",
+            "properties": {},
+            "required": []
+        }
+    })
+}
+
+/// Comprehensive test for protection rules functionality.
+/// Tests all essential cases in a single test to avoid cache interference.
+#[sqlx::test(fixtures("base"))]
+async fn test_protection_rules(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+    invalidate_protection_rules_cache("test-workspace");
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let base = format!("http://localhost:{port}/api/w/test-workspace");
+
+    // ========================================
+    // 1. Without protection rule, non-admin can create scripts and flows
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&new_script("u/test-user-2/script_no_rule", "No rule"))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "Should create script without rule: {}",
+        resp.text().await?
+    );
+
+    let resp = authed(
+        client().post(format!("{base}/flows/create")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&new_flow("u/test-user-2/flow_no_rule", "No rule"))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "Should create flow without rule: {}",
+        resp.text().await?
+    );
+
+    // ========================================
+    // 2. Non-admin cannot create protection rules
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&json!({
+        "name": "unauthorized-rule",
+        "rules": ["DisableDirectDeployment"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert!(
+        !resp.status().is_success(),
+        "Non-admin should not create rules: {}",
+        resp.status()
+    );
+
+    // ========================================
+    // 3. Admin creates protection rule
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "name": "test-rule",
+        "rules": ["DisableDirectDeployment"],
+        "bypass_users": [],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "Admin should create rule: {}",
+        resp.text().await?
+    );
+
+    // ========================================
+    // 4. With rule, non-admin is blocked from creating scripts/flows
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&new_script("u/test-user-2/blocked_script", "Blocked"))
+    .send()
+    .await?;
+    assert!(
+        !resp.status().is_success(),
+        "Non-admin should be blocked from scripts: {}",
+        resp.status()
+    );
+    let body = resp.text().await?;
+    assert!(
+        body.contains("blocked") || body.contains("Blocked"),
+        "Error should mention blocking: {}",
+        body
+    );
+
+    let resp = authed(
+        client().post(format!("{base}/flows/create")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&new_flow("u/test-user-2/blocked_flow", "Blocked"))
+    .send()
+    .await?;
+    assert!(
+        !resp.status().is_success(),
+        "Non-admin should be blocked from flows: {}",
+        resp.status()
+    );
+
+    // ========================================
+    // 5. Admin bypasses protection rule
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN",
+    )
+    .json(&new_script("u/test-user/admin_script", "Admin"))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "Admin should bypass rule: {}",
+        resp.text().await?
+    );
+
+    // ========================================
+    // 6. Update rule to bypass test-user-2
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/workspaces/protection_rules/test-rule")),
+        "SECRET_TOKEN",
+    )
+    .json(&json!({
+        "rules": ["DisableDirectDeployment"],
+        "bypass_users": ["test-user-2"],
+        "bypass_groups": []
+    }))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "Should update rule: {}",
+        resp.text().await?
+    );
+
+    // Invalidate cache to pick up the update
+    invalidate_protection_rules_cache("test-workspace");
+
+    // ========================================
+    // 7. Bypassed user can now create
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN_2",
+    )
+    .json(&new_script("u/test-user-2/bypassed_script", "Bypassed"))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "Bypassed user should create: {}",
+        resp.text().await?
+    );
+
+    // ========================================
+    // 8. Non-bypassed user (test-user-3) is still blocked
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN_3",
+    )
+    .json(&new_script("u/test-user-3/still_blocked", "Blocked"))
+    .send()
+    .await?;
+    assert!(
+        !resp.status().is_success(),
+        "Non-bypassed user should be blocked: {}",
+        resp.status()
+    );
+
+    // ========================================
+    // 9. Delete rule
+    // ========================================
+
+    let resp = authed(
+        client().delete(format!("{base}/workspaces/protection_rules/test-rule")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        200,
+        "Should delete rule: {}",
+        resp.text().await?
+    );
+
+    // Invalidate cache to pick up the deletion
+    invalidate_protection_rules_cache("test-workspace");
+
+    // ========================================
+    // 10. After deletion, non-admin can create again
+    // ========================================
+
+    let resp = authed(
+        client().post(format!("{base}/scripts/create")),
+        "SECRET_TOKEN_3",
+    )
+    .json(&new_script("u/test-user-3/after_delete", "After delete"))
+    .send()
+    .await?;
+    assert_eq!(
+        resp.status(),
+        201,
+        "Should create after rule deletion: {}",
+        resp.text().await?
+    );
+
+    // ========================================
+    // 11. Verify rule list is empty
+    // ========================================
+
+    let resp = authed(
+        client().get(format!("{base}/workspaces/protection_rules")),
+        "SECRET_TOKEN",
+    )
+    .send()
+    .await?;
+    assert_eq!(resp.status(), 200);
+    let rules: Vec<serde_json::Value> = resp.json().await?;
+    assert!(rules.is_empty(), "Should have no rules after deletion");
+
+    Ok(())
+}

backend/windmill-api-assets/src/lib.rs

@@ -27,9 +27,13 @@ struct ListAssetsQuery {
     per_page: i64,
     cursor_created_at: Option<chrono::DateTime<chrono::Utc>>,
     cursor_id: Option<i64>,
-    asset_path: Option<String>,
-    usage_path: Option<String>,
-    asset_kinds: Option<String>,
+    pub asset_path: Option<String>,
+    pub usage_path: Option<String>,
+    pub asset_kinds: Option<String>,
+    // Exact path match filter
+    pub path: Option<String>,
+    // Filter by matching a subset of the columns using base64 encoded json subset
+    pub columns: Option<String>,
 }
 
 fn default_per_page() -> i64 {
@@ -75,12 +79,24 @@ async fn list_assets(
 
     let mut param_count = 2; // $1 = workspace_id, $2 = limit
 
-    // Asset path filter
+    // Asset path filter (ILIKE pattern match)
     if query.asset_path.is_some() {
         param_count += 1;
         asset_summary_filters.push(format!("asset.path ILIKE ${}", param_count));
     }
 
+    // Exact path filter
+    if query.path.is_some() {
+        param_count += 1;
+        asset_summary_filters.push(format!("asset.path = ${}", param_count));
+    }
+
+    // Columns filter (check if JSONB has all specified keys)
+    if query.columns.is_some() {
+        param_count += 1;
+        asset_summary_filters.push(format!("asset.columns ?& ${}", param_count));
+    }
+
     // Usage path filter - for jobs, also check runnable_path
     let needs_job_join_in_cte = query.usage_path.is_some();
     if query.usage_path.is_some() {
@@ -128,7 +144,7 @@ async fn list_assets(
         format!(
             r#"FROM asset
             LEFT JOIN v2_job job_cte ON asset.usage_kind = 'job'
-              AND asset.usage_path = job_cte.id::text
+              AND job_cte.id = CASE WHEN asset.usage_kind = 'job' THEN asset.usage_path::uuid END
               AND job_cte.workspace_id = $1"#
         )
     } else {
@@ -193,7 +209,7 @@ async fn list_assets(
           ) = resource.path
           AND resource.workspace_id = $1
         LEFT JOIN v2_job job ON asset.usage_kind = 'job'
-          AND asset.usage_path = job.id::text
+          AND job.id = CASE WHEN asset.usage_kind = 'job' THEN asset.usage_path::uuid END
           AND job.workspace_id = $1
         WHERE asset.workspace_id = $1
           AND (asset.kind <> 'resource' OR resource.path IS NOT NULL)
@@ -211,6 +227,20 @@ async fn list_assets(
         query_builder = query_builder.bind(format!("%{}%", asset_path));
     }
 
+    if let Some(ref path) = query.path {
+        query_builder = query_builder.bind(path);
+    }
+
+    if let Some(ref columns) = query.columns {
+        // Columns is a comma-separated string, split into array for ?& operator
+        let columns_array: Vec<String> = columns
+            .split(',')
+            .map(|s| s.trim().to_string())
+            .filter(|s| !s.is_empty())
+            .collect();
+        query_builder = query_builder.bind(columns_array);
+    }
+
     if let Some(ref usage_path) = query.usage_path {
         query_builder = query_builder.bind(format!("%{}%", usage_path));
     }

backend/windmill-api-auth/src/lib.rs

@@ -534,10 +534,13 @@ pub async fn create_token_internal(
             ));
         }
     }
-    sqlx::query!(
+    let rows = sqlx::query!(
         "INSERT INTO token
             (token, email, label, expiration, super_admin, scopes, workspace_id)
-            VALUES ($1, $2, $3, $4, $5, $6, $7)",
+            SELECT $1, $2, $3, $4, $5, $6, $7
+            WHERE $7::varchar IS NULL OR NOT EXISTS(
+                SELECT 1 FROM workspace WHERE id = $7 AND deleted = true
+            )",
         token,
         authed.email,
         token_config.label,
@@ -548,6 +551,11 @@ pub async fn create_token_internal(
     )
     .execute(&mut *tx)
     .await?;
+    if rows.rows_affected() == 0 {
+        return Err(Error::BadRequest(
+            "Cannot create a token for an archived workspace".to_string(),
+        ));
+    }
 
     audit_log(
         &mut *tx,

backend/windmill-api-flows/src/flows.rs

@@ -503,7 +503,11 @@ async fn create_flow(
         nf.tag,
         nf.dedicated_worker,
         nf.visible_to_runner_only.unwrap_or(false),
-        nf.on_behalf_of_email.and(Some(&authed.email)),
+        windmill_common::resolve_on_behalf_of_email(
+            nf.on_behalf_of_email.as_deref(),
+            nf.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+        ),
         nf.ws_error_handler_muted.unwrap_or(false),
         sqlx::types::Json(&nf.value) as _,
         schema_str,
@@ -513,7 +517,7 @@ async fn create_flow(
     .await?;
 
     let version = sqlx::query_scalar!(
-        "INSERT INTO flow_version (workspace_id, path, value, schema, created_by) 
+        "INSERT INTO flow_version (workspace_id, path, value, schema, created_by)
         VALUES ($1, $2, $3, $4::text::json, $5)
         RETURNING id",
         w_id,
@@ -555,6 +559,29 @@ async fn create_flow(
         ),
     )
     .await?;
+    if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
+        nf.on_behalf_of_email.as_deref(),
+        nf.preserve_on_behalf_of.unwrap_or(false),
+        &authed,
+        &authed.email,
+    ) {
+        audit_log(
+            &mut *tx,
+            &authed,
+            "flows.on_behalf_of",
+            ActionKind::Create,
+            &w_id,
+            Some(&nf.path),
+            Some(
+                [
+                    ("on_behalf_of", on_behalf_of.as_str()),
+                    ("action", "create"),
+                ]
+                .into(),
+            ),
+        )
+        .await?;
+    }
 
     let mut args: HashMap<String, Box<serde_json::value::RawValue>> = HashMap::new();
     if let Some(dm) = nf.deployment_message {
@@ -940,7 +967,11 @@ async fn update_flow(
         nf.tag,
         nf.dedicated_worker,
         nf.visible_to_runner_only.unwrap_or(false),
-        nf.on_behalf_of_email.and(Some(&authed.email)),
+        windmill_common::resolve_on_behalf_of_email(
+            nf.on_behalf_of_email.as_deref(),
+            nf.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+        ),
         nf.ws_error_handler_muted.unwrap_or(false),
         sqlx::types::Json(&nf.value) as _,
         schema_str,
@@ -1103,6 +1134,29 @@ async fn update_flow(
         ),
     )
     .await?;
+    if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
+        nf.on_behalf_of_email.as_deref(),
+        nf.preserve_on_behalf_of.unwrap_or(false),
+        &authed,
+        &authed.email,
+    ) {
+        audit_log(
+            &mut *tx,
+            &authed,
+            "flows.on_behalf_of",
+            ActionKind::Update,
+            &w_id,
+            Some(&nf.path),
+            Some(
+                [
+                    ("on_behalf_of", on_behalf_of.as_str()),
+                    ("action", "update"),
+                ]
+                .into(),
+            ),
+        )
+        .await?;
+    }
 
     webhook.send_message(
         w_id.clone(),

backend/windmill-api-integration-tests/tests/fixtures/resources_test.sql

@@ -54,6 +54,21 @@ INSERT INTO resource (workspace_id, path, value, description, resource_type, ext
 VALUES ('test-workspace', 'u/test-user/scalar_var_resource', '"$var:u/test-user/db_password"',
         'Scalar var ref', 'string', '{}', 'test-user');
 
+-- === fileset resource type test data ===
+
+INSERT INTO resource_type (workspace_id, name, schema, description, created_by, is_fileset)
+VALUES ('test-workspace', 'test_fileset', '{}',
+        'Test fileset type', 'test-user', true);
+
+INSERT INTO resource_type (workspace_id, name, schema, description, created_by, format_extension)
+VALUES ('test-workspace', 'test_file', '{"type": "object", "properties": {"content": {"type": "string"}}}',
+        'Test file type', 'test-user', 'txt');
+
+INSERT INTO resource (workspace_id, path, value, description, resource_type, extra_perms, created_by)
+VALUES ('test-workspace', 'u/test-user/fileset_resource',
+        '{"config.yaml": "key: value", "data/input.json": "{\"items\": []}"}',
+        'A fileset resource', 'test_fileset', '{}', 'test-user');
+
 -- === mcp_tools test data ===
 
 INSERT INTO resource (workspace_id, path, value, description, resource_type, extra_perms, created_by)

backend/windmill-api-integration-tests/tests/resources.rs

@@ -69,8 +69,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_eq!(resp.status(), 404);
 
     // --- get_value_interpolated ---
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/simple_resource").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/simple_resource",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -78,8 +82,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // $var: interpolation
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/resource_with_var").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/resource_with_var",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -87,8 +95,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // $res: interpolation
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/resource_with_res").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/resource_with_res",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -96,8 +108,7 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // mixed $var: and $res: refs
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/resource_mixed").await;
+    let resp = authed_get(port, "get_value_interpolated", "u/test-user/resource_mixed").await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -105,8 +116,12 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // chained $res: -> $var:
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/chained_resource").await;
+    let resp = authed_get(
+        port,
+        "get_value_interpolated",
+        "u/test-user/chained_resource",
+    )
+    .await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -114,8 +129,7 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // null value
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/null_resource").await;
+    let resp = authed_get(port, "get_value_interpolated", "u/test-user/null_resource").await;
     assert_eq!(resp.status(), 200);
     assert_eq!(
         resp.json::<serde_json::Value>().await?,
@@ -123,8 +137,7 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // not found
-    let resp =
-        authed_get(port, "get_value_interpolated", "u/test-user/nonexistent").await;
+    let resp = authed_get(port, "get_value_interpolated", "u/test-user/nonexistent").await;
     assert_eq!(resp.status(), 404);
 
     // array passthrough
@@ -162,7 +175,9 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
         "expected at least 10 resources from fixture, got {}",
         list.len()
     );
-    assert!(list.iter().any(|r| r["path"] == "u/test-user/simple_resource"));
+    assert!(list
+        .iter()
+        .any(|r| r["path"] == "u/test-user/simple_resource"));
 
     // list with resource_type filter
     let resp = authed(client().get(format!("{base}/list?resource_type=mcp_server")))
@@ -259,9 +274,11 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_eq!(body["description"], "Updated description");
 
     // --- update_value ---
-    let resp = authed(
-        client().post(resource_url(port, "update_value", "u/test-user/new_resource")),
-    )
+    let resp = authed(client().post(resource_url(
+        port,
+        "update_value",
+        "u/test-user/new_resource",
+    )))
     .json(&json!({"value": {"url": "https://final.com"}}))
     .send()
     .await
@@ -275,35 +292,44 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     );
 
     // --- delete ---
-    let resp = authed(
-        client().delete(resource_url(port, "delete", "u/test-user/new_resource")),
-    )
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().delete(resource_url(port, "delete", "u/test-user/new_resource")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 200);
 
     let resp = authed_get(port, "exists", "u/test-user/new_resource").await;
     assert_eq!(resp.json::<bool>().await?, false);
 
     // delete nonexistent -> 404
-    let resp = authed(
-        client().delete(resource_url(port, "delete", "u/test-user/new_resource")),
-    )
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().delete(resource_url(port, "delete", "u/test-user/new_resource")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 404);
 
     // --- file_resource_type_to_file_ext_map ---
-    let resp = authed(client().get(format!(
-        "{base}/file_resource_type_to_file_ext_map"
-    )))
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().get(format!("{base}/file_resource_type_to_file_ext_map")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 200);
-    resp.json::<serde_json::Value>().await?;
+    let ext_map = resp.json::<serde_json::Value>().await?;
+    // Verify the map includes fileset type info with is_fileset flag (no format_extension)
+    let fileset_info = &ext_map["test_fileset"];
+    assert_eq!(fileset_info["format_extension"], serde_json::Value::Null);
+    assert_eq!(fileset_info["is_fileset"], true);
+    // Verify non-fileset file type
+    let file_info = &ext_map["test_file"];
+    assert_eq!(file_info["format_extension"], "txt");
+    assert_eq!(file_info["is_fileset"], false);
+
+    // --- fileset resource value ---
+    let resp = authed_get(port, "get_value", "u/test-user/fileset_resource").await;
+    assert_eq!(resp.status(), 200);
+    let fileset_val = resp.json::<serde_json::Value>().await?;
+    assert_eq!(fileset_val["config.yaml"], "key: value");
+    assert_eq!(fileset_val["data/input.json"], "{\"items\": []}");
 
     // --- resource types ---
 
@@ -384,17 +410,68 @@ async fn test_resource_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     assert_eq!(body["description"], "Updated type desc");
 
     // type/delete
-    let resp = authed(
-        client().delete(resource_url(port, "type/delete", "new_test_type")),
-    )
-    .send()
-    .await
-    .unwrap();
+    let resp = authed(client().delete(resource_url(port, "type/delete", "new_test_type")))
+        .send()
+        .await
+        .unwrap();
     assert_eq!(resp.status(), 200);
 
     let resp = authed_get(port, "type/exists", "new_test_type").await;
     assert_eq!(resp.json::<bool>().await?, false);
 
+    // --- fileset resource type CRUD ---
+
+    // type/get for fileset type - verify is_fileset is returned
+    let resp = authed_get(port, "type/get", "test_fileset").await;
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["name"], "test_fileset");
+    assert_eq!(body["is_fileset"], true);
+    assert_eq!(body["format_extension"], serde_json::Value::Null);
+
+    // type/get for non-fileset type - verify is_fileset is false
+    let resp = authed_get(port, "type/get", "test_db").await;
+    assert_eq!(resp.status(), 200);
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["is_fileset"], false);
+
+    // type/create fileset type (no format_extension needed)
+    let resp = authed(client().post(format!("{base}/type/create")))
+        .json(&json!({
+            "name": "new_fileset_type",
+            "description": "A fileset type",
+            "schema": {},
+            "is_fileset": true
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 201);
+
+    let resp = authed_get(port, "type/get", "new_fileset_type").await;
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["is_fileset"], true);
+    assert_eq!(body["format_extension"], serde_json::Value::Null);
+
+    // type/update - set is_fileset on existing type
+    let resp = authed(client().post(resource_url(port, "type/update", "new_fileset_type")))
+        .json(&json!({"is_fileset": false}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
+    let resp = authed_get(port, "type/get", "new_fileset_type").await;
+    let body = resp.json::<serde_json::Value>().await?;
+    assert_eq!(body["is_fileset"], false);
+
+    // cleanup
+    let resp = authed(client().delete(resource_url(port, "type/delete", "new_fileset_type")))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), 200);
+
     Ok(())
 }
 

backend/windmill-api-jobs/src/lib.rs

@@ -10,9 +10,11 @@ pub mod concurrency_groups;
 pub mod execution;
 pub mod job_metrics;
 pub mod jobs_export;
+pub mod negated_filter;
 pub mod query;
 pub mod types;
 
 pub use execution::*;
+pub use negated_filter::{NegatedFilter, NegatedListFilter};
 pub use query::*;
 pub use types::*;

backend/windmill-api-jobs/src/negated_filter.rs

@@ -0,0 +1,126 @@
+/*
+ * Author: Windmill Labs, Inc
+ * Copyright: Windmill Labs, Inc 2024
+ * This file and its contents are licensed under the AGPLv3 License.
+ * Please see the included NOTICE for copyright information and
+ * LICENSE-AGPL for a copy of the license.
+ */
+
+//! Filter wrappers that support an optional `!` negation prefix.
+//!
+//! - [`NegatedFilter<T>`] — a single value, e.g. `"schedule"` or `"!schedule"`.
+//! - [`NegatedListFilter<T>`] — comma-separated values, e.g. `"!schedule,!email"` or `"http,webhook"`.
+//!   Every item in the list shares the same negated/non-negated sense; mixing is not supported
+
+use serde::{
+    de::{self, DeserializeOwned},
+    Deserializer,
+};
+use std::{fmt, marker::PhantomData};
+
+// ── NegatedFilter<T> ──────────────────────────────────────────────────────────
+
+/// A single filter value optionally prefixed with `!` to indicate negation.
+///
+/// Deserializes `"schedule"` → `NegatedFilter { value: Schedule, negated: false }`
+/// Deserializes `"!schedule"` → `NegatedFilter { value: Schedule, negated: true }`
+#[derive(Debug, Clone)]
+pub struct NegatedFilter<T> {
+    pub value: T,
+    pub negated: bool,
+}
+
+impl<T> NegatedFilter<T> {
+    pub fn positive(value: T) -> Self {
+        Self { value, negated: false }
+    }
+
+    pub fn negated(value: T) -> Self {
+        Self { value, negated: true }
+    }
+}
+
+struct NegatedFilterVisitor<T>(PhantomData<T>);
+
+impl<'de, T: DeserializeOwned> de::Visitor<'de> for NegatedFilterVisitor<T> {
+    type Value = NegatedFilter<T>;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "a string optionally prefixed with '!'")
+    }
+
+    fn visit_str<E: de::Error>(self, s: &str) -> Result<Self::Value, E> {
+        let (negated, raw) = match s.strip_prefix('!') {
+            Some(rest) => (true, rest),
+            None => (false, s),
+        };
+        let value = serde_json::from_value(serde_json::Value::String(raw.to_owned()))
+            .map_err(|e| E::custom(format!("invalid filter value {:?}: {}", raw, e)))?;
+        Ok(NegatedFilter { value, negated })
+    }
+}
+
+impl<'de, T: DeserializeOwned> de::Deserialize<'de> for NegatedFilter<T> {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        deserializer.deserialize_str(NegatedFilterVisitor(PhantomData))
+    }
+}
+
+// ── NegatedListFilter<T> ──────────────────────────────────────────────────────
+
+/// A comma-separated list of filter values, all sharing the same negation sense.
+///
+/// Deserializes `"schedule,email"` → `NegatedListFilter { values: [Schedule, Email], negated: false }`
+/// Deserializes `"!schedule,!email"` → `NegatedListFilter { values: [Schedule, Email], negated: true }`
+///
+/// The `!` is read from the **first** item only; subsequent items may or may not carry
+/// `!` and it is stripped regardless, keeping the API forgiving.
+#[derive(Debug, Clone)]
+pub struct NegatedListFilter<T> {
+    pub values: Vec<T>,
+    pub negated: bool,
+}
+
+impl<T> NegatedListFilter<T> {
+    pub fn positive(values: Vec<T>) -> Self {
+        Self { values, negated: false }
+    }
+}
+
+struct NegatedListFilterVisitor<T>(PhantomData<T>);
+
+impl<'de, T: DeserializeOwned> de::Visitor<'de> for NegatedListFilterVisitor<T> {
+    type Value = NegatedListFilter<T>;
+
+    fn expecting(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        write!(f, "a comma-separated string optionally prefixed with '!'")
+    }
+
+    fn visit_str<E: de::Error>(self, s: &str) -> Result<Self::Value, E> {
+        let mut negated = false;
+        let values = s
+            .split(',')
+            .enumerate()
+            .map(|(i, item)| {
+                let raw = match item.strip_prefix('!') {
+                    Some(rest) => {
+                        if i == 0 {
+                            negated = true;
+                        }
+                        rest
+                    }
+                    None => item,
+                };
+                serde_json::from_value::<T>(serde_json::Value::String(raw.to_owned()))
+                    .map_err(|e| E::custom(format!("invalid filter value {:?}: {}", raw, e)))
+            })
+            .collect::<Result<Vec<T>, E>>()?;
+        Ok(NegatedListFilter { values, negated })
+    }
+}
+
+impl<'de, T: DeserializeOwned> de::Deserialize<'de> for NegatedListFilter<T> {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        deserializer.deserialize_str(NegatedListFilterVisitor(PhantomData))
+    }
+}

backend/windmill-api-jobs/src/query.rs

@@ -14,6 +14,17 @@ use windmill_common::utils::{paginate_without_limits, Pagination};
 
 use crate::types::{ListCompletedQuery, ListQueueQuery};
 
+/// Build a `NOT IN (...)` clause that also includes `OR col IS NULL`, so that
+/// rows where the nullable column is NULL are not silently excluded.
+fn not_in_nullable(col: &str, quoted: &[String]) -> String {
+    format!(
+        "({} IS NULL OR {} NOT IN ({}))",
+        col,
+        col,
+        quoted.join(", ")
+    )
+}
+
 pub fn filter_list_queue_query(
     mut sqlb: SqlBuilder,
     lq: &ListQueueQuery,
@@ -33,18 +44,62 @@ pub fn filter_list_queue_query(
     }
 
     if let Some(w) = &lq.worker {
+        let quoted: Vec<_> = w.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job_queue.worker", w.replace("*", "%"));
+            let clauses: Vec<_> = w
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if w.negated {
+                        format!("v2_job_queue.worker NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job_queue.worker LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if w.negated { " AND " } else { " OR " };
+            let inner = clauses.join(sep);
+            if w.negated {
+                sqlb.and_where(format!("(v2_job_queue.worker IS NULL OR ({inner}))"));
+            } else {
+                sqlb.and_where(format!("({inner})"));
+            }
+        } else if w.negated {
+            sqlb.and_where(not_in_nullable("v2_job_queue.worker", &quoted));
         } else {
-            sqlb.and_where_eq("v2_job_queue.worker", "?".bind(w));
+            sqlb.and_where_in("v2_job_queue.worker", &quoted);
         }
     }
 
     if let Some(ps) = &lq.script_path_start {
-        sqlb.and_where_like_left("runnable_path", ps);
+        let clauses: Vec<_> = ps
+            .values
+            .iter()
+            .map(|v| {
+                let e = v.replace("'", "''");
+                if ps.negated {
+                    format!("runnable_path NOT LIKE '{e}%'")
+                } else {
+                    format!("runnable_path LIKE '{e}%'")
+                }
+            })
+            .collect();
+        let sep = if ps.negated { " AND " } else { " OR " };
+        let inner = clauses.join(sep);
+        if ps.negated {
+            sqlb.and_where(format!("(runnable_path IS NULL OR ({inner}))"));
+        } else {
+            sqlb.and_where(format!("({inner})"));
+        }
     }
     if let Some(p) = &lq.script_path_exact {
-        sqlb.and_where_eq("runnable_path", "?".bind(p));
+        let quoted: Vec<_> = p.values.iter().map(|v| quote(v)).collect();
+        if p.negated {
+            sqlb.and_where(not_in_nullable("runnable_path", &quoted));
+        } else {
+            sqlb.and_where_in("runnable_path", &quoted);
+        }
     }
     if let Some(p) = &lq.schedule_path {
         sqlb.and_where_eq("trigger", "?".bind(p));
@@ -54,13 +109,34 @@ pub fn filter_list_queue_query(
         sqlb.and_where_eq("runnable_id", "?".bind(h));
     }
     if let Some(cb) = &lq.created_by {
-        sqlb.and_where_eq("created_by", "?".bind(cb));
+        let quoted: Vec<_> = cb.values.iter().map(|v| quote(v)).collect();
+        if cb.negated {
+            sqlb.and_where_not_in("created_by", &quoted);
+        } else {
+            sqlb.and_where_in("created_by", &quoted);
+        }
     }
     if let Some(t) = &lq.tag {
+        let quoted: Vec<_> = t.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job.tag", t.replace("*", "%"));
+            let clauses: Vec<_> = t
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if t.negated {
+                        format!("v2_job.tag NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job.tag LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if t.negated { " AND " } else { " OR " };
+            sqlb.and_where(format!("({})", clauses.join(sep)));
+        } else if t.negated {
+            sqlb.and_where_not_in("v2_job.tag", &quoted);
         } else {
-            sqlb.and_where_eq("v2_job.tag", "?".bind(t));
+            sqlb.and_where_in("v2_job.tag", &quoted);
         }
     }
 
@@ -115,10 +191,12 @@ pub fn filter_list_queue_query(
     }
 
     if let Some(jk) = &lq.job_kinds {
-        sqlb.and_where_in(
-            "kind",
-            &jk.split(',').into_iter().map(quote).collect::<Vec<_>>(),
-        );
+        let quoted: Vec<_> = jk.values.iter().map(|v| quote(v)).collect();
+        if jk.negated {
+            sqlb.and_where_not_in("kind", &quoted);
+        } else {
+            sqlb.and_where_in("kind", &quoted);
+        }
     }
 
     if let Some(args) = &lq.args {
@@ -134,11 +212,21 @@ pub fn filter_list_queue_query(
     }
 
     if let Some(tk) = &lq.trigger_kind {
-        sqlb.and_where_eq("trigger_kind", "?".bind(&format!("{}", tk)));
+        let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
+        if tk.negated {
+            sqlb.and_where(not_in_nullable("trigger_kind", &quoted));
+        } else {
+            sqlb.and_where_in("trigger_kind", &quoted);
+        }
     }
 
     if let Some(tp) = &lq.trigger_path {
-        sqlb.and_where_eq("trigger", "?".bind(tp));
+        let quoted: Vec<_> = tp.values.iter().map(|v| quote(v)).collect();
+        if tp.negated {
+            sqlb.and_where(not_in_nullable("trigger", &quoted));
+        } else {
+            sqlb.and_where_in("trigger", &quoted);
+        }
     }
 
     sqlb
@@ -187,25 +275,71 @@ pub fn filter_list_completed_query(
 
     if let Some(label) = &lq.label {
         if lq.allow_wildcards.unwrap_or(false) {
-            let wh = format!(
-                    "EXISTS (SELECT 1 FROM jsonb_array_elements_text(result->'wm_labels') label WHERE jsonb_typeof(result->'wm_labels') = 'array' AND label LIKE '{}')",
-                    &label.replace("*", "%").replace("'", "''")
-                );
-            sqlb.and_where("result ? 'wm_labels'");
-            sqlb.and_where(&wh);
+            let clauses: Vec<_> = label
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if label.negated {
+                        format!(
+                            "NOT EXISTS (SELECT 1 FROM jsonb_array_elements_text(result->'wm_labels') lbl WHERE jsonb_typeof(result->'wm_labels') = 'array' AND lbl LIKE '{p}')"
+                        )
+                    } else {
+                        format!(
+                            "EXISTS (SELECT 1 FROM jsonb_array_elements_text(result->'wm_labels') lbl WHERE jsonb_typeof(result->'wm_labels') = 'array' AND lbl LIKE '{p}')"
+                        )
+                    }
+                })
+                .collect();
+            let sep = if label.negated { " AND " } else { " OR " };
+            if !label.negated {
+                sqlb.and_where("result ? 'wm_labels'");
+            }
+            sqlb.and_where(format!("({})", clauses.join(sep)));
+        } else if label.negated {
+            let clauses: Vec<_> = label
+                .values
+                .iter()
+                .map(|v| format!("NOT (result->'wm_labels' ? '{}')", v.replace("'", "''")))
+                .collect();
+            sqlb.and_where(format!("({})", clauses.join(" AND ")));
         } else {
-            let mut wh = format!("result->'wm_labels' ? ");
-            wh.push_str(&format!("'{}'", &label.replace("'", "''")));
+            let clauses: Vec<_> = label
+                .values
+                .iter()
+                .map(|v| format!("result->'wm_labels' ? '{}'", v.replace("'", "''")))
+                .collect();
             sqlb.and_where("result ? 'wm_labels'");
-            sqlb.and_where(&wh);
+            sqlb.and_where(format!("({})", clauses.join(" OR ")));
         }
     }
 
     if let Some(worker) = &lq.worker {
+        let quoted: Vec<_> = worker.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job_completed.worker", worker.replace("*", "%"));
+            let clauses: Vec<_> = worker
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if worker.negated {
+                        format!("v2_job_completed.worker NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job_completed.worker LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if worker.negated { " AND " } else { " OR " };
+            let inner = clauses.join(sep);
+            if worker.negated {
+                sqlb.and_where(format!("(v2_job_completed.worker IS NULL OR ({inner}))"));
+            } else {
+                sqlb.and_where(format!("({inner})"));
+            }
+        } else if worker.negated {
+            sqlb.and_where(not_in_nullable("v2_job_completed.worker", &quoted));
         } else {
-            sqlb.and_where_eq("v2_job_completed.worker", "?".bind(worker));
+            sqlb.and_where_in("v2_job_completed.worker", &quoted);
         }
     }
 
@@ -220,24 +354,68 @@ pub fn filter_list_completed_query(
     }
 
     if let Some(ps) = &lq.script_path_start {
-        sqlb.and_where_like_left("runnable_path", ps);
+        let clauses: Vec<_> = ps
+            .values
+            .iter()
+            .map(|v| {
+                let e = v.replace("'", "''");
+                if ps.negated {
+                    format!("runnable_path NOT LIKE '{e}%'")
+                } else {
+                    format!("runnable_path LIKE '{e}%'")
+                }
+            })
+            .collect();
+        let sep = if ps.negated { " AND " } else { " OR " };
+        let inner = clauses.join(sep);
+        if ps.negated {
+            sqlb.and_where(format!("(runnable_path IS NULL OR ({inner}))"));
+        } else {
+            sqlb.and_where(format!("({inner})"));
+        }
     }
     if let Some(p) = &lq.script_path_exact {
-        sqlb.and_where_eq("runnable_path", "?".bind(p));
+        let quoted: Vec<_> = p.values.iter().map(|v| quote(v)).collect();
+        if p.negated {
+            sqlb.and_where(not_in_nullable("runnable_path", &quoted));
+        } else {
+            sqlb.and_where_in("runnable_path", &quoted);
+        }
     }
     if let Some(h) = &lq.script_hash {
         sqlb.and_where_eq("runnable_id", "?".bind(h));
     }
     if let Some(t) = &lq.tag {
+        let quoted: Vec<_> = t.values.iter().map(|v| quote(v)).collect();
         if lq.allow_wildcards.unwrap_or(false) {
-            sqlb.and_where_like_left("v2_job.tag", t.replace("*", "%"));
+            let clauses: Vec<_> = t
+                .values
+                .iter()
+                .map(|v| {
+                    let p = v.replace("*", "%").replace("'", "''");
+                    if t.negated {
+                        format!("v2_job.tag NOT LIKE '{p}'")
+                    } else {
+                        format!("v2_job.tag LIKE '{p}'")
+                    }
+                })
+                .collect();
+            let sep = if t.negated { " AND " } else { " OR " };
+            sqlb.and_where(format!("({})", clauses.join(sep)));
+        } else if t.negated {
+            sqlb.and_where_not_in("v2_job.tag", &quoted);
         } else {
-            sqlb.and_where_eq("v2_job.tag", "?".bind(t));
+            sqlb.and_where_in("v2_job.tag", &quoted);
         }
     }
 
     if let Some(cb) = &lq.created_by {
-        sqlb.and_where_eq("created_by", "?".bind(cb));
+        let quoted: Vec<_> = cb.values.iter().map(|v| quote(v)).collect();
+        if cb.negated {
+            sqlb.and_where_not_in("created_by", &quoted);
+        } else {
+            sqlb.and_where_in("created_by", &quoted);
+        }
     }
     if let Some(r) = &lq.success {
         if *r {
@@ -308,10 +486,12 @@ pub fn filter_list_completed_query(
         }
     }
     if let Some(jk) = &lq.job_kinds {
-        sqlb.and_where_in(
-            "kind",
-            &jk.split(',').into_iter().map(quote).collect::<Vec<_>>(),
-        );
+        let quoted: Vec<_> = jk.values.iter().map(|v| quote(v)).collect();
+        if jk.negated {
+            sqlb.and_where_not_in("kind", &quoted);
+        } else {
+            sqlb.and_where_in("kind", &quoted);
+        }
     }
 
     if let Some(args) = &lq.args {
@@ -327,11 +507,21 @@ pub fn filter_list_completed_query(
     }
 
     if let Some(tk) = &lq.trigger_kind {
-        sqlb.and_where_eq("trigger_kind", "?".bind(&format!("{}", tk)));
+        let quoted: Vec<_> = tk.values.iter().map(|v| quote(&format!("{}", v))).collect();
+        if tk.negated {
+            sqlb.and_where(not_in_nullable("trigger_kind", &quoted));
+        } else {
+            sqlb.and_where_in("trigger_kind", &quoted);
+        }
     }
 
     if let Some(tp) = &lq.trigger_path {
-        sqlb.and_where_eq("trigger", "?".bind(tp));
+        let quoted: Vec<_> = tp.values.iter().map(|v| quote(v)).collect();
+        if tp.negated {
+            sqlb.and_where(not_in_nullable("trigger", &quoted));
+        } else {
+            sqlb.and_where_in("trigger", &quoted);
+        }
     }
 
     sqlb
@@ -375,6 +565,7 @@ pub fn list_completed_jobs_query(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::negated_filter::NegatedListFilter;
 
     fn empty_queue_query() -> ListQueueQuery {
         ListQueueQuery {
@@ -478,7 +669,7 @@ mod tests {
     #[test]
     fn test_queue_filter_script_path_start() {
         let lq = ListQueueQuery {
-            script_path_start: Some("f/test".to_string()),
+            script_path_start: Some(NegatedListFilter::positive(vec!["f/test".to_string()])),
             ..empty_queue_query()
         };
         let sqlb = filter_list_queue_query(
@@ -495,7 +686,9 @@ mod tests {
     #[test]
     fn test_queue_filter_script_path_exact() {
         let lq = ListQueueQuery {
-            script_path_exact: Some("f/test/script".to_string()),
+            script_path_exact: Some(NegatedListFilter::positive(vec![
+                "f/test/script".to_string()
+            ])),
             ..empty_queue_query()
         };
         let sqlb = filter_list_queue_query(
@@ -510,10 +703,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_running() {
-        let lq = ListQueueQuery {
-            running: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { running: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -527,7 +717,10 @@ mod tests {
     #[test]
     fn test_queue_filter_job_kinds() {
         let lq = ListQueueQuery {
-            job_kinds: Some("script,flow".to_string()),
+            job_kinds: Some(NegatedListFilter::positive(vec![
+                "script".to_string(),
+                "flow".to_string(),
+            ])),
             ..empty_queue_query()
         };
         let sqlb = filter_list_queue_query(
@@ -543,10 +736,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_suspended() {
-        let lq = ListQueueQuery {
-            suspended: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { suspended: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -559,10 +749,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_is_not_schedule() {
-        let lq = ListQueueQuery {
-            is_not_schedule: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { is_not_schedule: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -575,10 +762,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_has_null_parent() {
-        let lq = ListQueueQuery {
-            has_null_parent: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { has_null_parent: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -591,10 +775,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_is_flow_step_true() {
-        let lq = ListQueueQuery {
-            is_flow_step: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { is_flow_step: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -607,10 +788,7 @@ mod tests {
 
     #[test]
     fn test_queue_filter_is_flow_step_false() {
-        let lq = ListQueueQuery {
-            is_flow_step: Some(false),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { is_flow_step: Some(false), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -623,10 +801,7 @@ mod tests {
 
     #[test]
     fn test_queue_admins_all_workspaces() {
-        let lq = ListQueueQuery {
-            all_workspaces: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { all_workspaces: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -639,10 +814,7 @@ mod tests {
 
     #[test]
     fn test_queue_non_admins_ignores_all_workspaces() {
-        let lq = ListQueueQuery {
-            all_workspaces: Some(true),
-            ..empty_queue_query()
-        };
+        let lq = ListQueueQuery { all_workspaces: Some(true), ..empty_queue_query() };
         let sqlb = filter_list_queue_query(
             SqlBuilder::select_from("v2_job_queue").clone(),
             &lq,
@@ -695,10 +867,7 @@ mod tests {
 
     #[test]
     fn test_completed_filter_success_true() {
-        let lq = ListCompletedQuery {
-            success: Some(true),
-            ..empty_completed_query()
-        };
+        let lq = ListCompletedQuery { success: Some(true), ..empty_completed_query() };
         let sqlb = filter_list_completed_query(
             SqlBuilder::select_from("v2_job_completed").clone(),
             &lq,
@@ -711,10 +880,7 @@ mod tests {
 
     #[test]
     fn test_completed_filter_success_false() {
-        let lq = ListCompletedQuery {
-            success: Some(false),
-            ..empty_completed_query()
-        };
+        let lq = ListCompletedQuery { success: Some(false), ..empty_completed_query() };
         let sqlb = filter_list_completed_query(
             SqlBuilder::select_from("v2_job_completed").clone(),
             &lq,
@@ -739,7 +905,7 @@ mod tests {
     #[test]
     fn test_completed_filter_label() {
         let lq = ListCompletedQuery {
-            label: Some("deploy".to_string()),
+            label: Some(NegatedListFilter::positive(vec!["deploy".to_string()])),
             ..empty_completed_query()
         };
         let sqlb = filter_list_completed_query(
@@ -754,10 +920,7 @@ mod tests {
 
     #[test]
     fn test_completed_filter_is_skipped() {
-        let lq = ListCompletedQuery {
-            is_skipped: Some(true),
-            ..empty_completed_query()
-        };
+        let lq = ListCompletedQuery { is_skipped: Some(true), ..empty_completed_query() };
         let sqlb = filter_list_completed_query(
             SqlBuilder::select_from("v2_job_completed").clone(),
             &lq,

backend/windmill-api-jobs/src/types.rs

@@ -27,6 +27,8 @@ use windmill_common::{
 
 use windmill_api_sse::{Job, JobExtended};
 
+use crate::negated_filter::NegatedListFilter;
+
 // ------------ RunJobQuery ------------
 
 #[derive(Debug, Deserialize, Clone, Default)]
@@ -89,10 +91,10 @@ impl RunJobQuery {
 
 #[derive(Deserialize, Clone)]
 pub struct ListQueueQuery {
-    pub script_path_start: Option<String>,
-    pub script_path_exact: Option<String>,
+    pub script_path_start: Option<NegatedListFilter<String>>,
+    pub script_path_exact: Option<NegatedListFilter<String>>,
     pub script_hash: Option<String>,
-    pub created_by: Option<String>,
+    pub created_by: Option<NegatedListFilter<String>>,
     pub started_before: Option<chrono::DateTime<chrono::Utc>>,
     pub started_after: Option<chrono::DateTime<chrono::Utc>>,
     pub created_before: Option<chrono::DateTime<chrono::Utc>>,
@@ -103,12 +105,12 @@ pub struct ListQueueQuery {
     pub schedule_path: Option<String>,
     pub parent_job: Option<String>,
     pub order_desc: Option<bool>,
-    pub job_kinds: Option<String>,
+    pub job_kinds: Option<NegatedListFilter<String>>,
     pub suspended: Option<bool>,
-    pub worker: Option<String>,
+    pub worker: Option<NegatedListFilter<String>>,
     // filter by matching a subset of the args using base64 encoded json subset
     pub args: Option<String>,
-    pub tag: Option<String>,
+    pub tag: Option<NegatedListFilter<String>>,
     pub scheduled_for_before_now: Option<bool>,
     pub all_workspaces: Option<bool>,
     pub is_flow_step: Option<bool>,
@@ -116,17 +118,17 @@ pub struct ListQueueQuery {
     pub is_not_schedule: Option<bool>,
     pub concurrency_key: Option<String>,
     pub allow_wildcards: Option<bool>,
-    pub trigger_kind: Option<JobTriggerKind>,
-    pub trigger_path: Option<String>,
+    pub trigger_kind: Option<NegatedListFilter<JobTriggerKind>>,
+    pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
 }
 
 #[derive(Deserialize, Clone)]
 pub struct ListCompletedQuery {
-    pub script_path_start: Option<String>,
-    pub script_path_exact: Option<String>,
+    pub script_path_start: Option<NegatedListFilter<String>>,
+    pub script_path_exact: Option<NegatedListFilter<String>>,
     pub script_hash: Option<String>,
-    pub created_by: Option<String>,
+    pub created_by: Option<NegatedListFilter<String>>,
     pub started_before: Option<chrono::DateTime<chrono::Utc>>,
     pub started_after: Option<chrono::DateTime<chrono::Utc>>,
     pub created_before: Option<chrono::DateTime<chrono::Utc>>,
@@ -142,7 +144,7 @@ pub struct ListCompletedQuery {
     pub running: Option<bool>,
     pub parent_job: Option<String>,
     pub order_desc: Option<bool>,
-    pub job_kinds: Option<String>,
+    pub job_kinds: Option<NegatedListFilter<String>>,
     pub is_skipped: Option<bool>,
     pub is_flow_step: Option<bool>,
     pub suspended: Option<bool>,
@@ -151,17 +153,17 @@ pub struct ListCompletedQuery {
     pub args: Option<String>,
     // filter by matching a subset of the result using base64 encoded json subset
     pub result: Option<String>,
-    pub tag: Option<String>,
+    pub tag: Option<NegatedListFilter<String>>,
     pub scheduled_for_before_now: Option<bool>,
     pub all_workspaces: Option<bool>,
     pub has_null_parent: Option<bool>,
-    pub label: Option<String>,
+    pub label: Option<NegatedListFilter<String>>,
     pub is_not_schedule: Option<bool>,
     pub concurrency_key: Option<String>,
-    pub worker: Option<String>,
+    pub worker: Option<NegatedListFilter<String>>,
     pub allow_wildcards: Option<bool>,
-    pub trigger_kind: Option<JobTriggerKind>,
-    pub trigger_path: Option<String>,
+    pub trigger_kind: Option<NegatedListFilter<JobTriggerKind>>,
+    pub trigger_path: Option<NegatedListFilter<String>>,
     pub include_args: Option<bool>,
 }
 
@@ -578,8 +580,7 @@ mod tests {
 
     #[test]
     fn test_decode_payload_valid() {
-        let payload = base64::engine::general_purpose::STANDARD
-            .encode(r#"{"key": "value"}"#);
+        let payload = base64::engine::general_purpose::STANDARD.encode(r#"{"key": "value"}"#);
         let result: HashMap<String, serde_json::Value> = decode_payload(payload).unwrap();
         assert_eq!(result["key"], json!("value"));
     }
@@ -644,22 +645,15 @@ mod tests {
 
     #[test]
     fn test_run_job_query_payload_as_args_valid() {
-        let encoded = base64::engine::general_purpose::STANDARD
-            .encode(r#"{"x": 42}"#);
-        let q = RunJobQuery {
-            payload: Some(encoded),
-            ..Default::default()
-        };
+        let encoded = base64::engine::general_purpose::STANDARD.encode(r#"{"x": 42}"#);
+        let q = RunJobQuery { payload: Some(encoded), ..Default::default() };
         let result = q.payload_as_args().unwrap();
         assert!(result.contains_key("x"));
     }
 
     #[test]
     fn test_run_job_query_payload_as_args_invalid() {
-        let q = RunJobQuery {
-            payload: Some("invalid!!!".to_string()),
-            ..Default::default()
-        };
+        let q = RunJobQuery { payload: Some("invalid!!!".to_string()), ..Default::default() };
         assert!(q.payload_as_args().is_err());
     }
 
@@ -668,10 +662,10 @@ mod tests {
     #[test]
     fn test_list_completed_to_queue_query_conversion() {
         let lcq = ListCompletedQuery {
-            script_path_start: Some("f/test".to_string()),
+            script_path_start: Some(NegatedListFilter::positive(vec!["f/test".to_string()])),
             script_path_exact: None,
             script_hash: None,
-            created_by: Some("admin".to_string()),
+            created_by: Some(NegatedListFilter::positive(vec!["admin".to_string()])),
             started_before: None,
             started_after: None,
             created_before: Some(chrono::Utc::now()),
@@ -687,14 +681,17 @@ mod tests {
             running: Some(true),
             parent_job: None,
             order_desc: Some(true),
-            job_kinds: Some("script,flow".to_string()),
+            job_kinds: Some(NegatedListFilter::positive(vec![
+                "script".to_string(),
+                "flow".to_string(),
+            ])),
             is_skipped: None,
             is_flow_step: None,
             suspended: None,
             schedule_path: None,
             args: None,
             result: None,
-            tag: Some("custom".to_string()),
+            tag: Some(NegatedListFilter::positive(vec!["custom".to_string()])),
             scheduled_for_before_now: None,
             all_workspaces: None,
             has_null_parent: None,
@@ -709,11 +706,24 @@ mod tests {
         };
 
         let lqq: ListQueueQuery = lcq.into();
-        assert_eq!(lqq.script_path_start, Some("f/test".to_string()));
-        assert_eq!(lqq.created_by, Some("admin".to_string()));
+        assert_eq!(
+            lqq.script_path_start
+                .as_ref()
+                .and_then(|f| f.values.first().cloned()),
+            Some("f/test".to_string())
+        );
+        assert_eq!(
+            lqq.created_by
+                .as_ref()
+                .and_then(|f| f.values.first().cloned()),
+            Some("admin".to_string())
+        );
         assert_eq!(lqq.running, Some(true));
-        assert_eq!(lqq.job_kinds, Some("script,flow".to_string()));
-        assert_eq!(lqq.tag, Some("custom".to_string()));
+        assert_eq!(lqq.job_kinds.as_ref().map(|f| f.values.len()), Some(2));
+        assert_eq!(
+            lqq.tag.as_ref().and_then(|f| f.values.first().cloned()),
+            Some("custom".to_string())
+        );
     }
 
     #[test]

backend/windmill-api-schedule/src/lib.rs

@@ -6,8 +6,6 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
-use windmill_api_auth::{check_scopes, maybe_refresh_folders, require_super_admin, ApiAuthed};
-use windmill_common::DB;
 use axum::{
     extract::{Extension, Path, Query},
     routing::{delete, get, post},
@@ -18,9 +16,12 @@ use serde::{Deserialize, Serialize};
 use sql_builder::{prelude::Bind, SqlBuilder};
 use sqlx::{Postgres, Transaction};
 use std::str::FromStr;
+use windmill_api_auth::{check_scopes, maybe_refresh_folders, require_super_admin, ApiAuthed};
 use windmill_audit::audit_oss::audit_log;
 use windmill_audit::ActionKind;
+use windmill_common::DB;
 use windmill_common::{
+    can_preserve_on_behalf_of,
     db::UserDB,
     error::{Error, JsonResult, Result},
     schedule::Schedule,
@@ -30,6 +31,45 @@ use windmill_common::{
 use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
 use windmill_queue::schedule::push_scheduled_job;
 
+/// Resolves the email to use for a schedule based on preservation settings.
+/// When preserving, looks up the email from the provided username.
+async fn resolve_email(
+    username: Option<&String>,
+    preserve_email: Option<bool>,
+    authed: &ApiAuthed,
+    db: &DB,
+    w_id: &str,
+) -> Result<String> {
+    if let Some(username) = username {
+        if preserve_email.unwrap_or(false) && can_preserve_on_behalf_of(authed) {
+            let email = sqlx::query_scalar!(
+                "SELECT email FROM usr WHERE username = $1 AND workspace_id = $2",
+                username,
+                w_id
+            )
+            .fetch_optional(db)
+            .await?;
+            if let Some(email) = email {
+                return Ok(email);
+            }
+        }
+    }
+    Ok(authed.email.clone())
+}
+
+fn resolve_edited_by(
+    username: Option<&String>,
+    preserve_edited_by: Option<bool>,
+    authed: &ApiAuthed,
+) -> String {
+    if let Some(username) = username {
+        if preserve_edited_by.unwrap_or(false) && can_preserve_on_behalf_of(authed) {
+            return username.clone();
+        }
+    }
+    authed.username.clone()
+}
+
 pub fn workspaced_service() -> Router {
     Router::new()
         .route("/list", get(list_schedule))
@@ -75,6 +115,8 @@ pub struct NewSchedule {
     pub paused_until: Option<DateTime<Utc>>,
     pub cron_version: Option<String>,
     pub dynamic_skip: Option<String>,
+    pub email: Option<String>,
+    pub preserve_email: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize)]
@@ -200,6 +242,8 @@ async fn create_schedule(
         validate_dynamic_skip(&mut tx, &w_id, handler_path).await?;
     }
 
+    let resolved_edited_by = resolve_edited_by(ns.email.as_ref(), ns.preserve_email, &authed);
+
     let schedule = sqlx::query_as!(
         Schedule,
         r#"
@@ -257,13 +301,13 @@ async fn create_schedule(
         ns.path,
         ns.schedule,
         ns.timezone,
-        authed.username,
+        resolved_edited_by,
         ns.script_path,
         ns.is_flow,
         to_json_raw_opt(ns.args.as_ref())
             as Option<sqlx::types::Json<Box<serde_json::value::RawValue>>>,
         ns.enabled.unwrap_or(false),
-        authed.email,
+        resolve_email(ns.email.as_ref(), ns.preserve_email, &authed, &db, &w_id).await?,
         ns.on_failure,
         ns.on_failure_times,
         ns.on_failure_exact,
@@ -308,6 +352,29 @@ async fn create_schedule(
         ),
     )
     .await?;
+    if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
+        ns.email.as_deref(),
+        ns.preserve_email.unwrap_or(false),
+        &authed,
+        &authed.username,
+    ) {
+        audit_log(
+            &mut *tx,
+            &authed,
+            "schedule.on_behalf_of",
+            ActionKind::Create,
+            &w_id,
+            Some(&ns.path),
+            Some(
+                [
+                    ("on_behalf_of", on_behalf_of.as_str()),
+                    ("action", "create"),
+                ]
+                .into(),
+            ),
+        )
+        .await?;
+    }
 
     if ns.enabled.unwrap_or(true) {
         tx = push_scheduled_job(&db, tx, &schedule, Some(&authed.clone().into()), None).await?
@@ -351,6 +418,9 @@ async fn edit_schedule(
     }
 
     clear_schedule(&mut tx, path, &w_id).await?;
+
+    let resolved_edited_by = resolve_edited_by(es.email.as_ref(), es.preserve_email, &authed);
+
     let schedule = sqlx::query_as!(
         Schedule,
         r#"
@@ -377,7 +447,9 @@ async fn edit_schedule(
             workspace_id            = $20,
             cron_version            = COALESCE($21, cron_version),
             description             = $22,
-            dynamic_skip        = $23
+            dynamic_skip            = $23,
+            email                   = COALESCE($24, email),
+            edited_by               = $25
         WHERE path = $19 AND workspace_id = $20
         RETURNING
             workspace_id,
@@ -438,7 +510,9 @@ async fn edit_schedule(
         w_id,
         es.cron_version,
         es.description,
-        es.dynamic_skip
+        es.dynamic_skip,
+        Some(resolve_email(es.email.as_ref(), es.preserve_email, &authed, &db, &w_id).await?),
+        resolved_edited_by
     )
     .fetch_one(&mut *tx)
     .await
@@ -459,6 +533,29 @@ async fn edit_schedule(
         ),
     )
     .await?;
+    if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
+        es.email.as_deref(),
+        es.preserve_email.unwrap_or(false),
+        &authed,
+        &authed.username,
+    ) {
+        audit_log(
+            &mut *tx,
+            &authed,
+            "schedule.on_behalf_of",
+            ActionKind::Update,
+            &w_id,
+            Some(path),
+            Some(
+                [
+                    ("on_behalf_of", on_behalf_of.as_str()),
+                    ("action", "update"),
+                ]
+                .into(),
+            ),
+        )
+        .await?;
+    }
 
     if schedule.enabled {
         tx = push_scheduled_job(&db, tx, &schedule, None, None).await?;
@@ -486,8 +583,15 @@ pub struct ListScheduleQuery {
     pub per_page: Option<usize>,
     pub path: Option<String>,
     pub is_flow: Option<bool>,
+    // filter by matching a subset of the args using base64 encoded json subset
     pub args: Option<String>,
     pub path_start: Option<String>,
+    // exact match on schedule path
+    pub schedule_path: Option<String>,
+    // filter on description (pattern match)
+    pub description: Option<String>,
+    // filter on summary (pattern match)
+    pub summary: Option<String>,
 }
 
 #[derive(sqlx::FromRow, Serialize, Deserialize, Debug, Clone)]
@@ -543,6 +647,18 @@ async fn list_schedule(
     if let Some(path_start) = &lsq.path_start {
         sqlb.and_where_like_left("path", path_start);
     }
+    if let Some(schedule_path) = &lsq.schedule_path {
+        sqlb.and_where_eq("path", "?".bind(schedule_path));
+    }
+    if let Some(description) = &lsq.description {
+        sqlb.and_where(&format!(
+            "description ILIKE '%{}%'",
+            description.replace("'", "''")
+        ));
+    }
+    if let Some(summary) = &lsq.summary {
+        sqlb.and_where(&format!("summary ILIKE '%{}%'", summary.replace("'", "''")));
+    }
     let sql = sqlb.sql().map_err(|e| Error::internal_err(e.to_string()))?;
     let rows = sqlx::query_as::<_, ScheduleLight>(&sql)
         .fetch_all(&mut *tx)
@@ -1054,6 +1170,8 @@ pub struct EditSchedule {
     pub paused_until: Option<DateTime<Utc>>,
     pub cron_version: Option<String>,
     pub dynamic_skip: Option<String>,
+    pub email: Option<String>,
+    pub preserve_email: Option<bool>,
 }
 
 pub use windmill_queue::schedule::clear_schedule;

backend/windmill-api-scripts/src/scripts.rs

@@ -927,11 +927,11 @@ async fn create_script_internal<'c>(
         no_main_func.filter(|x: &bool| *x), // should be Some(true) or None
         codebase,
         has_preprocessor.filter(|x: &bool| *x), // should be Some(true) or None
-        if ns.on_behalf_of_email.is_some() {
-            Some(&authed.email)
-        } else {
-            None
-        },
+        windmill_common::resolve_on_behalf_of_email(
+            ns.on_behalf_of_email.as_deref(),
+            ns.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+        ),
         validate_schema,
         ns.assets.as_ref().and_then(|a| serde_json::to_value(a).ok()),
         guarded_debounce_key,
@@ -1027,6 +1027,29 @@ async fn create_script_internal<'c>(
             Some([("hash", hash.to_string().as_str())].into()),
         )
         .await?;
+        if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
+            ns.on_behalf_of_email.as_deref(),
+            ns.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+            &authed.email,
+        ) {
+            audit_log(
+                &mut *tx,
+                &authed,
+                "scripts.on_behalf_of",
+                ActionKind::Update,
+                &w_id,
+                Some(&ns.path),
+                Some(
+                    [
+                        ("on_behalf_of", on_behalf_of.as_str()),
+                        ("action", "update"),
+                    ]
+                    .into(),
+                ),
+            )
+            .await?;
+        }
         webhook.send_message(
             w_id.clone(),
             WebhookMessage::UpdateScript {
@@ -1052,6 +1075,29 @@ async fn create_script_internal<'c>(
             ),
         )
         .await?;
+        if let Some(on_behalf_of) = windmill_common::check_on_behalf_of_preservation(
+            ns.on_behalf_of_email.as_deref(),
+            ns.preserve_on_behalf_of.unwrap_or(false),
+            &authed,
+            &authed.email,
+        ) {
+            audit_log(
+                &mut *tx,
+                &authed,
+                "scripts.on_behalf_of",
+                ActionKind::Create,
+                &w_id,
+                Some(&ns.path),
+                Some(
+                    [
+                        ("on_behalf_of", on_behalf_of.as_str()),
+                        ("action", "create"),
+                    ]
+                    .into(),
+                ),
+            )
+            .await?;
+        }
         webhook.send_message(
             w_id.clone(),
             WebhookMessage::CreateScript {

backend/windmill-api-settings/src/lib.rs

@@ -12,24 +12,24 @@ use std::{collections::HashMap, time::Duration};
 mod ee;
 pub mod ee_oss;
 
-use windmill_api_auth::{require_super_admin, ApiAuthed};
 #[cfg(feature = "enterprise")]
 use windmill_api_auth::require_devops_role;
+use windmill_api_auth::{require_super_admin, ApiAuthed};
 use windmill_common::utils::HTTP_CLIENT_PERMISSIVE as HTTP_CLIENT;
 use windmill_common::DB;
 
 use ee_oss::validate_license_key;
 use windmill_common::usernames::generate_instance_username_for_all_users;
 
-use axum::{
-    extract::{Extension, Path},
-    routing::{get, post},
-    body::Body,
-    response::Response,
-    Json, Router,
-};
 #[cfg(feature = "enterprise")]
 use axum::extract::Query;
+use axum::{
+    body::Body,
+    extract::{Extension, Path},
+    response::Response,
+    routing::{get, post},
+    Json, Router,
+};
 use serde_json::json;
 
 use serde::{Deserialize, Serialize};
@@ -43,9 +43,8 @@ use windmill_common::{
     get_database_url,
     global_settings::{
         APP_WORKSPACED_ROUTE_SETTING, AUTOMATE_USERNAME_CREATION_SETTING,
-        CRITICAL_ALERT_MUTE_UI_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING,
-        EMAIL_DOMAIN_SETTING, ENV_SETTINGS, HUB_ACCESSIBLE_URL_SETTING,
-        HUB_BASE_URL_SETTING,
+        CRITICAL_ALERT_MUTE_UI_SETTING, DEFAULT_TAGS_WORKSPACES_SETTING, EMAIL_DOMAIN_SETTING,
+        ENV_SETTINGS, HUB_ACCESSIBLE_URL_SETTING, HUB_BASE_URL_SETTING,
     },
     instance_config::{self, ApplyMode, InstanceConfig},
     server::Smtp,
@@ -171,7 +170,9 @@ pub async fn test_s3_bucket(
         .await?
         .store;
 
-    let mut list = client.list(Some(&windmill_object_store::object_store_reexports::Path::from("".to_string())));
+    let mut list = client.list(Some(
+        &windmill_object_store::object_store_reexports::Path::from("".to_string()),
+    ));
     let first_file = list.next().await;
     if first_file.is_some() {
         if let Err(e) = first_file.as_ref().unwrap() {
@@ -189,7 +190,10 @@ pub async fn test_s3_bucket(
     ));
     tracing::info!("Testing blob storage at path: {path}");
     client
-        .put(&path, windmill_object_store::object_store_reexports::PutPayload::from_static(b"hello"))
+        .put(
+            &path,
+            windmill_object_store::object_store_reexports::PutPayload::from_static(b"hello"),
+        )
         .await
         .map_err(|e| anyhow::anyhow!("error writing file to {path}: {e:#}"))?;
     let content = client
@@ -290,17 +294,17 @@ pub async fn set_global_setting_internal(
     match value {
         serde_json::Value::Null => {
             if instance_config::PROTECTED_SETTINGS.contains(&key.as_str()) {
-                return Err(error::Error::BadRequest(
-                    format!("{key} is a protected setting and cannot be deleted"),
-                ));
+                return Err(error::Error::BadRequest(format!(
+                    "{key} is a protected setting and cannot be deleted"
+                )));
             }
             delete_global_setting(db, &key).await?;
         }
         serde_json::Value::String(x) if x.is_empty() => {
             if instance_config::PROTECTED_SETTINGS.contains(&key.as_str()) {
-                return Err(error::Error::BadRequest(
-                    format!("{key} is a protected setting and cannot be set to empty"),
-                ));
+                return Err(error::Error::BadRequest(format!(
+                    "{key} is a protected setting and cannot be set to empty"
+                )));
             }
             delete_global_setting(db, &key).await?;
         }
@@ -437,7 +441,8 @@ async fn get_instance_config_yaml(
     let config = InstanceConfig::from_db(&db)
         .await
         .map_err(|e| error::Error::internal_err(e.to_string()))?;
-    let yaml = config.to_sorted_yaml()
+    let yaml = config
+        .to_sorted_yaml()
         .map_err(|e| error::Error::internal_err(e))?;
     Response::builder()
         .header("content-type", "application/yaml")
@@ -478,8 +483,7 @@ async fn set_instance_config(
             .map(|(k, v)| {
                 (
                     k.clone(),
-                    serde_json::to_value(v)
-                        .expect("WorkerGroupConfig serialization cannot fail"),
+                    serde_json::to_value(v).expect("WorkerGroupConfig serialization cannot fail"),
                 )
             })
             .collect();
@@ -489,8 +493,7 @@ async fn set_instance_config(
             .map(|(k, v)| {
                 (
                     k.clone(),
-                    serde_json::to_value(v)
-                        .expect("WorkerGroupConfig serialization cannot fail"),
+                    serde_json::to_value(v).expect("WorkerGroupConfig serialization cannot fail"),
                 )
             })
             .collect();
@@ -944,7 +947,8 @@ async fn setup_custom_instance_pg_database_inner(
              GRANT CREATE ON DATABASE \"{dbname}\" TO custom_instance_user;
              ALTER DEFAULT PRIVILEGES IN SCHEMA public
                  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO custom_instance_user;
-             ALTER ROLE custom_instance_user CREATEROLE;"
+             ALTER ROLE custom_instance_user CREATEROLE;
+             ALTER ROLE custom_instance_user REPLICATION;"
         ))
         .await
         .map_err(|e| {
@@ -1083,19 +1087,16 @@ async fn sync_cached_resource_types(
     use windmill_common::worker::HUB_RT_CACHE_DIR;
     let cache_path = format!("{}/resource_types.json", HUB_RT_CACHE_DIR);
 
-    let content = tokio::fs::read_to_string(&cache_path)
-        .await
-        .map_err(|e| {
-            error::Error::NotFound(format!(
-                "No cached resource types found at {}: {}",
-                cache_path, e
-            ))
-        })?;
+    let content = tokio::fs::read_to_string(&cache_path).await.map_err(|e| {
+        error::Error::NotFound(format!(
+            "No cached resource types found at {}: {}",
+            cache_path, e
+        ))
+    })?;
 
-    let cached_types: Vec<CachedResourceType> =
-        serde_json::from_str(&content).map_err(|e| {
-            error::Error::InternalErr(format!("Failed to parse cached resource types: {}", e))
-        })?;
+    let cached_types: Vec<CachedResourceType> = serde_json::from_str(&content).map_err(|e| {
+        error::Error::InternalErr(format!("Failed to parse cached resource types: {}", e))
+    })?;
 
     let mut synced_count = 0;
 
@@ -1176,7 +1177,10 @@ mod tests {
             deserialized.global_settings.base_url.as_deref(),
             Some("https://windmill.example.com")
         );
-        assert_eq!(deserialized.global_settings.retention_period_secs, Some(86400));
+        assert_eq!(
+            deserialized.global_settings.retention_period_secs,
+            Some(86400)
+        );
         assert_eq!(deserialized.global_settings.expose_metrics, Some(true));
         let wc = &deserialized.worker_configs["default"];
         assert_eq!(
@@ -1208,9 +1212,7 @@ mod tests {
         let retention_pos = yaml.find("retention_period_secs:").unwrap();
 
         assert!(
-            base_url_pos < email_pos
-                && email_pos < expose_pos
-                && expose_pos < retention_pos,
+            base_url_pos < email_pos && email_pos < expose_pos && expose_pos < retention_pos,
             "global_settings keys should be alphabetically sorted, got yaml:\n{yaml}"
         );
     }
@@ -1220,22 +1222,34 @@ mod tests {
         let config = InstanceConfig {
             global_settings: GlobalSettings::default(),
             worker_configs: BTreeMap::from([
-                ("gpu".to_string(), WorkerGroupConfig {
-                    init_bash: Some("echo gpu".to_string()),
-                    ..Default::default()
-                }),
-                ("native".to_string(), WorkerGroupConfig {
-                    init_bash: Some("echo native".to_string()),
-                    ..Default::default()
-                }),
-                ("default".to_string(), WorkerGroupConfig {
-                    init_bash: Some("echo default".to_string()),
-                    ..Default::default()
-                }),
-                ("alpha".to_string(), WorkerGroupConfig {
-                    init_bash: Some("echo alpha".to_string()),
-                    ..Default::default()
-                }),
+                (
+                    "gpu".to_string(),
+                    WorkerGroupConfig {
+                        init_bash: Some("echo gpu".to_string()),
+                        ..Default::default()
+                    },
+                ),
+                (
+                    "native".to_string(),
+                    WorkerGroupConfig {
+                        init_bash: Some("echo native".to_string()),
+                        ..Default::default()
+                    },
+                ),
+                (
+                    "default".to_string(),
+                    WorkerGroupConfig {
+                        init_bash: Some("echo default".to_string()),
+                        ..Default::default()
+                    },
+                ),
+                (
+                    "alpha".to_string(),
+                    WorkerGroupConfig {
+                        init_bash: Some("echo alpha".to_string()),
+                        ..Default::default()
+                    },
+                ),
             ]),
         };
 
@@ -1264,26 +1278,40 @@ mod tests {
                 ..Default::default()
             },
             worker_configs: BTreeMap::from([
-                ("default".to_string(), WorkerGroupConfig {
-                    worker_tags: Some(vec!["deno".to_string()]),
-                    ..Default::default()
-                }),
-                ("native".to_string(), WorkerGroupConfig {
-                    init_bash: Some("echo hi".to_string()),
-                    ..Default::default()
-                }),
+                (
+                    "default".to_string(),
+                    WorkerGroupConfig {
+                        worker_tags: Some(vec!["deno".to_string()]),
+                        ..Default::default()
+                    },
+                ),
+                (
+                    "native".to_string(),
+                    WorkerGroupConfig {
+                        init_bash: Some("echo hi".to_string()),
+                        ..Default::default()
+                    },
+                ),
             ]),
         };
 
         let yaml = config.to_sorted_yaml().unwrap();
         let deserialized: InstanceConfig = serde_yml::from_str(&yaml).unwrap();
 
-        assert_eq!(deserialized.global_settings.base_url.as_deref(), Some("https://rt.test"));
-        assert_eq!(deserialized.global_settings.retention_period_secs, Some(7200));
+        assert_eq!(
+            deserialized.global_settings.base_url.as_deref(),
+            Some("https://rt.test")
+        );
+        assert_eq!(
+            deserialized.global_settings.retention_period_secs,
+            Some(7200)
+        );
         assert_eq!(deserialized.global_settings.expose_metrics, Some(false));
         assert_eq!(deserialized.worker_configs.len(), 2);
         assert_eq!(
-            deserialized.worker_configs["default"].worker_tags.as_deref(),
+            deserialized.worker_configs["default"]
+                .worker_tags
+                .as_deref(),
             Some(["deno".to_string()].as_slice())
         );
         assert_eq!(

backend/windmill-api-workspaces/src/workspaces.rs

@@ -30,7 +30,6 @@ use uuid::Uuid;
 use windmill_audit::audit_oss::{audit_log, AuditAuthorable};
 use windmill_audit::ActionKind;
 use windmill_common::db::UserDB;
-use windmill_types::s3::LargeFileStorage;
 use windmill_common::users::username_to_permissioned_as;
 use windmill_common::variables::{build_crypt, decrypt, encrypt, WORKSPACE_CRYPT_CACHE};
 use windmill_common::worker::{to_raw_value, CLOUD_HOSTED};
@@ -55,6 +54,7 @@ use windmill_dep_map::scoped_dependency_map::{
     DependencyDependent, DependencyMap, ScopedDependencyMap,
 };
 use windmill_git_sync::{handle_deployment_metadata, handle_fork_branch_creation, DeployedObject};
+use windmill_types::s3::LargeFileStorage;
 
 use hyper::StatusCode;
 use serde::{Deserialize, Serialize};
@@ -2788,6 +2788,14 @@ async fn create_workspace(
     .execute(&mut *tx)
     .await?;
 
+    sqlx::query!(
+        "INSERT INTO group_
+            VALUES ($1, 'wm_deployers', 'Members can preserve the original author when deploying to this workspace')",
+        nw.id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     sqlx::query!(
         "INSERT INTO usr_to_group
             VALUES ($1, 'all', $2)",
@@ -3010,8 +3018,8 @@ async fn clone_resource_types(
     target_workspace_id: &str,
 ) -> Result<()> {
     sqlx::query!(
-        "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension)
-         SELECT $2, name, schema, description, edited_at, created_by, format_extension
+        "INSERT INTO resource_type (workspace_id, name, schema, description, edited_at, created_by, format_extension, is_fileset)
+         SELECT $2, name, schema, description, edited_at, created_by, format_extension, is_fileset
          FROM resource_type
          WHERE workspace_id = $1",
         source_workspace_id,
@@ -3558,7 +3566,7 @@ pub(crate) async fn archive_workspace_impl(
     db: &DB,
     w_id: &str,
     username: &str,
-) -> Result<(usize, usize)> {
+) -> Result<(usize, usize, usize)> {
     // Step 1: Disable all schedules and clear their queued jobs
     let mut tx = db.begin().await?;
     let disabled_schedules = sqlx::query_scalar!(
@@ -3580,6 +3588,20 @@ pub(crate) async fn archive_workspace_impl(
         windmill_queue::schedule::clear_schedule(&mut tx, schedule_path, w_id).await?;
     }
 
+    // Delete non-session tokens scoped to this workspace
+    let deleted_tokens = sqlx::query_scalar!(
+        "DELETE FROM token WHERE workspace_id = $1 AND label IS DISTINCT FROM 'session' RETURNING token",
+        w_id
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+
+    tracing::info!(
+        "Deleted {} non-session tokens in workspace {}",
+        deleted_tokens.len(),
+        w_id
+    );
+
     // Mark workspace as archived
     sqlx::query!("UPDATE workspace SET deleted = true WHERE id = $1", w_id)
         .execute(&mut *tx)
@@ -3618,7 +3640,7 @@ pub(crate) async fn archive_workspace_impl(
         0
     };
 
-    Ok((schedules_count, canceled_count))
+    Ok((schedules_count, canceled_count, deleted_tokens.len()))
 }
 
 async fn archive_workspace(
@@ -3628,7 +3650,7 @@ async fn archive_workspace(
 ) -> Result<String> {
     require_admin(authed.is_admin, &authed.username)?;
 
-    let (schedules_count, canceled_count) =
+    let (schedules_count, canceled_count, deleted_tokens_count) =
         archive_workspace_impl(&db, &w_id, &authed.username).await?;
 
     // Audit log
@@ -3636,6 +3658,7 @@ async fn archive_workspace(
     let mut audit_params = HashMap::new();
     audit_params.insert("disabled_schedules", schedules_count.to_string());
     audit_params.insert("canceled_jobs", canceled_count.to_string());
+    audit_params.insert("deleted_tokens", deleted_tokens_count.to_string());
     let audit_params_refs: HashMap<&str, &str> =
         audit_params.iter().map(|(k, v)| (*k, v.as_str())).collect();
 
@@ -3652,8 +3675,8 @@ async fn archive_workspace(
     tx.commit().await?;
 
     Ok(format!(
-        "Archived workspace {}, disabled {} schedules and canceled {} jobs",
-        &w_id, schedules_count, canceled_count
+        "Archived workspace {}, disabled {} schedules, canceled {} jobs and deleted {} tokens",
+        &w_id, schedules_count, canceled_count, deleted_tokens_count
     ))
 }
 
@@ -5254,7 +5277,7 @@ async fn compare_two_resource_types(
 ) -> Result<ItemComparison> {
     // Get resource type from each workspace
     let source_resource_type = sqlx::query!(
-        "SELECT schema, description, format_extension
+        "SELECT schema, description, format_extension, is_fileset
          FROM resource_type
          WHERE workspace_id = $1 AND name = $2",
         source_workspace_id,
@@ -5264,7 +5287,7 @@ async fn compare_two_resource_types(
     .await?;
 
     let target_resource_type = sqlx::query!(
-        "SELECT schema, description, format_extension
+        "SELECT schema, description, format_extension, is_fileset
          FROM resource_type
          WHERE workspace_id = $1 AND name = $2",
         fork_workspace_id,
@@ -5280,6 +5303,7 @@ async fn compare_two_resource_types(
         if source.schema != target.schema
             || source.description != target.description
             || source.format_extension != target.format_extension
+            || source.is_fileset != target.is_fileset
         {
             has_changes = true;
         }

backend/windmill-api-workspaces/src/workspaces_extra.rs

@@ -641,7 +641,7 @@ pub(crate) async fn change_workspace_id(
     // Archive old workspace: disable schedules, cancel remaining jobs, set deleted=true
     // Note: schedules were already moved to new workspace, so this will find 0 schedules
     info!("Archiving old workspace");
-    let (_schedules_count, canceled_count) =
+    let (_schedules_count, canceled_count, _deleted_tokens_count) =
         archive_workspace_impl(&db, &old_id, &authed.username).await?;
 
     info!(

backend/windmill-api/openapi-deref.yaml

@@ -28049,6 +28049,7 @@ components:
       name: trigger_kind
       description: trigger kind (schedule, http, websocket...)
       in: query
+      x-go-name: JobTriggerKindParam
       schema: *ref_160
     OrderDesc:
       name: order_desc

backend/windmill-api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: "3.0.3"
 
 info:
-  version: 1.642.0
+  version: 1.644.0
   title: Windmill API
 
   contact:
@@ -4091,6 +4091,21 @@ paths:
           in: query
           schema:
             type: string
+        - name: path
+          description: exact path match filter
+          in: query
+          schema:
+            type: string
+        - name: description
+          description: pattern match filter for description field (case-insensitive)
+          in: query
+          schema:
+            type: string
+        - name: value
+          description: pattern match filter for non-secret variable values (case-insensitive)
+          in: query
+          schema:
+            type: string
         - $ref: "#/components/parameters/Page"
         - $ref: "#/components/parameters/PerPage"
       responses:
@@ -5090,6 +5105,21 @@ paths:
           in: query
           schema:
             type: string
+        - name: path
+          description: exact path match filter
+          in: query
+          schema:
+            type: string
+        - name: description
+          description: pattern match filter for description field (case-insensitive)
+          in: query
+          schema:
+            type: string
+        - name: value
+          description: JSONB subset match filter using base64 encoded JSON
+          in: query
+          schema:
+            type: string
       responses:
         "200":
           description: resource list
@@ -5214,10 +5244,19 @@ paths:
         - $ref: "#/components/parameters/WorkspaceId"
       responses:
         "200":
-          description: map from resource type to file ext
+          description: map from resource type to file resource info
           content:
             application/json:
-              schema: {}
+              schema:
+                type: object
+                additionalProperties:
+                  type: object
+                  properties:
+                    format_extension:
+                      type: string
+                      nullable: true
+                    is_fileset:
+                      type: boolean
 
   /w/{workspace}/resources/type/delete/{path}:
     delete:
@@ -8176,6 +8215,9 @@ paths:
                   type: string
                 custom_path:
                   type: string
+                preserve_on_behalf_of:
+                  type: boolean
+                  description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it."
               required:
                 - path
                 - value
@@ -8221,6 +8263,9 @@ paths:
                       type: string
                     custom_path:
                       type: string
+                    preserve_on_behalf_of:
+                      type: boolean
+                      description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it."
                   required:
                     - path
                     - value
@@ -8532,6 +8577,9 @@ paths:
                   type: string
                 custom_path:
                   type: string
+                preserve_on_behalf_of:
+                  type: boolean
+                  description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it."
       responses:
         "200":
           description: app updated
@@ -8571,6 +8619,9 @@ paths:
                       type: string
                     custom_path:
                       type: string
+                    preserve_on_behalf_of:
+                      type: boolean
+                      description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it."
                 js:
                   type: string
                 css:
@@ -10629,6 +10680,16 @@ paths:
           required: false
           schema:
             type: string
+        - name: resume_button_text
+          in: query
+          required: false
+          schema:
+            type: string
+        - name: cancel_button_text
+          in: query
+          required: false
+          schema:
+            type: string
       responses:
         "200":
           description: Interactive slack approval message sent successfully
@@ -10675,6 +10736,16 @@ paths:
           required: false
           schema:
             type: string
+        - name: resume_button_text
+          in: query
+          required: false
+          schema:
+            type: string
+        - name: cancel_button_text
+          in: query
+          required: false
+          schema:
+            type: string
       responses:
         "200":
           description: Interactive slack approval message sent successfully
@@ -11120,7 +11191,7 @@ paths:
         - $ref: "#/components/parameters/PerPage"
         - $ref: "#/components/parameters/ArgsFilter"
         - name: path
-          description: filter by path
+          description: filter by path (script path)
           in: query
           schema:
             type: string
@@ -11134,6 +11205,21 @@ paths:
           in: query
           schema:
             type: string
+        - name: schedule_path
+          description: exact match on the schedule's path
+          in: query
+          schema:
+            type: string
+        - name: description
+          description: pattern match filter for description field (case-insensitive)
+          in: query
+          schema:
+            type: string
+        - name: summary
+          description: pattern match filter for summary field (case-insensitive)
+          in: query
+          schema:
+            type: string
       responses:
         "200":
           description: schedule list
@@ -16885,6 +16971,16 @@ paths:
           description: Filter by asset kinds (multiple values allowed)
           schema:
             type: string
+        - name: path
+          in: query
+          description: exact path match filter
+          schema:
+            type: string
+        - name: columns
+          in: query
+          description: JSONB subset match filter for columns using base64 encoded JSON
+          schema:
+            type: string
       responses:
         "200":
           description: paginated assets in the workspace
@@ -17258,10 +17354,11 @@ components:
         type: integer
     JobTriggerKind:
       name: trigger_kind
-      description: trigger kind (schedule, http, websocket...)
+      description: "filter by trigger kind. Supports comma-separated list (e.g. 'schedule,webhook') and negation by prefixing all values with '!' (e.g. '!schedule,!webhook')"
       in: query
+      x-go-name: JobTriggerKindParam
       schema:
-        $ref: "#/components/schemas/JobTriggerKind"
+        type: string
     OrderDesc:
       name: order_desc
       description: order by desc order (default true)
@@ -17270,19 +17367,19 @@ components:
         type: boolean
     CreatedBy:
       name: created_by
-      description: mask to filter exact matching user creator
+      description: "filter by exact matching user creator. Supports comma-separated list (e.g. 'alice,bob') and negation by prefixing all values with '!' (e.g. '!alice,!bob')"
       in: query
       schema:
         type: string
     Label:
       name: label
-      description: mask to filter exact matching job's label (job labels are completed jobs with as a result an object containing a string in the array at key 'wm_labels')
+      description: "filter by exact matching job label. Supports comma-separated list (e.g. 'deploy,release') and negation by prefixing all values with '!' (e.g. '!deploy,!release')"
       in: query
       schema:
         type: string
     Worker:
       name: worker
-      description: worker this job was ran on
+      description: "filter by worker this job ran on. Supports comma-separated list (e.g. 'worker-1,worker-2') and negation by prefixing all values with '!' (e.g. '!worker-1,!worker-2')"
       in: query
       schema:
         type: string
@@ -17348,7 +17445,7 @@ components:
         type: string
     ScriptStartPath:
       name: script_path_start
-      description: mask to filter matching starting path
+      description: "filter by script path prefix. Supports comma-separated list (e.g. 'f/folder1,f/folder2') and negation by prefixing all values with '!' (e.g. '!f/folder1,!f/folder2')"
       in: query
       schema:
         type: string
@@ -17360,13 +17457,13 @@ components:
         type: string
     TriggerPath:
       name: trigger_path
-      description: mask to filter by trigger path
+      description: "filter by trigger path. Supports comma-separated list (e.g. 'f/trigger1,f/trigger2') and negation by prefixing all values with '!' (e.g. '!f/trigger1,!f/trigger2')"
       in: query
       schema:
         type: string
     ScriptExactPath:
       name: script_path_exact
-      description: mask to filter exact matching path
+      description: "filter by exact matching script path. Supports comma-separated list (e.g. 'f/script1,f/script2') and negation by prefixing all values with '!' (e.g. '!f/script1,!f/script2')"
       in: query
       schema:
         type: string
@@ -17481,7 +17578,7 @@ components:
         type: string
     Tag:
       name: tag
-      description: filter on jobs with a given tag/worker group
+      description: "filter by tag/worker group. Supports comma-separated list (e.g. 'gpu,highmem') and negation by prefixing all values with '!' (e.g. '!gpu,!highmem')"
       in: query
       schema:
         type: string
@@ -17525,9 +17622,7 @@ components:
         enum: [Create, Update, Delete, Execute]
     JobKinds:
       name: job_kinds
-      description:
-        filter on job kind (values 'preview', 'script', 'dependencies', 'flow')
-        separated by,
+      description: "filter by job kind. Supports comma-separated list of values ('preview', 'script', 'dependencies', 'flow') and negation by prefixing all values with '!' (e.g. '!preview,!dependencies')"
       in: query
       schema:
         type: string
@@ -18434,6 +18529,9 @@ components:
           type: boolean
         on_behalf_of_email:
           type: string
+        preserve_on_behalf_of:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
         assets:
           type: array
           items:
@@ -19832,6 +19930,8 @@ components:
           format: date-time
         format_extension:
           type: string
+        is_fileset:
+          type: boolean
       required:
         - name
 
@@ -19841,6 +19941,8 @@ components:
         schema: {}
         description:
           type: string
+        is_fileset:
+          type: boolean
 
     Schedule:
       type: object
@@ -20084,6 +20186,12 @@ components:
           type: string
           nullable: true
           description: Path to a script that validates scheduled datetimes. Receives scheduled_for datetime and returns boolean to skip (true) or run (false)
+        email:
+          type: string
+          description: Email of the user who the scheduled jobs run as. Used during deployment to preserve the original schedule owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - schedule
@@ -20171,6 +20279,12 @@ components:
           type: string
           nullable: true
           description: Path to a script that validates scheduled datetimes. Receives scheduled_for datetime and returns boolean to skip (true) or run (false)
+        email:
+          type: string
+          description: Email of the user who the scheduled jobs run as. Used during deployment to preserve the original schedule owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - schedule
         - timezone
@@ -20527,6 +20641,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -20613,6 +20733,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -20775,6 +20901,12 @@ components:
         retry:
           description: Retry configuration for failed executions
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -20837,6 +20969,12 @@ components:
         retry:
           description: Retry configuration for failed executions
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -21006,6 +21144,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -21060,6 +21204,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -21196,6 +21346,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: "Retry configuration for failed executions."
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -21358,6 +21514,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - queue_url
         - aws_resource_path
@@ -21404,6 +21566,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - queue_url
         - aws_resource_path
@@ -21562,6 +21730,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -21604,6 +21778,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -21711,6 +21891,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -21764,6 +21950,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -21865,6 +22057,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -21914,6 +22112,12 @@ components:
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
           description: Retry configuration for failed executions
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -21962,6 +22166,12 @@ components:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
         mode:
           $ref: "#/components/schemas/TriggerMode"
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
 
       required:
         - path
@@ -21988,6 +22198,12 @@ components:
           $ref: "#/components/schemas/ScriptArgs"
         retry:
           $ref: "../../openflow.openapi.yaml#/components/schemas/Retry"
+        email:
+          type: string
+          description: Email of the user who triggered jobs run as. Used during deployment to preserve the original trigger owner.
+        preserve_email:
+          type: boolean
+          description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original email value instead of overwriting it."
       required:
         - path
         - script_path
@@ -22407,6 +22623,9 @@ components:
               type: boolean
             on_behalf_of_email:
               type: string
+            preserve_on_behalf_of:
+              type: boolean
+              description: "When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of_email value instead of overwriting it."
           required:
             - path
 

backend/windmill-api/src/ai.rs

@@ -663,12 +663,30 @@ async fn global_proxy(
 
     let base_url = provider.get_base_url(None, &db).await?;
 
-    let url = format!("{}/{}", base_url, ai_path);
+    let is_anthropic = provider.is_anthropic();
+    let is_anthropic_sdk = headers.get("X-Anthropic-SDK").is_some();
+
+    let url = if is_anthropic_sdk {
+        let truncated_base_url = base_url.trim_end_matches("/v1");
+        format!("{}/{}", truncated_base_url, ai_path)
+    } else {
+        format!("{}/{}", base_url, ai_path)
+    };
 
     let mut request = HTTP_CLIENT
         .request(method, url)
         .header("content-type", "application/json")
-        .header("Authorization", format!("Bearer {}", api_key));
+        .header("Authorization", format!("Bearer {}", &api_key));
+
+    if is_anthropic {
+        request = request.header("X-API-Key", &api_key);
+    }
+
+    for (header_name, header_value) in headers.iter() {
+        if header_name.to_string().starts_with("anthropic-") {
+            request = request.header(header_name, header_value);
+        }
+    }
 
     // Apply custom headers from AI_HTTP_HEADERS environment variable
     for (header_name, header_value) in AI_HTTP_HEADERS.iter() {

backend/windmill-api/src/approvals.rs

@@ -83,6 +83,12 @@ pub struct QueryDynamicEnumJson {
     pub dynamic_enums_json: Option<serde_json::Value>,
 }
 
+#[derive(Deserialize, Debug)]
+pub struct QueryButtonText {
+    pub resume_button_text: Option<String>,
+    pub cancel_button_text: Option<String>,
+}
+
 #[derive(Debug)]
 pub struct ApprovalFormDetails {
     pub message_str: String,
@@ -266,7 +272,12 @@ pub async fn get_approval_form_details(
         })
     });
 
-    let args_str = args.map_or("None".to_string(), |a| a.get().to_string());
+    let args_str = args.map_or("None".to_string(), |a| {
+        serde_json::from_str::<serde_json::Value>(a.get())
+            .ok()
+            .and_then(|v| serde_json::to_string_pretty(&v).ok())
+            .unwrap_or_else(|| a.get().to_string())
+    });
     let parent_job_id_str = parent_job_id.map_or("None".to_string(), |id| id.to_string());
     let script_path_str = script_path.as_deref().unwrap_or("None");
 
@@ -282,7 +293,7 @@ pub async fn get_approval_form_details(
         {}: {created_by}\n\n\
         {}: {created_at_formatted}\n\n\
         {}: {script_path_str}\n\n\
-        {}: {args_str}\n\n\
+        {}:\n```\n{args_str}\n```\n\n\
         {}: {parent_job_id_str}\n\n",
         bold_format.replace("{}", "Created by"),
         bold_format.replace("{}", "Created at"),

backend/windmill-api/src/apps.rs

@@ -39,8 +39,6 @@ use itertools::Itertools;
 use lazy_static::lazy_static;
 use magic_crypt::MagicCryptTrait;
 #[cfg(feature = "parquet")]
-use windmill_object_store::object_store_reexports::{Attribute, Attributes};
-#[cfg(feature = "parquet")]
 use regex::Regex;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, value::RawValue};
@@ -67,6 +65,8 @@ use windmill_common::{
     workspaces::{check_user_against_rule, ProtectionRuleKind, RuleCheckResult},
     HUB_BASE_URL,
 };
+#[cfg(feature = "parquet")]
+use windmill_object_store::object_store_reexports::{Attribute, Attributes};
 use windmill_store::resources::get_resource_value_interpolated_internal;
 
 use windmill_git_sync::{handle_deployment_metadata, DeployedObject};
@@ -75,11 +75,7 @@ use windmill_queue::{push, PushArgs, PushArgsOwned, PushIsolationLevel};
 #[cfg(feature = "parquet")]
 use hmac::Mac;
 #[cfg(feature = "parquet")]
-use windmill_common::{
-    jwt,
-    oauth2::HmacSha256,
-    variables::get_workspace_key,
-};
+use windmill_common::{jwt, oauth2::HmacSha256, variables::get_workspace_key};
 #[cfg(feature = "parquet")]
 use windmill_types::s3::{S3Object, S3Permission};
 
@@ -279,6 +275,7 @@ pub struct CreateApp {
     pub draft_only: Option<bool>,
     pub deployment_message: Option<String>,
     pub custom_path: Option<String>,
+    pub preserve_on_behalf_of: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize)]
@@ -289,6 +286,7 @@ pub struct EditApp {
     pub policy: Option<Policy>,
     pub deployment_message: Option<String>,
     pub custom_path: Option<String>,
+    pub preserve_on_behalf_of: Option<bool>,
 }
 
 #[derive(Serialize, FromRow)]
@@ -443,7 +441,9 @@ async fn get_raw_app_data(
     if let Some(os) = object_store {
         let path = format!("/app_bundles/{}/{}.{}", w_id, id, file_type);
         let stream = os
-            .get(&windmill_object_store::object_store_reexports::Path::from(path))
+            .get(&windmill_object_store::object_store_reexports::Path::from(
+                path,
+            ))
             .await
             .map_err(windmill_object_store::object_store_error_to_error)?
             .bytes()
@@ -958,7 +958,10 @@ async fn store_raw_app_file<'a>(
 
         if let Some(os) = object_store {
             if let Err(e) = os
-                .put(&windmill_object_store::object_store_reexports::Path::from(path.clone()), data.into())
+                .put(
+                    &windmill_object_store::object_store_reexports::Path::from(path.clone()),
+                    data.into(),
+                )
                 .await
             {
                 tracing::error!("Failed to put snapshot to s3 at {path}: {:?}", e);
@@ -1178,8 +1181,14 @@ async fn create_app_internal<'a>(
         }
     }
     let mut tx = user_db.clone().begin(&authed).await?;
-    app.policy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
-    app.policy.on_behalf_of_email = Some(authed.email.clone());
+    let should_preserve = app.preserve_on_behalf_of.unwrap_or(false)
+        && windmill_common::can_preserve_on_behalf_of(&authed)
+        && app.policy.on_behalf_of.is_some();
+
+    if !should_preserve {
+        app.policy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
+        app.policy.on_behalf_of_email = Some(authed.email.clone());
+    }
     let path = app.path.clone();
     if &app.path == "" {
         return Err(Error::BadRequest("App path cannot be empty".to_string()));
@@ -1270,6 +1279,22 @@ async fn create_app_internal<'a>(
         None,
     )
     .await?;
+    if should_preserve {
+        if let Some(ref obo_email) = app.policy.on_behalf_of_email {
+            if obo_email != &authed.email {
+                audit_log(
+                    &mut *tx,
+                    &authed,
+                    "apps.on_behalf_of",
+                    ActionKind::Create,
+                    w_id,
+                    Some(&app.path),
+                    Some([("on_behalf_of", obo_email.as_str()), ("action", "create")].into()),
+                )
+                .await?;
+            }
+        }
+    }
     let mut args: HashMap<String, Box<serde_json::value::RawValue>> = HashMap::new();
     if let Some(dm) = &app.deployment_message {
         args.insert("deployment_message".to_string(), to_raw_value(&dm));
@@ -1599,6 +1624,7 @@ async fn update_app_internal<'a>(
     use sql_builder::prelude::*;
     let mut tx = user_db.clone().begin(&authed).await?;
 
+    let mut preserved_on_behalf_of: Option<String> = None;
     let npath = if ns.policy.is_some()
         || ns.path.is_some()
         || ns.summary.is_some()
@@ -1664,8 +1690,20 @@ async fn update_app_internal<'a>(
         }
 
         if let Some(mut npolicy) = ns.policy {
-            npolicy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
-            npolicy.on_behalf_of_email = Some(authed.email.clone());
+            let should_preserve = ns.preserve_on_behalf_of.unwrap_or(false)
+                && windmill_common::can_preserve_on_behalf_of(&authed)
+                && npolicy.on_behalf_of.is_some();
+
+            if should_preserve {
+                if let Some(ref obo_email) = npolicy.on_behalf_of_email {
+                    if obo_email != &authed.email {
+                        preserved_on_behalf_of = Some(obo_email.clone());
+                    }
+                }
+            } else {
+                npolicy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
+                npolicy.on_behalf_of_email = Some(authed.email.clone());
+            }
             sqlb.set(
                 "policy",
                 quote(serde_json::to_string(&json!(npolicy)).map_err(|e| {
@@ -1747,6 +1785,24 @@ async fn update_app_internal<'a>(
         None,
     )
     .await?;
+    if let Some(on_behalf_of) = preserved_on_behalf_of {
+        audit_log(
+            &mut *tx,
+            &authed,
+            "apps.on_behalf_of",
+            ActionKind::Update,
+            w_id,
+            Some(&npath),
+            Some(
+                [
+                    ("on_behalf_of", on_behalf_of.as_str()),
+                    ("action", "update"),
+                ]
+                .into(),
+            ),
+        )
+        .await?;
+    }
     let tx = PushIsolationLevel::Transaction(tx);
     let mut args: HashMap<String, Box<serde_json::value::RawValue>> = HashMap::new();
     if let Some(dm) = ns.deployment_message {

backend/windmill-api/src/db.rs

@@ -15,7 +15,10 @@ use sqlx::{
 
 use tokio::task::JoinHandle;
 pub use windmill_common::db::DB;
-use windmill_common::{error::Error, utils::{generate_lock_id, GIT_VERSION}};
+use windmill_common::{
+    error::Error,
+    utils::{generate_lock_id, GIT_VERSION},
+};
 
 #[allow(unused_imports)]
 pub use windmill_api_auth::{ApiAuthed, OptJobAuthed};
@@ -75,6 +78,9 @@ lazy_static::lazy_static! {
                     (20260207000004, include_str!(
                         "../../migrations/20260207000004_concurrent_indexes_other.up.sql"
                     ).replace("CREATE INDEX", "CREATE INDEX CONCURRENTLY").replace("DROP INDEX", "DROP INDEX CONCURRENTLY")),
+                    (20260225100000, include_str!(
+                        "../../migrations/20260225100000_asset_covering_index.up.sql"
+                    ).replace("CREATE INDEX", "CREATE INDEX CONCURRENTLY").replace("DROP INDEX", "DROP INDEX CONCURRENTLY")),
                     ].into_iter().collect();
 }
 
@@ -255,8 +261,7 @@ pub async fn migrate(
     if let Err(err) = sqlx::query!(
         "DELETE FROM _sqlx_migrations WHERE
         version=20250131115248 OR version=20250902085503 OR version=20250201145630 OR
-        version=20250201145631 OR version=20250201145632 OR version=20251006143821 OR
-        version=20260207000001 OR version=20260207000002 OR version=20260207000003 OR version=20260207000004"
+        version=20250201145631 OR version=20250201145632 OR version=20251006143821"
     )
     .execute(db)
     .await
@@ -264,6 +269,31 @@ pub async fn migrate(
         tracing::info!("Could not remove sqlx migrations: {err:#}");
     }
 
+    // For migrations that were replaced (same version, new content), only delete if
+    // the stored checksum doesn't match the current file — i.e., it's a stale record
+    // from the old broken version. Once the new migration is applied, the checksum
+    // matches and the record is kept, avoiding expensive re-application on every start.
+    let migrator = sqlx::migrate!("../migrations");
+    let potentially_stale: &[i64] = &[
+        20260207000001,
+        20260207000002,
+        20260207000003,
+        20260207000004,
+    ];
+    for m in migrator.migrations.iter() {
+        if potentially_stale.contains(&m.version) {
+            if let Err(err) =
+                sqlx::query("DELETE FROM _sqlx_migrations WHERE version = $1 AND checksum != $2")
+                    .bind(m.version)
+                    .bind(&*m.checksum)
+                    .execute(db)
+                    .await
+            {
+                tracing::info!("Could not clean up stale migration {}: {err:#}", m.version);
+            }
+        }
+    }
+
     tokio::select! {
         _ = killpill_rx.recv() => {
             tracing::info!("Killpill received, stopping migration");
@@ -309,12 +339,11 @@ pub async fn wait_for_migrations(
     let mut attempts = 0;
 
     loop {
-        let is_applied: Result<Option<bool>, sqlx::Error> = sqlx::query_scalar(
-            "SELECT EXISTS(SELECT 1 FROM _sqlx_migrations WHERE version = $1)",
-        )
-        .bind(latest_version)
-        .fetch_one(db)
-        .await;
+        let is_applied: Result<Option<bool>, sqlx::Error> =
+            sqlx::query_scalar("SELECT EXISTS(SELECT 1 FROM _sqlx_migrations WHERE version = $1)")
+                .bind(latest_version)
+                .fetch_one(db)
+                .await;
 
         match is_applied {
             Ok(Some(true)) => {

backend/windmill-api/src/jobs.rs

@@ -1933,7 +1933,7 @@ async fn count_completed_jobs_detail(
 
     if let Some(after_s_ago) = query.completed_after_s_ago {
         let after = Utc::now() - chrono::Duration::seconds(after_s_ago);
-        sqlb.and_where_gt("ended_at", "?".bind(&after.to_rfc3339()));
+        sqlb.and_where_gt("completed_at", "?".bind(&after.to_rfc3339()));
     }
 
     if let Some(success) = query.success {

backend/windmill-api/src/mcp/oauth_server.rs

@@ -387,10 +387,11 @@ async fn handle_authorization_code_grant(
     let token_family = sqlx::types::Uuid::new_v4();
     let scopes = auth_code.scopes;
 
-    // Create access token
-    if let Err(e) = sqlx::query!(
+    // Create access token (rejects archived workspaces inline)
+    let rows = sqlx::query!(
         "INSERT INTO token (token, email, label, expiration, scopes, workspace_id)
-         VALUES ($1, $2, $3, now() + ($4 || ' seconds')::interval, $5, $6)",
+         SELECT $1::varchar, $2::varchar, $3::varchar, now() + ($4 || ' seconds')::interval, $5::text[], $6::varchar
+         WHERE NOT EXISTS(SELECT 1 FROM workspace WHERE id = $6 AND deleted = true)",
         access_token,
         auth_code.user_email,
         format!("mcp-oauth-{}", auth_code.client_id),
@@ -400,10 +401,13 @@ async fn handle_authorization_code_grant(
     )
     .execute(db)
     .await
-    {
+    .map_err(|e| {
         tracing::error!("Failed to create access token: {}", e);
-        return Err(OAuthTokenError::server_error(
-            "Failed to create access token",
+        OAuthTokenError::server_error("Failed to create access token")
+    })?;
+    if rows.rows_affected() == 0 {
+        return Err(OAuthTokenError::invalid_grant(
+            "Cannot create a token for an archived workspace",
         ));
     }
 
@@ -514,10 +518,11 @@ async fn handle_refresh_token_grant(
     let new_refresh_token = rd_string(32);
     let scopes = token_row.scopes;
 
-    // Create new access token
-    if let Err(e) = sqlx::query!(
+    // Create new access token (rejects archived workspaces inline)
+    let rows = sqlx::query!(
         "INSERT INTO token (token, email, label, expiration, scopes, workspace_id)
-         VALUES ($1, $2, $3, now() + ($4 || ' seconds')::interval, $5, $6)",
+         SELECT $1::varchar, $2::varchar, $3::varchar, now() + ($4 || ' seconds')::interval, $5::text[], $6::varchar
+         WHERE NOT EXISTS(SELECT 1 FROM workspace WHERE id = $6 AND deleted = true)",
         new_access_token,
         token_row.user_email,
         format!("mcp-oauth-{}", token_row.client_id),
@@ -527,10 +532,13 @@ async fn handle_refresh_token_grant(
     )
     .execute(db)
     .await
-    {
+    .map_err(|e| {
         tracing::error!("Failed to create new access token: {}", e);
-        return Err(OAuthTokenError::server_error(
-            "Failed to create access token",
+        OAuthTokenError::server_error("Failed to create access token")
+    })?;
+    if rows.rows_affected() == 0 {
+        return Err(OAuthTokenError::invalid_grant(
+            "Cannot create a token for an archived workspace",
         ));
     }
 

backend/windmill-api/src/slack_approvals.rs

@@ -16,8 +16,8 @@ use crate::jobs::{QueryApprover, ResumeUrls};
 use crate::{
     approvals::{
         extract_w_id_from_resume_url, handle_resume_action, ApprovalFormDetails, FieldType,
-        MessageFormat, QueryDefaultArgsJson, QueryDynamicEnumJson, QueryFlowStepId, QueryMessage,
-        ResumeFormField, ResumeSchema,
+        MessageFormat, QueryButtonText, QueryDefaultArgsJson, QueryDynamicEnumJson,
+        QueryFlowStepId, QueryMessage, ResumeFormField, ResumeSchema,
     },
     auth::OptTokened,
 };
@@ -107,6 +107,8 @@ struct ModalActionValue {
     flow_step_id: Option<String>,
     default_args_json: Option<String>,
     dynamic_enums_json: Option<String>,
+    resume_button_text: Option<String>,
+    cancel_button_text: Option<String>,
 }
 
 #[derive(Deserialize, Debug)]
@@ -200,6 +202,8 @@ pub async fn slack_app_callback_handler(
                                 container,
                                 default_args_json.as_ref(),
                                 dynamic_enums_json.as_ref(),
+                                parsed_value.resume_button_text.as_deref(),
+                                parsed_value.cancel_button_text.as_deref(),
                             )
                             .await
                             .map_err(|e| Error::BadRequest(e.to_string()))?;
@@ -229,6 +233,7 @@ pub async fn request_slack_approval(
     Query(flow_step_id): Query<QueryFlowStepId>,
     Query(default_args_json): Query<QueryDefaultArgsJson>,
     Query(dynamic_enums_json): Query<QueryDynamicEnumJson>,
+    Query(button_text): Query<QueryButtonText>,
 ) -> Result<StatusCode, Error> {
     let slack_resource_path = slack_resource_path.slack_resource_path;
     let channel_id = channel_id.channel_id;
@@ -255,6 +260,8 @@ pub async fn request_slack_approval(
         flow_step_id.as_str(),
         default_args_json.default_args_json.as_ref(),
         dynamic_enums_json.dynamic_enums_json.as_ref(),
+        button_text.resume_button_text.as_deref(),
+        button_text.cancel_button_text.as_deref(),
     )
     .await
     .map_err(|e| Error::BadRequest(e.to_string()))?;
@@ -752,6 +759,8 @@ async fn send_slack_message(
     flow_step_id: &str,
     default_args_json: Option<&serde_json::Value>,
     dynamic_enums_json: Option<&serde_json::Value>,
+    resume_button_text: Option<&str>,
+    cancel_button_text: Option<&str>,
 ) -> Result<StatusCode, Box<dyn std::error::Error>> {
     let url = "https://slack.com/api/chat.postMessage";
 
@@ -779,6 +788,14 @@ async fn send_slack_message(
         value["dynamic_enums_json"] = dynamic_enums_json.clone();
     }
 
+    if let Some(resume_button_text) = resume_button_text {
+        value["resume_button_text"] = serde_json::json!(resume_button_text);
+    }
+
+    if let Some(cancel_button_text) = cancel_button_text {
+        value["cancel_button_text"] = serde_json::json!(cancel_button_text);
+    }
+
     let payload = serde_json::json!({
         "channel": channel_id,
         "text": "A flow has been suspended. Please approve or reject the flow.",
@@ -842,6 +859,8 @@ async fn get_modal_blocks(
     container: Container,
     default_args_json: Option<&serde_json::Value>,
     dynamic_enums_json: Option<&serde_json::Value>,
+    resume_button_text: Option<&str>,
+    cancel_button_text: Option<&str>,
 ) -> Result<axum::Json<serde_json::Value>, Error> {
     let approval_details = crate::approvals::get_approval_form_details(
         db,
@@ -895,6 +914,8 @@ async fn get_modal_blocks(
         &urls.resume,
         resource_path,
         container,
+        resume_button_text,
+        cancel_button_text,
     )))
 }
 
@@ -905,6 +926,8 @@ fn construct_payload(
     resume_url: &str,
     resource_path: &str,
     container: Container,
+    resume_button_text: Option<&str>,
+    cancel_button_text: Option<&str>,
 ) -> serde_json::Value {
     let mut view = serde_json::json!({
         "type": "modal",
@@ -912,12 +935,12 @@ fn construct_payload(
         "notify_on_close": true,
         "title": {
             "type": "plain_text",
-            "text": "Worfklow Suspended"
+            "text": "Workflow Suspended"
         },
         "blocks": blocks,
         "submit": {
             "type": "plain_text",
-            "text": "Resume Workflow"
+            "text": resume_button_text.unwrap_or("Resume Workflow")
         },
         "private_metadata": serde_json::json!({ "resume_url": resume_url, "resource_path": resource_path, "container": container, "hide_cancel": hide_cancel }).to_string(),
     });
@@ -925,7 +948,7 @@ fn construct_payload(
     if !hide_cancel {
         view["close"] = serde_json::json!({
             "type": "plain_text",
-            "text": "Cancel Workflow"
+            "text": cancel_button_text.unwrap_or("Cancel Workflow")
         });
     }
 
@@ -949,6 +972,8 @@ async fn open_modal_with_blocks(
     container: Container,
     default_args_json: Option<&serde_json::Value>,
     dynamic_enums_json: Option<&serde_json::Value>,
+    resume_button_text: Option<&str>,
+    cancel_button_text: Option<&str>,
 ) -> Result<(), Box<dyn std::error::Error>> {
     let resume_id = rand::random::<u32>();
     let blocks_json = match get_modal_blocks(
@@ -964,6 +989,8 @@ async fn open_modal_with_blocks(
         container,
         default_args_json,
         dynamic_enums_json,
+        resume_button_text,
+        cancel_button_text,
     )
     .await
     {

backend/windmill-common/src/bench.rs

@@ -179,13 +179,12 @@ pub async fn benchmark_verify(benchmark_jobs: i32, db: &DB) {
     let canceled = row.canceled.unwrap_or(0);
     let total = succeeded + failed + canceled;
 
-    let remaining_in_queue = sqlx::query_scalar!(
-        "SELECT COUNT(*) FROM v2_job_queue WHERE workspace_id = 'admins'",
-    )
-    .fetch_one(db)
-    .await
-    .expect("benchmark verify queue query failed")
-    .unwrap_or(0);
+    let remaining_in_queue =
+        sqlx::query_scalar!("SELECT COUNT(*) FROM v2_job_queue WHERE workspace_id = 'admins'",)
+            .fetch_one(db)
+            .await
+            .expect("benchmark verify queue query failed")
+            .unwrap_or(0);
 
     println!("=== BENCHMARK VERIFICATION ===");
     println!("  kind:              {benchmark_kind}");
@@ -248,10 +247,12 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
             .execute(db)
             .await
             .unwrap_or_else(|e| panic!("failed to clean up job_perms: {e:#}"));
-        sqlx::query!("DELETE FROM concurrency_key WHERE key LIKE 'bench_%' OR key LIKE 'u/admin/bench_%'")
-            .execute(db)
-            .await
-            .unwrap_or_else(|e| panic!("failed to clean up concurrency_key: {e:#}"));
+        sqlx::query!(
+            "DELETE FROM concurrency_key WHERE key LIKE 'bench_%' OR key LIKE 'u/admin/bench_%'"
+        )
+        .execute(db)
+        .await
+        .unwrap_or_else(|e| panic!("failed to clean up concurrency_key: {e:#}"));
         sqlx::query!("DELETE FROM concurrency_counter WHERE concurrency_id LIKE 'bench_%' OR concurrency_id LIKE 'u/admin/bench_%'")
             .execute(db)
             .await
@@ -637,9 +638,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                 sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &noop_uuids, "admins", "deno")
                 .execute(&mut *tx)
                 .await.unwrap_or_else(|_e| panic!("failed to insert mixed noop queue"));
-                sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &noop_uuids)
+                sqlx::query!(
+                    "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                    &noop_uuids
+                )
                 .execute(&mut *tx)
-                .await.unwrap_or_else(|_e| panic!("failed to insert mixed noop runtime"));
+                .await
+                .unwrap_or_else(|_e| panic!("failed to insert mixed noop runtime"));
 
                 // 2) sequentialflow jobs
                 if portion > 0 {
@@ -661,9 +666,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                     sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &sf_uuids, "admins", "flow")
                     .execute(&mut *tx)
                     .await.unwrap_or_else(|_e| panic!("failed to insert mixed sequentialflow queue"));
-                    sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &sf_uuids)
+                    sqlx::query!(
+                        "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                        &sf_uuids
+                    )
                     .execute(&mut *tx)
-                    .await.unwrap_or_else(|_e| panic!("failed to insert mixed sequentialflow runtime"));
+                    .await
+                    .unwrap_or_else(|_e| panic!("failed to insert mixed sequentialflow runtime"));
                     sqlx::query!(
                         "INSERT INTO v2_job_status (id, flow_status) SELECT unnest($1::uuid[]), $2",
                         &sf_uuids,
@@ -693,9 +702,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                     sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &sl_uuids, "admins", "deno")
                     .execute(&mut *tx)
                     .await.unwrap_or_else(|_e| panic!("failed to insert mixed scriptlogs queue"));
-                    sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &sl_uuids)
+                    sqlx::query!(
+                        "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                        &sl_uuids
+                    )
                     .execute(&mut *tx)
-                    .await.unwrap_or_else(|_e| panic!("failed to insert mixed scriptlogs runtime"));
+                    .await
+                    .unwrap_or_else(|_e| panic!("failed to insert mixed scriptlogs runtime"));
                 }
 
                 // 4) concurrencylimit jobs
@@ -720,9 +733,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                     sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &cl_uuids, "admins", "deno")
                     .execute(&mut *tx)
                     .await.unwrap_or_else(|_e| panic!("failed to insert mixed concurrencylimit queue"));
-                    sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &cl_uuids)
+                    sqlx::query!(
+                        "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                        &cl_uuids
+                    )
                     .execute(&mut *tx)
-                    .await.unwrap_or_else(|_e| panic!("failed to insert mixed concurrencylimit runtime"));
+                    .await
+                    .unwrap_or_else(|_e| panic!("failed to insert mixed concurrencylimit runtime"));
                     let cl_concurrency_id = "u/admin/bench_conclimit";
                     sqlx::query!(
                         "INSERT INTO concurrency_counter (concurrency_id, job_uuids) VALUES ($1, '{}'::jsonb) ON CONFLICT (concurrency_id) DO NOTHING",
@@ -763,9 +780,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                     sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &ck_uuids, "admins", "deno")
                     .execute(&mut *tx)
                     .await.unwrap_or_else(|_e| panic!("failed to insert mixed concurrencykey queue"));
-                    sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &ck_uuids)
+                    sqlx::query!(
+                        "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                        &ck_uuids
+                    )
                     .execute(&mut *tx)
-                    .await.unwrap_or_else(|_e| panic!("failed to insert mixed concurrencykey runtime"));
+                    .await
+                    .unwrap_or_else(|_e| panic!("failed to insert mixed concurrencykey runtime"));
                     let ck_concurrency_id = "bench_shared_concurrency_key";
                     sqlx::query!(
                         "INSERT INTO concurrency_counter (concurrency_id, job_uuids) VALUES ($1, '{}'::jsonb) ON CONFLICT (concurrency_id) DO NOTHING",
@@ -807,9 +828,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                 sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &noop_uuids, "admins", "deno")
                 .execute(&mut *tx)
                 .await.unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc noop queue"));
-                sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &noop_uuids)
+                sqlx::query!(
+                    "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                    &noop_uuids
+                )
                 .execute(&mut *tx)
-                .await.unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc noop runtime"));
+                .await
+                .unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc noop runtime"));
 
                 // 2) sequentialflow jobs
                 if portion > 0 {
@@ -831,9 +856,15 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                     sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &sf_uuids, "admins", "flow")
                     .execute(&mut *tx)
                     .await.unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc sequentialflow queue"));
-                    sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &sf_uuids)
+                    sqlx::query!(
+                        "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                        &sf_uuids
+                    )
                     .execute(&mut *tx)
-                    .await.unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc sequentialflow runtime"));
+                    .await
+                    .unwrap_or_else(|_e| {
+                        panic!("failed to insert mixed_no_cc sequentialflow runtime")
+                    });
                     sqlx::query!(
                         "INSERT INTO v2_job_status (id, flow_status) SELECT unnest($1::uuid[]), $2",
                         &sf_uuids,
@@ -863,9 +894,13 @@ pub async fn benchmark_init(benchmark_jobs: i32, db: &DB) {
                     sqlx::query!("INSERT INTO v2_job_queue (id, workspace_id, scheduled_for, tag) SELECT unnest($1::uuid[]), $2, now(), $3", &sl_uuids, "admins", "deno")
                     .execute(&mut *tx)
                     .await.unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc scriptlogs queue"));
-                    sqlx::query!("INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])", &sl_uuids)
+                    sqlx::query!(
+                        "INSERT INTO v2_job_runtime (id) SELECT unnest($1::uuid[])",
+                        &sl_uuids
+                    )
                     .execute(&mut *tx)
-                    .await.unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc scriptlogs runtime"));
+                    .await
+                    .unwrap_or_else(|_e| panic!("failed to insert mixed_no_cc scriptlogs runtime"));
                 }
             }
             "none" => {}

backend/windmill-common/src/lib.rs

@@ -109,6 +109,50 @@ pub const DEFAULT_MAX_CONNECTIONS_INDEXER: u32 = 5;
 pub const DEFAULT_HUB_BASE_URL: &str = "https://hub.windmill.dev";
 pub const PRIVATE_HUB_MIN_VERSION: i32 = 10_000_000;
 pub const SERVICE_LOG_RETENTION_SECS: i64 = 60 * 60 * 24 * 14; // 2 weeks retention period for logs
+pub const WM_DEPLOYERS_GROUP: &str = "wm_deployers";
+
+/// Checks if the user is allowed to preserve on_behalf_of values (admin or deployer).
+pub fn can_preserve_on_behalf_of(authed: &impl db::Authable) -> bool {
+    authed.is_admin() || authed.groups().iter().any(|g| g == &WM_DEPLOYERS_GROUP)
+}
+
+/// Checks if on-behalf-of preservation actually happened (the target user differs from the acting user).
+/// Returns Some(target_identifier) if preservation occurred, None otherwise.
+pub fn check_on_behalf_of_preservation(
+    on_behalf_of_identifier: Option<&str>,
+    preserve: bool,
+    authed: &impl db::Authable,
+    authed_identifier: &str,
+) -> Option<String> {
+    if preserve && can_preserve_on_behalf_of(authed) {
+        if let Some(id) = on_behalf_of_identifier {
+            if id != authed_identifier {
+                return Some(id.to_string());
+            }
+        }
+    }
+    None
+}
+
+/// Determines the on_behalf_of_email value to use when creating/updating a flow or script.
+/// - If `on_behalf_of_email` is None, returns None
+/// - If `preserve` is true and the user is admin or in the deployers group, returns the original value
+/// - Otherwise, returns the authenticated user's email
+pub fn resolve_on_behalf_of_email<'a>(
+    on_behalf_of_email: Option<&'a str>,
+    preserve: bool,
+    authed: &'a impl db::Authable,
+) -> Option<&'a str> {
+    if on_behalf_of_email.is_some() {
+        if preserve && can_preserve_on_behalf_of(authed) {
+            on_behalf_of_email
+        } else {
+            Some(authed.email())
+        }
+    } else {
+        None
+    }
+}
 
 #[macro_export]
 macro_rules! add_time {

backend/windmill-common/src/runtime_assets.rs

@@ -52,7 +52,10 @@ fn extract_assets_from_raw_value(
         if prefix {
             let s = serde_json::from_str::<String>(value.get()).ok()?;
             let (kind, path) = parse_asset_syntax(&s, false)?;
-            assets.push(RuntimeAsset { path: path.to_string(), kind: crate::assets::asset_kind_from_parser(kind) });
+            assets.push(RuntimeAsset {
+                path: path.to_string(),
+                kind: crate::assets::asset_kind_from_parser(kind),
+            });
         }
     }
     None

backend/windmill-common/src/scripts.rs

@@ -49,9 +49,7 @@ pub fn extract_workspace_dependencies_annotated_refs(
             Some(&RE_PYTHON),
             runnable_path,
         ),
-        Go => {
-            WorkspaceDependenciesAnnotatedRefs::parse("//", "go_mod", code, None, runnable_path)
-        }
+        Go => WorkspaceDependenciesAnnotatedRefs::parse("//", "go_mod", code, None, runnable_path),
         Php => WorkspaceDependenciesAnnotatedRefs::parse(
             "//",
             "composer_json",
@@ -67,11 +65,8 @@ pub async fn prefetch_cached_script(
     script: Script<ScriptRunnableSettingsHandle>,
     db: &DB,
 ) -> crate::error::Result<Script<ScriptRunnableSettingsInline>> {
-    let rs = runnable_settings::from_handle(
-        script.runnable_settings.runnable_settings_handle,
-        db,
-    )
-    .await?;
+    let rs = runnable_settings::from_handle(script.runnable_settings.runnable_settings_handle, db)
+        .await?;
     let (debouncing_settings, concurrency_settings) =
         runnable_settings::prefetch_cached(&rs, db).await?;
 
@@ -379,11 +374,8 @@ pub async fn clone_script<'c>(
         )));
     };
 
-    let rs = runnable_settings::from_handle(
-        s.runnable_settings.runnable_settings_handle,
-        db,
-    )
-    .await?;
+    let rs =
+        runnable_settings::from_handle(s.runnable_settings.runnable_settings_handle, db).await?;
     let (debouncing_settings, concurrency_settings) =
         runnable_settings::prefetch_cached(&rs, db).await?;
 
@@ -424,6 +416,7 @@ pub async fn clone_script<'c>(
         codebase: s.codebase,
         has_preprocessor: s.has_preprocessor,
         on_behalf_of_email: s.on_behalf_of_email,
+        preserve_on_behalf_of: None,
         assets: s.assets,
     };
 

backend/windmill-common/src/workspace_dependencies.rs

@@ -384,8 +384,11 @@ impl WorkspaceDependenciesPrefetched {
 
         Box::pin(async {
             let r = if let Some(wdar) =
-                crate::scripts::extract_workspace_dependencies_annotated_refs(&language, code, runnable_path)
-            {
+                crate::scripts::extract_workspace_dependencies_annotated_refs(
+                    &language,
+                    code,
+                    runnable_path,
+                ) {
                 tracing::debug!(workspace_id, ?language, "found explicit annotations");
 
                 let expanded = wdar

backend/windmill-git-sync/src/lib.rs

@@ -27,15 +27,15 @@ pub enum DeployedObject {
     ResourceType { path: String },
     User { email: String },
     Group { name: String },
-    HttpTrigger { path: String },
-    WebsocketTrigger { path: String },
-    KafkaTrigger { path: String },
-    NatsTrigger { path: String },
-    PostgresTrigger { path: String },
-    MqttTrigger { path: String },
-    SqsTrigger { path: String },
-    GcpTrigger { path: String },
-    EmailTrigger { path: String },
+    HttpTrigger { path: String, parent_path: Option<String> },
+    WebsocketTrigger { path: String, parent_path: Option<String> },
+    KafkaTrigger { path: String, parent_path: Option<String> },
+    NatsTrigger { path: String, parent_path: Option<String> },
+    PostgresTrigger { path: String, parent_path: Option<String> },
+    MqttTrigger { path: String, parent_path: Option<String> },
+    SqsTrigger { path: String, parent_path: Option<String> },
+    GcpTrigger { path: String, parent_path: Option<String> },
+    EmailTrigger { path: String, parent_path: Option<String> },
     Settings { setting_type: String },
     Key { key_type: String },
 }
@@ -54,15 +54,15 @@ impl DeployedObject {
             DeployedObject::ResourceType { path, .. } => path.to_owned(),
             DeployedObject::User { email } => format!("users/{email}"),
             DeployedObject::Group { name } => format!("groups/{name}"),
-            DeployedObject::HttpTrigger { path } => path.to_owned(),
-            DeployedObject::WebsocketTrigger { path } => path.to_owned(),
-            DeployedObject::KafkaTrigger { path } => path.to_owned(),
-            DeployedObject::NatsTrigger { path } => path.to_owned(),
-            DeployedObject::PostgresTrigger { path } => path.to_owned(),
-            DeployedObject::MqttTrigger { path } => path.to_owned(),
-            DeployedObject::SqsTrigger { path } => path.to_owned(),
-            DeployedObject::GcpTrigger { path } => path.to_owned(),
-            DeployedObject::EmailTrigger { path } => path.to_owned(),
+            DeployedObject::HttpTrigger { path, .. } => path.to_owned(),
+            DeployedObject::WebsocketTrigger { path, .. } => path.to_owned(),
+            DeployedObject::KafkaTrigger { path, .. } => path.to_owned(),
+            DeployedObject::NatsTrigger { path, .. } => path.to_owned(),
+            DeployedObject::PostgresTrigger { path, .. } => path.to_owned(),
+            DeployedObject::MqttTrigger { path, .. } => path.to_owned(),
+            DeployedObject::SqsTrigger { path, .. } => path.to_owned(),
+            DeployedObject::GcpTrigger { path, .. } => path.to_owned(),
+            DeployedObject::EmailTrigger { path, .. } => path.to_owned(),
             DeployedObject::Settings { .. } => "settings.yaml".to_string(),
             DeployedObject::Key { .. } => "encryption_key.yaml".to_string(),
         }
@@ -92,15 +92,15 @@ impl DeployedObject {
             DeployedObject::ResourceType { .. } => None,
             DeployedObject::User { .. } => None,
             DeployedObject::Group { .. } => None,
-            DeployedObject::HttpTrigger { .. } => None,
-            DeployedObject::WebsocketTrigger { .. } => None,
-            DeployedObject::KafkaTrigger { .. } => None,
-            DeployedObject::NatsTrigger { .. } => None,
-            DeployedObject::PostgresTrigger { .. } => None,
-            DeployedObject::MqttTrigger { .. } => None,
-            DeployedObject::SqsTrigger { .. } => None,
-            DeployedObject::GcpTrigger { .. } => None,
-            DeployedObject::EmailTrigger { .. } => None,
+            DeployedObject::HttpTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::WebsocketTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::KafkaTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::NatsTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::PostgresTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::MqttTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::SqsTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::GcpTrigger { parent_path, .. } => parent_path.to_owned(),
+            DeployedObject::EmailTrigger { parent_path, .. } => parent_path.to_owned(),
             DeployedObject::Settings { .. } => None,
             DeployedObject::Key { .. } => None,
         }