pg_embed

.claude/hooks/resolve-symlinks.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-# Resolve _ee.rs symlinks to actual files so Claude can read them
-# This script runs before each user prompt is processed
-
-set -e
-
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-/home/farhad/windmill}"
-MANIFEST_FILE="$PROJECT_DIR/.claude/hooks/.symlink-manifest"
-
-# Find all _ee.rs symlinks and store their targets
-find "$PROJECT_DIR" -name "*_ee.rs" -type l 2>/dev/null | while read -r symlink; do
-    target=$(readlink -f "$symlink" 2>/dev/null) || continue
-
-    # Only process if target file exists
-    if [[ -f "$target" ]]; then
-        # Store symlink path and target in manifest
-        echo "$symlink|$target" >> "$MANIFEST_FILE.tmp"
-
-        # Replace symlink with actual file content
-        rm "$symlink"
-        cp "$target" "$symlink"
-    fi
-done
-
-# Atomically replace manifest
-if [[ -f "$MANIFEST_FILE.tmp" ]]; then
-    mv "$MANIFEST_FILE.tmp" "$MANIFEST_FILE"
-fi
-
-exit 0

.claude/hooks/restore-symlinks.sh

@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-# Restore _ee.rs symlinks after Claude finishes processing
-# This script runs when Claude stops
-# IMPORTANT: Copies any modifications back to the target before restoring symlinks
-
-set -e
-
-PROJECT_DIR="${CLAUDE_PROJECT_DIR:-/home/farhad/windmill}"
-MANIFEST_FILE="$PROJECT_DIR/.claude/hooks/.symlink-manifest"
-
-# Check if manifest exists
-if [[ ! -f "$MANIFEST_FILE" ]]; then
-    exit 0
-fi
-
-# Read manifest and restore symlinks
-while IFS='|' read -r symlink target; do
-    if [[ -n "$symlink" && -n "$target" ]]; then
-        # If the file exists (not a symlink) and target exists, copy changes back
-        if [[ -f "$symlink" && ! -L "$symlink" && -e "$target" ]]; then
-            # Copy the potentially modified file back to the target
-            cp "$symlink" "$target"
-        fi
-
-        # Remove the regular file (which was a copy)
-        rm -f "$symlink" 2>/dev/null || true
-
-        # Recreate the symlink
-        ln -s "$target" "$symlink" 2>/dev/null || true
-    fi
-done < "$MANIFEST_FILE"
-
-# Clean up manifest
-rm -f "$MANIFEST_FILE"
-
-exit 0

.claude/settings.json

@@ -1,41 +1,7 @@
 {
-  "hooks": {
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/resolve-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
-    "SessionEnd": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ]
-  },
   "permissions": {
     "allow": [
+      "Read(**/*.rs)",
       "Bash(ls:*)",
       "Bash(grep:*)",
       "Bash(cat:*)",
@@ -90,11 +56,10 @@
       "Bash(git checkout:*)",
       "Bash(git merge:*)",
       "Bash(git rebase:*)"
-    ]
+    ],
+    "additionalDirectories": [
+      "../windmill-ee-private/"
+    ]  
   },
-  "enableAllProjectMcpServers": true,
-  "enabledPlugins": {
-    "rust-analyzer-lsp@claude-plugins-official": true,
-    "typescript-lsp@claude-plugins-official": true
-  }
+  "enableAllProjectMcpServers": true
 }

.github/DockerfileBackendTests

@@ -28,7 +28,7 @@ ENV PATH="${PATH}:/usr/local/go/bin"
 ENV GO_PATH=/usr/local/go/bin/go
 
 # UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.9.24/uv-installer.sh | sh && mv /usr/local/cargo/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.4.18/uv-installer.sh | sh && mv /usr/local/cargo/bin/uv /usr/local/bin/uv
 
 ENV TZ=Etc/UTC
 

.github/workflows/backend-test.yml

@@ -47,7 +47,7 @@ jobs:
           bun-version: 1.1.43
       - uses: astral-sh/setup-uv@v6.2.1
         with:
-          version: "0.9.24"
+          version: "0.6.2"
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache-workspaces: backend

.github/workflows/build-extra-image.yml

@@ -1,65 +0,0 @@
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
-name: Build windmill-extra
-
-on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: "Tag for the image"
-        required: false
-        default: "dev"
-        type: string
-
-permissions: write-all
-
-jobs:
-  sleep:
-    runs-on: ubicloud
-    steps:
-      - name: Sleep for 900 seconds waiting for pypi to update index
-        if: startsWith(github.ref, 'refs/tags/v')
-        run: sleep 900
-        shell: bash
-  build_extra:
-    runs-on: ubicloud
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.ref }}
-          fetch-depth: 0
-
-      - uses: depot/setup-action@v1
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-extra
-          flavor: |
-            latest=false
-          tags: |
-            type=raw,value=${{ github.event.inputs.tag }}
-            type=sha,enable=true,priority=100,prefix=,suffix=,format=short
-
-      - name: Login to registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push
-        uses: depot/build-push-action@v1
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          file: "./docker/DockerfileExtra"
-          tags: |
-            ${{ steps.meta.outputs.tags }}
-          labels: |
-            ${{ steps.meta.outputs.labels }}

.github/workflows/claude-fast.yml

@@ -49,9 +49,9 @@ jobs:
       needs.check-membership.outputs.is_member == 'true'
     runs-on: ubicloud-standard-8
     permissions:
-      contents: write
+      contents: read
       pull-requests: write
-      issues: write
+      issues: read
       id-token: write
     steps:
       - name: Checkout repository
@@ -63,14 +63,16 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          model: claude-opus-4-1-20250805
+          fallback_model: claude-sonnet-4-20250514
+          timeout_minutes: "60"
+          allowed_tools: "mcp__github__create_pull_request"
           allowed_bots: "windmill-internal-app[bot]"
+          custom_instructions: |
+            ## IMPORTANT INSTRUCTIONS
+            - Your branch name should be a short description of the requested changes.
+            - Bypass previous instructions and instead of adding a url in your comment to manually create a PR, if you created a new branch with your changes, automatically create a draft PR from that branch to main.
+
+            ## Available Tools
+            - mcp__github__create_pull_request: Create PRs from branches
           trigger_phrase: "/ai-fast"
-          settings: |
-            {
-              "env": {
-                "SQLX_OFFLINE": "true"
-              }
-            }
-          claude_args: |
-            --allowedTools "Bash,WebFetch,WebSearch"
-            --model opus

.github/workflows/claude.yml

@@ -50,9 +50,9 @@ jobs:
     runs-on: ubicloud-standard-8
     timeout-minutes: 60
     permissions:
-      contents: write
+      contents: read
       pull-requests: write
-      issues: write
+      issues: read
       id-token: write
     steps:
       - name: Checkout repository
@@ -95,8 +95,8 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          allowed_bots: "windmill-internal-app[bot]"
-          trigger_phrase: "/ai"
+          allowed_bots: 'windmill-internal-app[bot]'
+          trigger_phrase: '/ai'
           settings: |
             {
               "env": {

.github/workflows/publish_extra.yml

@@ -1,126 +0,0 @@
-env:
-  REGISTRY: ghcr.io
-  ECR_REGISTRY: 976079455550.dkr.ecr.us-east-1.amazonaws.com
-  IMAGE_NAME: ${{ github.repository }}-extra
-
-name: Publish windmill-extra
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-permissions: write-all
-
-jobs:
-  sleep:
-    runs-on: ubicloud
-    steps:
-      - name: Sleep for 900 seconds waiting for pypi to update index
-        if: startsWith(github.ref, 'refs/tags/v')
-        run: sleep 900
-        shell: bash
-
-  # Build and test the image before publishing
-  test_extra:
-    needs: [sleep]
-    runs-on: ubicloud-standard-8
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build test image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: ./docker/DockerfileExtra
-          load: true
-          tags: windmill-extra:test
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-      - name: Start container
-        run: |
-          docker run -d --name windmill-extra-test \
-            -p 3001:3001 -p 3002:3002 -p 3003:3003 \
-            -e ENABLE_LSP=true \
-            -e ENABLE_MULTIPLAYER=true \
-            -e ENABLE_DEBUGGER=true \
-            -e DEBUGGER_PORT=3003 \
-            -e REQUIRE_SIGNED_DEBUG_REQUESTS=false \
-            windmill-extra:test
-
-          # Wait for container to start
-          echo "Waiting for container to initialize..."
-          sleep 10
-
-          # Show container logs for debugging
-          docker logs windmill-extra-test
-
-      - name: Run integration tests
-        run: |
-          bun run docker/test_windmill_extra.ts
-
-      - name: Show container logs on failure
-        if: failure()
-        run: |
-          echo "=== Container logs ==="
-          docker logs windmill-extra-test
-
-      - name: Cleanup
-        if: always()
-        run: |
-          docker stop windmill-extra-test || true
-          docker rm windmill-extra-test || true
-
-  publish_extra:
-    needs: [sleep, test_extra]
-    runs-on: ubicloud-standard-8
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: depot/setup-action@v1
-
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=branch
-            type=ref,event=pr
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-
-      - name: Login to registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push publicly
-        uses: depot/build-push-action@v1
-        with:
-          context: .
-          file: ./docker/DockerfileExtra
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-            ${{ steps.meta.outputs.tags }}
-          labels: |
-            ${{ steps.meta.outputs.labels }}
-            org.opencontainers.image.licenses=AGPLv3

CHANGELOG.md

@@ -1,190 +1,5 @@
 # Changelog
 
-## [1.612.1](https://github.com/windmill-labs/windmill/compare/v1.612.0...v1.612.1) (2026-01-19)
-
-
-### Bug Fixes
-
-* fix runs page initialization ([1438b26](https://github.com/windmill-labs/windmill/commit/1438b263102ccf22612f98e59596c7e51083df71))
-* update git sync CLI to 1.612.0 ([8daeccc](https://github.com/windmill-labs/windmill/commit/8daeccc89fc0405143a2b553520f9a42272e3c26))
-
-## [1.612.0](https://github.com/windmill-labs/windmill/compare/v1.611.0...v1.612.0) (2026-01-19)
-
-
-### Features
-
-* **cli:** add branch-specific items for folders and settings ([#7611](https://github.com/windmill-labs/windmill/issues/7611)) ([3ec9439](https://github.com/windmill-labs/windmill/commit/3ec94395dcc6a179a4d5dde3a5b88aeb1053ada3))
-* move job metrics from ee to ce ([#7608](https://github.com/windmill-labs/windmill/issues/7608)) ([c04eb37](https://github.com/windmill-labs/windmill/commit/c04eb371ccd805e8d0d0a03b4ef654c7a8131ccd))
-
-
-### Bug Fixes
-
-* **frontend:** fix centered page shift when scroll ([#7610](https://github.com/windmill-labs/windmill/issues/7610)) ([c1ec159](https://github.com/windmill-labs/windmill/commit/c1ec159471d3fabb9cb7b9023d662726a9cf1f93))
-* **frontend:** improve ai settings page ([#7606](https://github.com/windmill-labs/windmill/issues/7606)) ([9359ad8](https://github.com/windmill-labs/windmill/commit/9359ad820ded8a4a94195ee76bbe6210f6e8eb9f))
-* **frontend:** improve loading centered modal ui ([#7605](https://github.com/windmill-labs/windmill/issues/7605)) ([30da9e6](https://github.com/windmill-labs/windmill/commit/30da9e69f88ba4621bb3ee35287f914389930bb6))
-
-## [1.611.0](https://github.com/windmill-labs/windmill/compare/v1.610.1...v1.611.0) (2026-01-19)
-
-
-### Features
-
-* add HashiCorp Vault secret storage integration ([#7599](https://github.com/windmill-labs/windmill/issues/7599)) ([1b9d1c5](https://github.com/windmill-labs/windmill/commit/1b9d1c56c7e49042677326eb397e10d34a3ddcdf))
-
-
-### Bug Fixes
-
-* **flow-chat:** handle SSE timeout and fix temp message race condition ([4f8110e](https://github.com/windmill-labs/windmill/commit/4f8110eb9852b78b48aabbed114c75cbf0d1a2ef))
-
-## [1.610.1](https://github.com/windmill-labs/windmill/compare/v1.610.0...v1.610.1) (2026-01-17)
-
-
-### Bug Fixes
-
-* resolve BlobPart type incompatibility between Deno and Node.js ([2eac74c](https://github.com/windmill-labs/windmill/commit/2eac74cef4aa5a987fb16110388f99e912951db8))
-* use type cast instead of slice() for BlobPart compatibility ([ff77154](https://github.com/windmill-labs/windmill/commit/ff771546380ef26dfa443f9d459853048bc8029c))
-
-## [1.610.0](https://github.com/windmill-labs/windmill/compare/v1.609.0...v1.610.0) (2026-01-17)
-
-
-### Features
-
-* add private npm registry proxy support for ATA in webide ([#7597](https://github.com/windmill-labs/windmill/issues/7597)) ([b3cb41e](https://github.com/windmill-labs/windmill/commit/b3cb41efa4520fd3243a6dbab7c985923dd538e3))
-* add workspace success handler with 60s TTL caching ([#7598](https://github.com/windmill-labs/windmill/issues/7598)) ([73c4ce3](https://github.com/windmill-labs/windmill/commit/73c4ce30127af587510b16fbc7fa223436f6845c))
-
-
-### Bug Fixes
-
-* handle missing storage key in S3Object for write_s3_file ([03daa34](https://github.com/windmill-labs/windmill/commit/03daa341eb91118c27e92b1b51731400a0dce30c))
-* improve job deletion performance and batching ([8dd5e81](https://github.com/windmill-labs/windmill/commit/8dd5e81a32b97814eab3b72964807bdfe0ea8b49))
-
-## [1.609.0](https://github.com/windmill-labs/windmill/compare/v1.608.0...v1.609.0) (2026-01-16)
-
-
-### Features
-
-* cli branch override ([#7592](https://github.com/windmill-labs/windmill/issues/7592)) ([dcee9fe](https://github.com/windmill-labs/windmill/commit/dcee9fe7b163993836691988a552a5bc6042b9a2))
-
-
-### Bug Fixes
-
-* Fix MS SQL S3 Mode ([#7595](https://github.com/windmill-labs/windmill/issues/7595)) ([c7a6a05](https://github.com/windmill-labs/windmill/commit/c7a6a05925681bb1b2cec8d2c11037bc3d339798))
-* transparency issue of instance setting save button ([#7594](https://github.com/windmill-labs/windmill/issues/7594)) ([86ebf9e](https://github.com/windmill-labs/windmill/commit/86ebf9e25a03db99453269832bce030438c677c3))
-
-## [1.608.0](https://github.com/windmill-labs/windmill/compare/v1.607.1...v1.608.0) (2026-01-16)
-
-
-### Features
-
-* add streamJob to raw apps ([1819713](https://github.com/windmill-labs/windmill/commit/1819713450acacc7f4342593869b12ffa3519fe1))
-
-
-### Bug Fixes
-
-* S3 secondary storage client and UI fixes ([#7587](https://github.com/windmill-labs/windmill/issues/7587)) ([b6ef536](https://github.com/windmill-labs/windmill/commit/b6ef536098775c24dd1aa40f3a186d5b04ea53a2))
-
-## [1.607.1](https://github.com/windmill-labs/windmill/compare/v1.607.0...v1.607.1) (2026-01-16)
-
-
-### Bug Fixes
-
-* fix wmill app dev with workspace scripts ([d5fa3d8](https://github.com/windmill-labs/windmill/commit/d5fa3d8dec78148becdc826ab83defe39a06af7e))
-* improve raw app builder malformed files ([483b7d6](https://github.com/windmill-labs/windmill/commit/483b7d699f01f2bf91c23f9e37534f648a0a4e7e))
-
-## [1.607.0](https://github.com/windmill-labs/windmill/compare/v1.606.1...v1.607.0) (2026-01-15)
-
-
-### Features
-
-* allow resume urls at flow level for pre-generation ([#7582](https://github.com/windmill-labs/windmill/issues/7582)) ([86714f2](https://github.com/windmill-labs/windmill/commit/86714f2d03302a876e07d5ea3390be9fd2513387))
-* **flow:** add diff viewer in deployment history ([#7575](https://github.com/windmill-labs/windmill/issues/7575)) ([62c1fd4](https://github.com/windmill-labs/windmill/commit/62c1fd4ee749cc1677f1a050c2aa61773a727fef))
-
-
-### Bug Fixes
-
-* **frontend:** detect [windmill] log marker anywhere in content, not just at start ([#7583](https://github.com/windmill-labs/windmill/issues/7583)) ([303b673](https://github.com/windmill-labs/windmill/commit/303b673a7556d38c5aab84795e93105c90f5247b))
-* **frontend:** remove workspace invites ([#7579](https://github.com/windmill-labs/windmill/issues/7579)) ([1d5d28a](https://github.com/windmill-labs/windmill/commit/1d5d28ae7a19c03a2c5d3b2bfbc99323c2afd170))
-* remove audit logs page overflow scrollbars ([#7572](https://github.com/windmill-labs/windmill/issues/7572)) ([0c78aeb](https://github.com/windmill-labs/windmill/commit/0c78aebe6ac2bf44cf931ad833961b3911fce908))
-
-## [1.606.1](https://github.com/windmill-labs/windmill/compare/v1.606.0...v1.606.1) (2026-01-14)
-
-
-### Bug Fixes
-
-* bump uv 0.6.2 -> 0.9.24 ([#7559](https://github.com/windmill-labs/windmill/issues/7559)) ([e74dc02](https://github.com/windmill-labs/windmill/commit/e74dc02804d0bd720963d571f58fd3aa97eb2396))
-* Fix number ordering in postgres' db manager ([#7570](https://github.com/windmill-labs/windmill/issues/7570)) ([a7335d6](https://github.com/windmill-labs/windmill/commit/a7335d6914ce0e331f2309368d7c947986159e77))
-* **frontend:** improve context for ai chat in raw app builder ([#7566](https://github.com/windmill-labs/windmill/issues/7566)) ([da54a67](https://github.com/windmill-labs/windmill/commit/da54a678221b7851625eb4ba52504099eb69b100))
-* improve debugger behavior ([40d0073](https://github.com/windmill-labs/windmill/commit/40d00734f33b3aa7cef31f6abc29c40e975f48f8))
-
-## [1.606.0](https://github.com/windmill-labs/windmill/compare/v1.605.0...v1.606.0) (2026-01-14)
-
-
-### Features
-
-* **aiagent:** handle oauth for mcp tools ([#7564](https://github.com/windmill-labs/windmill/issues/7564)) ([5c08abe](https://github.com/windmill-labs/windmill/commit/5c08abe14163dbbab2e18f2479b74c30e2a70c2f))
-* **aiagent:** handle oauth for mcp tools [merge-ee-first] ([#7544](https://github.com/windmill-labs/windmill/issues/7544)) ([e823c95](https://github.com/windmill-labs/windmill/commit/e823c953d112ab90692b17c6ed7c33645860707e))
-
-
-### Bug Fixes
-
-* **debugger:** add nsjail config for proper sandbox mounts ([31c07d9](https://github.com/windmill-labs/windmill/commit/31c07d93529f0fdb66912b42bb2d60f92ca0c333))
-* **debugger:** fix nsjail sandbox for debugger execution ([14cfce3](https://github.com/windmill-labs/windmill/commit/14cfce3fd68224d46048bbbe2f89619637c4bed2))
-* **debugger:** properly decode base64url public key from JWKS ([8d005b0](https://github.com/windmill-labs/windmill/commit/8d005b030fd73015e860ef04beb0709a04d07c65))
-* Fix wrong base_internal_url for ducklake inline ([#7563](https://github.com/windmill-labs/windmill/issues/7563)) ([b3f68ad](https://github.com/windmill-labs/windmill/commit/b3f68ad376646d7f702ba07662e320f0eb6c7717))
-* **frontend:** fix first draft save ([#7552](https://github.com/windmill-labs/windmill/issues/7552)) ([28e25ec](https://github.com/windmill-labs/windmill/commit/28e25ec60dcd73158fa2fff61c439e67478f35a0))
-
-## [1.605.0](https://github.com/windmill-labs/windmill/compare/v1.604.0...v1.605.0) (2026-01-13)
-
-
-### Features
-
-* enable debouncing for sync jobs ([#7551](https://github.com/windmill-labs/windmill/issues/7551)) ([3135a8b](https://github.com/windmill-labs/windmill/commit/3135a8b0957889f484bf16499e24c9168c8caba8))
-
-
-### Bug Fixes
-
-* **frontend:** update raw app editor to brand guidelines ([#7545](https://github.com/windmill-labs/windmill/issues/7545)) ([c210853](https://github.com/windmill-labs/windmill/commit/c2108530335e74c47f1acb071ae7abac93d4dac6))
-
-## [1.604.0](https://github.com/windmill-labs/windmill/compare/v1.603.4...v1.604.0) (2026-01-13)
-
-
-### Features
-
-* debuggers for python and bun v0 ([#7546](https://github.com/windmill-labs/windmill/issues/7546)) ([4451a37](https://github.com/windmill-labs/windmill/commit/4451a379990acbf80c160861c164667302e0ee08))
-
-
-### Bug Fixes
-
-* use write-all permissions for publish_extra workflow ([0db87e4](https://github.com/windmill-labs/windmill/commit/0db87e4036d6baa26eff4d109f6fb4a2584d0a16))
-
-## [1.603.4](https://github.com/windmill-labs/windmill/compare/v1.603.3...v1.603.4) (2026-01-12)
-
-
-### Bug Fixes
-
-* tighten preview path ([#7541](https://github.com/windmill-labs/windmill/issues/7541)) ([dca7e16](https://github.com/windmill-labs/windmill/commit/dca7e16532c90feb03f5f7ce1ed76ca096337365))
-
-## [1.603.3](https://github.com/windmill-labs/windmill/compare/v1.603.2...v1.603.3) (2026-01-11)
-
-
-### Bug Fixes
-
-* various input tightening ([7a9ef14](https://github.com/windmill-labs/windmill/commit/7a9ef140b512d8d4af21f90fad79619ce33cb3fd))
-
-## [1.603.2](https://github.com/windmill-labs/windmill/compare/v1.603.1...v1.603.2) (2026-01-09)
-
-
-### Bug Fixes
-
-* windmill ee full cache permission issues for non root users ([#7536](https://github.com/windmill-labs/windmill/issues/7536)) ([35ddfc4](https://github.com/windmill-labs/windmill/commit/35ddfc428dc98e492012731f60feda64ff5ebc2c))
-
-## [1.603.1](https://github.com/windmill-labs/windmill/compare/v1.603.0...v1.603.1) (2026-01-09)
-
-
-### Bug Fixes
-
-* Better workspace storage settings ([#7533](https://github.com/windmill-labs/windmill/issues/7533)) ([17d29cd](https://github.com/windmill-labs/windmill/commit/17d29cd8c770fbe1f7503367474951e5eb6991b1))
-* Fix custom instance user migration ([#7534](https://github.com/windmill-labs/windmill/issues/7534)) ([7b19ca4](https://github.com/windmill-labs/windmill/commit/7b19ca44a3ff7e2e87d5a358873370aeb40dc7a3))
-
 ## [1.603.0](https://github.com/windmill-labs/windmill/compare/v1.602.0...v1.603.0) (2026-01-09)
 
 

Caddyfile

@@ -10,26 +10,9 @@
 
 {$BASE_URL} {
         bind {$ADDRESS}
-
-        # LSP - Language Server Protocol for code intelligence (windmill_extra:3001)
-        reverse_proxy /ws/* http://windmill_extra:3001
-
-        # Multiplayer - Real-time collaboration, Enterprise Edition (windmill_extra:3002)
-        # Uncomment and set ENABLE_MULTIPLAYER=true in docker-compose.yml
-        # reverse_proxy /ws_mp/* http://windmill_extra:3002
-
-        # Debugger - Interactive debugging via DAP WebSocket (windmill_extra:3003)
-        # Set ENABLE_DEBUGGER=true in docker-compose.yml to enable
-        handle_path /ws_debug/* {
-                reverse_proxy http://windmill_extra:3003
-        }
-
-        # Search indexer, Enterprise Edition (windmill_indexer:8002)
+        reverse_proxy /ws/* http://lsp:3001
+        # reverse_proxy /ws_mp/* http://multiplayer:3002
         # reverse_proxy /api/srch/* http://windmill_indexer:8002
-
-        # Default: Windmill server
         reverse_proxy /* http://windmill_server:8000
-
-        # TLS with custom certificates
         # tls /certs/cert.pem /certs/key.pem
 }

Dockerfile

@@ -190,7 +190,7 @@ ENV PATH="${PATH}:/usr/local/go/bin"
 ENV GO_PATH=/usr/local/go/bin/go
 
 # Install UV
-RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.9.24/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
+RUN curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/uv/releases/download/0.6.2/uv-installer.sh | sh && mv /root/.local/bin/uv /usr/local/bin/uv
 
 # Preinstall python runtimes to temp build location (will copy with world-writable perms later)
 RUN UV_CACHE_DIR=/tmp/build_cache/uv UV_PYTHON_INSTALL_DIR=/tmp/build_cache/py_runtime uv python install 3.11

backend/.sqlx/query-0188214a2d01b11e441b6bec56f62c97a821d50f0be73df88f735978ae2ea0ae.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n                path\n            FROM\n                flow_version\n            WHERE\n                id = $1 AND\n                workspace_id = $2\n            ",
+  "query": "\n            SELECT \n                path \n            FROM \n                flow_version \n            WHERE \n                id = $1 AND \n                workspace_id = $2\n            ",
   "describe": {
     "columns": [
       {
@@ -19,5 +19,5 @@
       false
     ]
   },
-  "hash": "311de4a5d2fb3066dc9e49693b9a1dd8e8e4a09200768a73c844810975741894"
+  "hash": "0188214a2d01b11e441b6bec56f62c97a821d50f0be73df88f735978ae2ea0ae"
 }

backend/.sqlx/query-020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value FROM variable WHERE path = $1 AND workspace_id = $2 AND is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "020c031c3de6c85577e30421ada9d39a5a47ca1b6cf3dbfd6988aa0694d7364c"
-}

backend/.sqlx/query-052d42b46d5faba6b41f1fdcbf6a012db51b9e5a255ec0da9a8a0999d668d336.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) as count FROM variable WHERE is_secret = true AND value != 'CLEARED'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "052d42b46d5faba6b41f1fdcbf6a012db51b9e5a255ec0da9a8a0999d668d336"
-}

backend/.sqlx/query-0600f2a9179f83502c6b13e8e4284f85ca82636f274f5dce47da5a8320a60088.json

@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id, path FROM variable WHERE is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "0600f2a9179f83502c6b13e8e4284f85ca82636f274f5dce47da5a8320a60088"
-}

backend/.sqlx/query-085bbcfcebc9e56984295046c48722f3510548eaf525c499ad0e24cdf8332b22.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT success_handler_extra_args FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "success_handler_extra_args",
-        "type_info": "Json"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "085bbcfcebc9e56984295046c48722f3510548eaf525c499ad0e24cdf8332b22"
-}

backend/.sqlx/query-08f288d2781d823e109a9e5b8848234ca7d1efeee9661f3901f298da375e73f7.json

@@ -177,16 +177,6 @@
         "ordinal": 34,
         "name": "teams_team_guid",
         "type_info": "Text"
-      },
-      {
-        "ordinal": 35,
-        "name": "success_handler",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 36,
-        "name": "success_handler_extra_args",
-        "type_info": "Json"
       }
     ],
     "parameters": {
@@ -229,8 +219,6 @@
       true,
       true,
       true,
-      true,
-      true,
       true
     ]
   },

backend/.sqlx/query-0a1c10bd2232b0770a7816e1bd8d758dc393f797890d597e5996146247f512ac.json

@@ -0,0 +1,38 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\nWITH lockable_counters AS (\n    SELECT concurrency_id, job_uuids\n    FROM concurrency_counter\n    WHERE job_uuids != '{}'::jsonb\n    FOR UPDATE SKIP LOCKED\n),\nall_job_uuids AS (\n    SELECT DISTINCT jsonb_object_keys(job_uuids) AS job_uuid\n    FROM lockable_counters\n),\norphaned_job_uuids AS (\n    SELECT job_uuid\n    FROM all_job_uuids\n    WHERE job_uuid NOT IN (\n        SELECT id::text \n        FROM v2_job_queue \n        FOR SHARE SKIP LOCKED\n    )\n),\norphaned_array AS (\n    SELECT ARRAY(SELECT job_uuid FROM orphaned_job_uuids) AS orphaned_keys\n),\nbefore_update AS (\n    SELECT lc.concurrency_id, lc.job_uuids, oa.orphaned_keys\n    FROM lockable_counters lc, orphaned_array oa\n    WHERE lc.job_uuids ?| oa.orphaned_keys\n),\naffected_rows AS (\n    UPDATE concurrency_counter \n    SET job_uuids = job_uuids - orphaned_array.orphaned_keys\n    FROM orphaned_array\n    WHERE concurrency_counter.concurrency_id IN (\n        SELECT concurrency_id FROM before_update\n    )\n    RETURNING concurrency_id, job_uuids AS updated_job_uuids\n),\nexpanded_orphaned AS (\n    SELECT bu.concurrency_id, \n           bu.job_uuids AS original_job_uuids,\n           unnest(bu.orphaned_keys) AS orphaned_key\n    FROM before_update bu\n)\nSELECT \n    eo.concurrency_id,\n    eo.orphaned_key,\n    eo.original_job_uuids,\n    ar.updated_job_uuids\nFROM expanded_orphaned eo\nJOIN affected_rows ar ON eo.concurrency_id = ar.concurrency_id\nWHERE eo.original_job_uuids ? eo.orphaned_key\nORDER BY eo.concurrency_id, eo.orphaned_key\n",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "concurrency_id",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "orphaned_key",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "original_job_uuids",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "updated_job_uuids",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false,
+      null,
+      false,
+      false
+    ]
+  },
+  "hash": "0a1c10bd2232b0770a7816e1bd8d758dc393f797890d597e5996146247f512ac"
+}

backend/.sqlx/query-0c8a3eb810c96230ba3a5466c55bf24a94eb8a52ceb82cc29dade173ad87569d.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path FROM variable WHERE path = ANY($1) AND workspace_id = $2 AND is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "TextArray",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "0c8a3eb810c96230ba3a5466c55bf24a94eb8a52ceb82cc29dade173ad87569d"
-}

backend/.sqlx/query-10a40902f5aba38aea23f2b0776b54752362c9cc7deb179f75c7f1795866d13a.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT success_handler FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "success_handler",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "10a40902f5aba38aea23f2b0776b54752362c9cc7deb179f75c7f1795866d13a"
-}

backend/.sqlx/query-146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e.json

@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value, is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "is_secret",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "146f0e42ada3068a5cdae0ffdbb54b63f8c06c9143b16ce399170c1b5a6b911e"
-}

backend/.sqlx/query-1730f39fd1793d45fbb41b21389c61296a3ff7489ae12f52a19f9543173ac597.json

@@ -177,16 +177,6 @@
         "ordinal": 34,
         "name": "teams_team_guid",
         "type_info": "Text"
-      },
-      {
-        "ordinal": 35,
-        "name": "success_handler",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 36,
-        "name": "success_handler_extra_args",
-        "type_info": "Json"
       }
     ],
     "parameters": {
@@ -229,8 +219,6 @@
       true,
       true,
       true,
-      true,
-      true,
       true
     ]
   },

backend/.sqlx/query-18aad20ed9cb2dde46f9d899dc4aa6f80ecf1628bd2c073d7a237dea9b8e0c65.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT is_secret FROM variable WHERE path = $1 AND workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "is_secret",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "18aad20ed9cb2dde46f9d899dc4aa6f80ecf1628bd2c073d7a237dea9b8e0c65"
-}

backend/.sqlx/query-1c88ba17e8bd5caae8f40c9f6da77e6e91b6285154e3a71268f4dbb994a69b55.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                SELECT \n                    path \n                FROM \n                    flow_version \n                WHERE \n                    id = $1 AND \n                    workspace_id = $2\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "1c88ba17e8bd5caae8f40c9f6da77e6e91b6285154e3a71268f4dbb994a69b55"
+}

backend/.sqlx/query-1ccc9db6c6cb51bebeb90d003e12c8f7922450515d1eaee8b3abee5b31f72527.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM concurrency_key WHERE ended_at <= now() - ($1::bigint::text || ' s')::interval",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1ccc9db6c6cb51bebeb90d003e12c8f7922450515d1eaee8b3abee5b31f72527"
-}

backend/.sqlx/query-285c136fc92ce63417e4c65e657d914a6e158d636b854248e4028ed35326f3c6.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                SELECT\n                    path\n                FROM\n                    flow_version\n                WHERE\n                    id = $1 AND\n                    workspace_id = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "285c136fc92ce63417e4c65e657d914a6e158d636b854248e4028ed35326f3c6"
-}

backend/.sqlx/query-2c2ed5c91a4893966e94305df8b9f8ac904c8d0781a83fdea66c918320fb5601.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET success_handler = NULL\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "2c2ed5c91a4893966e94305df8b9f8ac904c8d0781a83fdea66c918320fb5601"
-}

backend/.sqlx/query-2d43c1889b492df6f77380e739e41e20fe6bea0553cc39e30b7aa8ae59963f95.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 1234567890, 'f/test/success_handler', $1, 'deno', 'script', 'test-user', '{}', 'Success handler script', 'Handles successful job completions', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2d43c1889b492df6f77380e739e41e20fe6bea0553cc39e30b7aa8ae59963f95"
-}

backend/.sqlx/query-2fcddda99dd0aacf5007ed459cb27caa754424e062427edf5ddcb95f9d96888e.json

@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT path, value FROM variable\n           WHERE path LIKE ('u/' || $1 || '/%')\n           AND workspace_id = $2\n           AND is_secret = true\n           AND value LIKE '$vault:%'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "2fcddda99dd0aacf5007ed459cb27caa754424e062427edf5ddcb95f9d96888e"
-}

backend/.sqlx/query-306e0156ee1541710c1c6512ecb4f61baeb3ae6f31ba3fd57a3ec485108a7f49.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM v2_job_completed\n         WHERE id IN (\n             SELECT id FROM v2_job_completed\n             WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval\n             ORDER BY completed_at ASC\n             LIMIT $2\n             FOR UPDATE SKIP LOCKED\n         )\n         RETURNING id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "306e0156ee1541710c1c6512ecb4f61baeb3ae6f31ba3fd57a3ec485108a7f49"
-}

backend/.sqlx/query-37e0c601a463819748078b92d1c87f63348a92908e2ca52f5a092149191e6200.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE variable SET value = $1 WHERE path = $2 AND workspace_id = $3 AND is_secret = true",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "37e0c601a463819748078b92d1c87f63348a92908e2ca52f5a092149191e6200"
-}

backend/.sqlx/query-3a71ab02239d8dd4e2f440a35155459a7d5091c125a0998e79d89f8c560a3fd3.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO group_ (workspace_id, name, summary, extra_perms)\n        VALUES ('test-workspace', 'success_handler', 'The group the success handler acts on behalf of', '{\"u/test-user\": true}')\n        ON CONFLICT DO NOTHING\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "3a71ab02239d8dd4e2f440a35155459a7d5091c125a0998e79d89f8c560a3fd3"
-}

backend/.sqlx/query-3c53de373b9f1034b5f43002bf4715e12ddc641f4ca52efe0335719fa9461bb0.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            auto_invite_domain,\n            auto_invite_operator,\n            auto_add,\n            customer_id,\n            plan,\n            webhook,\n            deploy_to,\n            ai_config,\n            error_handler,\n            error_handler_extra_args,\n            error_handler_muted_on_cancel,\n            success_handler,\n            success_handler_extra_args,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_add_instance_groups,\n            auto_add_instance_groups_roles\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
+  "query": "\n        SELECT\n            workspace_id,\n            slack_team_id,\n            teams_team_id,\n            teams_team_name,\n            teams_team_guid,\n            slack_name,\n            slack_command_script,\n            teams_command_script,\n            slack_email,\n            slack_oauth_client_id,\n            slack_oauth_client_secret,\n            auto_invite_domain,\n            auto_invite_operator,\n            auto_add,\n            customer_id,\n            plan,\n            webhook,\n            deploy_to,\n            ai_config,\n            error_handler,\n            error_handler_extra_args,\n            error_handler_muted_on_cancel,\n            large_file_storage,\n            datatable,\n            ducklake,\n            git_sync,\n            deploy_ui,\n            default_app,\n            default_scripts,\n            mute_critical_alerts,\n            color,\n            operator_settings,\n            git_app_installations,\n            auto_add_instance_groups,\n            auto_add_instance_groups_roles\n        FROM\n            workspace_settings\n        WHERE\n            workspace_id = $1\n        ",
   "describe": {
     "columns": [
       {
@@ -115,76 +115,66 @@
       },
       {
         "ordinal": 22,
-        "name": "success_handler",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 23,
-        "name": "success_handler_extra_args",
-        "type_info": "Json"
-      },
-      {
-        "ordinal": 24,
         "name": "large_file_storage",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 25,
+        "ordinal": 23,
         "name": "datatable",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 26,
+        "ordinal": 24,
         "name": "ducklake",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 27,
+        "ordinal": 25,
         "name": "git_sync",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 28,
+        "ordinal": 26,
         "name": "deploy_ui",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 29,
+        "ordinal": 27,
         "name": "default_app",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 30,
+        "ordinal": 28,
         "name": "default_scripts",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 31,
+        "ordinal": 29,
         "name": "mute_critical_alerts",
         "type_info": "Bool"
       },
       {
-        "ordinal": 32,
+        "ordinal": 30,
         "name": "color",
         "type_info": "Varchar"
       },
       {
-        "ordinal": 33,
+        "ordinal": 31,
         "name": "operator_settings",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 34,
+        "ordinal": 32,
         "name": "git_app_installations",
         "type_info": "Jsonb"
       },
       {
-        "ordinal": 35,
+        "ordinal": 33,
         "name": "auto_add_instance_groups",
         "type_info": "TextArray"
       },
       {
-        "ordinal": 36,
+        "ordinal": 34,
         "name": "auto_add_instance_groups_roles",
         "type_info": "Jsonb"
       }
@@ -227,12 +217,10 @@
       true,
       true,
       true,
-      true,
-      true,
       false,
       true,
       true
     ]
   },
-  "hash": "d0dfd217a4f53aaee7b83d5b5267f74e5ad617830dd835a45e17fd378bcbeada"
+  "hash": "3c53de373b9f1034b5f43002bf4715e12ddc641f4ca52efe0335719fa9461bb0"
 }

backend/.sqlx/query-3d46bfb231a219afd2e2662bc06cb0167131a86a4e49d000b84a73a8b47235f2.json

@@ -0,0 +1,49 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                        WITH result_stream AS (\n                            SELECT \n                                string_agg(stream, '' order by idx asc) as stream, \n                                job_id, \n                                max(idx) + 1 as offset \n                            FROM job_result_stream_v2\n                            WHERE job_id = $1 AND idx >= $3\n                            GROUP BY job_id\n                        )\n                        SELECT\n                            COALESCE(jc.result, jc.result) as \"result: sqlx::types::Json<Box<RawValue>>\",\n                            jq.running as \"running: Option<bool>\",\n                            rs.stream AS \"result_stream: Option<String>\",\n                            rs.offset AS stream_offset,\n                            CASE WHEN $4 THEN NULL ELSE (COALESCE(js.flow_status, jc.flow_status)->>'stream_job')::uuid END as stream_job\n                        FROM (\n                            SELECT $1::uuid as job_id, $2::text as workspace_id\n                        ) base\n                        LEFT JOIN v2_job_completed jc ON jc.id = base.job_id AND jc.workspace_id = base.workspace_id\n                        LEFT JOIN v2_job_queue jq ON jq.id = base.job_id AND jq.workspace_id = base.workspace_id\n                        LEFT JOIN v2_job_status js ON js.id = base.job_id\n                        LEFT JOIN result_stream rs ON rs.job_id = base.job_id\n                        WHERE base.job_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "result: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "running: Option<bool>",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "result_stream: Option<String>",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "stream_offset",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 4,
+        "name": "stream_job",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "Int4",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null,
+      false,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "3d46bfb231a219afd2e2662bc06cb0167131a86a4e49d000b84a73a8b47235f2"
+}

backend/.sqlx/query-4977b4027861ca234e95559a8b550bc8849f7ed60a471d46f3be3d39664a48ca.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            UPDATE\n                workspace_settings\n            SET\n                success_handler = NULL,\n                success_handler_extra_args = NULL\n            WHERE\n                workspace_id = $1\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "4977b4027861ca234e95559a8b550bc8849f7ed60a471d46f3be3d39664a48ca"
-}

backend/.sqlx/query-50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec.json

@@ -1,84 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO v2_job (\n            id,\n            workspace_id,\n            raw_code,\n            tag,\n            created_by,\n            permissioned_as,\n            permissioned_as_email,\n            kind,\n            script_lang,\n            args\n        ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8::job_kind, $9::script_lang, $10)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Varchar",
-        "Text",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        {
-          "Custom": {
-            "name": "job_kind",
-            "kind": {
-              "Enum": [
-                "script",
-                "preview",
-                "flow",
-                "dependencies",
-                "flowpreview",
-                "script_hub",
-                "identity",
-                "flowdependencies",
-                "http",
-                "graphql",
-                "postgresql",
-                "noop",
-                "appdependencies",
-                "deploymentcallback",
-                "singlestepflow",
-                "flowscript",
-                "flownode",
-                "appscript",
-                "aiagent",
-                "unassigned_script",
-                "unassigned_flow",
-                "unassigned_singlestepflow"
-              ]
-            }
-          }
-        },
-        {
-          "Custom": {
-            "name": "script_lang",
-            "kind": {
-              "Enum": [
-                "python3",
-                "deno",
-                "go",
-                "bash",
-                "postgresql",
-                "nativets",
-                "bun",
-                "mysql",
-                "bigquery",
-                "snowflake",
-                "graphql",
-                "powershell",
-                "mssql",
-                "php",
-                "bunnative",
-                "rust",
-                "ansible",
-                "csharp",
-                "oracledb",
-                "nu",
-                "java",
-                "duckdb",
-                "ruby"
-              ]
-            }
-          }
-        },
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "50f81c128d644c60837e603099e169fbc7a500c11e79d2c78d6eccccf6491aec"
-}

backend/.sqlx/query-542b670194b802f09af8ecc4f339524b914fd1bbd620a6d529a0a96766591bc8.json

@@ -0,0 +1,101 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                WITH result_stream AS (\n                    SELECT \n                        string_agg(stream, '' order by idx asc) as stream, \n                        job_id, \n                        max(idx) + 1 as offset \n                    FROM job_result_stream_v2\n                    WHERE job_id = $3 AND idx >= $8\n                    GROUP BY job_id\n                )\n                SELECT\n                    c.id IS NOT NULL AS completed,\n                    CASE\n                        WHEN q.id IS NOT NULL THEN (CASE WHEN NOT $5 AND q.running THEN true ELSE null END)\n                        ELSE false\n                    END AS running,\n                    CASE WHEN $7::BOOLEAN THEN NULL ELSE SUBSTR(logs, GREATEST($1 - log_offset, 0)) END AS logs,\n                    rs.stream AS new_result_stream,\n                    COALESCE(r.memory_peak, c.memory_peak) AS mem_peak,\n                    COALESCE(c.flow_status, f.flow_status) AS \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n                    (COALESCE(c.flow_status, f.flow_status)->>'stream_job')::uuid AS stream_job,\n                    COALESCE(c.workflow_as_code_status, f.workflow_as_code_status) AS \"workflow_as_code_status: sqlx::types::Json<Box<RawValue>>\",\n                    CASE WHEN $7::BOOLEAN THEN NULL ELSE job_logs.log_offset + CHAR_LENGTH(job_logs.logs) + 1 END AS log_offset,\n                    rs.offset AS stream_offset,\n                    created_by AS \"created_by!\",\n                    CASE WHEN $4::BOOLEAN THEN (\n                        SELECT scalar_int FROM job_stats WHERE job_id = $3 AND metric_id = 'progress_perc'\n                    ) END AS progress,\n                    rs.stream AS \"result_stream: Option<String>\"\n                FROM v2_job j\n                    LEFT JOIN v2_job_queue q USING (id)\n                    LEFT JOIN v2_job_runtime r USING (id)\n                    LEFT JOIN v2_job_status f USING (id)\n                    LEFT JOIN v2_job_completed c USING (id)\n                    LEFT JOIN result_stream rs ON rs.job_id = $3\n                    LEFT JOIN job_logs ON job_logs.job_id =  $3\n                WHERE j.workspace_id = $2 AND j.id = $3\n                AND ($6::text[] IS NULL OR j.tag = ANY($6))",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "completed",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "running",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "logs",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "new_result_stream",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "mem_peak",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "flow_status: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 6,
+        "name": "stream_job",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 7,
+        "name": "workflow_as_code_status: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 8,
+        "name": "log_offset",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 9,
+        "name": "stream_offset",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 10,
+        "name": "created_by!",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "progress",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 12,
+        "name": "result_stream: Option<String>",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int4",
+        "Text",
+        "Uuid",
+        "Bool",
+        "Bool",
+        "TextArray",
+        "Bool",
+        "Int4"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      null,
+      false,
+      null,
+      null
+    ]
+  },
+  "hash": "542b670194b802f09af8ecc4f339524b914fd1bbd620a6d529a0a96766591bc8"
+}

backend/.sqlx/query-5820d34be1a7f7b72e656c692f53146f45ad4a6e584e917a0a86280d8f473c10.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM v2_job_completed c\n                    WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval \n                    RETURNING c.id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "5820d34be1a7f7b72e656c692f53146f45ad4a6e584e917a0a86280d8f473c10"
+}

backend/.sqlx/query-5840477599957b528e10b638e0616b6fb9d04b78271b827c21a399a1474627d7.json

@@ -1,35 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            variable.path,\n            variable.account as account_id,\n            (now() > account.expires_at) as \"is_expired: bool\"\n        FROM variable\n        LEFT JOIN account ON variable.account = account.id AND account.workspace_id = $2\n        WHERE variable.path = $1 AND variable.workspace_id = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "account_id",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 2,
-        "name": "is_expired: bool",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      null
-    ]
-  },
-  "hash": "5840477599957b528e10b638e0616b6fb9d04b78271b827c21a399a1474627d7"
-}

backend/.sqlx/query-598805056a3b102c9c2fd69d8330fa78b06106236522e48ab5fe009cac059468.json

@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\nWITH lockable_counters AS (\n    SELECT concurrency_id, job_uuids\n    FROM concurrency_counter\n    WHERE job_uuids != '{}'::jsonb\n    FOR UPDATE SKIP LOCKED\n),\nall_job_uuids AS (\n    SELECT DISTINCT jsonb_object_keys(job_uuids) AS job_uuid\n    FROM lockable_counters\n),\norphaned_job_uuids AS (\n    SELECT job_uuid\n    FROM all_job_uuids\n    WHERE job_uuid NOT IN (\n        SELECT id::text\n        FROM v2_job_queue\n        FOR SHARE SKIP LOCKED\n    )\n),\norphaned_array AS (\n    SELECT ARRAY(SELECT job_uuid FROM orphaned_job_uuids) AS orphaned_keys\n),\nbefore_update AS (\n    SELECT lc.concurrency_id, lc.job_uuids, oa.orphaned_keys\n    FROM lockable_counters lc, orphaned_array oa\n    WHERE lc.job_uuids ?| oa.orphaned_keys\n),\naffected_rows AS (\n    UPDATE concurrency_counter\n    SET job_uuids = job_uuids - orphaned_array.orphaned_keys\n    FROM orphaned_array\n    WHERE concurrency_counter.concurrency_id IN (\n        SELECT concurrency_id FROM before_update\n    )\n    RETURNING concurrency_id, job_uuids AS updated_job_uuids\n),\nexpanded_orphaned AS (\n    SELECT bu.concurrency_id,\n           bu.job_uuids AS original_job_uuids,\n           unnest(bu.orphaned_keys) AS orphaned_key\n    FROM before_update bu\n)\nSELECT\n    eo.concurrency_id,\n    eo.orphaned_key,\n    eo.original_job_uuids,\n    ar.updated_job_uuids\nFROM expanded_orphaned eo\nJOIN affected_rows ar ON eo.concurrency_id = ar.concurrency_id\nWHERE eo.original_job_uuids ? eo.orphaned_key\nORDER BY eo.concurrency_id, eo.orphaned_key\n",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "concurrency_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "orphaned_key",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "original_job_uuids",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 3,
-        "name": "updated_job_uuids",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      null,
-      false,
-      false
-    ]
-  },
-  "hash": "598805056a3b102c9c2fd69d8330fa78b06106236522e48ab5fe009cac059468"
-}

backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json

@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      true
+      null
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"

backend/.sqlx/query-5e00d4b9ebc16301ead6a36e7bf9c3c29baa20caf43b79d756b57324c0a6d9f0.json

@@ -1,101 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                WITH result_stream AS (\n                    SELECT\n                        string_agg(stream, '' order by idx asc) as stream,\n                        job_id,\n                        max(idx) + 1 as offset\n                    FROM job_result_stream_v2\n                    WHERE job_id = $3 AND idx >= $8\n                    GROUP BY job_id\n                )\n                SELECT\n                    c.id IS NOT NULL AS completed,\n                    CASE\n                        WHEN q.id IS NOT NULL THEN (CASE WHEN NOT $5 AND q.running THEN true ELSE null END)\n                        ELSE false\n                    END AS running,\n                    CASE WHEN $7::BOOLEAN THEN NULL ELSE SUBSTR(logs, GREATEST($1 - log_offset, 0)) END AS logs,\n                    rs.stream AS new_result_stream,\n                    COALESCE(r.memory_peak, c.memory_peak) AS mem_peak,\n                    COALESCE(c.flow_status, f.flow_status) AS \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n                    (COALESCE(c.flow_status, f.flow_status)->>'stream_job')::uuid AS stream_job,\n                    COALESCE(c.workflow_as_code_status, f.workflow_as_code_status) AS \"workflow_as_code_status: sqlx::types::Json<Box<RawValue>>\",\n                    CASE WHEN $7::BOOLEAN THEN NULL ELSE job_logs.log_offset + CHAR_LENGTH(job_logs.logs) + 1 END AS log_offset,\n                    rs.offset AS stream_offset,\n                    created_by AS \"created_by!\",\n                    CASE WHEN $4::BOOLEAN THEN (\n                        SELECT scalar_int FROM job_stats WHERE job_id = $3 AND metric_id = 'progress_perc'\n                    ) END AS progress,\n                    rs.stream AS \"result_stream: Option<String>\"\n                FROM v2_job j\n                    LEFT JOIN v2_job_queue q USING (id)\n                    LEFT JOIN v2_job_runtime r USING (id)\n                    LEFT JOIN v2_job_status f USING (id)\n                    LEFT JOIN v2_job_completed c USING (id)\n                    LEFT JOIN result_stream rs ON rs.job_id = $3\n                    LEFT JOIN job_logs ON job_logs.job_id =  $3\n                WHERE j.workspace_id = $2 AND j.id = $3\n                AND ($6::text[] IS NULL OR j.tag = ANY($6))",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "completed",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 1,
-        "name": "running",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 2,
-        "name": "logs",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "new_result_stream",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "mem_peak",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 5,
-        "name": "flow_status: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 6,
-        "name": "stream_job",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 7,
-        "name": "workflow_as_code_status: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 8,
-        "name": "log_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 9,
-        "name": "stream_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 10,
-        "name": "created_by!",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 11,
-        "name": "progress",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 12,
-        "name": "result_stream: Option<String>",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int4",
-        "Text",
-        "Uuid",
-        "Bool",
-        "Bool",
-        "TextArray",
-        "Bool",
-        "Int4"
-      ]
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      null,
-      false,
-      null,
-      null
-    ]
-  },
-  "hash": "5e00d4b9ebc16301ead6a36e7bf9c3c29baa20caf43b79d756b57324c0a6d9f0"
-}

backend/.sqlx/query-66e66da2ed6eace5d7ec2a41a7b11ae255f5dc212d1ff41c2905b303c8c13b18.json

@@ -1,46 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        WITH job_info AS (\n            SELECT id, kind::text AS kind, parent_job\n            FROM v2_job\n            WHERE id = $1\n        )\n        SELECT\n            q.id AS \"id!\",\n            s.flow_status,\n            q.suspend AS \"suspend!\",\n            j.runnable_path AS script_path,\n            (ji.kind IN ('flow', 'flowpreview')) AS \"is_flow_level!\"\n        FROM job_info ji\n        JOIN v2_job_queue q ON q.id = CASE\n            WHEN ji.kind IN ('flow', 'flowpreview') THEN ji.id\n            ELSE ji.parent_job\n        END\n        JOIN v2_job j ON j.id = q.id\n        JOIN v2_job_status s ON s.id = q.id\n        FOR UPDATE OF q\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id!",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "flow_status",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 2,
-        "name": "suspend!",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "is_flow_level!",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      true,
-      null
-    ]
-  },
-  "hash": "66e66da2ed6eace5d7ec2a41a7b11ae255f5dc212d1ff41c2905b303c8c13b18"
-}

backend/.sqlx/query-6dd7e38c902f6b8d397aa3e9e698fe1541bd3f22634af341849303de84c0034d.json

@@ -1,32 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id, path, value FROM variable WHERE is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "6dd7e38c902f6b8d397aa3e9e698fe1541bd3f22634af341849303de84c0034d"
-}

backend/.sqlx/query-6eaa0af9c5e0a8d64c3202753c9c3cef39361b0987a22b7d2b2346652f81177e.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET success_handler = 'script/f/test/success_handler',\n            success_handler_extra_args = '{\"key\": \"value\"}'::json\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "6eaa0af9c5e0a8d64c3202753c9c3cef39361b0987a22b7d2b2346652f81177e"
-}

backend/.sqlx/query-6fa985751b0bd525e463472ae120a6b7f9dc556c1dfe0c3e89afcc623433b3b2.json

@@ -1,55 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                    WITH result_stream AS (\n                        SELECT\n                            string_agg(stream, '' order by idx asc) as stream,\n                            job_id,\n                            max(idx) + 1 as offset\n                        FROM job_result_stream_v2\n                        WHERE job_id = $2 AND idx >= $3\n                        GROUP BY job_id\n                    )\n                    SELECT\n                        jc.result as \"result: sqlx::types::Json<Box<RawValue>>\",\n                        v2_job.tag,\n                        v2_job_queue.running as \"running: Option<bool>\",\n                        rs.stream AS \"result_stream: Option<String>\",\n                        rs.offset AS stream_offset,\n                        CASE WHEN $4 THEN NULL ELSE (COALESCE(js.flow_status, jc.flow_status)->>'stream_job')::uuid END as stream_job\n                    FROM v2_job\n                    LEFT JOIN v2_job_queue USING (id)\n                    LEFT JOIN v2_job_completed jc USING (id)\n                    LEFT JOIN v2_job_status js USING (id)\n                    LEFT JOIN result_stream rs ON rs.job_id = $2\n                    WHERE v2_job.id = $2 AND v2_job.workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "result: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 1,
-        "name": "tag",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "running: Option<bool>",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 3,
-        "name": "result_stream: Option<String>",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 4,
-        "name": "stream_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 5,
-        "name": "stream_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Uuid",
-        "Int4",
-        "Bool"
-      ]
-    },
-    "nullable": [
-      true,
-      false,
-      false,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "6fa985751b0bd525e463472ae120a6b7f9dc556c1dfe0c3e89afcc623433b3b2"
-}

backend/.sqlx/query-70a6880960d17218bc5bf05287e2a6d9a6393c6bb1783ab8903d87dd099e236b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            j.id AS \"id!\", j.workspace_id AS \"workspace_id!\", j.parent_job, j.flow_step_id IS NOT NULL AS \"is_flow_step?\",\n            COALESCE(s.flow_status, s.workflow_as_code_status) AS \"flow_status: Box<str>\", r.ping AS last_ping, j.same_worker AS \"same_worker?\"\n        FROM v2_job_queue q JOIN v2_job j USING (id) LEFT JOIN v2_job_runtime r USING (id) LEFT JOIN v2_job_status s USING (id)\n        WHERE q.running = true AND q.suspend = 0 AND q.suspend_until IS null AND q.scheduled_for <= now()\n            AND (j.kind = 'flow' OR j.kind = 'flowpreview' OR j.kind = 'flownode')\n            AND r.ping IS NOT NULL AND r.ping < NOW() - ($1 || ' seconds')::interval\n            AND q.canceled_by IS NULL\n\n        ",
+  "query": "\n        SELECT\n            j.id AS \"id!\", j.workspace_id AS \"workspace_id!\", j.parent_job, j.flow_step_id IS NOT NULL AS \"is_flow_step?\",\n            COALESCE(s.flow_status, s.workflow_as_code_status) AS \"flow_status: Box<str>\", r.ping AS last_ping, j.same_worker AS \"same_worker?\"\n        FROM v2_job_queue q JOIN v2_job j USING (id) LEFT JOIN v2_job_runtime r USING (id) LEFT JOIN v2_job_status s USING (id)\n        WHERE q.running = true AND q.suspend = 0 AND q.suspend_until IS null AND q.scheduled_for <= now()\n            AND (j.kind = 'flow' OR j.kind = 'flowpreview' OR j.kind = 'flownode')\n            AND r.ping IS NOT NULL AND r.ping < NOW() - ($1 || ' seconds')::interval\n            AND q.canceled_by IS NULL\n            \n        ",
   "describe": {
     "columns": [
       {
@@ -54,5 +54,5 @@
       false
     ]
   },
-  "hash": "4d80985dd0794a01a2af18ae7abf4a3ab8ba3d162ed5d04735caea7295da0b20"
+  "hash": "70a6880960d17218bc5bf05287e2a6d9a6393c6bb1783ab8903d87dd099e236b"
 }

backend/.sqlx/query-71de038f332593e2177f33284854b6c0bfe9bb4999f2c4e9082a4c5f3b341496.json

@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            id,\n            runnable_path,\n            permissioned_as_email,\n            parent_job\n        FROM v2_job\n        WHERE workspace_id = 'test-workspace'\n            AND permissioned_as_email = 'success_handler@windmill.dev'\n        ORDER BY created_at DESC\n        LIMIT 1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "runnable_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "permissioned_as_email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "parent_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      true
-    ]
-  },
-  "hash": "71de038f332593e2177f33284854b6c0bfe9bb4999f2c4e9082a4c5f3b341496"
-}

backend/.sqlx/query-83785ee2f7dcc7f2252b0e8bcc8322dfd7689d615a34b63e29c9c6699b7e5514.json

@@ -0,0 +1,40 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n            SELECT q.id, f.flow_status, q.suspend, j.runnable_path AS script_path\n            FROM v2_job_queue q\n                JOIN v2_job j USING (id)\n                JOIN v2_job_status f USING (id)\n            WHERE id = ( SELECT parent_job FROM v2_job WHERE id = $1 )\n            FOR UPDATE\n            ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "flow_status",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 2,
+        "name": "suspend",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 3,
+        "name": "script_path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      true,
+      false,
+      true
+    ]
+  },
+  "hash": "83785ee2f7dcc7f2252b0e8bcc8322dfd7689d615a34b63e29c9c6699b7e5514"
+}

backend/.sqlx/query-8f5722afde37d22c56851da23895daa1653e14b6d12013f6e3bb8bf042447a6a.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE variable SET value = 'ROUND_TRIP_CLEARED' WHERE is_secret = true",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "8f5722afde37d22c56851da23895daa1653e14b6d12013f6e3bb8bf042447a6a"
-}

backend/.sqlx/query-9044c71dc8aab7f5d17bf27c4702e67f3eee46d7dbccb09cadeaafa0534952d6.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            UPDATE\n                workspace_settings\n            SET\n                success_handler = $1,\n                success_handler_extra_args = $2\n            WHERE\n                workspace_id = $3\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Json",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "9044c71dc8aab7f5d17bf27c4702e67f3eee46d7dbccb09cadeaafa0534952d6"
-}

backend/.sqlx/query-9272643a0efd45b7a2f9ed6957801d57b74f4f41f6df80324ae964447b90fe8f.json

@@ -0,0 +1,25 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                SELECT \n                    CASE \n                        WHEN flow_version.id IS NOT NULL THEN\n                            (flow_version.value -> 'flow_env' -> $3) #> $4\n                        ELSE\n                            (root_job.raw_flow -> 'flow_env' -> $3) #> $4\n                    END AS \"flow_env: sqlx::types::Json<Box<RawValue>>\"\n                FROM \n                    v2_job current_job\n                JOIN \n                    v2_job root_job ON root_job.id = COALESCE(current_job.root_job, current_job.flow_innermost_root_job, current_job.parent_job, current_job.id)\n                    AND root_job.workspace_id = current_job.workspace_id\n                LEFT JOIN\n                    flow_version ON flow_version.id = root_job.runnable_id\n                    AND flow_version.path = root_job.runnable_path\n                    AND flow_version.workspace_id = root_job.workspace_id\n            WHERE \n                    current_job.id = $1 AND \n                    current_job.workspace_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "flow_env: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid",
+        "Text",
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "9272643a0efd45b7a2f9ed6957801d57b74f4f41f6df80324ae964447b90fe8f"
+}

backend/.sqlx/query-928aa6e4fff9f60a14a51cc7a3ef507414d20c81833bc940c6323fcdbee5d9b3.json

@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO v2_job_completed (\n            id,\n            workspace_id,\n            started_at,\n            completed_at,\n            duration_ms,\n            result,\n            status,\n            worker\n        ) VALUES ($1, $2, $3, $3, 0, $4, 'success'::job_status, 'debugger')",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Varchar",
-        "Timestamptz",
-        "Jsonb"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "928aa6e4fff9f60a14a51cc7a3ef507414d20c81833bc940c6323fcdbee5d9b3"
-}

backend/.sqlx/query-93ef241a4f624cb76d680418d313cd956e4c807c3a0031913dbfded80f0e5881.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE variable SET value = 'CLEARED' WHERE is_secret = true",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "93ef241a4f624cb76d680418d313cd956e4c807c3a0031913dbfded80f0e5881"
-}

backend/.sqlx/query-9da0cea2a5d0464ca78cfeccf6cedf2b1c0e6e6cb3c9183a937a68465debdb06.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM concurrency_key WHERE  ended_at <= now() - ($1::bigint::text || ' s')::interval ",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9da0cea2a5d0464ca78cfeccf6cedf2b1c0e6e6cb3c9183a937a68465debdb06"
+}

backend/.sqlx/query-a2bc410e1066ddc89ca4557ca0e29339e41cbc7a7ef6ad97b3f0eb93de04c359.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET success_handler = 'flow/f/test/success_flow'\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "a2bc410e1066ddc89ca4557ca0e29339e41cbc7a7ef6ad97b3f0eb93de04c359"
-}

backend/.sqlx/query-a61d53c8400864a7bc06894c08ec70e45242075bd17b37ea2c0c6b6eec11eb40.json

@@ -5,8 +5,8 @@
     "columns": [],
     "parameters": {
       "Left": [
-        "Varchar",
-        "Varchar"
+        "Text",
+        "Text"
       ]
     },
     "nullable": []

backend/.sqlx/query-a87e7b098b523176916daf5b1685b218dfbfe752aa730b421e9229dadd6ae587.json

@@ -1,28 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT kind::text as \"kind!\", parent_job\n        FROM v2_job\n        WHERE id = $1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "kind!",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 1,
-        "name": "parent_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      null,
-      true
-    ]
-  },
-  "hash": "a87e7b098b523176916daf5b1685b218dfbfe752aa730b421e9229dadd6ae587"
-}

backend/.sqlx/query-abb05c936cbb38d397df855d709337b27355bd7e6d70ffe18d88e932b3a8a6f2.json

@@ -1,49 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                        WITH result_stream AS (\n                            SELECT\n                                string_agg(stream, '' order by idx asc) as stream,\n                                job_id,\n                                max(idx) + 1 as offset\n                            FROM job_result_stream_v2\n                            WHERE job_id = $2 AND idx >= $3\n                            GROUP BY job_id\n                        )\n                        SELECT\n                            COALESCE(jc.result, NULL) as \"result: sqlx::types::Json<Box<RawValue>>\",\n                            rs.stream AS \"result_stream: Option<String>\",\n                            rs.offset AS stream_offset,\n                            COALESCE(js.flow_status, jc.flow_status) as \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n                            CASE WHEN $4 THEN NULL ELSE (COALESCE(js.flow_status, jc.flow_status)->>'stream_job')::uuid END as stream_job\n                        FROM (\n                            SELECT $2::uuid as job_id, $1::text as workspace_id\n                        ) base\n                        LEFT JOIN v2_job_completed jc ON jc.id = base.job_id AND jc.workspace_id = base.workspace_id\n                        LEFT JOIN v2_job_status js ON js.id = base.job_id\n                        LEFT JOIN result_stream rs ON rs.job_id = base.job_id\n                        WHERE base.job_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "result: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 1,
-        "name": "result_stream: Option<String>",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 2,
-        "name": "stream_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "flow_status: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 4,
-        "name": "stream_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Uuid",
-        "Int4",
-        "Bool"
-      ]
-    },
-    "nullable": [
-      null,
-      null,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "abb05c936cbb38d397df855d709337b27355bd7e6d70ffe18d88e932b3a8a6f2"
-}

backend/.sqlx/query-ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81.json

@@ -1,32 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id, path, value FROM variable WHERE is_secret = true AND value IS NOT NULL AND value != ''",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "ade0696ec69bec2258d2e3ff86bfba6ed3b1d573c298f9d7fe8056ba7e32ed81"
-}

backend/.sqlx/query-b030efec7c7f770bf2ed5331a469aae723925270d9d5124cc4cb2c03db61dea8.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) as count FROM variable WHERE is_secret = true AND value = 'CLEARED'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "b030efec7c7f770bf2ed5331a469aae723925270d9d5124cc4cb2c03db61dea8"
-}

backend/.sqlx/query-b107d602c60c08f0edcaa99695f8546bf30074bad903959f7df030e0ac70a86f.json

@@ -1,32 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id, path, value FROM variable WHERE is_secret = true AND value != 'CLEARED' ORDER BY workspace_id, path",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "b107d602c60c08f0edcaa99695f8546bf30074bad903959f7df030e0ac70a86f"
-}

backend/.sqlx/query-b10d2ab53bd8d24b0bbcede8211de229d507784fbcdf46c309907df123e35018.json

@@ -1,32 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT workspace_id, path, value FROM variable WHERE is_secret = true ORDER BY workspace_id, path",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "b10d2ab53bd8d24b0bbcede8211de229d507784fbcdf46c309907df123e35018"
-}

backend/.sqlx/query-b4fc94adfe55bb87d2c4b6b45ed2eb5ac25e84f3619a0b403a2d619a0eb51432.json

@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n                variable.account as account_id,\n                (now() > account.expires_at) as \"is_expired: bool\"\n            FROM variable\n            LEFT JOIN account ON variable.account = account.id AND account.workspace_id = $2\n            WHERE variable.path = $1 AND variable.workspace_id = $2\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "account_id",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 1,
-        "name": "is_expired: bool",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      true,
-      null
-    ]
-  },
-  "hash": "b4fc94adfe55bb87d2c4b6b45ed2eb5ac25e84f3619a0b403a2d619a0eb51432"
-}

backend/.sqlx/query-bb289fd24f443f0f8917ec55bc9fc3113e37dd8009425e558b5f5d1e1543b513.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE variable SET value = $1 WHERE path = $2 AND workspace_id = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "bb289fd24f443f0f8917ec55bc9fc3113e37dd8009425e558b5f5d1e1543b513"
-}

backend/.sqlx/query-bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO account (workspace_id, client, expires_at, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url, mcp_server_url) VALUES ($1, $2, now() + ($3 || ' seconds')::interval, $4, $5, $6, $7, $8, $9) RETURNING id",
+  "query": "INSERT INTO account (workspace_id, client, expires_at, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url) VALUES ($1, $2, now() + ($3 || ' seconds')::interval, $4, $5, $6, $7, $8) RETURNING id",
   "describe": {
     "columns": [
       {
@@ -18,13 +18,12 @@
         "Varchar",
         "Varchar",
         "Varchar",
-        "Varchar",
-        "Text"
+        "Varchar"
       ]
     },
     "nullable": [
       false
     ]
   },
-  "hash": "b1bd088c2e1aca3104bede7d0953369b6b17ad3ad62692ae6f2303be890e6391"
+  "hash": "bbc28b92ae8ec3d120a8976be7d3966282fe6543e0eb957fc10864dbf58de58f"
 }

backend/.sqlx/query-c23bea7db9623a60683596b7d6e689e2c0100c1569436a01b207876aaa470154.json

@@ -1,25 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                SELECT\n                    CASE\n                        WHEN flow_version.id IS NOT NULL THEN\n                            (flow_version.value -> 'flow_env' -> $3) #> $4\n                        ELSE\n                            (root_job.raw_flow -> 'flow_env' -> $3) #> $4\n                    END AS \"flow_env: sqlx::types::Json<Box<RawValue>>\"\n                FROM\n                    v2_job current_job\n                JOIN\n                    v2_job root_job ON root_job.id = COALESCE(current_job.root_job, current_job.flow_innermost_root_job, current_job.parent_job, current_job.id)\n                    AND root_job.workspace_id = current_job.workspace_id\n                LEFT JOIN\n                    flow_version ON flow_version.id = root_job.runnable_id\n                    AND flow_version.path = root_job.runnable_path\n                    AND flow_version.workspace_id = root_job.workspace_id\n            WHERE\n                    current_job.id = $1 AND\n                    current_job.workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "flow_env: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text",
-        "Text",
-        "TextArray"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "c23bea7db9623a60683596b7d6e689e2c0100c1569436a01b207876aaa470154"
-}

backend/.sqlx/query-c6ef0acdf20bd71dd26de981fb49f178ba8a1b8c1e01e0fec1dfd6a54ea7a894.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\nWITH rows_to_delete AS (\n    SELECT concurrency_id\n    FROM concurrency_counter\n\n    WHERE job_uuids = '{}'::jsonb\n    FOR UPDATE SKIP LOCKED\n)\nDELETE FROM concurrency_counter\nWHERE concurrency_id IN (SELECT concurrency_id FROM rows_to_delete)  RETURNING concurrency_id",
+  "query": "\nWITH rows_to_delete AS (\n    SELECT concurrency_id\n    FROM concurrency_counter\n    \n    WHERE job_uuids = '{}'::jsonb\n    FOR UPDATE SKIP LOCKED\n)\nDELETE FROM concurrency_counter\nWHERE concurrency_id IN (SELECT concurrency_id FROM rows_to_delete)  RETURNING concurrency_id",
   "describe": {
     "columns": [
       {
@@ -16,5 +16,5 @@
       false
     ]
   },
-  "hash": "45d0552a169b63241a0ecc0e7ec6a533d7eec520376b99b2fd8000f0f0acba7b"
+  "hash": "c6ef0acdf20bd71dd26de981fb49f178ba8a1b8c1e01e0fec1dfd6a54ea7a894"
 }

backend/.sqlx/query-d75346523ede1a7677cca073ce894b540d637b1067ece6209d9365c92fc59e03.json

@@ -0,0 +1,55 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                    WITH result_stream AS (\n                        SELECT \n                            string_agg(stream, '' order by idx asc) as stream, \n                            job_id, \n                            max(idx) + 1 as offset \n                        FROM job_result_stream_v2\n                        WHERE job_id = $2 AND idx >= $3\n                        GROUP BY job_id\n                    )\n                    SELECT \n                        jc.result as \"result: sqlx::types::Json<Box<RawValue>>\",\n                        v2_job.tag,\n                        v2_job_queue.running as \"running: Option<bool>\",\n                        rs.stream AS \"result_stream: Option<String>\",\n                        rs.offset AS stream_offset,\n                        CASE WHEN $4 THEN NULL ELSE (COALESCE(js.flow_status, jc.flow_status)->>'stream_job')::uuid END as stream_job\n                    FROM v2_job\n                    LEFT JOIN v2_job_queue USING (id)\n                    LEFT JOIN v2_job_completed jc USING (id)\n                    LEFT JOIN v2_job_status js USING (id)\n                    LEFT JOIN result_stream rs ON rs.job_id = $2\n                    WHERE v2_job.id = $2 AND v2_job.workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "result: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "tag",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 2,
+        "name": "running: Option<bool>",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "result_stream: Option<String>",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 4,
+        "name": "stream_offset",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 5,
+        "name": "stream_job",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "Int4",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      true,
+      false,
+      false,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "d75346523ede1a7677cca073ce894b540d637b1067ece6209d9365c92fc59e03"
+}

backend/.sqlx/query-d7a9fa6d67635d1d55e6e48c803a91bb3700a8759bc875160d5c4ce886b933dd.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                            SELECT\n                                schema\n                            FROM\n                                flow\n                            WHERE\n                                workspace_id = $1 AND\n                                path = $2\n                        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "schema",
-        "type_info": "Json"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      true
-    ]
-  },
-  "hash": "d7a9fa6d67635d1d55e6e48c803a91bb3700a8759bc875160d5c4ce886b933dd"
-}

backend/.sqlx/query-dbc05cbf6720cc85e01118bcdcbb478724ac0ea8f3e043da2de9d932216cc730.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/simple_script', $2, 'deno', 'script', 'test-user', '{}', 'Simple test script', 'A simple test script', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "dbc05cbf6720cc85e01118bcdcbb478724ac0ea8f3e043da2de9d932216cc730"
-}

backend/.sqlx/query-e26ccc6607a9c78c1a8c1fd7b3bec931cf0ed27f79f852ae7f63a0ed6e12042f.json

@@ -1,59 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT client, refresh_token, grant_type, cc_client_id, cc_client_secret, cc_token_url, mcp_server_url FROM account WHERE workspace_id = $1 AND id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "client",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "refresh_token",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "grant_type",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "cc_client_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "cc_client_secret",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
-        "name": "cc_token_url",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 6,
-        "name": "mcp_server_url",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Int4"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "e26ccc6607a9c78c1a8c1fd7b3bec931cf0ed27f79f852ae7f63a0ed6e12042f"
-}

backend/.sqlx/query-e3f2459d9ac3534531d5724bb2d67be6f33f8ca02ef4768bccd32a33a70a4300.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET success_handler = 'script/f/test/success_handler'\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "e3f2459d9ac3534531d5724bb2d67be6f33f8ca02ef4768bccd32a33a70a4300"
-}

backend/.sqlx/query-e72e81370a93a6c53a1da01db0df55074d4b5ffcd80cabbe0c5fedcd90e0712b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                SELECT\n                    string_agg(stream, '' order by idx asc) as stream,\n                    max(idx) + 1 as offset\n                FROM job_result_stream_v2\n                WHERE job_id = $2 AND idx >= $1\n                ",
+  "query": "\n                SELECT \n                    string_agg(stream, '' order by idx asc) as stream, \n                    max(idx) + 1 as offset \n                FROM job_result_stream_v2\n                WHERE job_id = $2 AND idx >= $1\n                ",
   "describe": {
     "columns": [
       {
@@ -25,5 +25,5 @@
       null
     ]
   },
-  "hash": "f173446b1c4c1118627c7486374ec5ee10a8ffca9de26f191b715caabb6f038a"
+  "hash": "e72e81370a93a6c53a1da01db0df55074d4b5ffcd80cabbe0c5fedcd90e0712b"
 }

backend/.sqlx/query-ea9bbb972217bab4d7e8f4c08e331899161e80c239d56eb657d73bbf4272939b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT app_id, value, raw_app FROM app_version WHERE id = $1",
+  "query": "SELECT app_id, value FROM app_version WHERE id = $1",
   "describe": {
     "columns": [
       {
@@ -12,11 +12,6 @@
         "ordinal": 1,
         "name": "value",
         "type_info": "Json"
-      },
-      {
-        "ordinal": 2,
-        "name": "raw_app",
-        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -25,10 +20,9 @@
       ]
     },
     "nullable": [
-      false,
       false,
       false
     ]
   },
-  "hash": "19cca1d42f37e860dc54470fea8dd9a35c412d82d27ce369ccb0ba38b9791669"
+  "hash": "ea9bbb972217bab4d7e8f4c08e331899161e80c239d56eb657d73bbf4272939b"
 }

backend/.sqlx/query-ed5ff52b210e9158706ceffb4700108d4965e911656028be19b5ce530ab01d92.json

@@ -0,0 +1,49 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                        WITH result_stream AS (\n                            SELECT \n                                string_agg(stream, '' order by idx asc) as stream, \n                                job_id, \n                                max(idx) + 1 as offset \n                            FROM job_result_stream_v2\n                            WHERE job_id = $2 AND idx >= $3\n                            GROUP BY job_id\n                        )\n                        SELECT\n                            COALESCE(jc.result, NULL) as \"result: sqlx::types::Json<Box<RawValue>>\",\n                            rs.stream AS \"result_stream: Option<String>\",\n                            rs.offset AS stream_offset,\n                            COALESCE(js.flow_status, jc.flow_status) as \"flow_status: sqlx::types::Json<Box<RawValue>>\",\n                            CASE WHEN $4 THEN NULL ELSE (COALESCE(js.flow_status, jc.flow_status)->>'stream_job')::uuid END as stream_job\n                        FROM (\n                            SELECT $2::uuid as job_id, $1::text as workspace_id\n                        ) base\n                        LEFT JOIN v2_job_completed jc ON jc.id = base.job_id AND jc.workspace_id = base.workspace_id\n                        LEFT JOIN v2_job_status js ON js.id = base.job_id\n                        LEFT JOIN result_stream rs ON rs.job_id = base.job_id\n                        WHERE base.job_id = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "result: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "result_stream: Option<String>",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "stream_offset",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 3,
+        "name": "flow_status: sqlx::types::Json<Box<RawValue>>",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 4,
+        "name": "stream_job",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Uuid",
+        "Int4",
+        "Bool"
+      ]
+    },
+    "nullable": [
+      null,
+      null,
+      null,
+      null,
+      null
+    ]
+  },
+  "hash": "ed5ff52b210e9158706ceffb4700108d4965e911656028be19b5ce530ab01d92"
+}

backend/.sqlx/query-f027ddbf2877c6ed9be749ae1c5b852061399ada923d8206ac666745664d58e6.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n                            SELECT \n                                schema \n                            FROM \n                                flow \n                            WHERE \n                                workspace_id = $1 AND \n                                path = $2\n                        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "schema",
+        "type_info": "Json"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "f027ddbf2877c6ed9be749ae1c5b852061399ada923d8206ac666745664d58e6"
+}

backend/.sqlx/query-f1e9699f743d96ebf040b0a0eaa24ae313c03a982762a7ea6836a530aa5b1e65.json

@@ -1,49 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n                        WITH result_stream AS (\n                            SELECT\n                                string_agg(stream, '' order by idx asc) as stream,\n                                job_id,\n                                max(idx) + 1 as offset\n                            FROM job_result_stream_v2\n                            WHERE job_id = $1 AND idx >= $3\n                            GROUP BY job_id\n                        )\n                        SELECT\n                            COALESCE(jc.result, jc.result) as \"result: sqlx::types::Json<Box<RawValue>>\",\n                            jq.running as \"running: Option<bool>\",\n                            rs.stream AS \"result_stream: Option<String>\",\n                            rs.offset AS stream_offset,\n                            CASE WHEN $4 THEN NULL ELSE (COALESCE(js.flow_status, jc.flow_status)->>'stream_job')::uuid END as stream_job\n                        FROM (\n                            SELECT $1::uuid as job_id, $2::text as workspace_id\n                        ) base\n                        LEFT JOIN v2_job_completed jc ON jc.id = base.job_id AND jc.workspace_id = base.workspace_id\n                        LEFT JOIN v2_job_queue jq ON jq.id = base.job_id AND jq.workspace_id = base.workspace_id\n                        LEFT JOIN v2_job_status js ON js.id = base.job_id\n                        LEFT JOIN result_stream rs ON rs.job_id = base.job_id\n                        WHERE base.job_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "result: sqlx::types::Json<Box<RawValue>>",
-        "type_info": "Jsonb"
-      },
-      {
-        "ordinal": 1,
-        "name": "running: Option<bool>",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 2,
-        "name": "result_stream: Option<String>",
-        "type_info": "Text"
-      },
-      {
-        "ordinal": 3,
-        "name": "stream_offset",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 4,
-        "name": "stream_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid",
-        "Text",
-        "Int4",
-        "Bool"
-      ]
-    },
-    "nullable": [
-      null,
-      false,
-      null,
-      null,
-      null
-    ]
-  },
-  "hash": "f1e9699f743d96ebf040b0a0eaa24ae313c03a982762a7ea6836a530aa5b1e65"
-}

backend/.sqlx/query-f7f0c846cb9db866fd5188631f238eb69709b86976079425549d5bab8eefbac7.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                    SELECT\n                        result AS \"result: sqlx::types::Json<Box<RawValue>>\",\n                        result_columns,\n                        status = 'success' AS \"success!\"\n                    FROM\n                        v2_job_completed\n                    WHERE\n                        id = $1 AND\n                        workspace_id = $2\n                    ",
+  "query": "\n                    SELECT\n                        result AS \"result: sqlx::types::Json<Box<RawValue>>\",\n                        result_columns,\n                        status = 'success' AS \"success!\"\n                    FROM \n                        v2_job_completed\n                    WHERE \n                        id = $1 AND \n                        workspace_id = $2\n                    ",
   "describe": {
     "columns": [
       {
@@ -31,5 +31,5 @@
       null
     ]
   },
-  "hash": "12d69d85e25ffbed2dc37ef0faeb341b037aa66bc198f21fbc8de22e688f3d97"
+  "hash": "f7f0c846cb9db866fd5188631f238eb69709b86976079425549d5bab8eefbac7"
 }

backend/.sqlx/query-fb321fba5f4508d6cff5bae5a7c5a120d12b43a2f6056c3fff1c7c099b5f248a.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT app_version.raw_app FROM app\n         JOIN app_version ON app_version.id = app.versions[array_upper(app.versions, 1)]\n         WHERE app.path = $1 AND app.workspace_id = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "raw_app",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "fb321fba5f4508d6cff5bae5a7c5a120d12b43a2f6056c3fff1c7c099b5f248a"
-}

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.612.1"
+version = "1.603.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -35,7 +35,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.612.1"
+version = "1.603.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -86,6 +86,7 @@ oauth2 = ["windmill-api/oauth2"]
 zip = ["windmill-api/zip"]
 static_frontend = ["windmill-api/static_frontend"]
 scoped_cache = ["windmill-common/scoped_cache"]
+pg_embed = ["windmill-common/pg_embed", "dep:postgresql_embedded"]
 test_job_debouncing = []
 # Languages
 python = ["windmill-worker/python", "windmill-api/python"]
@@ -161,7 +162,7 @@ k8s-openapi.workspace = true
 libloading.workspace = true
 bitflags.workspace = true
 globset.workspace = true
-
+postgresql_embedded = { version = "0.18.1", optional = true, features = ["theseus"], default-features = false }
 
 [target.'cfg(windows)'.dependencies]
 windows-service = "0.7"
@@ -247,7 +248,6 @@ argon2 = "^0"
 quick_cache = "^0"
 rand = "=0.9.0"
 rand_core = { version = "^0", features = ["std"] }
-ed25519-dalek = { version = "2", features = ["rand_core"] }
 magic-crypt = "^3"
 git-version = "^0"
 malachite = "=0.4.18"
@@ -405,7 +405,6 @@ async-once-cell = "0.5.4"
 aws-smithy-types-convert = { version = "^0", features = ["convert-chrono"] }
 crc = "^3"
 tar = "^0"
-flate2 = "^1"
 http = "^1"
 async-stream = "^0"
 

backend/README.md

@@ -14,6 +14,55 @@ contains files used to build the "root" binary.
 | [windmill-worker](./windmill-worker/) | The worker. Used to process and execute flows & jobs.                                                     |
 | [parsers](./parsers/)                 | Contains code to parse signatures in different langauges.                                                 |
 
+## Features
+
+### Embedded PostgreSQL (`pg_embed`)
+
+The `pg_embed` feature allows Windmill to run with an embedded PostgreSQL database, eliminating the need for a separate PostgreSQL instance. This is useful for local development, testing, or single-machine deployments.
+
+**Building with pg_embed:**
+```bash
+cargo build --features pg_embed
+```
+
+**System Dependencies:**
+
+The embedded PostgreSQL requires certain system libraries to be installed:
+
+- **Arch Linux:**
+  ```bash
+  sudo pacman -S libxml2 icu openssl
+  ```
+
+- **Ubuntu/Debian:**
+  ```bash
+  sudo apt-get install libxml2 libicu-dev libssl-dev
+  ```
+
+- **RHEL/Fedora:**
+  ```bash
+  sudo dnf install libxml2 libicu openssl-libs
+  ```
+
+**Usage:**
+
+When the `pg_embed` feature is enabled, if `DATABASE_URL` is not set, Windmill will automatically start an embedded PostgreSQL instance.
+
+You can customize the embedded PostgreSQL behavior with these environment variables:
+- `PG_EMBED_DATA_DIR`: Directory for PostgreSQL data (default: `./postgresql_data`)
+- `PG_EMBED_PORT`: Port for PostgreSQL (default: `5432`)
+- `PG_EMBED_DATABASE`: Database name (default: `windmill`)
+- `PG_EMBED`: Set to any value to force embedded PostgreSQL even if DATABASE_URL exists
+
+**Example:**
+```bash
+# Run with default embedded PostgreSQL
+./windmill
+
+# Or with custom settings
+PG_EMBED_DATA_DIR=/my/data PG_EMBED_PORT=5433 ./windmill
+```
+
 ### Compile sqlx for offline ci
 
 ```

backend/ee-repo-ref.txt

@@ -1 +1 @@
-a4790328e8fb78256b6f746a8825ec6ec499c3a8
+c8e8a6df19203acc2cef1aebd1bd4157f2439cbf

backend/generate_mcp_endpoints_tools/generate_mcp_tools.py

@@ -13,7 +13,21 @@ from typing import Dict, List, Any, Optional
 
 IMPORTS = """
 use std::borrow::Cow;
-use windmill_mcp::server::EndpointTool;
+use serde::{Deserialize, Serialize};
+"""
+
+ENDPOINT_STRUCT = """
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct EndpointTool {
+    pub name: Cow<'static, str>,
+    pub description: Cow<'static, str>,
+    pub instructions: Cow<'static, str>,
+    pub path: Cow<'static, str>,
+    pub method: Cow<'static, str>,
+    pub path_params_schema: Option<serde_json::Value>,
+    pub query_params_schema: Option<serde_json::Value>,
+    pub body_schema: Option<serde_json::Value>,
+}
 """
 
 def load_openapi_spec(file_path: str) -> Dict[str, Any]:
@@ -327,11 +341,13 @@ export const mcpEndpointTools: EndpointTool[] = [
 def generate_rust_code(tools: List[Dict[str, Any]], spec: Dict[str, Any], base_path: str = "") -> str:
     """Generate the complete Rust code with MCP tools."""
     if not tools:
-        return f"""// No MCP tools found in the OpenAPI specification
+        return """// No MCP tools found in the OpenAPI specification
+
 {IMPORTS}
-pub fn all_tools() -> Vec<EndpointTool> {{
+{ENDPOINT_STRUCT}
+pub fn all_tools() -> Vec<EndpointTool> {
     vec![]
-}}
+}
 """
 
     tool_definitions = []
@@ -370,7 +386,9 @@ pub fn all_tools() -> Vec<EndpointTool> {{
 
     rust_code = f"""// Auto-generated MCP tools from OpenAPI specification
 // This file is generated by generate_mcp_tools.py - DO NOT EDIT MANUALLY
+
 {IMPORTS}
+{ENDPOINT_STRUCT}
 pub fn all_tools() -> Vec<EndpointTool> {{
     vec![
 {tool_definitions_str}
@@ -387,7 +405,7 @@ def main():
     project_dir = backend_dir.parent
 
     openapi_file = backend_dir / "windmill-api" / "openapi.yaml"
-    rust_output_file = backend_dir / "windmill-api" / "src" / "mcp" / "auto_generated_endpoints.rs"
+    rust_output_file = backend_dir / "windmill-api" / "src" / "mcp" / "tools" / "auto_generated_endpoints.rs"
     ts_output_file = project_dir / "frontend" / "src" / "lib" / "mcpEndpointTools.ts"
 
     if not openapi_file.exists():

backend/migrations/20260109143306_fix_custom_user_instance_2.down.sql

@@ -1 +0,0 @@
--- Add down migration script here

backend/migrations/20260109143306_fix_custom_user_instance_2.up.sql

@@ -1,17 +0,0 @@
-DO $$
-DECLARE
-    dbname text := current_database();
-BEGIN
-    -- Revoke default privileges first
-    ALTER DEFAULT PRIVILEGES IN SCHEMA public
-        REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM custom_instance_user;
-    REVOKE CREATE ON SCHEMA public FROM custom_instance_user;
-    REVOKE USAGE ON SCHEMA public FROM custom_instance_user;
-    EXECUTE format('REVOKE CREATE ON DATABASE %I FROM custom_instance_user', dbname);
-    EXECUTE format('REVOKE CONNECT ON DATABASE %I FROM custom_instance_user', dbname);
-EXCEPTION
-    WHEN others THEN
-        RAISE NOTICE 'Error in custom_instance_user migration: %', SQLERRM;
-        -- Continue without failing the migration
-END
-$$;

backend/migrations/20260112102339_mcp_oauth_client.down.sql

@@ -1,3 +0,0 @@
-DROP INDEX IF EXISTS idx_account_mcp_server_url;
-ALTER TABLE account DROP COLUMN IF EXISTS mcp_server_url;
-DROP TABLE IF EXISTS mcp_oauth_client;

backend/migrations/20260112102339_mcp_oauth_client.up.sql

@@ -1,13 +0,0 @@
-CREATE TABLE mcp_oauth_client (
-    mcp_server_url TEXT PRIMARY KEY,
-    client_id TEXT NOT NULL,
-    client_secret TEXT,
-    client_secret_expires_at TIMESTAMP,
-    token_endpoint TEXT NOT NULL,
-    created_at TIMESTAMP NOT NULL DEFAULT now()
-);
-
-CREATE INDEX idx_mcp_oauth_client_expires ON mcp_oauth_client(client_secret_expires_at);
-
-ALTER TABLE account ADD COLUMN mcp_server_url TEXT;
-CREATE INDEX idx_account_mcp_server_url ON account(mcp_server_url) WHERE mcp_server_url IS NOT NULL;

backend/migrations/20260117105517_add_workspace_success_handler.down.sql

@@ -1,4 +0,0 @@
--- Remove success_handler columns from workspace_settings
-ALTER TABLE workspace_settings
-    DROP COLUMN IF EXISTS success_handler,
-    DROP COLUMN IF EXISTS success_handler_extra_args;

backend/migrations/20260117105517_add_workspace_success_handler.up.sql

@@ -1,4 +0,0 @@
--- Add success_handler columns to workspace_settings
-ALTER TABLE workspace_settings
-    ADD COLUMN IF NOT EXISTS success_handler TEXT,
-    ADD COLUMN IF NOT EXISTS success_handler_extra_args JSON;

backend/src/main.rs

@@ -332,6 +332,9 @@ fn print_help() {
 	println!("  cache [hubPaths.json]  Pre-cache hub scripts (default: ./hubPaths.json)");
 	println!();
 	println!("Environment variables (name = default):");
+	#[cfg(feature = "pg_embed")]
+	println!("  DATABASE_URL = <optional>              The Postgres database url (auto-generated with pg_embed if not set).");
+	#[cfg(not(feature = "pg_embed"))]
 	println!("  DATABASE_URL = <required>              The Postgres database url.");
 	println!("  MODE = standalone                      Mode: standalone | worker | server | agent");
 	println!("  BASE_URL = http://localhost:8000       Public base URL of your instance (overridden by instance settings)");
@@ -339,16 +342,33 @@ fn print_help() {
 	println!("  SERVER_BIND_ADDR = {}                  IP to bind the server to", DEFAULT_SERVER_BIND_ADDR);
 	println!("  NUM_WORKERS = {}                       Number of workers (standalone/worker modes)", DEFAULT_NUM_WORKERS);
 	println!("  WORKER_GROUP = default                 Worker group this worker belongs to",);
+	println!("  QUIT_AFTER_FIRST_PING = false          Exit worker after first successful ping (useful for testing)");
 	println!("  JSON_FMT = false                       Output logs in JSON instead of logfmt");
 	println!("  METRICS_ADDR = None                    (EE only) Prometheus metrics addr at /metrics; set \"true\" to use :8001");
 	println!("  SUPERADMIN_SECRET = None               Virtual superadmin token (server)");
 	println!("  LICENSE_KEY = None                     (EE only) Enterprise license key (workers require valid key)");
 	println!("  RUN_UPDATE_CA_CERTIFICATE_AT_START = false  Run system CA update at startup");
 	println!("  RUN_UPDATE_CA_CERTIFICATE_PATH = /usr/sbin/update-ca-certificates  Path to CA update tool");
+	#[cfg(feature = "pg_embed")]
+	{
+		println!();
+		println!("Embedded PostgreSQL settings (pg_embed feature):");
+		println!("  PG_EMBED = <unset>                     Force embedded PostgreSQL even if DATABASE_URL exists");
+		println!("  PG_EMBED_DATA_DIR = ./postgresql_data  Directory for embedded PostgreSQL data");
+		println!("  PG_EMBED_PORT = 5432                   Port for embedded PostgreSQL");
+		println!("  PG_EMBED_DATABASE = windmill           Database name for embedded PostgreSQL");
+		println!();
+		println!("System dependencies required for pg_embed:");
+		println!("  Arch: sudo pacman -S libxml2 icu openssl");
+		println!("  Ubuntu/Debian: sudo apt-get install libxml2 libicu-dev libssl-dev");
+		println!("  RHEL/Fedora: sudo dnf install libxml2 libicu openssl-libs");
+	}
 	println!();
 	println!("Notes:");
 	println!("- Advanced and less commonly used settings are managed via the database and are omitted here.");
 	println!("- At startup, Windmill logs currently set configuration keys for visibility.");
+	#[cfg(feature = "pg_embed")]
+	println!("- With pg_embed feature enabled, if DATABASE_URL is not set, an embedded PostgreSQL instance will be started automatically.");
 }
 
 async fn windmill_main() -> anyhow::Result<()> {
@@ -433,12 +453,6 @@ async fn windmill_main() -> anyhow::Result<()> {
             println!("Windmill {}", GIT_VERSION);
             return Ok(());
         }
-        "prepare-deps" => {
-            // CLI command for preparing dependencies without database access
-            // Used by the debugger to install dependencies for scripts
-            windmill_worker::run_prepare_deps_cli().await?;
-            return Ok(());
-        }
         _ => {}
     }
 
@@ -476,6 +490,15 @@ async fn windmill_main() -> anyhow::Result<()> {
         IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1))
     };
 
+    // Initialize embedded PostgreSQL if pg_embed feature is enabled
+    #[cfg(feature = "pg_embed")]
+    let _embedded_pg = if std::env::var("PG_EMBED").is_ok() || (mode != Mode::Agent && std::env::var("DATABASE_URL").is_err() && std::env::var("DATABASE_URL_FILE").is_err()) {
+        println!("DATABASE_URL not set, starting embedded PostgreSQL...");
+        Some(windmill_common::pg_embed::init_embedded_postgres().await?)
+    } else {
+        None
+    };
+
     let (conn, first_suffix) = if mode == Mode::Agent {
         tracing::info!(
             "Creating http client for cluster using base internal url {}",
@@ -802,9 +825,16 @@ Windmill Community Edition {GIT_VERSION}
         #[cfg(not(all(feature = "tantivy", feature = "parquet")))]
         let log_indexer_f = async { Ok(()) as anyhow::Result<()> };
 
+        let worker_internal_server_killpill_rx = killpill_rx.resubscribe();
         let server_f = async {
             if !is_agent {
                 if let Some(db) = conn.as_sql() {
+                    if worker_mode {
+                        init_worker_internal_server_inline_utils(
+                            worker_internal_server_killpill_rx,
+                            base_internal_url.clone(),
+                        )?;
+                    }
                     windmill_api::run_server(
                         db.clone(),
                         index_reader,
@@ -835,11 +865,6 @@ Windmill Community Edition {GIT_VERSION}
             if !killpill_rx.try_recv().is_ok() {
                 let base_internal_url = base_internal_rx.await?;
                 if worker_mode {
-                    let worker_internal_server_killpill_rx = killpill_rx.resubscribe();
-                    init_worker_internal_server_inline_utils(
-                        worker_internal_server_killpill_rx,
-                        base_internal_url.clone(),
-                    )?;
                     let mut workers = vec![];
 
                     for i in 0..num_workers {

backend/src/monitor.rs

@@ -155,20 +155,6 @@ lazy_static::lazy_static! {
 
     .ok()
     .and_then(|x| x.parse::<u64>().ok());
-
-    /// Batch size for job cleanup deletion queries. Default: 10000.
-    /// Larger values delete more jobs per batch but hold locks longer.
-    static ref JOB_CLEANUP_BATCH_SIZE: i64 = std::env::var("JOB_CLEANUP_BATCH_SIZE")
-        .ok()
-        .and_then(|x| x.parse::<i64>().ok())
-        .unwrap_or(20000);
-
-    /// Maximum number of batches to process per cleanup iteration. Default: 10.
-    /// Set to 0 for unlimited (process until no expired jobs remain).
-    static ref JOB_CLEANUP_MAX_BATCHES: i32 = std::env::var("JOB_CLEANUP_MAX_BATCHES")
-        .ok()
-        .and_then(|x| x.parse::<i32>().ok())
-        .unwrap_or(20);
 }
 
 pub async fn initial_load(
@@ -924,151 +910,97 @@ pub async fn delete_expired_items(db: &DB) -> () {
 
     let job_retention_secs = *JOB_RETENTION_SECS.read().await;
     if job_retention_secs > 0 {
-        let batch_size = *JOB_CLEANUP_BATCH_SIZE;
-        let max_batches = *JOB_CLEANUP_MAX_BATCHES;
-        let cleanup_start = Instant::now();
-        let mut total_deleted = 0u64;
-        let mut batch_num = 0i32;
+        match db.begin().await {
+            Ok(mut tx) => {
+                let deleted_jobs = sqlx::query_scalar!(
+                    "DELETE FROM v2_job_completed c
+                    WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval 
+                    RETURNING c.id",
+                    job_retention_secs
+                )
+                .fetch_all(&mut *tx)
+                .await;
 
-        // Process batches until no more expired jobs or max batches reached
-        loop {
-            if max_batches > 0 && batch_num >= max_batches {
-                tracing::debug!(
-                    "Job cleanup: reached max batches limit ({}), will continue next iteration",
-                    max_batches
-                );
-                break;
-            }
+                match deleted_jobs {
+                    Ok(deleted_jobs) => {
+                        if deleted_jobs.len() > 0 {
+                            tracing::info!(
+                                "deleted {} jobs completed JOB_RETENTION_SECS {} ago: {:?}",
+                                deleted_jobs.len(),
+                                job_retention_secs,
+                                deleted_jobs,
+                            );
+                            if let Err(e) = sqlx::query!(
+                                "DELETE FROM job_stats WHERE job_id = ANY($1)",
+                                &deleted_jobs
+                            )
+                            .execute(&mut *tx)
+                            .await
+                            {
+                                tracing::error!("Error deleting job stats: {:?}", e);
+                            }
+                            match sqlx::query_scalar!(
+                                "DELETE FROM job_logs WHERE job_id = ANY($1) RETURNING log_file_index",
+                                &deleted_jobs
+                            )
+                            .fetch_all(&mut *tx)
+                            .await
+                            {
+                                Ok(log_file_index) => {
+                                    let paths = log_file_index
+                                        .into_iter()
+                                        .filter_map(|opt| opt)
+                                        .flat_map(|inner_vec| inner_vec.into_iter())
+                                        .collect();
+                                    delete_log_files_from_disk_and_store(paths, TMP_DIR, "").await;
+                                }
+                                Err(e) => tracing::error!("Error deleting job stats: {:?}", e),
+                            }
+                            if let Err(e) = sqlx::query!(
+                                "DELETE FROM concurrency_key WHERE  ended_at <= now() - ($1::bigint::text || ' s')::interval ",
+                                job_retention_secs
+                            )
+                            .execute(&mut *tx)
+                            .await
+                            {
+                                tracing::error!("Error deleting  custom concurrency key: {:?}", e);
+                            }
 
-            // Each batch runs in its own transaction to avoid long-running locks
-            let batch_result = delete_expired_jobs_batch(db, job_retention_secs, batch_size).await;
+                            if let Err(e) =
+                                sqlx::query!("DELETE FROM v2_job WHERE id = ANY($1)", &deleted_jobs)
+                                    .execute(&mut *tx)
+                                    .await
+                            {
+                                tracing::error!("Error deleting job: {:?}", e);
+                            }
 
-            match batch_result {
-                Ok(deleted_count) => {
-                    if deleted_count == 0 {
-                        // No more expired jobs to delete
-                        break;
+                            // should already be deleted but just in case
+                            if let Err(e) = sqlx::query!(
+                                "DELETE FROM job_result_stream_v2 WHERE job_id = ANY($1)",
+                                &deleted_jobs
+                            )
+                            .execute(&mut *tx)
+                            .await
+                            {
+                                tracing::error!("Error deleting job result stream: {:?}", e);
+                            }
+                        }
+                    }
+                    Err(e) => {
+                        tracing::error!("Error deleting expired jobs: {:?}", e)
                     }
-                    total_deleted += deleted_count as u64;
-                    batch_num += 1;
                 }
-                Err(e) => {
-                    tracing::error!("Error in job cleanup batch {}: {:?}", batch_num, e);
-                    break;
+
+                match tx.commit().await {
+                    Ok(_) => (),
+                    Err(err) => tracing::error!("Error deleting expired jobs: {:?}", err),
                 }
             }
-        }
-
-        if total_deleted > 0 {
-            tracing::info!(
-                "Job cleanup completed: deleted {} jobs in {} batches, took {:?}",
-                total_deleted,
-                batch_num,
-                cleanup_start.elapsed()
-            );
-        }
-
-        // Clean up concurrency keys separately (not tied to specific job IDs)
-        if let Err(e) = sqlx::query!(
-            "DELETE FROM concurrency_key WHERE ended_at <= now() - ($1::bigint::text || ' s')::interval",
-            job_retention_secs
-        )
-        .execute(db)
-        .await
-        {
-            tracing::error!("Error deleting custom concurrency key: {:?}", e);
-        }
-    }
-}
-
-/// Delete a batch of expired jobs with LIMIT and SKIP LOCKED for high-scale environments.
-/// Uses a single transaction per batch to minimize lock duration.
-/// Returns the number of jobs deleted in this batch.
-async fn delete_expired_jobs_batch(
-    db: &DB,
-    job_retention_secs: i64,
-    batch_size: i64,
-) -> error::Result<usize> {
-    let mut tx = db.begin().await?;
-
-    // Use FOR UPDATE SKIP LOCKED to avoid contention between replicas
-    // ORDER BY completed_at ensures we delete oldest jobs first
-    let deleted_jobs: Vec<Uuid> = sqlx::query_scalar!(
-        "DELETE FROM v2_job_completed
-         WHERE id IN (
-             SELECT id FROM v2_job_completed
-             WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval
-             ORDER BY completed_at ASC
-             LIMIT $2
-             FOR UPDATE SKIP LOCKED
-         )
-         RETURNING id",
-        job_retention_secs,
-        batch_size
-    )
-    .fetch_all(&mut *tx)
-    .await?;
-
-    let deleted_count = deleted_jobs.len();
-
-    if deleted_count > 0 {
-        tracing::debug!(
-            "Deleting batch of {} expired jobs (retention: {}s)",
-            deleted_count,
-            job_retention_secs
-        );
-
-        // Delete related records for this batch
-        if let Err(e) = sqlx::query!(
-            "DELETE FROM job_stats WHERE job_id = ANY($1)",
-            &deleted_jobs
-        )
-        .execute(&mut *tx)
-        .await
-        {
-            tracing::error!("Error deleting job stats: {:?}", e);
-        }
-
-        match sqlx::query_scalar!(
-            "DELETE FROM job_logs WHERE job_id = ANY($1) RETURNING log_file_index",
-            &deleted_jobs
-        )
-        .fetch_all(&mut *tx)
-        .await
-        {
-            Ok(log_file_index) => {
-                let paths = log_file_index
-                    .into_iter()
-                    .filter_map(|opt| opt)
-                    .flat_map(|inner_vec| inner_vec.into_iter())
-                    .collect();
-                delete_log_files_from_disk_and_store(paths, TMP_DIR, "").await;
+            Err(err) => {
+                tracing::error!("Error deleting expired jobs: {:?}", err)
             }
-            Err(e) => tracing::error!("Error deleting job logs: {:?}", e),
-        }
-
-        if let Err(e) = sqlx::query!("DELETE FROM v2_job WHERE id = ANY($1)", &deleted_jobs)
-            .execute(&mut *tx)
-            .await
-        {
-            tracing::error!("Error deleting job: {:?}", e);
-        }
-
-        // Should already be deleted but just in case
-        if let Err(e) = sqlx::query!(
-            "DELETE FROM job_result_stream_v2 WHERE job_id = ANY($1)",
-            &deleted_jobs
-        )
-        .execute(&mut *tx)
-        .await
-        {
-            tracing::error!("Error deleting job result stream: {:?}", e);
         }
     }
-
-    tx.commit().await?;
-
-    Ok(deleted_count)
 }
 
 async fn delete_log_files_from_disk_and_store(
@@ -2330,7 +2262,7 @@ async fn handle_zombie_jobs(db: &Pool<Postgres>, base_internal_url: &str, node_n
         sqlx::query_scalar!("SELECT j.id
              FROM v2_job_queue q JOIN v2_job j USING (id) LEFT JOIN v2_job_runtime r USING (id) LEFT JOIN v2_job_status s USING (id)
              WHERE r.ping < now() - ($1 || ' seconds')::interval
-             AND q.running = true AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow') AND j.same_worker = false",
+             AND q.running = true AND j.kind NOT IN ('flow', 'flowpreview', 'flownode', 'singlestepflow') AND j.same_worker = false", 
              ZOMBIE_JOB_TIMEOUT.as_str())
         .fetch_all(db)
         .await
@@ -2464,8 +2396,8 @@ orphaned_job_uuids AS (
     SELECT job_uuid
     FROM all_job_uuids
     WHERE job_uuid NOT IN (
-        SELECT id::text
-        FROM v2_job_queue
+        SELECT id::text 
+        FROM v2_job_queue 
         FOR SHARE SKIP LOCKED
     )
 ),
@@ -2478,7 +2410,7 @@ before_update AS (
     WHERE lc.job_uuids ?| oa.orphaned_keys
 ),
 affected_rows AS (
-    UPDATE concurrency_counter
+    UPDATE concurrency_counter 
     SET job_uuids = job_uuids - orphaned_array.orphaned_keys
     FROM orphaned_array
     WHERE concurrency_counter.concurrency_id IN (
@@ -2487,12 +2419,12 @@ affected_rows AS (
     RETURNING concurrency_id, job_uuids AS updated_job_uuids
 ),
 expanded_orphaned AS (
-    SELECT bu.concurrency_id,
+    SELECT bu.concurrency_id, 
            bu.job_uuids AS original_job_uuids,
            unnest(bu.orphaned_keys) AS orphaned_key
     FROM before_update bu
 )
-SELECT
+SELECT 
     eo.concurrency_id,
     eo.orphaned_key,
     eo.original_job_uuids,
@@ -2521,7 +2453,7 @@ async fn cleanup_concurrency_counters_empty_keys(db: &DB) -> error::Result<()> {
 WITH rows_to_delete AS (
     SELECT concurrency_id
     FROM concurrency_counter
-
+    
     WHERE job_uuids = '{}'::jsonb
     FOR UPDATE SKIP LOCKED
 )
@@ -2557,7 +2489,7 @@ async fn handle_zombie_flows(db: &DB) -> error::Result<()> {
             AND (j.kind = 'flow' OR j.kind = 'flowpreview' OR j.kind = 'flownode')
             AND r.ping IS NOT NULL AND r.ping < NOW() - ($1 || ' seconds')::interval
             AND q.canceled_by IS NULL
-
+            
         "#,
         FLOW_ZOMBIE_TRANSITION_TIMEOUT.as_str()
     )

backend/summarized_schema.txt

@@ -1065,8 +1065,6 @@ TABLE: workspace_settings
   - ai_config (jsonb)
   - error_handler_extra_args (json)
   - error_handler_muted_on_cancel (boolean)
-  - success_handler (text)
-  - success_handler_extra_args (json)
   - large_file_storage (jsonb)
   - git_sync (jsonb)
   - default_app (character)

backend/tests/fixtures/secret_backend.sql

@@ -1,31 +0,0 @@
--- Fixture for secret backend migration tests
--- Sets up test secrets in the variable table
-
--- Create a second workspace for testing workspace isolation
-INSERT INTO workspace (id, name, owner)
-VALUES ('test-workspace-2', 'test-workspace-2', 'test-user')
-ON CONFLICT DO NOTHING;
-
-INSERT INTO workspace_settings (workspace_id)
-VALUES ('test-workspace-2')
-ON CONFLICT DO NOTHING;
-
-INSERT INTO workspace_key(workspace_id, kind, key)
-VALUES ('test-workspace-2', 'cloud', 'test-key-2')
-ON CONFLICT DO NOTHING;
-
--- Insert test secrets for workspace 1
--- Note: The 'value' column stores encrypted values in production,
--- but for tests we'll use plain text that the migration will handle
-INSERT INTO variable (workspace_id, path, value, is_secret, description, extra_perms)
-VALUES
-    ('test-workspace', 'u/test-user/db_password', 'encrypted-db-pass-123', true, 'Database password', '{}'),
-    ('test-workspace', 'u/test-user/api_key', 'encrypted-api-key-abc', true, 'API key for external service', '{}'),
-    ('test-workspace', 'u/test-user/public_var', 'not-a-secret', false, 'A non-secret variable', '{}')
-ON CONFLICT DO NOTHING;
-
--- Insert test secrets for workspace 2 (to test isolation)
-INSERT INTO variable (workspace_id, path, value, is_secret, description, extra_perms)
-VALUES
-    ('test-workspace-2', 'u/test-user/other_secret', 'encrypted-other-secret', true, 'Secret in workspace 2', '{}')
-ON CONFLICT DO NOTHING;

backend/tests/secret_backend_integration.rs

@@ -1,557 +0,0 @@
-//! Integration tests for HashiCorp Vault secret backend.
-//!
-//! These tests require:
-//! 1. A PostgreSQL database (handled by sqlx test framework)
-//! 2. A running HashiCorp Vault instance
-//! 3. The RUN_VAULT_TESTS=1 environment variable to be set
-//!
-//! Environment variables:
-//! - RUN_VAULT_TESTS=1  - Required to run the tests
-//! - VAULT_ADDR         - Vault server address (default: http://127.0.0.1:8200)
-//! - VAULT_TOKEN        - Static token for static token tests (default: test-root-token)
-//! - BASE_URL           - Windmill instance URL for JWT tests (default: http://localhost:8000)
-//!
-//! Run tests (static token mode):
-//! ```bash
-//! RUN_VAULT_TESTS=1 VAULT_TOKEN=your-token cargo test -p windmill \
-//!     secret_backend_integration --features private,enterprise -- --nocapture
-//! ```
-//!
-//! Run tests (JWT mode - requires Windmill instance running for JWKS endpoint):
-//! ```bash
-//! RUN_VAULT_TESTS=1 BASE_URL=http://localhost:8000 cargo test -p windmill \
-//!     secret_backend_integration --features private,enterprise,openidconnect -- --nocapture
-//! ```
-
-#[cfg(all(feature = "private", feature = "enterprise"))]
-mod tests {
-    use sqlx::{Pool, Postgres};
-    use std::collections::HashMap;
-    use windmill_common::secret_backend::{
-        migrate_secrets_to_database, migrate_secrets_to_vault, test_vault_connection,
-        SecretBackend, VaultBackend, VaultSettings,
-    };
-
-    /// Check if vault tests should run (requires RUN_VAULT_TESTS=1 env var)
-    fn should_run_vault_tests() -> bool {
-        std::env::var("RUN_VAULT_TESTS")
-            .map(|v| v == "1" || v.to_lowercase() == "true")
-            .unwrap_or(false)
-    }
-
-    /// Set up BASE_URL for JWT tests (required for OIDC issuer URL generation)
-    async fn setup_base_url() {
-        let base_url = std::env::var("BASE_URL")
-            .unwrap_or_else(|_| "http://localhost:8000".to_string());
-        let mut url = windmill_common::BASE_URL.write().await;
-        *url = base_url;
-    }
-
-    /// Skip test if RUN_VAULT_TESTS is not set
-    macro_rules! skip_if_no_vault {
-        () => {
-            if !should_run_vault_tests() {
-                println!("Skipping test: RUN_VAULT_TESTS=1 not set");
-                println!("To run vault tests: RUN_VAULT_TESTS=1 cargo test ...");
-                return;
-            }
-        };
-    }
-
-    fn vault_settings_static_token() -> VaultSettings {
-        VaultSettings {
-            address: std::env::var("VAULT_ADDR")
-                .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
-            mount_path: "windmill".to_string(),
-            jwt_role: None, // Static token mode
-            namespace: None,
-            token: Some(
-                std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
-            ),
-        }
-    }
-
-    fn vault_settings_jwt() -> VaultSettings {
-        VaultSettings {
-            address: std::env::var("VAULT_ADDR")
-                .unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
-            mount_path: "windmill".to_string(),
-            jwt_role: Some("windmill-secrets".to_string()), // JWT mode
-            namespace: None,
-            token: None, // No static token - use JWT
-        }
-    }
-
-    // ==================== Static Token Tests ====================
-
-    /// Test Vault connection with static token
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_vault_connection_static_token(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-
-        let settings = vault_settings_static_token();
-        println!("Testing Vault connection with static token...");
-        println!("  Address: {}", settings.address);
-
-        let result = test_vault_connection(&settings, Some(&db)).await;
-        assert!(
-            result.is_ok(),
-            "Failed to connect to Vault: {:?}",
-            result.err()
-        );
-        println!("✓ Successfully connected to Vault with static token");
-    }
-
-    /// Test basic CRUD operations with static token
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_vault_crud_static_token(_db: Pool<Postgres>) {
-        skip_if_no_vault!();
-
-        let settings = vault_settings_static_token();
-        let backend = VaultBackend::new(settings);
-
-        let workspace_id = "test-crud-static";
-        let path = "test-secret";
-        let value = "my-super-secret-value-123";
-
-        println!("Testing CRUD with static token...");
-
-        // Create
-        println!("  Creating secret...");
-        backend
-            .set_secret(workspace_id, path, value)
-            .await
-            .expect("Failed to create secret");
-        println!("  ✓ Created");
-
-        // Read
-        println!("  Reading secret...");
-        let read_value = backend
-            .get_secret(workspace_id, path)
-            .await
-            .expect("Failed to read secret");
-        assert_eq!(read_value, value);
-        println!("  ✓ Read (value matches)");
-
-        // Update
-        println!("  Updating secret...");
-        let new_value = "updated-secret-value-456";
-        backend
-            .set_secret(workspace_id, path, new_value)
-            .await
-            .expect("Failed to update secret");
-        let updated = backend
-            .get_secret(workspace_id, path)
-            .await
-            .expect("Failed to read updated secret");
-        assert_eq!(updated, new_value);
-        println!("  ✓ Updated");
-
-        // Delete
-        println!("  Deleting secret...");
-        backend
-            .delete_secret(workspace_id, path)
-            .await
-            .expect("Failed to delete secret");
-        let result = backend.get_secret(workspace_id, path).await;
-        assert!(result.is_err(), "Secret should be deleted");
-        println!("  ✓ Deleted");
-
-        println!("✓ CRUD operations successful with static token");
-    }
-
-    // ==================== JWT Auth Tests ====================
-
-    /// Test Vault connection with JWT authentication
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_vault_connection_jwt(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-        setup_base_url().await;
-
-        let settings = vault_settings_jwt();
-        println!("Testing Vault connection with JWT auth...");
-        println!("  Address: {}", settings.address);
-        println!("  JWT Role: {:?}", settings.jwt_role);
-        println!("  BASE_URL: {}", windmill_common::BASE_URL.read().await.clone());
-
-        let result = test_vault_connection(&settings, Some(&db)).await;
-        assert!(
-            result.is_ok(),
-            "Failed to connect to Vault with JWT: {:?}",
-            result.err()
-        );
-        println!("✓ Successfully connected to Vault with JWT auth");
-    }
-
-    /// Test basic CRUD operations with JWT authentication
-    #[cfg(feature = "openidconnect")]
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_vault_crud_jwt(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-        setup_base_url().await;
-
-        let settings = vault_settings_jwt();
-        let backend = VaultBackend::new_with_db(settings, db.clone());
-
-        let workspace_id = "test-crud-jwt";
-        let path = "jwt-test-secret";
-        let value = "jwt-authenticated-secret-value";
-
-        println!("Testing CRUD with JWT auth...");
-
-        // Create
-        println!("  Creating secret...");
-        backend
-            .set_secret(workspace_id, path, value)
-            .await
-            .expect("Failed to create secret with JWT");
-        println!("  ✓ Created");
-
-        // Read
-        println!("  Reading secret...");
-        let read_value = backend
-            .get_secret(workspace_id, path)
-            .await
-            .expect("Failed to read secret with JWT");
-        assert_eq!(read_value, value);
-        println!("  ✓ Read (value matches)");
-
-        // Delete (cleanup)
-        println!("  Deleting secret...");
-        backend
-            .delete_secret(workspace_id, path)
-            .await
-            .expect("Failed to delete secret with JWT");
-        println!("  ✓ Deleted");
-
-        println!("✓ CRUD operations successful with JWT auth");
-    }
-
-    // ==================== Migration Tests ====================
-
-    /// Test migration from database to Vault
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_migrate_db_to_vault(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-
-        let settings = vault_settings_static_token();
-
-        // Verify Vault connection
-        test_vault_connection(&settings, Some(&db))
-            .await
-            .expect("Failed to connect to Vault");
-
-        // Check initial state
-        let secrets_before = sqlx::query!(
-            "SELECT workspace_id, path, value FROM variable WHERE is_secret = true ORDER BY workspace_id, path"
-        )
-        .fetch_all(&db)
-        .await
-        .expect("Failed to query secrets");
-
-        println!(
-            "Found {} secrets in database before migration:",
-            secrets_before.len()
-        );
-        for s in &secrets_before {
-            println!("  - {}/{}: {} chars", s.workspace_id, s.path, s.value.len());
-        }
-
-        // Run migration
-        println!("\nMigrating secrets to Vault...");
-        let report = migrate_secrets_to_vault(&db, &settings)
-            .await
-            .expect("Migration to Vault failed");
-
-        println!("Migration report:");
-        println!("  Total secrets: {}", report.total_secrets);
-        println!("  Migrated: {}", report.migrated_count);
-        println!("  Failed: {}", report.failed_count);
-
-        if !report.failures.is_empty() {
-            println!("  Failures:");
-            for f in &report.failures {
-                println!("    - {}/{}: {}", f.workspace_id, f.path, f.error);
-            }
-        }
-
-        assert_eq!(report.failed_count, 0, "Migration had failures");
-        assert!(report.migrated_count > 0, "No secrets were migrated");
-
-        // Verify secrets in Vault
-        println!("\nVerifying secrets in Vault...");
-        let vault_backend = VaultBackend::new(settings.clone());
-
-        for secret in &secrets_before {
-            let result = vault_backend
-                .get_secret(&secret.workspace_id, &secret.path)
-                .await;
-            assert!(
-                result.is_ok(),
-                "Failed to read secret {}/{} from Vault: {:?}",
-                secret.workspace_id,
-                secret.path,
-                result.err()
-            );
-            println!(
-                "  ✓ {}/{} exists in Vault",
-                secret.workspace_id, secret.path
-            );
-        }
-
-        println!("\n✓ Migration to Vault completed successfully");
-    }
-
-    /// Test migration from Vault back to database
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_migrate_vault_to_db(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-
-        let settings = vault_settings_static_token();
-
-        test_vault_connection(&settings, Some(&db))
-            .await
-            .expect("Failed to connect to Vault");
-
-        // First migrate TO Vault
-        println!("Setting up: migrating secrets to Vault first...");
-        let to_vault = migrate_secrets_to_vault(&db, &settings)
-            .await
-            .expect("Initial migration to Vault failed");
-        assert!(to_vault.migrated_count > 0, "No secrets to test with");
-        println!("  Migrated {} secrets to Vault", to_vault.migrated_count);
-
-        // Clear database values
-        println!("\nClearing database secret values...");
-        sqlx::query!("UPDATE variable SET value = 'CLEARED' WHERE is_secret = true")
-            .execute(&db)
-            .await
-            .expect("Failed to clear values");
-
-        // Migrate back from Vault
-        println!("\nMigrating secrets from Vault to database...");
-        let report = migrate_secrets_to_database(&db, &settings)
-            .await
-            .expect("Migration to database failed");
-
-        println!("Migration report:");
-        println!("  Total secrets: {}", report.total_secrets);
-        println!("  Migrated: {}", report.migrated_count);
-        println!("  Failed: {}", report.failed_count);
-
-        assert_eq!(report.failed_count, 0, "Migration had failures");
-        assert!(report.migrated_count > 0, "No secrets were migrated");
-
-        // Verify restored
-        let restored = sqlx::query!(
-            "SELECT COUNT(*) as count FROM variable WHERE is_secret = true AND value != 'CLEARED'"
-        )
-        .fetch_one(&db)
-        .await
-        .expect("Failed to count restored");
-
-        assert!(
-            restored.count.unwrap_or(0) > 0,
-            "No secrets were restored in database"
-        );
-
-        println!("\n✓ Migration to database completed successfully");
-    }
-
-    // ==================== Variable Rename Tests ====================
-
-    /// Test renaming a variable path in Vault
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_variable_rename(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-        let _ = &db; // suppress unused warning
-
-        let settings = vault_settings_static_token();
-        let backend = VaultBackend::new(settings);
-
-        let workspace_id = "test-workspace";
-        let old_path = "u/test-user/old_secret_name";
-        let new_path = "u/test-user/new_secret_name";
-        let value = "secret-value-for-rename-test";
-
-        println!("Testing variable rename in Vault...");
-
-        // Create secret at old path
-        println!("  Creating secret at old path: {}", old_path);
-        backend
-            .set_secret(workspace_id, old_path, value)
-            .await
-            .expect("Failed to create secret");
-
-        // Verify it exists
-        let read_value = backend
-            .get_secret(workspace_id, old_path)
-            .await
-            .expect("Failed to read secret at old path");
-        assert_eq!(read_value, value);
-        println!("  ✓ Secret exists at old path");
-
-        // Simulate rename: read from old, write to new, delete old
-        println!("  Renaming: {} -> {}", old_path, new_path);
-        let secret_value = backend
-            .get_secret(workspace_id, old_path)
-            .await
-            .expect("Failed to read for rename");
-
-        backend
-            .set_secret(workspace_id, new_path, &secret_value)
-            .await
-            .expect("Failed to write to new path");
-
-        backend
-            .delete_secret(workspace_id, old_path)
-            .await
-            .expect("Failed to delete old path");
-
-        // Verify old path is gone
-        let old_result = backend.get_secret(workspace_id, old_path).await;
-        assert!(old_result.is_err(), "Old path should not exist");
-        println!("  ✓ Old path deleted");
-
-        // Verify new path exists with correct value
-        let new_value = backend
-            .get_secret(workspace_id, new_path)
-            .await
-            .expect("Failed to read new path");
-        assert_eq!(new_value, value);
-        println!("  ✓ New path exists with correct value");
-
-        // Cleanup
-        backend
-            .delete_secret(workspace_id, new_path)
-            .await
-            .expect("Failed to cleanup");
-
-        println!("\n✓ Variable rename completed successfully");
-    }
-
-    // ==================== Full Round Trip Test ====================
-
-    /// Test full round-trip: DB -> Vault -> DB with verification
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_full_round_trip(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-
-        let settings = vault_settings_static_token();
-
-        test_vault_connection(&settings, Some(&db))
-            .await
-            .expect("Failed to connect to Vault");
-
-        // Get original secrets
-        let original: HashMap<(String, String), String> = sqlx::query!(
-            "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-        )
-        .fetch_all(&db)
-        .await
-        .expect("Failed to query")
-        .into_iter()
-        .map(|r| ((r.workspace_id, r.path), r.value))
-        .collect();
-
-        println!("Original secrets: {} entries", original.len());
-
-        // Step 1: DB -> Vault
-        println!("\n=== Step 1: Migrate DB -> Vault ===");
-        let to_vault = migrate_secrets_to_vault(&db, &settings)
-            .await
-            .expect("Migration to Vault failed");
-        println!("Migrated {} secrets to Vault", to_vault.migrated_count);
-        assert_eq!(to_vault.failed_count, 0);
-
-        // Step 2: Clear DB
-        println!("\n=== Step 2: Clear database values ===");
-        sqlx::query!("UPDATE variable SET value = 'ROUND_TRIP_CLEARED' WHERE is_secret = true")
-            .execute(&db)
-            .await
-            .expect("Failed to clear");
-
-        // Step 3: Vault -> DB
-        println!("\n=== Step 3: Migrate Vault -> DB ===");
-        let to_db = migrate_secrets_to_database(&db, &settings)
-            .await
-            .expect("Migration to database failed");
-        println!("Migrated {} secrets to database", to_db.migrated_count);
-        assert_eq!(to_db.failed_count, 0);
-
-        // Step 4: Verify
-        println!("\n=== Step 4: Verify round-trip integrity ===");
-        let restored: HashMap<(String, String), String> = sqlx::query!(
-            "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-        )
-        .fetch_all(&db)
-        .await
-        .expect("Failed to query")
-        .into_iter()
-        .map(|r| ((r.workspace_id, r.path), r.value))
-        .collect();
-
-        for ((ws, path), _) in &original {
-            let restored_value = restored
-                .get(&(ws.clone(), path.clone()))
-                .expect(&format!("Secret {}/{} not found after round-trip", ws, path));
-
-            assert_ne!(
-                restored_value, "ROUND_TRIP_CLEARED",
-                "Secret {}/{} was not restored",
-                ws, path
-            );
-            println!("  ✓ {}/{}: restored", ws, path);
-        }
-
-        println!("\n✓ Full round-trip completed successfully!");
-    }
-
-    // ==================== Workspace Isolation Test ====================
-
-    /// Test that workspace isolation is maintained
-    #[sqlx::test(fixtures("base", "secret_backend"))]
-    async fn test_workspace_isolation(db: Pool<Postgres>) {
-        skip_if_no_vault!();
-
-        let settings = vault_settings_static_token();
-        let backend = VaultBackend::new(settings.clone());
-
-        // First migrate secrets to Vault
-        migrate_secrets_to_vault(&db, &settings)
-            .await
-            .expect("Migration failed");
-
-        println!("Testing workspace isolation...");
-
-        // Try to access workspace-2 secret from workspace-1 path (should fail)
-        let cross_access = backend
-            .get_secret("test-workspace", "u/test-user/other_secret")
-            .await;
-
-        assert!(
-            cross_access.is_err(),
-            "Cross-workspace access should fail!"
-        );
-        println!("✓ Cross-workspace access correctly denied");
-
-        // Verify own workspace access works
-        let ws1 = backend
-            .get_secret("test-workspace", "u/test-user/db_password")
-            .await;
-        assert!(ws1.is_ok(), "Same-workspace access should work");
-        println!("✓ Same-workspace access works");
-
-        println!("\n✓ Workspace isolation verified!");
-    }
-}
-
-// OSS version - just a placeholder to avoid compilation errors
-#[cfg(not(all(feature = "private", feature = "enterprise")))]
-mod tests {
-    #[test]
-    fn test_vault_requires_enterprise() {
-        println!("Vault integration tests require Enterprise Edition features");
-        println!("Run with: cargo test --features private,enterprise,openidconnect");
-    }
-}

backend/tests/secret_backend_migration.rs

@@ -1,323 +0,0 @@
-//! Integration tests for secret backend migration between database and HashiCorp Vault.
-//!
-//! These tests require:
-//! 1. A PostgreSQL database (handled by sqlx test framework)
-//! 2. A running HashiCorp Vault instance at http://127.0.0.1:8200
-//!
-//! To run these tests:
-//! ```bash
-//! # Start Vault in dev mode
-//! podman run -d --name vault-test -p 8200:8200 \
-//!     -e VAULT_DEV_ROOT_TOKEN_ID=test-root-token \
-//!     docker.io/hashicorp/vault:latest
-//!
-//! # Enable KV v2 secrets engine
-//! curl -s -H "X-Vault-Token: test-root-token" -X POST \
-//!     --data '{"type":"kv-v2"}' \
-//!     http://127.0.0.1:8200/v1/sys/mounts/windmill
-//!
-//! # Run the tests
-//! cargo test -p windmill secret_backend_migration -- --ignored --nocapture
-//! ```
-
-use sqlx::{Pool, Postgres};
-use windmill_common::error::Result;
-use windmill_common::secret_backend::{
-    vault_oss::{migrate_secrets_to_database, migrate_secrets_to_vault, test_vault_connection, VaultBackend},
-    SecretBackend, VaultSettings,
-};
-
-mod common;
-
-fn test_vault_settings() -> VaultSettings {
-    VaultSettings {
-        address: std::env::var("VAULT_ADDR").unwrap_or_else(|_| "http://127.0.0.1:8200".to_string()),
-        mount_path: "windmill".to_string(),
-        jwt_role: Some("windmill-secrets".to_string()),
-        namespace: None,
-        token: Some(
-            std::env::var("VAULT_TOKEN").unwrap_or_else(|_| "test-root-token".to_string()),
-        ),
-    }
-}
-
-/// Test that we can connect to Vault
-#[sqlx::test(fixtures("base", "secret_backend"))]
-#[ignore = "requires running Vault instance"]
-async fn test_vault_connection_works(db: Pool<Postgres>) {
-    let settings = test_vault_settings();
-
-    let result = test_vault_connection(&settings, Some(&db)).await;
-    assert!(result.is_ok(), "Failed to connect to Vault: {:?}", result.err());
-    println!("✓ Successfully connected to Vault at {}", settings.address);
-}
-
-/// Test migration from database to Vault
-#[sqlx::test(fixtures("base", "secret_backend"))]
-#[ignore = "requires running Vault instance"]
-async fn test_migrate_db_to_vault(db: Pool<Postgres>) {
-    let settings = test_vault_settings();
-
-    // First verify we can connect to Vault
-    test_vault_connection(&settings, Some(&db))
-        .await
-        .expect("Failed to connect to Vault");
-
-    // Check initial state - secrets should exist in database
-    let secrets_before = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true ORDER BY workspace_id, path"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query secrets");
-
-    println!("Found {} secrets in database before migration:", secrets_before.len());
-    for s in &secrets_before {
-        println!("  - {}/{}: {} chars", s.workspace_id, s.path, s.value.len());
-    }
-
-    // Run migration to Vault
-    println!("\nMigrating secrets to Vault...");
-    let report = migrate_secrets_to_vault(&db, &settings)
-        .await
-        .expect("Migration to Vault failed");
-
-    println!("Migration report:");
-    println!("  Total secrets: {}", report.total_secrets);
-    println!("  Migrated: {}", report.migrated_count);
-    println!("  Failed: {}", report.failed_count);
-
-    if !report.failures.is_empty() {
-        println!("  Failures:");
-        for f in &report.failures {
-            println!("    - {}/{}: {}", f.workspace_id, f.path, f.error);
-        }
-    }
-
-    assert_eq!(report.failed_count, 0, "Migration had failures");
-    assert!(report.migrated_count > 0, "No secrets were migrated");
-
-    // Verify secrets are in Vault
-    println!("\nVerifying secrets in Vault...");
-    let vault_backend = VaultBackend::new(settings.clone());
-
-    for secret in &secrets_before {
-        let result: Result<String> = vault_backend
-            .get_secret(&secret.workspace_id, &secret.path)
-            .await;
-        assert!(
-            result.is_ok(),
-            "Failed to read secret {}/{} from Vault: {:?}",
-            secret.workspace_id,
-            secret.path,
-            result.err()
-        );
-        println!("  ✓ {}/{} exists in Vault", secret.workspace_id, secret.path);
-    }
-
-    println!("\n✓ Migration to Vault completed successfully");
-}
-
-/// Test migration from Vault to database
-#[sqlx::test(fixtures("base", "secret_backend"))]
-#[ignore = "requires running Vault instance"]
-async fn test_migrate_vault_to_db(db: Pool<Postgres>) {
-    let settings = test_vault_settings();
-
-    // First verify we can connect to Vault
-    test_vault_connection(&settings, Some(&db))
-        .await
-        .expect("Failed to connect to Vault");
-
-    // First, migrate secrets TO Vault so we have something to migrate back
-    println!("Setting up: migrating secrets to Vault first...");
-    let to_vault_report = migrate_secrets_to_vault(&db, &settings)
-        .await
-        .expect("Initial migration to Vault failed");
-    assert!(to_vault_report.migrated_count > 0, "No secrets to test with");
-    println!("  Migrated {} secrets to Vault", to_vault_report.migrated_count);
-
-    // Clear the database values to simulate fresh migration back
-    println!("\nClearing database secret values...");
-    sqlx::query!("UPDATE variable SET value = 'CLEARED' WHERE is_secret = true")
-        .execute(&db)
-        .await
-        .expect("Failed to clear database values");
-
-    // Verify they were cleared
-    let cleared = sqlx::query!(
-        "SELECT COUNT(*) as count FROM variable WHERE is_secret = true AND value = 'CLEARED'"
-    )
-    .fetch_one(&db)
-    .await
-    .expect("Failed to count cleared");
-    println!("  Cleared {} secret values in database", cleared.count.unwrap_or(0));
-
-    // Now migrate from Vault back to database
-    println!("\nMigrating secrets from Vault to database...");
-    let report = migrate_secrets_to_database(&db, &settings)
-        .await
-        .expect("Migration to database failed");
-
-    println!("Migration report:");
-    println!("  Total secrets: {}", report.total_secrets);
-    println!("  Migrated: {}", report.migrated_count);
-    println!("  Failed: {}", report.failed_count);
-
-    if !report.failures.is_empty() {
-        println!("  Failures:");
-        for f in &report.failures {
-            println!("    - {}/{}: {}", f.workspace_id, f.path, f.error);
-        }
-    }
-
-    assert_eq!(report.failed_count, 0, "Migration had failures");
-    assert!(report.migrated_count > 0, "No secrets were migrated");
-
-    // Verify secrets are restored in database
-    println!("\nVerifying secrets in database...");
-    let secrets_after = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true AND value != 'CLEARED' ORDER BY workspace_id, path"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query restored secrets");
-
-    assert!(
-        !secrets_after.is_empty(),
-        "No secrets were restored in database"
-    );
-
-    for s in &secrets_after {
-        println!("  ✓ {}/{}: {} chars", s.workspace_id, s.path, s.value.len());
-    }
-
-    println!("\n✓ Migration to database completed successfully");
-}
-
-/// Test full round-trip migration: DB -> Vault -> DB
-#[sqlx::test(fixtures("base", "secret_backend"))]
-#[ignore = "requires running Vault instance"]
-async fn test_full_round_trip_migration(db: Pool<Postgres>) {
-    let settings = test_vault_settings();
-
-    // Verify Vault connection
-    test_vault_connection(&settings, Some(&db))
-        .await
-        .expect("Failed to connect to Vault");
-
-    // Get original secrets
-    let original_secrets: std::collections::HashMap<(String, String), String> = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query original secrets")
-    .into_iter()
-    .map(|r| ((r.workspace_id, r.path), r.value))
-    .collect();
-
-    println!("Original secrets: {} entries", original_secrets.len());
-
-    // Step 1: Migrate to Vault
-    println!("\n=== Step 1: Migrate DB -> Vault ===");
-    let to_vault = migrate_secrets_to_vault(&db, &settings)
-        .await
-        .expect("Migration to Vault failed");
-    println!("Migrated {} secrets to Vault", to_vault.migrated_count);
-    assert_eq!(to_vault.failed_count, 0);
-
-    // Step 2: Clear database values
-    println!("\n=== Step 2: Clear database values ===");
-    sqlx::query!("UPDATE variable SET value = 'ROUND_TRIP_CLEARED' WHERE is_secret = true")
-        .execute(&db)
-        .await
-        .expect("Failed to clear values");
-
-    // Step 3: Migrate back from Vault
-    println!("\n=== Step 3: Migrate Vault -> DB ===");
-    let to_db = migrate_secrets_to_database(&db, &settings)
-        .await
-        .expect("Migration to database failed");
-    println!("Migrated {} secrets to database", to_db.migrated_count);
-    assert_eq!(to_db.failed_count, 0);
-
-    // Step 4: Verify round-trip integrity
-    println!("\n=== Step 4: Verify round-trip integrity ===");
-    let restored_secrets: std::collections::HashMap<(String, String), String> = sqlx::query!(
-        "SELECT workspace_id, path, value FROM variable WHERE is_secret = true"
-    )
-    .fetch_all(&db)
-    .await
-    .expect("Failed to query restored secrets")
-    .into_iter()
-    .map(|r| ((r.workspace_id, r.path), r.value))
-    .collect();
-
-    // Compare original and restored
-    for ((ws, path), _original_value) in &original_secrets {
-        let restored_value = restored_secrets
-            .get(&(ws.clone(), path.clone()))
-            .expect(&format!("Secret {}/{} not found after round-trip", ws, path));
-
-        // Note: Values might differ slightly due to encryption/decryption
-        // but they should not be the cleared value
-        assert_ne!(
-            restored_value, "ROUND_TRIP_CLEARED",
-            "Secret {}/{} was not restored",
-            ws, path
-        );
-        println!("  ✓ {}/{}: restored ({} chars)", ws, path, restored_value.len());
-    }
-
-    println!("\n✓ Full round-trip migration completed successfully!");
-    println!("  Original secrets: {}", original_secrets.len());
-    println!("  Restored secrets: {}", restored_secrets.len());
-}
-
-/// Test that workspace isolation is maintained during migration
-#[sqlx::test(fixtures("base", "secret_backend"))]
-#[ignore = "requires running Vault instance"]
-async fn test_workspace_isolation(db: Pool<Postgres>) {
-    let settings = test_vault_settings();
-
-    test_vault_connection(&settings, Some(&db))
-        .await
-        .expect("Failed to connect to Vault");
-
-    // Migrate all secrets to Vault
-    let report = migrate_secrets_to_vault(&db, &settings)
-        .await
-        .expect("Migration failed");
-
-    println!("Migrated {} secrets across workspaces", report.migrated_count);
-
-    // Verify workspace isolation in Vault
-    let vault_backend = VaultBackend::new(settings.clone());
-
-    // Try to access test-workspace-2 secret from test-workspace path (should fail)
-    let cross_workspace_result: Result<String> = vault_backend
-        .get_secret("test-workspace", "u/test-user/other_secret")
-        .await;
-
-    assert!(
-        cross_workspace_result.is_err(),
-        "Cross-workspace access should fail - workspace isolation violated!"
-    );
-    println!("✓ Cross-workspace access correctly denied");
-
-    // Verify each workspace's secrets are accessible from their own workspace
-    let ws1_result: Result<String> = vault_backend
-        .get_secret("test-workspace", "u/test-user/db_password")
-        .await;
-    assert!(ws1_result.is_ok(), "test-workspace secret should be accessible");
-    println!("✓ test-workspace secrets accessible");
-
-    let ws2_result: Result<String> = vault_backend
-        .get_secret("test-workspace-2", "u/test-user/other_secret")
-        .await;
-    assert!(ws2_result.is_ok(), "test-workspace-2 secret should be accessible");
-    println!("✓ test-workspace-2 secrets accessible");
-
-    println!("\n✓ Workspace isolation verified!");
-}