fix: prevent retention cleanup from deleting jobs of active flows

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/settings.json

@@ -1,39 +1,4 @@
 {
-  "hooks": {
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/resolve-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
-    "SessionEnd": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ]
-  },
   "permissions": {
     "allow": [
       "Bash(ls:*)",
@@ -93,8 +58,44 @@
     ]
   },
   "enableAllProjectMcpServers": true,
+  "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/resolve-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ]
+  },
   "enabledPlugins": {
     "rust-analyzer-lsp@claude-plugins-official": true,
-    "typescript-lsp@claude-plugins-official": true
+    "typescript-lsp@claude-plugins-official": true,
+    "code-review@claude-plugins-official": true
   }
 }

.claude/skills/commit/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: commit
+user_invocable: true
+description: Create a git commit with conventional commit format. MUST use anytime you want to commit changes.
+---
+
+# Git Commit Skill
+
+Create a focused, single-line commit following conventional commit conventions.
+
+## Instructions
+
+1. **Analyze changes**: Run `git status` and `git diff` to understand what was modified
+2. **Stage only modified files**: Add files individually by name. NEVER use `git add -A` or `git add .`
+3. **Write commit message**: Follow the conventional commit format as a single line
+
+## Conventional Commit Format
+
+```
+<type>: <description>
+```
+
+### Types
+- `feat`: New feature or capability
+- `fix`: Bug fix
+- `refactor`: Code change that neither fixes a bug nor adds a feature
+- `docs`: Documentation only changes
+- `style`: Formatting, missing semicolons, etc (no code change)
+- `test`: Adding or correcting tests
+- `chore`: Maintenance tasks, dependency updates, etc
+- `perf`: Performance improvement
+
+### Rules
+- Message MUST be a single line (no multi-line messages)
+- Description should be lowercase, imperative mood ("add" not "added")
+- No period at the end
+- Keep under 72 characters total
+
+### Examples
+```
+feat: add token usage tracking for AI providers
+fix: resolve null pointer in job executor
+refactor: extract common validation logic
+docs: update API endpoint documentation
+chore: upgrade sqlx to 0.7
+```
+
+## Execution Steps
+
+1. Run `git status` to see all changes
+2. Run `git diff` to understand the changes in detail
+3. Run `git log --oneline -5` to see recent commit style
+4. Stage ONLY the modified/relevant files: `git add <file1> <file2> ...`
+5. Create the commit with conventional format:
+   ```bash
+   git commit -m "<type>: <description>
+
+   Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>"
+   ```
+6. Run `git status` to verify the commit succeeded

.claude/skills/pr/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: pr
+user_invocable: true
+description: Open a draft pull request on GitHub. MUST use when you want to create/open a PR.
+---
+
+# Pull Request Skill
+
+Create a draft pull request with a clear title and explicit description of changes.
+
+## Instructions
+
+1. **Analyze branch changes**: Understand all commits since diverging from main
+2. **Push to remote**: Ensure all commits are pushed
+3. **Create draft PR**: Always open as draft for review before merging
+
+## PR Title Format
+
+Follow conventional commit format for the PR title:
+```
+<type>: <description>
+```
+
+### Types
+- `feat`: New feature or capability
+- `fix`: Bug fix
+- `refactor`: Code restructuring
+- `docs`: Documentation changes
+- `chore`: Maintenance tasks
+- `perf`: Performance improvements
+
+### Title Rules
+- Keep under 70 characters
+- Use lowercase, imperative mood
+- No period at the end
+
+## PR Body Format
+
+The body MUST be explicit about what changed. Structure:
+
+```markdown
+## Summary
+<Clear description of what this PR does and why>
+
+## Changes
+- <Specific change 1>
+- <Specific change 2>
+- <Specific change 3>
+
+## Test plan
+- [ ] <How to verify change 1>
+- [ ] <How to verify change 2>
+
+---
+Generated with [Claude Code](https://claude.com/claude-code)
+```
+
+## Execution Steps
+
+1. Run `git status` to check for uncommitted changes
+2. Run `git log main..HEAD --oneline` to see all commits in this branch
+3. Run `git diff main...HEAD` to see the full diff against main
+4. Check if remote branch exists and is up to date:
+   ```bash
+   git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null || echo "no upstream"
+   ```
+5. Push to remote if needed: `git push -u origin HEAD`
+6. Create draft PR using gh CLI:
+   ```bash
+   gh pr create --draft --title "<type>: <description>" --body "$(cat <<'EOF'
+   ## Summary
+   <description>
+
+   ## Changes
+   - <change 1>
+   - <change 2>
+
+   ## Test plan
+   - [ ] <test 1>
+   - [ ] <test 2>
+
+   ---
+   Generated with [Claude Code](https://claude.com/claude-code)
+   EOF
+   )"
+   ```
+7. Return the PR URL to the user

.claude/skills/rust-backend/SKILL.md

@@ -0,0 +1,495 @@
+---
+name: rust-backend
+description: Rust coding guidelines for the Windmill backend. MUST use when writing or modifying Rust code in the backend directory.
+---
+
+# Rust Backend Coding Guidelines
+
+Apply these patterns when writing or modifying Rust code in the `backend/` directory.
+
+## Data Structure Design
+
+Choose between `struct`, `enum`, or `newtype` based on domain needs:
+
+- Use `enum` for state machines instead of boolean flags or loosely related fields
+- Model invariants explicitly using types (e.g., `NonZeroU32`, `Duration`, custom enums)
+- Consider ownership of each field:
+  - Use `&str` vs `String`, slices vs vectors
+  - Use `Arc<T>` when sharing across threads
+  - Use `Cow<'a, T>` for flexible ownership
+
+```rust
+// State machine with enum
+enum JobState {
+    Pending { scheduled_for: DateTime<Utc> },
+    Running { started_at: DateTime<Utc>, worker: String },
+    Completed { result: JobResult, duration_ms: i64 },
+    Failed { error: String, retries: u32 },
+}
+
+// Avoid multiple booleans
+struct Job {
+    is_pending: bool,   // Don't do this
+    is_running: bool,
+    is_completed: bool,
+}
+```
+
+## Impl Block Organization
+
+Place `impl` blocks immediately below the struct/enum they modify. Group methods logically:
+
+```rust
+struct JobQueue {
+    jobs: Vec<Job>,
+    capacity: usize,
+}
+
+impl JobQueue {
+    // Constructors first
+    pub fn new(capacity: usize) -> Self { ... }
+    pub fn with_jobs(jobs: Vec<Job>) -> Self { ... }
+
+    // Getters
+    pub fn len(&self) -> usize { ... }
+    pub fn is_empty(&self) -> bool { ... }
+
+    // Mutation methods
+    pub fn push(&mut self, job: Job) -> Result<()> { ... }
+    pub fn pop(&mut self) -> Option<Job> { ... }
+
+    // Domain logic
+    pub fn next_scheduled(&self) -> Option<&Job> { ... }
+}
+```
+
+## Iterator Chains Over For-Loops
+
+Prefer functional iterator chains (`.filter().map().collect()`) over imperative for-loops:
+
+```rust
+// Preferred
+let results: Vec<_> = items
+    .iter()
+    .filter(|item| item.is_valid())
+    .map(|item| item.transform())
+    .collect();
+
+// Avoid
+let mut results = Vec::new();
+for item in items.iter() {
+    if item.is_valid() {
+        results.push(item.transform());
+    }
+}
+```
+
+## Error Handling
+
+Use the `Error` type from `windmill_common::error`. Return `Result<T, Error>` or `JsonResult<T>` for fallible functions:
+
+```rust
+use windmill_common::error::{Error, Result};
+
+// Use ? operator for propagation
+pub async fn get_job(db: &DB, id: Uuid) -> Result<Job> {
+    let job = sqlx::query_as!(Job, "SELECT ... WHERE id = $1", id)
+        .fetch_optional(db)
+        .await?
+        .ok_or_else(|| Error::NotFound("job not found".to_string()))?;
+    Ok(job)
+}
+```
+
+Prefer `if let` for optional handling. Use `let...else` when early return makes code clearer:
+
+```rust
+let Some(config) = get_config() else {
+    return Err(Error::MissingConfig);
+};
+```
+
+Never panic in library code. Reserve `.unwrap()` for cases with compile-time guarantees. Keep functions short to help lifetime inference and clarity.
+
+## Early Returns
+
+Return early to avoid deep nesting. Handle error cases and edge conditions first:
+
+```rust
+// Preferred - early returns
+fn process_job(job: Option<Job>) -> Result<Output> {
+    let Some(job) = job else {
+        return Ok(Output::default());
+    };
+
+    if !job.is_valid() {
+        return Err(Error::InvalidJob);
+    }
+
+    if job.is_cached() {
+        return Ok(job.cached_result());
+    }
+
+    // Main logic at the end, not nested
+    execute_job(job)
+}
+
+// Avoid - deep nesting
+fn process_job(job: Option<Job>) -> Result<Output> {
+    if let Some(job) = job {
+        if job.is_valid() {
+            if !job.is_cached() {
+                execute_job(job)
+            } else {
+                Ok(job.cached_result())
+            }
+        } else {
+            Err(Error::InvalidJob)
+        }
+    } else {
+        Ok(Output::default())
+    }
+}
+```
+
+## Variable Shadowing
+
+Shadow variables instead of creating new names with prefixes:
+
+```rust
+// Preferred
+let data = fetch_raw_data();
+let data = parse(data);
+let data = validate(data)?;
+
+// Avoid
+let raw_data = fetch_raw_data();
+let parsed_data = parse(raw_data);
+let validated_data = validate(parsed_data)?;
+```
+
+## Minimal Comments
+
+- No inline comments explaining obvious code
+- No TODO/FIXME comments in committed code
+- Doc comments (`///`) only on public items
+- Let code be self-documenting through clear naming
+
+## Type Safety
+
+Use enums over boolean flags for clarity:
+
+```rust
+// Preferred
+enum JobStatus {
+    Pending,
+    Running,
+    Completed,
+}
+
+// Avoid
+struct Job {
+    is_running: bool,
+    is_completed: bool,
+}
+```
+
+## Pattern Matching
+
+Prefer explicit matching. Use wildcards strategically for fallback cases or ignored fields:
+
+```rust
+// Explicit matching preferred
+match status {
+    JobStatus::Pending => handle_pending(),
+    JobStatus::Running => handle_running(),
+    JobStatus::Completed => handle_completed(),
+}
+
+// Wildcards OK for fallback
+match result {
+    Ok(value) => process(value),
+    Err(_) => return default_value(),
+}
+
+// Wildcards OK for ignoring fields in destructuring
+let Point { x, y, .. } = point;
+```
+
+## Destructuring in Function Signatures
+
+Destructure structs directly in function parameters:
+
+```rust
+// Preferred
+async fn process_job(
+    Extension(db): Extension<DB>,
+    Path((workspace, job_id)): Path<(String, Uuid)>,
+    Query(pagination): Query<Pagination>,
+) -> Result<Json<Job>> {
+    // ...
+}
+
+// Avoid
+async fn process_job(
+    db_ext: Extension<DB>,
+    path: Path<(String, Uuid)>,
+    query: Query<Pagination>,
+) -> Result<Json<Job>> {
+    let Extension(db) = db_ext;
+    let Path((workspace, job_id)) = path;
+    // ...
+}
+```
+
+## Trait Implementations
+
+Use standard trait implementations to simplify conversions and reduce boilerplate:
+
+```rust
+// Implement From/Into for type conversions
+impl From<DbJob> for ApiJob {
+    fn from(db: DbJob) -> Self {
+        ApiJob {
+            id: db.id,
+            status: db.status.into(),
+        }
+    }
+}
+
+// Use TryFrom for fallible conversions
+impl TryFrom<String> for JobKind {
+    type Error = Error;
+    fn try_from(s: String) -> Result<Self, Self::Error> { ... }
+}
+```
+
+Apply `derive` macros to reduce boilerplate:
+
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Job { ... }
+```
+
+## Module Structure
+
+- Use `pub(crate)` instead of `pub` when possible; expose only what needs exposing
+- Keep APIs small and expressive; avoid leaking internal types
+- Organize code into modules reflecting ownership and domain boundaries
+
+```rust
+// Prefer restricted visibility
+pub(crate) fn internal_helper() { ... }
+
+// Only pub for external API
+pub fn create_job(...) -> Result<Job> { ... }
+```
+
+## Code Navigation
+
+Always use rust-analyzer LSP for:
+- Go to definition
+- Find references
+- Type information
+- Import resolution
+
+Do not guess at module paths or type definitions.
+
+## JSON Handling
+
+Prefer `Box<serde_json::value::RawValue>` over `serde_json::Value` when:
+- Storing JSON in the database (JSONB columns)
+- Passing JSON through without modification
+- The JSON structure doesn't need inspection
+
+```rust
+// Preferred - avoids parsing/serialization overhead
+pub struct Job {
+    pub id: Uuid,
+    pub args: Option<Box<serde_json::value::RawValue>>,
+}
+
+// Only use Value when you need to inspect/modify JSON
+let value: serde_json::Value = serde_json::from_str(&json)?;
+if let Some(field) = value.get("field") {
+    // modify or inspect
+}
+```
+
+## Serde Optimizations
+
+Use serde attributes to optimize serialization:
+
+```rust
+#[derive(Serialize, Deserialize)]
+pub struct Job {
+    #[serde(rename = "jobId")]
+    pub id: Uuid,
+
+    #[serde(default)]
+    pub priority: i32,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parent_job: Option<Uuid>,
+
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub tags: Vec<String>,
+}
+```
+
+Prefer borrowing for zero-copy deserialization when lifetimes allow:
+
+```rust
+#[derive(Deserialize)]
+pub struct JobInput<'a> {
+    #[serde(borrow)]
+    pub workspace_id: Cow<'a, str>,
+
+    #[serde(borrow)]
+    pub script_path: &'a str,
+}
+```
+
+## SQLx Patterns
+
+**Never use `SELECT *`** - always list columns explicitly. This is critical for backwards compatibility when workers run behind the API server version:
+
+```rust
+// Preferred - explicit columns
+sqlx::query_as!(
+    Job,
+    "SELECT id, workspace_id, path, created_at FROM v2_job WHERE id = $1",
+    job_id
+)
+
+// Avoid - breaks when columns are added
+sqlx::query_as!(Job, "SELECT * FROM v2_job WHERE id = $1", job_id)
+```
+
+Use batch operations to minimize round trips:
+
+```rust
+// Preferred - single query with multiple values
+sqlx::query!(
+    "INSERT INTO job_logs (job_id, logs) VALUES ($1, $2), ($3, $4)",
+    id1, log1, id2, log2
+)
+
+// Avoid N+1 queries
+for id in ids {
+    sqlx::query!("SELECT ... WHERE id = $1", id).fetch_one(db).await?;
+}
+
+// Preferred - single query with IN clause
+sqlx::query!("SELECT ... WHERE id = ANY($1)", &ids[..]).fetch_all(db).await?
+```
+
+Use transactions for multi-step operations and parameterize all queries.
+
+## Async & Tokio Patterns
+
+Never block the async runtime. Use `spawn_blocking` for CPU-intensive or blocking I/O:
+
+```rust
+// Preferred - offload blocking work
+let result = tokio::task::spawn_blocking(move || {
+    expensive_computation(&data)
+}).await?;
+
+// Avoid - blocks the runtime
+let result = expensive_computation(&data);  // Don't do this in async
+```
+
+Use tokio primitives for sleep and channels:
+
+```rust
+use tokio::sync::mpsc;
+use tokio::time::sleep;
+
+// Avoid in async contexts
+use std::thread::sleep; // Blocks the runtime
+```
+
+Use bounded channels for backpressure:
+
+```rust
+// Preferred - bounded channel prevents overwhelming
+let (tx, rx) = tokio::sync::mpsc::channel(100);
+
+// Be careful with unbounded
+let (tx, rx) = tokio::sync::mpsc::unbounded_channel();
+```
+
+## Mutex Selection in Async Code
+
+**Prefer `std::sync::Mutex` (or `parking_lot::Mutex`) over `tokio::sync::Mutex`** for protecting data in async code. The async mutex is more expensive and only needed when holding locks across `.await` points.
+
+```rust
+// Preferred for data protection - std mutex is faster
+use std::sync::Mutex;
+
+struct Cache {
+    data: Mutex<HashMap<String, Value>>,
+}
+
+impl Cache {
+    fn get(&self, key: &str) -> Option<Value> {
+        self.data.lock().unwrap().get(key).cloned()
+    }
+
+    fn insert(&self, key: String, value: Value) {
+        self.data.lock().unwrap().insert(key, value);
+    }
+}
+```
+
+**Use `tokio::sync::Mutex` only when you must hold the lock across `.await` points**, typically for IO resources like database connections:
+
+```rust
+use tokio::sync::Mutex;
+use std::sync::Arc;
+
+// Async mutex for IO resources held across await points
+let conn = Arc::new(Mutex::new(db_connection));
+
+async fn execute_query(conn: Arc<Mutex<DbConn>>, query: &str) {
+    let mut lock = conn.lock().await;
+    lock.execute(query).await;  // Lock held across .await
+}
+```
+
+**Common pattern**: Wrap `Arc<Mutex<...>>` in a struct with non-async methods that lock internally, keeping lock scope minimal:
+
+```rust
+struct SharedState {
+    inner: std::sync::Mutex<StateInner>,
+}
+
+impl SharedState {
+    fn update(&self, value: i32) {
+        self.inner.lock().unwrap().value = value;
+    }
+
+    fn get(&self) -> i32 {
+        self.inner.lock().unwrap().value
+    }
+}
+```
+
+**Alternative for IO resources**: Spawn a dedicated task to manage the resource and communicate via message passing:
+
+```rust
+let (tx, mut rx) = tokio::sync::mpsc::channel(32);
+
+tokio::spawn(async move {
+    while let Some(cmd) = rx.recv().await {
+        handle_io_command(&mut resource, cmd).await;
+    }
+});
+```
+
+## Build & Tooling
+
+Build speed tips:
+- Use `cargo check` during rapid iteration over `cargo build`
+- Minimize unnecessary dependencies and feature flags

.github/workflows/cli-tests.yml

@@ -79,6 +79,17 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Symlink Bun to /usr/bin/bun
+        run: sudo ln -sf $(which bun) /usr/bin/bun
+
+      - name: Symlink Node to /usr/bin/node
+        run: sudo ln -sf $(which node) /usr/bin/node
+
       - name: Generate Windmill clients
         working-directory: cli
         run: |
@@ -125,6 +136,20 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Get Bun and Node paths
+        id: runtime-paths
+        shell: pwsh
+        run: |
+          $bunPath = (Get-Command bun).Source
+          $nodePath = (Get-Command node).Source
+          echo "BUN_PATH=$bunPath" >> $env:GITHUB_OUTPUT
+          echo "NODE_BIN_PATH=$nodePath" >> $env:GITHUB_OUTPUT
+
       - name: Generate Windmill clients
         working-directory: cli
         shell: bash
@@ -138,6 +163,8 @@ jobs:
         env:
           DATABASE_URL: postgres://postgres:changeme@localhost:5432
           CI_MINIMAL_FEATURES: "true"
+          BUN_PATH: ${{ steps.runtime-paths.outputs.BUN_PATH }}
+          NODE_BIN_PATH: ${{ steps.runtime-paths.outputs.NODE_BIN_PATH }}
         run: |
           deno test --no-check --allow-all test/ `
             --ignore=test/cargo_backend_example.test.ts

CHANGELOG.md

@@ -1,5 +1,99 @@
 # Changelog
 
+## [1.623.0](https://github.com/windmill-labs/windmill/compare/v1.622.0...v1.623.0) (2026-01-31)
+
+
+### Features
+
+* add PocketID OAuth provider support ([#7318](https://github.com/windmill-labs/windmill/issues/7318)) ([720e3c5](https://github.com/windmill-labs/windmill/commit/720e3c543623c2612b1af704c13d032c53368efb))
+
+
+### Bug Fixes
+
+* add schema compatibility layer for MCP clients like n8n ([#7747](https://github.com/windmill-labs/windmill/issues/7747)) ([297aa23](https://github.com/windmill-labs/windmill/commit/297aa23ed46315dfd4b034d44361a5bd8aaca884))
+* preserve script envs field during sync push ([f405dff](https://github.com/windmill-labs/windmill/commit/f405dff2e22681dc8d4f3a9b7427e278c6cfb0cc))
+
+## [1.622.0](https://github.com/windmill-labs/windmill/compare/v1.621.2...v1.622.0) (2026-01-29)
+
+
+### Features
+
+* add token usage tracking to AI agent output ([#7738](https://github.com/windmill-labs/windmill/issues/7738)) ([ce23f21](https://github.com/windmill-labs/windmill/commit/ce23f21c0e0bc6365f616ace4c45fa341741c555))
+* workspace dedicated workers ([#7741](https://github.com/windmill-labs/windmill/issues/7741)) ([60858d1](https://github.com/windmill-labs/windmill/commit/60858d1e20e68b83fddcdbfc0ff34decaff5d1c5))
+
+
+### Bug Fixes
+
+* forward teams error to client ([#7746](https://github.com/windmill-labs/windmill/issues/7746)) ([ca8dbc0](https://github.com/windmill-labs/windmill/commit/ca8dbc0676dda619aff6fab7f6ff05ed773738e0))
+* indexer build error ([#7744](https://github.com/windmill-labs/windmill/issues/7744)) ([6679ecb](https://github.com/windmill-labs/windmill/commit/6679ecb9a2ead08d2252a64f2a27a6d539fa23e9))
+* remove uuid-ossp extension requirement for RDS compatibility ([ad5293c](https://github.com/windmill-labs/windmill/commit/ad5293c0edacfaf1431a3639ef5ea32d9bd761b0))
+* require AGENT_TOKEN and BASE_INTERNAL_URL for agent mode ([6c84a89](https://github.com/windmill-labs/windmill/commit/6c84a8905382e29a4bbe0ae947eda794bc4dc566))
+* visibility bug on deployment UI (issue when renaming items) + add tracking of folders and resource types ([#7739](https://github.com/windmill-labs/windmill/issues/7739)) ([998f11a](https://github.com/windmill-labs/windmill/commit/998f11a10da45c6d933d8b78ca24ed4f55a53f3b))
+
+## [1.621.2](https://github.com/windmill-labs/windmill/compare/v1.621.1...v1.621.2) (2026-01-29)
+
+
+### Bug Fixes
+
+* **cli:** revert findCodebase change that broke ../shared codebases ([#7740](https://github.com/windmill-labs/windmill/issues/7740)) ([20357f4](https://github.com/windmill-labs/windmill/commit/20357f41f55ce246220ec56ef257ea7d6ac82e3a))
+* do not quit indexer when receiving handoff during pull ([#7659](https://github.com/windmill-labs/windmill/issues/7659)) ([8bb6b63](https://github.com/windmill-labs/windmill/commit/8bb6b6331b74d43b1ecfa08d3393254f54a94f87))
+
+## [1.621.1](https://github.com/windmill-labs/windmill/compare/v1.621.0...v1.621.1) (2026-01-29)
+
+
+### Bug Fixes
+
+* add 32MB memory limit to QuickJS runtime for flow expressions ([db74470](https://github.com/windmill-labs/windmill/commit/db74470ec355ae317a50f350133fc140d2921595))
+
+## [1.621.0](https://github.com/windmill-labs/windmill/compare/v1.620.1...v1.621.0) (2026-01-29)
+
+
+### Features
+
+* add QuickJS as alternative JS engine for flow expression evaluation ([#7664](https://github.com/windmill-labs/windmill/issues/7664)) ([5c20b37](https://github.com/windmill-labs/windmill/commit/5c20b37a537bae09ce13ef133ac12fd5976d9c37))
+
+
+### Bug Fixes
+
+* return null for non-existent step access in flow expressions ([22cce51](https://github.com/windmill-labs/windmill/commit/22cce51db55fe2b08a4f38cbddf98c12c861542d))
+
+## [1.620.1](https://github.com/windmill-labs/windmill/compare/v1.620.0...v1.620.1) (2026-01-28)
+
+
+### Bug Fixes
+
+* codebase preview in standalone mode ([c59699a](https://github.com/windmill-labs/windmill/commit/c59699acd73aa170d5bd65d903db6b635c19f9ad))
+
+## [1.620.0](https://github.com/windmill-labs/windmill/compare/v1.619.0...v1.620.0) (2026-01-28)
+
+
+### Features
+
+* **cli:** add script preview and flow preview commands ([#7729](https://github.com/windmill-labs/windmill/issues/7729)) ([95cbb2c](https://github.com/windmill-labs/windmill/commit/95cbb2c86ce66abd8e5488400b2367a22237e8c7))
+
+
+### Bug Fixes
+
+* cache git branch detection to avoid repeated execSync calls ([eafee16](https://github.com/windmill-labs/windmill/commit/eafee16bfc66081a0d1d575020fc4e40c76feb8a))
+
+## [1.619.0](https://github.com/windmill-labs/windmill/compare/v1.618.2...v1.619.0) (2026-01-28)
+
+
+### Features
+
+* enable tree-shaking for windmill-client ([b6abcc3](https://github.com/windmill-labs/windmill/commit/b6abcc33a121423faaa41d9eef5488df67686fe7))
+
+
+### Bug Fixes
+
+* **backend:** leave job and audit history and archive workspace when changing workspace id ([#7724](https://github.com/windmill-labs/windmill/issues/7724)) ([d3d35d4](https://github.com/windmill-labs/windmill/commit/d3d35d4cd86dc73a4e2e007f457bc945ccef8263))
+* **cli:** handle symlinks in isMain() for Node.js ([116b9e7](https://github.com/windmill-labs/windmill/commit/116b9e7db38cd0a9ec2a5c5780a9004ff2015a02))
+* fix TypeScript default export for Monaco/ATA compatibility ([a02938c](https://github.com/windmill-labs/windmill/commit/a02938c80c425b5964e815722be9919ea405234b))
+* make api key optional ([#7726](https://github.com/windmill-labs/windmill/issues/7726)) ([82f378b](https://github.com/windmill-labs/windmill/commit/82f378bcb4d29f5c272c70564d30814542115fed))
+* nativets http tracing ([#7716](https://github.com/windmill-labs/windmill/issues/7716)) ([f50a866](https://github.com/windmill-labs/windmill/commit/f50a866430da8f5f43cb3163ec116fe254407ef9))
+* Raw apps deployment UI (and merge UI) ([#7725](https://github.com/windmill-labs/windmill/issues/7725)) ([36dad2c](https://github.com/windmill-labs/windmill/commit/36dad2c7a29e4880bdf0198611e07a4366b01edf))
+* use tsc for clean .d.ts files instead of tsdown bundled types ([0f62558](https://github.com/windmill-labs/windmill/commit/0f625580f37e562240bdaa155e8b25e889bb680d))
+
 ## [1.618.2](https://github.com/windmill-labs/windmill/compare/v1.618.1...v1.618.2) (2026-01-28)
 
 

backend/.sqlx/query-02bf9763298f301d4fc75490c070a0663142d4d23a2df007361622b94d4783e1.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT flow_version.value AS \"value!: sqlx::types::Json<Box<sqlx::types::JsonRawValue>>\" \n                FROM flow \n                LEFT JOIN flow_version \n                    ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]\n                WHERE flow.path = $1 AND flow.workspace_id = $2",
+  "query": "SELECT flow_version.value AS \"value!: sqlx::types::Json<Box<sqlx::types::JsonRawValue>>\"\n                FROM flow\n                LEFT JOIN flow_version\n                    ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]\n                WHERE flow.path = $1 AND flow.workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -19,5 +19,5 @@
       false
     ]
   },
-  "hash": "bbce3e1eae78c48409d4204cd6cb3b9db088f6e51bea5e74a494c4e9f4c3b78e"
+  "hash": "02bf9763298f301d4fc75490c070a0663142d4d23a2df007361622b94d4783e1"
 }

backend/.sqlx/query-0cfb1528c3636dd1f43c41b91aa340862ed795f96870dd9ec999ea7e9373ec51.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE job_stats SET workspace_id = $1 WHERE workspace_id = $2",
+  "query": "UPDATE mcp_oauth_server_code SET workspace_id = $1 WHERE workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "65121a4bfba70c2d7055a2b58c8520fddaef1bd9a3f041e851f9c136c73d34e7"
+  "hash": "0cfb1528c3636dd1f43c41b91aa340862ed795f96870dd9ec999ea7e9373ec51"
 }

backend/.sqlx/query-14110b9c1b68cf29a6cbdfa737707a44bda831246736e60d63696c3227491adb.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/old_name', 'resource', 0, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_name', 'resource', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "14110b9c1b68cf29a6cbdfa737707a44bda831246736e60d63696c3227491adb"
+}

backend/.sqlx/query-18272dde939afcd87464d74c03bc3c8ee4395919fbfa50565d8d800e3886911e.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET value = $1\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/original_flow'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "18272dde939afcd87464d74c03bc3c8ee4395919fbfa50565d8d800e3886911e"
+}

backend/.sqlx/query-1d32bd9309bf2066399b446e8c47502a0ec72ffc07b22593311915ab5e98f80a.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n    SELECT \n        tag\n    FROM \n        v2_job\n    WHERE \n        id = $1\n    ",
+  "query": "\n    SELECT\n        tag\n    FROM\n        v2_job\n    WHERE\n        id = $1\n    ",
   "describe": {
     "columns": [
       {
@@ -18,5 +18,5 @@
       false
     ]
   },
-  "hash": "49e2430af74ec10857e5df7f7e1ad1b53ba70bb51b0259a1f765f76db9b733ad"
+  "hash": "1d32bd9309bf2066399b446e8c47502a0ec72ffc07b22593311915ab5e98f80a"
 }

backend/.sqlx/query-1ed8d27979cd903cfd12f52461aada26f807236364fb56bf826228983bdab3ab.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_in_parent', 'script', 1, 0, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'new_type', 'resource_type', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "1ed8d27979cd903cfd12f52461aada26f807236364fb56bf826228983bdab3ab"
+}

backend/.sqlx/query-21941635afc295e5a42aceffce7aad910477c4537e9fe40b227e4ecc7eae76d3.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET archived = true\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/to_delete'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "21941635afc295e5a42aceffce7aad910477c4537e9fe40b227e4ecc7eae76d3"
+}

backend/.sqlx/query-2248e2c5ca8e6fe58704e45066477a1257b15cde7ea44962ce8566d6d7396add.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_in_fork', 'script', 0, 1, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "2248e2c5ca8e6fe58704e45066477a1257b15cde7ea44962ce8566d6d7396add"
+}

backend/.sqlx/query-2925aee1a56827a1ca839673ea4c6fb21c7ef440d1a7ee57e7efd6a079db16d5.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE job_logs SET workspace_id = $1\n         WHERE job_id IN (SELECT id FROM v2_job WHERE workspace_id = $1)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2925aee1a56827a1ca839673ea4c6fb21c7ef440d1a7ee57e7efd6a079db16d5"
-}

backend/.sqlx/query-306e0156ee1541710c1c6512ecb4f61baeb3ae6f31ba3fd57a3ec485108a7f49.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM v2_job_completed\n         WHERE id IN (\n             SELECT id FROM v2_job_completed\n             WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval\n             ORDER BY completed_at ASC\n             LIMIT $2\n             FOR UPDATE SKIP LOCKED\n         )\n         RETURNING id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "306e0156ee1541710c1c6512ecb4f61baeb3ae6f31ba3fd57a3ec485108a7f49"
-}

backend/.sqlx/query-338f8f878aba9d9361b17329ee448ee4582194cbbc853d26abd285c259642c60.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT has_changes, exists_in_source, exists_in_fork FROM workspace_diff\n         WHERE path = 'f/shared/new_in_parent' AND kind = 'script' AND source_workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_changes",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "exists_in_source",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "exists_in_fork",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "338f8f878aba9d9361b17329ee448ee4582194cbbc853d26abd285c259642c60"
+}

backend/.sqlx/query-33ad6eb46a13dd49605fdb863a03602878c9d1f40f61e349e06698140133153f.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script\n         SET content = 'def main(): return \"fork_modified\"', summary = 'Modified in fork'\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/to_modify_fork'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "33ad6eb46a13dd49605fdb863a03602878c9d1f40f61e349e06698140133153f"
+}

backend/.sqlx/query-3439a44ea40ea748346af50bc1529dc8fd135c8cb54b7e39d03b326c30a0ab25.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)\n         VALUES\n         ('test-workspace', 'f/shared/original_script', 12345, 'def main(): pass', 'Original', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_modify_parent', 22222, 'def main(): return 1', 'To modify in parent', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_modify_fork', 33333, 'def main(): return 2', 'To modify in fork', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_conflict', 44444, 'def main(): return 3', 'To conflict', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_delete', 55555, 'def main(): return 4', 'To delete', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "3439a44ea40ea748346af50bc1529dc8fd135c8cb54b7e39d03b326c30a0ab25"
+}

backend/.sqlx/query-452fe403cef5a62cb34b9996794c1607757eecba9d2d0326b09d6fcd4dc45c12.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE mcp_oauth_refresh_token SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "452fe403cef5a62cb34b9996794c1607757eecba9d2d0326b09d6fcd4dc45c12"
+}

backend/.sqlx/query-45997fcb4d9d62c7f7011966bf59bdb86e12ce1d0c8e925e738d2645121a5c1f.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM v2_job_completed\n         WHERE id IN (\n             SELECT jc.id FROM v2_job_completed jc\n             LEFT JOIN v2_job j ON j.id = jc.id\n             WHERE jc.completed_at <= now() - ($1::bigint::text || ' s')::interval\n               AND COALESCE(j.root_job, j.flow_innermost_root_job, jc.id) != ALL($3)\n             ORDER BY jc.completed_at ASC\n             LIMIT $2\n             FOR UPDATE OF jc SKIP LOCKED\n         )\n         RETURNING id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "45997fcb4d9d62c7f7011966bf59bdb86e12ce1d0c8e925e738d2645121a5c1f"
+}

backend/.sqlx/query-49e4bef9d5e366c179d33794472201bfca768ee5ead967e0232fa87a59b9747c.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id FROM app WHERE path = 'f/shared/dashboard' AND workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "49e4bef9d5e366c179d33794472201bfca768ee5ead967e0232fa87a59b9747c"
+}

backend/.sqlx/query-4c1dac4ddeca8f053abb35c833acd6993448d0327404cf1ad089ec3df6f2db35.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO agent_token_blacklist (token, expires_at, blacklisted_by)\n         VALUES ($1, $2, $3)\n         ON CONFLICT (token) DO UPDATE SET\n            expires_at = EXCLUDED.expires_at,\n            blacklisted_at = NOW(),\n            blacklisted_by = EXCLUDED.blacklisted_by",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Timestamp",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4c1dac4ddeca8f053abb35c833acd6993448d0327404cf1ad089ec3df6f2db35"
+}

backend/.sqlx/query-4c8d3693059ce1e2bbc84d76b543830ed343a5c6a1fef780f477dfbed80300f3.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE usr SET workspace_id = $1 WHERE workspace_id = $2",
+  "query": "UPDATE ai_agent_memory SET workspace_id = $1 WHERE workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "0659bab15d4cccdb04c7a57e0e3bbb6bfebb8896601a27ddf5618d4eae678bc1"
+  "hash": "4c8d3693059ce1e2bbc84d76b543830ed343a5c6a1fef780f477dfbed80300f3"
 }

backend/.sqlx/query-4ef7fcfa9a8962497c1eace31e59138cb8b252b207122a823185b36c44c10045.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script\n         SET content = 'def main(): return \"modified\"', summary = 'Modified in parent'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/to_modify_parent'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "4ef7fcfa9a8962497c1eace31e59138cb8b252b207122a823185b36c44c10045"
+}

backend/.sqlx/query-56e6be86747e953e4eb75b434906bea7f471c22923ac29894feae9c199d78788.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_modify_fork', 'script', 0, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/resource_to_modify', 'resource', 0, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'shared', 'folder', 0, 1, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "56e6be86747e953e4eb75b434906bea7f471c22923ac29894feae9c199d78788"
+}

backend/.sqlx/query-5a3cf6f0958a559c147a37e29458b48eb7488446eb69adeddf2007ae7ae897a7.json

@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5a3cf6f0958a559c147a37e29458b48eb7488446eb69adeddf2007ae7ae897a7"
+}

backend/.sqlx/query-5b3b4119469b7b110657926e6f99093c8fa5980ad061804cf73dc29151beac4b.json

@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n                SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    behind = workspace_diff.behind + 1,\n                    has_changes = NULL",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5b3b4119469b7b110657926e6f99093c8fa5980ad061804cf73dc29151beac4b"
+}

backend/.sqlx/query-642b6c2c55c19f554a0c4e8dcc9ddbeec6327a8d87d6a45d6c0823ec42c65639.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE audit SET workspace_id = $1 WHERE workspace_id = $2",
+  "query": "UPDATE flow_conversation SET workspace_id = $1 WHERE workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "0ba594244a366a31d9bed97a2d7b031d42c23463599d267d1712d1af1d26b321"
+  "hash": "642b6c2c55c19f554a0c4e8dcc9ddbeec6327a8d87d6a45d6c0823ec42c65639"
 }

backend/.sqlx/query-65c2ecb52cc777f17ffeb77be597ea87026bb4e56c0ccfb12f2feaf1a6124c86.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow\n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs)\n        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at, lock_error_logs\n            FROM flow WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "65c2ecb52cc777f17ffeb77be597ea87026bb4e56c0ccfb12f2feaf1a6124c86"
+}

backend/.sqlx/query-681bab96dce7249eda1d0d207513f0c4e8ba950bf79e9bd1cf2618a322be7858.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE v2_job SET workspace_id = $1\n         WHERE workspace_id = $2\n         AND id IN (SELECT id FROM v2_job_queue WHERE workspace_id = $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "681bab96dce7249eda1d0d207513f0c4e8ba950bf79e9bd1cf2618a322be7858"
+}

backend/.sqlx/query-6974521dec19adbc4c4497cc50e11a3f3be2a76a68287b3da2b999a925f972b4.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, created_by)\n         VALUES ('test-workspace', 'custom_db', $1, 'Custom DB type', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6974521dec19adbc4c4497cc50e11a3f3be2a76a68287b3da2b999a925f972b4"
+}

backend/.sqlx/query-6bdb3fcfe16fc40222dc7010a11026d4d4e0d381b31fe02da7d2667c0cdc1a85.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job_completed SET workspace_id = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "6bdb3fcfe16fc40222dc7010a11026d4d4e0d381b31fe02da7d2667c0cdc1a85"
-}

backend/.sqlx/query-739501f637dac4e5f4843e3ebfc30aa94729cfdb307c7f56584db8edcfd48e42.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT path FROM schedule WHERE workspace_id = $1 AND enabled = true",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "path",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "739501f637dac4e5f4843e3ebfc30aa94729cfdb307c7f56584db8edcfd48e42"
+}

backend/.sqlx/query-77929b1ab186a01113436b5739240285dc111218efb4df8dbb0c72280a4c6a2c.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT has_changes FROM workspace_diff\n         WHERE path = 'f/shared/original_script' AND kind = 'script' AND source_workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_changes",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "77929b1ab186a01113436b5739240285dc111218efb4df8dbb0c72280a4c6a2c"
+}

backend/.sqlx/query-7bc9fc05dbd162866bef1fdd3e7faeb50429881ed1bc962903f06e4b3d5f8d44.json

@@ -0,0 +1,35 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT schema, description, format_extension\n         FROM resource_type\n         WHERE workspace_id = $1 AND name = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "schema",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "description",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "format_extension",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "7bc9fc05dbd162866bef1fdd3e7faeb50429881ed1bc962903f06e4b3d5f8d44"
+}

backend/.sqlx/query-7c45f8d05a10ccf538c1b63aa1337e6d0491a2e8d04fe87eddb5a573de00d125.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_settings SELECT $1, slack_team_id, slack_name, slack_command_script, slack_email, customer_id, plan, webhook, deploy_to, ai_config, large_file_storage, git_sync, default_app, default_scripts, deploy_ui, mute_critical_alerts, color, operator_settings, teams_command_script, teams_team_id, teams_team_name, git_app_installations, ducklake, slack_oauth_client_id, slack_oauth_client_secret, datatable, teams_team_guid, auto_invite, error_handler, success_handler FROM workspace_settings WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "7c45f8d05a10ccf538c1b63aa1337e6d0491a2e8d04fe87eddb5a573de00d125"
+}

backend/.sqlx/query-7cbfad812eeb80cff00336697052f266693cf838d62a8b1e581c7239ec42095b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by \n             FROM agent_token_blacklist \n             ORDER BY blacklisted_at DESC",
+  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by\n             FROM agent_token_blacklist\n             ORDER BY blacklisted_at DESC",
   "describe": {
     "columns": [
       {
@@ -34,5 +34,5 @@
       false
     ]
   },
-  "hash": "1c5d3556fc8436ddd294f39c5431e1f501a821d6143c5d8aece20814237a6b86"
+  "hash": "7cbfad812eeb80cff00336697052f266693cf838d62a8b1e581c7239ec42095b"
 }

backend/.sqlx/query-8039b459914ceefe0c0a31b97473a5522e47b4b2fd3ddeff8f221560bc9c6f57.json

@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT display_name, owners, extra_perms, summary\n         FROM folder\n         WHERE workspace_id = $1 AND name = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "display_name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "owners",
+        "type_info": "VarcharArray"
+      },
+      {
+        "ordinal": 2,
+        "name": "extra_perms",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "summary",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "8039b459914ceefe0c0a31b97473a5522e47b4b2fd3ddeff8f221560bc9c6f57"
+}

backend/.sqlx/query-81a9d976ac5c1a78c83b95a1164995e78878a4a4ff6894a04e6626cdd98c24e4.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO flow \n            (workspace_id, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at) \n        SELECT $1, path, summary, description, archived, extra_perms, dependency_job, draft_only, tag, ws_error_handler_muted, dedicated_worker, timeout, visible_to_runner_only, on_behalf_of_email, concurrency_key, versions, value, schema, edited_by, edited_at\n            FROM flow WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "81a9d976ac5c1a78c83b95a1164995e78878a4a4ff6894a04e6626cdd98c24e4"
-}

backend/.sqlx/query-81e87e212075159270ff6c2811e93f31e941e71b9addd1e915fe779f81a6ae43.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_diff SET source_workspace_id = $1 WHERE source_workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "81e87e212075159270ff6c2811e93f31e941e71b9addd1e915fe779f81a6ae43"
+}

backend/.sqlx/query-82185eb02e03e3dd1a4b5a3f22c3b60169989703ee33d14ab348301885c9d745.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace SELECT $1, $2, owner, false, premium FROM workspace WHERE id = $3",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "82185eb02e03e3dd1a4b5a3f22c3b60169989703ee33d14ab348301885c9d745"
+}

backend/.sqlx/query-85711709ee4c9684cd46af85c2d21124bfaa6aa07eadeb8d55b4b9b9e3073f10.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/lazy_test', 'script', 1, 0, NULL)\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "85711709ee4c9684cd46af85c2d21124bfaa6aa07eadeb8d55b4b9b9e3073f10"
+}

backend/.sqlx/query-863581331dc7abd9ffa47c6977ee94d939a9e3ab3921605e5b0f4f7586e431c2.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_key SET workspace_id = $1 WHERE workspace_id = $2",
+  "query": "UPDATE email_trigger SET workspace_id = $1 WHERE workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "0d0c379b1cd2eec15869dd0b1a31886a95d53096fdcb1cdb1e0eb282b54105dc"
+  "hash": "863581331dc7abd9ffa47c6977ee94d939a9e3ab3921605e5b0f4f7586e431c2"
 }

backend/.sqlx/query-893c2dea38bfff42ad8cbd7afaf0280a8c1d6a7f1dc99f14c894899031534bea.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO skip_workspace_diff_tally SELECT $1, added_at FROM skip_workspace_diff_tally WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "893c2dea38bfff42ad8cbd7afaf0280a8c1d6a7f1dc99f14c894899031534bea"
+}

backend/.sqlx/query-8b8d29f3133228dbc5bdf1927e06dc1adfdaeed3f8dfc9d44887347f82f2d520.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE job_perms SET workspace_id = $1\n         WHERE job_id IN (SELECT id FROM v2_job WHERE workspace_id = $1)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8b8d29f3133228dbc5bdf1927e06dc1adfdaeed3f8dfc9d44887347f82f2d520"
+}

backend/.sqlx/query-8c0596e2a1c7cf9eef4e4ce3249a8bdd6cb4ead841591d873e5ec8c9c214b6b5.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT has_changes FROM workspace_diff\n         WHERE path = 'f/shared/lazy_test' AND kind = 'script' AND source_workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_changes",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "8c0596e2a1c7cf9eef4e4ce3249a8bdd6cb4ead841591d873e5ec8c9c214b6b5"
+}

backend/.sqlx/query-8d1920926cbdce897305c775b1d286fed8fa2f4258bde54b9d771c91923751ff.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM workspace WHERE id = 'wm-fork-test-workspace')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8d1920926cbdce897305c775b1d286fed8fa2f4258bde54b9d771c91923751ff"
+}

backend/.sqlx/query-907025d53448ea70760420f90cd95ad1d93ef6d4ebe0295cdc1e70108320f6a9.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, created_by)\n         VALUES ('test-workspace', 'new_type', $1, 'New type in parent', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "907025d53448ea70760420f90cd95ad1d93ef6d4ebe0295cdc1e70108320f6a9"
+}

backend/.sqlx/query-93def20ecf1bcbffe57c54bb12f0a5da22d9d2845d69e998cad8b68954b7a289.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/original_script', 'script', 0, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "93def20ecf1bcbffe57c54bb12f0a5da22d9d2845d69e998cad8b68954b7a289"
+}

backend/.sqlx/query-93e6cdf58803f63d7d465f9d778c052c40dcdacade0f9b9921860160604f3763.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE workspace_settings SET workspace_id = $1 WHERE workspace_id = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "93e6cdf58803f63d7d465f9d778c052c40dcdacade0f9b9921860160604f3763"
-}

backend/.sqlx/query-96406f7d7a42ec5a614415ed2fbf6f24291e869aa028ef3190390aaeadd10a46.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE folder SET display_name = 'Modified Shared Folder'\n         WHERE workspace_id = 'wm-fork-test-workspace' AND name = 'shared'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "96406f7d7a42ec5a614415ed2fbf6f24291e869aa028ef3190390aaeadd10a46"
+}

backend/.sqlx/query-9775cbe9f8592743575b06ae60b4afdca78d46a5934521314bb7a7d8688f9a35.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)\n         VALUES ('wm-fork-test-workspace', 'f/shared/new_in_fork', 99999, 'def main(): return \"fork\"', 'New in fork', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9775cbe9f8592743575b06ae60b4afdca78d46a5934521314bb7a7d8688f9a35"
+}

backend/.sqlx/query-97c61b6a9a5112ea484565236959a544511d5d501fb737da8110a8725b883465.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) ON CONFLICT (worker)\n        DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_workers = EXCLUDED.dedicated_workers",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Int8",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "97c61b6a9a5112ea484565236959a544511d5d501fb737da8110a8725b883465"
+}

backend/.sqlx/query-98034dc06e7478f4a828ea58cf9bbe728f4eabcd6a6e7ad7c8445efb6966e0c9.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_integrations SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "98034dc06e7478f4a828ea58cf9bbe728f4eabcd6a6e7ad7c8445efb6966e0c9"
+}

backend/.sqlx/query-9a7f4786fc29ed2b561d9eb96c274c66da29fdfb3e862e06c10c5deb4a2b5771.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app (workspace_id, path, summary, policy, versions, extra_perms, draft_only)\n         VALUES ('test-workspace', 'f/shared/dashboard', 'Dashboard app', '{}', ARRAY[1::bigint], '{}', false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9a7f4786fc29ed2b561d9eb96c274c66da29fdfb3e862e06c10c5deb4a2b5771"
+}

backend/.sqlx/query-9b7d0f980267e62fb50545570e83daae65e4458a88b53b65870523b64d183231.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE resource SET path = 'f/shared/new_name'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/old_name'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9b7d0f980267e62fb50545570e83daae65e4458a88b53b65870523b64d183231"
+}

backend/.sqlx/query-9df747dec3f3c245b1cd3a5039f0a4a69d0667e328ad838c1a2f9bb9fee2d121.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE variable SET value = 'modified_value'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/variable_to_modify'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9df747dec3f3c245b1cd3a5039f0a4a69d0667e328ad838c1a2f9bb9fee2d121"
+}

backend/.sqlx/query-a17539823e5f2b0ffa8d3f270801d6d41db9e2ef4c33f09565a858d6c55cc3a9.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource (workspace_id, path, value, resource_type, description, created_by)\n         VALUES\n         ('test-workspace', 'f/shared/db_config', $1, 'postgresql', '', 'test@windmill.dev'),\n         ('test-workspace', 'f/shared/old_name', $2, 'generic', '', 'test@windmill.dev'),\n         ('test-workspace', 'f/shared/resource_to_modify', $3, 'generic', '', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a17539823e5f2b0ffa8d3f270801d6d41db9e2ef4c33f09565a858d6c55cc3a9"
+}

backend/.sqlx/query-a1f8d5c97404166603de2fe214d965243ddf8a37685a7f62b593718d195dab06.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/original_flow', 'flow', 1, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_conflict', 'script', 1, 1, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a1f8d5c97404166603de2fe214d965243ddf8a37685a7f62b593718d195dab06"
+}

backend/.sqlx/query-a962567ecfcbf251a8fcc12db894580b53f209d5f9f771bfaf0453b8d704bf31.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)\n         VALUES ('test-workspace', 'f/shared/new_in_parent', 54321, 'def main(): return \"new\"', 'New in parent', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a962567ecfcbf251a8fcc12db894580b53f209d5f9f771bfaf0453b8d704bf31"
+}

backend/.sqlx/query-b32c7c24440137d6749e1fc3095512b0f5bc8b81e0b644b01256398664ecf9b1.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (workspace_id, path, summary, description, value, schema, edited_by, edited_at, archived)\n         VALUES ('test-workspace', 'f/shared/original_flow', 'Flow summary', '', $1, NULL, 'test@windmill.dev', NOW(), false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b32c7c24440137d6749e1fc3095512b0f5bc8b81e0b644b01256398664ecf9b1"
+}

backend/.sqlx/query-b3f791c8ef04f0aefd9b510d751dbe467e17e15d4a6512889009d850760502d9.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO usr SELECT $1, username, email, is_admin, created_at, operator, disabled, role FROM usr WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b3f791c8ef04f0aefd9b510d751dbe467e17e15d4a6512889009d850760502d9"
+}

backend/.sqlx/query-b928974804d710f37c4703a23c67440bcb4733ff706669abc787cd414c11f82e.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_key SELECT $1, kind, key FROM workspace_key WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b928974804d710f37c4703a23c67440bcb4733ff706669abc787cd414c11f82e"
+}

backend/.sqlx/query-b95b6ee787c590dd21969965a687fef33fc9fbc80ca87f96aced906570e28c18.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT name FROM resource_type\n                     WHERE workspace_id = $1 AND name = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "b95b6ee787c590dd21969965a687fef33fc9fbc80ca87f96aced906570e28c18"
+}

backend/.sqlx/query-ba3149ec0aa62dba41c459a1bf5be86aebccee68172abefe82f4bb76fc7a80ee.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO folder (workspace_id, name, display_name, owners, summary, created_by)\n         VALUES ('test-workspace', 'shared', 'Shared Folder', ARRAY['test@windmill.dev']::varchar[], 'Test folder', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "ba3149ec0aa62dba41c459a1bf5be86aebccee68172abefe82f4bb76fc7a80ee"
+}

backend/.sqlx/query-bda182047ae37e263b0011248d86c1b20d8b7908bb8a8ae4c5ed83b51db5446a.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app_version (app_id, value, created_by, created_at)\n         VALUES ($1, $2, 'test@windmill.dev', NOW())",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Json"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bda182047ae37e263b0011248d86c1b20d8b7908bb8a8ae4c5ed83b51db5446a"
+}

backend/.sqlx/query-c01a94ec75990c8fb4068485c91211af295a1d2630861bf53a33966abc4562ec.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT q.id FROM v2_job_queue q\n         JOIN v2_job j ON j.id = q.id\n         WHERE j.parent_job IS NULL\n           AND j.created_at <= now() - ($1::bigint::text || ' s')::interval",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c01a94ec75990c8fb4068485c91211af295a1d2630861bf53a33966abc4562ec"
+}

backend/.sqlx/query-c64288c867ba944e834a44c5a6af7231efd899a148d3607316a5537f4e7b031c.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO deployment_metadata (workspace_id, path, script_hash, callback_job_ids, deployment_msg) VALUES ($1, $2, $3, $4, $5) \n                            ON CONFLICT (workspace_id, script_hash) WHERE script_hash IS NOT NULL DO UPDATE SET callback_job_ids = EXCLUDED.callback_job_ids, deployment_msg = EXCLUDED.deployment_msg",
+  "query": "INSERT INTO deployment_metadata (workspace_id, path, script_hash, callback_job_ids, deployment_msg) VALUES ($1, $2, $3, $4, $5)\n                            ON CONFLICT (workspace_id, script_hash) WHERE script_hash IS NOT NULL DO UPDATE SET callback_job_ids = EXCLUDED.callback_job_ids, deployment_msg = EXCLUDED.deployment_msg",
   "describe": {
     "columns": [],
     "parameters": {
@@ -14,5 +14,5 @@
     },
     "nullable": []
   },
-  "hash": "8e750d4b3af9b5844c11b1b92741f2ee9d2d3412d4a2c96c6ccc87ec1c382384"
+  "hash": "c64288c867ba944e834a44c5a6af7231efd899a148d3607316a5537f4e7b031c"
 }

backend/.sqlx/query-c925a52d90231f9e6f3af652ddfddd67bff8c3d306794e3583af86818b7054d0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_modify_parent', 'script', 1, 0, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/dashboard', 'app', 1, 0, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/variable_to_modify', 'variable', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "c925a52d90231f9e6f3af652ddfddd67bff8c3d306794e3583af86818b7054d0"
+}

backend/.sqlx/query-c9c040ec228a8fe4fda08439420141bee63339d4e3d5e2d68aabb12009f691c6.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO agent_token_blacklist (token, expires_at, blacklisted_by) \n         VALUES ($1, $2, $3) \n         ON CONFLICT (token) DO UPDATE SET \n            expires_at = EXCLUDED.expires_at,\n            blacklisted_at = NOW(),\n            blacklisted_by = EXCLUDED.blacklisted_by",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Timestamp",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "c9c040ec228a8fe4fda08439420141bee63339d4e3d5e2d68aabb12009f691c6"
-}

backend/.sqlx/query-d20d6c43b16b762fb4cdb2cafe1fe9a2920124f398fca5bd54cb805b03b94763.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by \n             FROM agent_token_blacklist \n             WHERE expires_at > $1 \n             ORDER BY blacklisted_at DESC",
+  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by\n             FROM agent_token_blacklist\n             WHERE expires_at > $1\n             ORDER BY blacklisted_at DESC",
   "describe": {
     "columns": [
       {
@@ -36,5 +36,5 @@
       false
     ]
   },
-  "hash": "d56722c25877222af9affd5da5bb83b28fa8cbb528a2cfc90684cb10a69e4375"
+  "hash": "d20d6c43b16b762fb4cdb2cafe1fe9a2920124f398fca5bd54cb805b03b94763"
 }

backend/.sqlx/query-d6ce9016308da0f20c2118c047349d8110d899121c9c00795c55217b9f1886c2.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE app SET summary = 'Modified dashboard app'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/dashboard'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d6ce9016308da0f20c2118c047349d8110d899121c9c00795c55217b9f1886c2"
+}

backend/.sqlx/query-d8c5c64006cdd52570bbc56b0fa5df9b597d9a45353391411efa86959a7512bc.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO variable (workspace_id, path, value, is_secret, description)\n         VALUES\n         ('test-workspace', 'f/shared/api_key', 'secret123', false, 'Test key'),\n         ('test-workspace', 'f/shared/variable_to_modify', 'original', false, 'To modify')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d8c5c64006cdd52570bbc56b0fa5df9b597d9a45353391411efa86959a7512bc"
+}

backend/.sqlx/query-df804e2a8795af329aa84ccfeb90329383524232276908af181f6ecb3c8fc804.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT name FROM folder\n                     WHERE workspace_id = $1 AND name = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "df804e2a8795af329aa84ccfeb90329383524232276908af181f6ecb3c8fc804"
+}

backend/.sqlx/query-e1e55ce8c28ac4d253c289e4c972ae00cfdcc3ef056625a5a5bef76377953278.json

@@ -1,16 +1,15 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO workspace SELECT $1, $2, owner, deleted, premium FROM workspace WHERE id = $3",
+  "query": "UPDATE native_trigger SET workspace_id = $1 WHERE workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
       "Left": [
-        "Varchar",
         "Varchar",
         "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "8f0031533f1bf407bd5d8af4d364eaf00d4c38ee7ba75141b40fc9fcd2ffc0b8"
+  "hash": "e1e55ce8c28ac4d253c289e4c972ae00cfdcc3ef056625a5a5bef76377953278"
 }

backend/.sqlx/query-e2f7a1a48bb026df5c7155b76e166cd5a6ca2ab25926f70095328d5ea2d2bc7c.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE v2_job SET workspace_id = $1\n         WHERE workspace_id = $2\n         AND (id IN (SELECT id FROM v2_job_queue WHERE workspace_id = $1)\n              OR id IN (SELECT id FROM v2_job_completed WHERE workspace_id = $1))",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "e2f7a1a48bb026df5c7155b76e166cd5a6ca2ab25926f70095328d5ea2d2bc7c"
-}

backend/.sqlx/query-e3491d953cb9f85a5e3a9b1a386dfde77f0387d1ed8f5defa34359147e9c0907.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_dependencies SET workspace_id = $1 WHERE workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e3491d953cb9f85a5e3a9b1a386dfde77f0387d1ed8f5defa34359147e9c0907"
+}

backend/.sqlx/query-e42bb9155be93cbc750702cf7f9a3c54d1a236421861880fe3749052bd2ab43f.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET value = $1\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/original_flow'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e42bb9155be93cbc750702cf7f9a3c54d1a236421861880fe3749052bd2ab43f"
+}

backend/.sqlx/query-e881a777b8e67c76cf458828a02f7d5234ae76da567195f5da11cd11d7ebbc05.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_delete', 'script', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "e881a777b8e67c76cf458828a02f7d5234ae76da567195f5da11cd11d7ebbc05"
+}

backend/.sqlx/query-e9e6c8ba034b4f80fada2e07e500a78983aeb1a7b1185b5267229c3197d6f714.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE resource SET value = $1\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/resource_to_modify'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e9e6c8ba034b4f80fada2e07e500a78983aeb1a7b1185b5267229c3197d6f714"
+}

backend/.sqlx/query-ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, wm_version, vcpus, memory, job_isolation) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10) ON CONFLICT (worker)\n        DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "TextArray",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c"
-}

backend/.sqlx/query-f23a296f5e04dcf6f2cda808193e4ee91c14823639cbcdb77d92409fe5218c3c.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE workspace_diff SET fork_workspace_id = $1 WHERE fork_workspace_id = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "f23a296f5e04dcf6f2cda808193e4ee91c14823639cbcdb77d92409fe5218c3c"
+}

backend/.sqlx/query-f863cb7ec416d774dc4c8170b2f5ec974b035405da38bf3e7764f7e22232b760.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM v2_job WHERE workspace_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "f863cb7ec416d774dc4c8170b2f5ec974b035405da38bf3e7764f7e22232b760"
-}

backend/CLAUDE.md

@@ -1,22 +1,61 @@
 # Backend Development (Rust)
 
-## Core Principles
+## Project Structure
 
-- Follow @rust-best-practices.mdc for detailed guidelines
-- Database schema reference: @summarized_schema.txt
-- The API routes prefixes are all listed in windmill-api/src/lib.rs
-- This repository is the open source side of the project. The enterprise files (\*\_ee.rs) are in the `windmill-ee-private` folder (a sibling directory). Those files are symlinked into their corresponding locations within each crate's `src/` directory.
+Windmill uses a workspace-based architecture with multiple crates:
 
-## JSON Handling
+- **windmill-api**: API server functionality
+- **windmill-worker**: Job execution
+- **windmill-common**: Shared code used by all crates
+- **windmill-queue**: Job & flow queuing
+- **windmill-audit**: Audit logging
+- Other specialized crates (git-sync, autoscaling, etc.)
 
-- **Prefer `Box<serde_json::value::RawValue>` over `serde_json::Value`** when possible, especially:
-  - When storing JSON in the database (JSONB columns)
-  - When passing JSON through without modification
-  - When the JSON structure doesn't need to be inspected or manipulated
-- This avoids unnecessary parsing/serialization overhead and preserves the original JSON format
-- Use `serde_json::Value` only when you need to inspect, modify, or construct JSON programmatically
+## Key References (MUST FOLLOW THESE)
 
-## Adding New Features
+- You MUST follow best-practices by using the `rust-backend` skill, everytime you write RUST code.
+- When working with the database: read `summarized_schema.txt` before starting 
+- When working with the API routes: you can read `windmill-api/src/lib.rs` to get started
 
-1. Update database schema with migration if necessary
-2. Update backend/windmill-api/openapi.yaml after modifying API endpoints
+## Adding New Code
+
+### Module Organization
+
+- Place new code in the appropriate crate based on functionality
+- For API endpoints, create or modify files in `windmill-api/src/` organized by domain
+- For shared functionality, use `windmill-common/src/`
+- Follow existing patterns for file structure and organization
+
+### API Endpoints
+
+- Follow existing patterns in the `windmill-api` crate
+- Use axum's routing system and extractors
+- Update `backend/windmill-api/openapi.yaml` after modifying API endpoints
+
+### Database Changes
+
+- Update database schema with migration if necessary
+- Use `sqlx` for database operations with prepared statements
+- Use transactions for multi-step operations
+
+## Enterprise Features
+
+- Enterprise files use the `*_ee.rs` suffix
+- Enterprise source is in `windmill-ee-private` folder (sibling directory), symlinked into each crate's `src/`
+- Use feature flags: `#[cfg(feature = "enterprise")]`
+- Isolate enterprise code in separate modules
+
+## Testing
+
+- Write unit tests for core functionality
+- Use the `#[cfg(test)]` module for test code
+- For database tests, use the existing test utilities
+
+## Common Crates
+
+- **tokio**: Async runtime
+- **axum**: Web server and routing
+- **sqlx**: Database operations
+- **serde**: Serialization/deserialization
+- **tracing**: Logging and diagnostics
+- **reqwest**: HTTP client

backend/Cargo.lock

@@ -1117,9 +1117,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.8"
+version = "1.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330762ee48c6cecfad2cb37b1506c16c8e858c90638eda2b1a7272b56f88bd5"
+checksum = "e39f47abe8641e434de98e047e85ced629862e7ab719b6914a846796ceb289e2"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -1128,9 +1128,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.60.15"
+version = "0.60.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0810b22ae554f5076c3eabe1fe89b01aee61c354c575789f67e248e83c5f472b"
+checksum = "ff6a1db93c9aaf8c8e5d97f055e5fa01a782bd5bdc9c4042b7e18090503b12a7"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -1161,9 +1161,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.1.6"
+version = "1.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec918f18147cec121cb142a91b0038f66d99bbe903e585dccf871920e90b22ab"
+checksum = "a395c914b1ff95db3cb7003ea4fd19432343af698a9b5028a7d35f8e712240a1"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -1200,18 +1200,18 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-observability"
-version = "0.2.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a700a7702874cd78b85fecdc9f64f3f72eb22fb713791cb445bcfd2a15bc1ecf"
+checksum = "7764bc1dfdb71157bc481528a649e617ed8c9c8aa93c0e8b01087133677cfc8e"
 dependencies = [
  "aws-smithy-runtime-api",
 ]
 
 [[package]]
 name = "aws-smithy-query"
-version = "0.60.10"
+version = "0.60.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc4a6cdc289a37be7fddb7f4365448187d62c603a40e6d46d13c68e5e81900f"
+checksum = "786bbf4434ed3e3413c5a1741abf53a0372dd48124ddb2091e6bff1b1b2582b5"
 dependencies = [
  "aws-smithy-types",
  "urlencoding",
@@ -1243,9 +1243,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.11.0"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c47b1e62accf759b01aba295e40479d1ba8fb77c2a54f0fed861c809ca49761"
+checksum = "8b743e9aab0b8d50a9a40eebedf974fcfe3621032e07c6388d1c7821b155b7b0"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-types",
@@ -1260,9 +1260,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.4.0"
+version = "1.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2d447863bdec38c899e5753a48c0abcf590f3ec629e257ad5a9ef8806ad7714"
+checksum = "0828575b70da70406b4cdb5d4afe0afe725f72245f04d34f02e0fb5ebd6fc872"
 dependencies = [
  "base64-simd 0.8.0",
  "bytes",
@@ -1842,7 +1842,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0686c856aa6aac0c4498f936d7d6a02df690f614c03e4d906d1018062b5c5e2c"
 dependencies = [
  "once_cell",
- "proc-macro-crate",
+ "proc-macro-crate 3.4.0",
  "proc-macro2",
  "quote",
  "syn 2.0.114",
@@ -1976,9 +1976,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.24.0"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 dependencies = [
  "bytemuck_derive",
 ]
@@ -2150,9 +2150,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.54"
+version = "1.2.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6354c81bbfd62d9cfa9cb3c773c2b7b2a3a482d569de977fd0e961f6e7c00583"
+checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2265,9 +2265,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.55"
+version = "4.5.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e34525d5bbbd55da2bb745d34b36121baac88d07619a9a09cfcf4a6c0832785"
+checksum = "a75ca66430e33a14957acc24c5077b503e7d374151b2b4b3a10c83b4ceb4be0e"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2275,9 +2275,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.55"
+version = "4.5.56"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59a20016a20a3da95bef50ec7238dbd09baeef4311dcdd38ec15aba69812fb61"
+checksum = "793207c7fa6300a0608d1080b858e5fdbe713cdc1c8db9fb17777d8a13e63df0"
 dependencies = [
  "anstream",
  "anstyle",
@@ -5566,9 +5566,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8591b0bcc8a98a64310a2fae1bb3e9b8564dd10e381e6e28010fde8e8e8568db"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "fixedbitset"
@@ -8550,7 +8550,7 @@ dependencies = [
  "darling 0.20.11",
  "heck 0.5.0",
  "num-bigint",
- "proc-macro-crate",
+ "proc-macro-crate 3.4.0",
  "proc-macro-error2",
  "proc-macro2",
  "quote",
@@ -9119,7 +9119,7 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
 dependencies = [
- "proc-macro-crate",
+ "proc-macro-crate 3.4.0",
  "proc-macro2",
  "quote",
  "syn 2.0.114",
@@ -10054,9 +10054,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f89776e4d69bb58bc6993e99ffa1d11f228b839984854c7daeb5d37f87cbe950"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postgres-native-tls"
@@ -10192,6 +10192,16 @@ dependencies = [
  "elliptic-curve",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.4.0"
@@ -10895,6 +10905,12 @@ version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
 
+[[package]]
+name = "relative-path"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
+
 [[package]]
 name = "rend"
 version = "0.4.2"
@@ -11185,6 +11201,53 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "rquickjs"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16661bff09e9ed8e01094a188b463de45ec0693ade55b92ed54027d7ba7c40c"
+dependencies = [
+ "rquickjs-core",
+ "rquickjs-macro",
+]
+
+[[package]]
+name = "rquickjs-core"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c8db6379e204ef84c0811e90e7cc3e3e4d7688701db68a00d14a6db6849087b"
+dependencies = [
+ "async-lock",
+ "relative-path",
+ "rquickjs-sys",
+]
+
+[[package]]
+name = "rquickjs-macro"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6041104330c019fcd936026ae05e2446f5e8a2abef329d924f25424b7052a2f3"
+dependencies = [
+ "convert_case 0.6.0",
+ "fnv",
+ "ident_case",
+ "indexmap 2.11.1",
+ "proc-macro-crate 1.3.1",
+ "proc-macro2",
+ "quote",
+ "rquickjs-core",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "rquickjs-sys"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bc352c6b663604c3c186c000cfcc6c271f4b50bc135a285dd6d4f2a42f9790a"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "rsa"
 version = "0.9.10"
@@ -12336,9 +12399,9 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "slotmap"
@@ -15403,7 +15466,7 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "aws-sdk-config",
@@ -15466,7 +15529,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15596,7 +15659,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15606,7 +15669,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15620,7 +15683,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -15639,7 +15702,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15735,7 +15798,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "regex",
  "serde",
@@ -15750,7 +15813,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15774,7 +15837,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15790,7 +15853,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15810,7 +15873,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "async-oauth2",
@@ -15834,7 +15897,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15843,7 +15906,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15855,7 +15918,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15867,7 +15930,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15879,7 +15942,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15891,7 +15954,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15903,7 +15966,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15914,7 +15977,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15925,7 +15988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15938,7 +16001,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15962,7 +16025,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15976,7 +16039,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15993,7 +16056,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16007,7 +16070,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16026,7 +16089,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16037,7 +16100,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16074,7 +16137,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -16084,7 +16147,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.618.2"
+version = "1.623.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16156,6 +16219,7 @@ dependencies = [
  "regex",
  "reqwest 0.13.1",
  "reqwest-middleware",
+ "rquickjs",
  "rust_decimal",
  "rustls-pemfile 2.2.0",
  "serde",
@@ -16984,18 +17048,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.35"
+version = "0.8.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdea86ddd5568519879b8187e1cf04e24fce28f7fe046ceecbce472ff19a2572"
+checksum = "7456cf00f0685ad319c5b1693f291a650eaf345e941d082fc4e03df8a03996ac"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.35"
+version = "0.8.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c15e1b46eff7c6c91195752e0eeed8ef040e391cdece7c25376957d5f15df22"
+checksum = "1328722bbf2115db7e19d69ebcc15e795719e2d66b60827c6a69a117365e37a0"
 dependencies = [
  "proc-macro2",
  "quote",

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.618.2"
+version = "1.623.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -35,7 +35,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.618.2"
+version = "1.623.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -68,6 +68,7 @@ jemalloc = ["windmill-common/jemalloc", "dep:tikv-jemallocator", "dep:tikv-jemal
 tantivy = ["dep:windmill-indexer", "windmill-api/tantivy", "windmill-indexer/enterprise", "windmill-indexer/parquet", "windmill-common/tantivy", "enterprise", "parquet"]
 sqlx = ["windmill-worker/sqlx"]
 deno_core = ["windmill-worker/deno_core", "windmill-api/deno_core", "dep:deno_core", "dep:v8"]
+quickjs = ["windmill-worker/quickjs"]
 deno_core_mac = ["deno_core", "windmill-worker/libffi_mac"]
 kafka = ["windmill-api/kafka"]
 nats = ["windmill-api/nats"]
@@ -391,8 +392,11 @@ nu-parser = { version = "0.101.0", default-features = false }
 globset = "0.4.16"
 croner = "2.2.0"
 rmcp = { version = "^0", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
+rquickjs = { version = "0.8", features = ["futures", "parallel", "macro"] }
 process-wrap = { version = "8.2.1", features = ["tokio1"] }
 
+systemstat = "0.2.4"
+
 datafusion = "47.0.0"
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7", features = ["aws", "azure", "gcp"] }
 openidconnect = { version = "4.0.0-rc.1" }
@@ -407,7 +411,6 @@ aws-sdk-sso = "=1.77.0"
 aws-sdk-ssooidc = "=1.78.0"
 rustls = "=0.23.35"
 async-once-cell = "0.5.4"
-systemstat = "0.2.4"
 size = "0.5.0"
 
 aws-smithy-types-convert = { version = "^0", features = ["convert-chrono"] }

backend/QUICKJS_MIGRATION_ANALYSIS.md

@@ -0,0 +1,370 @@
+# QuickJS Migration - Potential Breaking Changes Analysis
+
+## Summary
+
+This document details the comprehensive investigation into potential breaking changes when migrating flow expressions from Deno Core (V8) to QuickJS.
+
+## 1. Areas Already Tested (60+ Parity Tests)
+
+The following areas have comprehensive parity tests in `js_eval_parity_tests.rs`:
+
+- **Arithmetic operations**: +, -, *, /, %, **
+- **Comparison operators**: ===, !==, >, <, >=, <=, ==, !=
+- **Logical operators**: &&, ||, !, ??, ?.
+- **Bitwise operators**: &, |, ^, ~, <<, >>, >>>
+- **Object operations**: property access, spread, destructuring, Object.keys/values/entries
+- **Array operations**: map, filter, reduce, find, some, every, slice, flat, etc.
+- **String operations**: split, replace, includes, startsWith, trim, etc.
+- **Template literals**: ${} interpolation
+- **Optional chaining**: ?. for properties, methods, computed properties
+- **Nullish coalescing**: ??
+- **Try-catch blocks**
+- **Arrow functions**
+- **Destructuring**
+- **Date operations** (with fixed dates)
+- **JSON.parse/stringify**
+- **Math functions**
+- **Set and Map operations**
+- **Regular expressions** (basic patterns)
+- **flow_input, flow_env, previous_result access**
+- **Error extraction logic** (from parallel results)
+
+## 2. Potential Breaking Changes Identified
+
+### 2.1 Number Handling Edge Cases (MEDIUM RISK)
+
+**Implementation Difference:**
+```rust
+// QuickJS json_to_js:
+if i >= i32::MIN as i64 && i <= i32::MAX as i64 {
+    Ok(Value::new_int(ctx.clone(), i as i32))
+} else {
+    Ok(Value::new_float(ctx.clone(), i as f64))
+}
+```
+
+**Potential Issues:**
+- Numbers outside i32 range (-2147483648 to 2147483647) are stored as floats
+- Large integers (between i32::MAX and 2^53) might lose precision
+- **Timestamps** (e.g., 1704067200000) are typically in this range
+
+**Test Case Needed:**
+```javascript
+// Numbers just above i32::MAX
+2147483648 + 1  // i32::MAX + 2
+9007199254740991 - 1  // Near MAX_SAFE_INTEGER
+```
+
+### 2.2 Object Property Order (LOW RISK)
+
+**Implementation Difference:**
+- QuickJS: `obj.props::<String, Value>()` iteration order
+- V8: Guaranteed insertion order for string keys
+
+**Potential Impact:**
+- `Object.keys()`, `Object.values()`, `Object.entries()` order might differ
+- Object spread `{...obj}` order might differ
+
+**Mitigated by:**
+- JSON comparison in tests normalizes order
+- Most flow expressions don't depend on property order
+
+### 2.3 Missing Browser/Deno APIs (MEDIUM RISK)
+
+**APIs NOT available in QuickJS:**
+- `atob()` / `btoa()` - Base64 encoding/decoding
+- `TextEncoder` / `TextDecoder`
+- `fetch()` (not relevant for expressions)
+- `Blob`, `ArrayBuffer` (limited support)
+- `Intl.*` - Internationalization APIs
+- `console.log()` - No effect (not breaking, just no output)
+
+**Expressions that would break:**
+```javascript
+atob("SGVsbG8=")  // Would throw: atob is not defined
+btoa("Hello")     // Would throw: btoa is not defined
+new TextEncoder().encode("test")  // Would throw
+"test".toLocaleUpperCase('tr-TR') // Might behave differently
+```
+
+### 2.4 Regular Expression Differences (LOW RISK)
+
+**QuickJS RegExp limitations:**
+- No `d` flag (indices)
+- No lookbehind assertions `(?<=...)` and `(?<!...)`
+- No named capture groups `(?<name>...)`
+
+**Expressions that might break:**
+```javascript
+"test123".match(/(?<=test)\d+/)  // Lookbehind not supported
+/(?<name>\w+)/.exec("test")?.groups?.name  // Named groups not supported
+```
+
+### 2.5 Prototype Method Availability (LOW RISK)
+
+**Methods that might differ:**
+- `Array.prototype.at()` - ES2022
+- `String.prototype.at()` - ES2022
+- `Object.hasOwn()` - ES2022
+- `String.prototype.replaceAll()` - ES2021
+
+**Test Case:**
+```javascript
+[1,2,3].at(-1)  // Might not exist
+"hello".at(-1)  // Might not exist
+```
+
+### 2.6 NaN/Infinity/Special Values (LOW RISK)
+
+**Implementation:**
+```rust
+// QuickJS js_to_json:
+if let Some(n) = serde_json::Number::from_f64(f) {
+    return Ok(serde_json::Value::Number(n));
+} else {
+    return Ok(serde_json::Value::Null);  // NaN, Infinity -> null
+}
+```
+
+Both engines convert NaN/Infinity to null in JSON, so this is consistent.
+
+### 2.7 Fallback for Unsupported Types (LOW RISK)
+
+**QuickJS fallback:**
+```rust
+// Fallback
+Ok(serde_json::Value::String("[object]".to_string()))
+```
+
+Types that would trigger this:
+- Symbol
+- WeakMap/WeakRef
+- Generator objects
+- Custom objects with non-enumerable properties only
+
+### 2.8 Date Object Timezone Handling (MEDIUM RISK)
+
+**Potential Issue:**
+- `new Date()` without arguments uses system time
+- Timezone-dependent methods might vary
+
+**Safe patterns (already tested):**
+```javascript
+new Date('2024-01-15T00:00:00.000Z').getUTCFullYear()  // OK - UTC methods
+Date.parse('2024-01-15T00:00:00.000Z')  // OK - explicit timezone
+```
+
+**Risky patterns:**
+```javascript
+new Date().toLocaleDateString()  // Timezone dependent
+new Date().getHours()  // Timezone dependent
+```
+
+## 3. Edge Cases NOT Currently Tested
+
+### 3.1 Very Large Numbers
+```javascript
+9007199254740991  // MAX_SAFE_INTEGER
+9007199254740992  // MAX_SAFE_INTEGER + 1 (loses precision)
+2147483648        // i32::MAX + 1
+```
+
+### 3.2 Negative Zero
+```javascript
+-0 === 0  // true
+Object.is(-0, 0)  // false
+1/-0  // -Infinity
+```
+
+### 3.3 Sparse Arrays
+```javascript
+const arr = [1, , 3]  // Hole at index 1
+arr.map(x => x * 2)  // Holes might be handled differently
+arr.filter(x => true)  // Holes might be skipped or preserved
+```
+
+### 3.4 Unicode Edge Cases
+```javascript
+"🎉".length  // 2 (surrogate pairs)
+"🎉".split('')  // Might differ
+[..."🎉"]  // Might differ
+"café" === "café"  // NFC vs NFD normalization
+```
+
+### 3.5 Prototype Chain
+```javascript
+const obj = Object.create({ inherited: 1 });
+obj.own = 2;
+Object.keys(obj)  // Should only return ['own']
+```
+
+### 3.6 Getter/Setter Properties
+```javascript
+const obj = {
+  get prop() { return 42; },
+  set prop(v) { }
+};
+obj.prop  // Should return 42
+```
+
+### 3.7 Circular References
+```javascript
+const obj = { a: 1 };
+obj.self = obj;
+JSON.stringify(obj)  // Should throw in both
+```
+
+### 3.8 Array-like Objects
+```javascript
+const arrayLike = { 0: 'a', 1: 'b', length: 2 };
+Array.from(arrayLike)  // Should work in both
+```
+
+## 4. Recommended Additional Tests
+
+### High Priority (Add to parity tests):
+1. Large integers (i32 boundary, MAX_SAFE_INTEGER boundary)
+2. `Array.prototype.at()` and `String.prototype.at()`
+3. Sparse arrays with holes
+4. Emoji/surrogate pair handling
+5. Object property order verification
+
+### Medium Priority:
+1. Getter/setter access
+2. Prototype chain behavior
+3. Array-like object conversion
+4. Error message format differences
+
+### Low Priority (Unlikely to be used in expressions):
+1. WeakMap/WeakSet
+2. Generators
+3. Symbols
+4. Proxy edge cases
+
+## 5. Known Safe Patterns
+
+These patterns are safe to use and have been verified:
+- All arithmetic and comparison operators
+- All standard array methods (map, filter, reduce, etc.)
+- All standard string methods
+- Object spread and destructuring
+- Optional chaining and nullish coalescing
+- Template literals
+- Arrow functions
+- Try-catch blocks
+- `flow_input`, `flow_env`, `previous_result`, `results` access
+- JSON operations
+- Date operations with UTC methods
+- Regular expressions (basic patterns without lookbehind)
+
+## 6. Test Coverage Summary
+
+### Unit Parity Tests (114 tests in js_eval_parity_tests.rs)
+- Basic arithmetic, comparison, logical, and bitwise operators
+- Object operations: property access, spread, destructuring
+- Array operations: map, filter, reduce, find, some, every, slice, flat, etc.
+- String operations: all standard methods
+- Template literals with complex expressions
+- Optional chaining and nullish coalescing
+- Set and Map operations
+- JSON parse/stringify
+- Date operations with UTC methods
+- Error handling with try-catch
+- Large integer handling (i32 boundaries, timestamps, MAX_SAFE_INTEGER)
+- Unicode and special characters
+- Type coercion
+
+### Flow Engine Parity Tests (19 tests in flow_engine_parity.rs)
+All tests pass with both Deno Core and QuickJS:
+
+1. **Linear flow with input transforms** - `results.a.property` access
+2. **For-loop with complex iterator** - `results.a.users.filter(...)`
+3. **Branch conditions** - `results.a.status === 'premium' && results.a.score >= 90`
+4. **Previous result aggregation** - `previous_result.value`, `results.a.value + results.b.value`
+5. **Nested complexity** - Deep result access across loop iterations
+6. **Parallel for-loops** - Multiple concurrent iterations
+7. **Skip-if expressions** - Conditional step execution
+8. **Object transformations** - Complex data manipulation
+9. **Template literals** - `\`Status: ${results.a.status}\``
+10. **Optional chaining** - `results.a.user?.name`, `results.a?.missing?.value ?? 'default'`
+11. **Flow env access** - `flow_env.CONFIG.apiUrl`
+12. **Combined flow_input and flow_env**
+13. **Results optional chaining** - Deep optional chaining with results proxy
+14. **Large integers** - Timestamps, i32 boundaries through results
+15. **Unicode and emoji** - Strings with unicode through flow results
+16. **Complex array operations** - Sort, filter/map chains, reduce through results
+17. **Multiline expressions** - Multi-statement expressions with semicolons and return
+18. **Spread operators** - `{...results.a.config}`, `[...results.a.tags]`
+19. **Nested for-loop results access** - Accessing outer step results from inner loops
+
+## 7. Conclusion
+
+The QuickJS migration is **safe** for the vast majority of flow expressions. Comprehensive testing shows:
+
+- **133 total parity tests pass** (114 unit + 19 flow engine)
+- All tests pass with both Deno Core and QuickJS
+- No behavioral differences detected in production-like scenarios
+
+### ES2022+ Method Support (All SUPPORTED in both engines):
+
+Tested and verified to work identically:
+- `Array.prototype.at()` - ES2022 ✅
+- `String.prototype.at()` - ES2022 ✅
+- `Object.hasOwn()` - ES2022 ✅
+- `String.prototype.replaceAll()` - ES2021 ✅
+- `Array.prototype.findLast()` - ES2023 ✅
+- `Array.prototype.findLastIndex()` - ES2023 ✅
+- `Array.prototype.toSorted()` - ES2023 ✅
+- `Array.prototype.toReversed()` - ES2023 ✅
+- `Array.prototype.toSpliced()` - ES2023 ✅
+- `Array.prototype.with()` - ES2023 ✅
+- `Object.groupBy()` - ES2024 ✅
+
+### Regex Feature Support (All SUPPORTED in both engines):
+
+- Lookbehind assertions `(?<=...)` ✅
+- Negative lookbehind `(?<!...)` ✅
+- Named capture groups `(?<name>...)` ✅
+- `d` flag (indices) ✅
+
+### Browser API Parity (Both engines return undefined):
+
+These APIs are NOT available in either engine (consistent behavior):
+- `atob` / `btoa` - Both return `typeof === "undefined"` ✅
+- `TextEncoder` / `TextDecoder` - Both return `typeof === "undefined"` ✅
+- `URL` / `URLSearchParams` - Both return `typeof === "undefined"` ✅
+
+### BREAKING CHANGE IDENTIFIED:
+
+**Intl API** - ONLY breaking change found:
+- Deno Core: `typeof Intl === "object"` (available)
+- QuickJS: `typeof Intl === "undefined"` (NOT available)
+
+Expressions using these will FAIL with QuickJS:
+- `new Intl.NumberFormat('en-US').format(1234567.89)`
+- `new Intl.DateTimeFormat('en-US').format(new Date())`
+- `num.toLocaleString('de-DE')`
+- `date.toLocaleDateString('fr-FR')`
+
+**Mitigation**: Search production logs for `Intl` usage in flow expressions before migration.
+
+### Recommendations:
+
+1. ✅ Run the parity tests to verify current implementation (132 unit tests + 19 flow engine tests pass)
+2. ✅ Add tests for edge cases (large integers, optional chaining, spread, multiline)
+3. ✅ Test ES2022+ methods - All supported (Array.at, Object.hasOwn, etc.)
+4. ✅ Test regex features - All supported (lookbehind, named groups)
+5. ⚠️ **Search production for `Intl` usage** - Only confirmed breaking change
+6. Run `USE_QUICKJS_FOR_FLOW_EVAL=1` in staging before full production rollout
+7. Consider adding `Intl` polyfill to QuickJS if production usage is found
+
+### Commands to Run Tests:
+
+```bash
+# Run all parity tests (132 tests)
+cargo test --features deno_core,quickjs -p windmill-worker -- parity_
+
+# Run flow engine tests with both engines (19 tests)
+cargo test --features deno_core -p windmill --test flow_engine_parity
+USE_QUICKJS_FOR_FLOW_EVAL=1 cargo test --features deno_core,quickjs -p windmill --test flow_engine_parity
+```

backend/ee-repo-ref.txt

@@ -1 +1 @@
-371efb2d7307f588c5ce00d63fd036751cc068f2
+fa881b63272aebab8ef79d262be7da2a2908c227

backend/migrations/20260129161851_dedicated_workers_column.down.sql

@@ -0,0 +1 @@
+ALTER TABLE worker_ping DROP COLUMN IF EXISTS dedicated_workers;

backend/migrations/20260129161851_dedicated_workers_column.up.sql

@@ -0,0 +1 @@
+ALTER TABLE worker_ping ADD COLUMN IF NOT EXISTS dedicated_workers TEXT[];

backend/migrations/20260129165755_reset_cached_workspace_diffs.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20260129165755_reset_cached_workspace_diffs.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+UPDATE workspace_diff SET has_changes = NULL;

backend/rust-best-practices.mdc

@@ -1,111 +0,0 @@
----
-description: 
-globs: backend/**/*.rs
-alwaysApply: false
----
-# Windmill Backend - Rust Best Practices
-
-## Project Structure
-
-Windmill uses a workspace-based architecture with multiple crates:
-
-- **windmill-api**: API server functionality
-- **windmill-worker**: Job execution
-- **windmill-common**: Shared code used by all crates
-- **windmill-queue**: Job & flow queuing
-- **windmill-audit**: Audit logging
-- Other specialized crates (git-sync, autoscaling, etc.)
-
-## Adding New Code
-
-### Module Organization
-
-- Place new code in the appropriate crate based on functionality
-- For API endpoints, create or modify files in `windmill-api/src/` organized by domain
-- For shared functionality, use `windmill-common/src/`
-- Use the `_ee.rs` suffix for enterprise-only modules
-- Follow existing patterns for file structure and organization
-
-### Error Handling
-
-- Use the custom `Error` enum from `windmill-common::error`
-- Return `Result<T, Error>` or `JsonResult<T>` for functions that can fail
-- Use the `?` operator for error propagation
-- Add location tracking to errors using `#[track_caller]`
-
-### Database Operations
-
-- Use `sqlx` for database operations with prepared statements
-- Leverage existing database helper functions in `db.rs` modules
-- Use transactions for multi-step operations
-- Handle database errors properly
-
-### API Endpoints
-
-- Follow existing patterns in the `windmill-api` crate
-- Use axum's routing system and extractors
-- Group related routes together
-- Use consistent response formats (JSON)
-- Follow proper authentication and authorization patterns
-- Do not forget to update backend/windmill-api/openapi.yaml after modifying an api endpoint
-
-## Performance Optimizations
-
-When generating code, especially involving `serde`, `sqlx`, and `tokio`, prioritize performance by applying the following principles:
-
-### Serde Optimizations (Serialization & Deserialization)
-
--   **Specify Structure Explicitly:** When defining structs for Serde (`#[derive(Serialize, Deserialize)]`), use `#[serde(...` attributes extensively. This includes:
-    *   `#[serde(rename = "...")]` or `#[serde(alias = "...")]` to map external names precisely, avoiding dynamic lookups.
-    *   `#[serde(default)]` for optional fields with default values, reducing parsing complexity.
-    *   `#[serde(skip_serializing_if = "...")]` to avoid writing fields that meet a certain condition (e.g., `Option::is_none()`, `Vec::is_empty()`, or a custom function), reducing output size and serialization work.
-    *   `#[serde(skip_serializing)]` or `#[serde(skip_deserializing)]` for fields that should *not* be included.
--   **Prefer Borrowing:** Where possible and safe (data lifetime allows), use `Cow<'a, str>` or `&'a str` (with `#[serde(borrow)]`) instead of `String` for string fields during deserialization. This avoids allocating new strings, enabling zero-copy reading from the input buffer. Apply this principle to byte slices (`&'a [u8]` / `Cow<'a, [u8]>`) and potentially borrowed vectors as well.
--   **Avoid Intermediate `Value`:** Unless the data structure is truly dynamic or unknown at compile time, deserialize directly into a well-defined struct or enum rather than into `serde_json::Value` (or equivalent for other formats). This avoids unnecessary heap allocations and type switching.
-
-### SQLx Optimizations (Database Interaction)
-
--   **CRITICAL - Never Use `SELECT *` in Worker-Executed Queries:** For any query that can potentially be executed by workers, **always** explicitly list the specific columns you need instead of using `SELECT *`. This is essential for backwards compatibility: when workers are running behind the API server version (common in distributed deployments), adding new columns to database tables will cause outdated workers to fail when they try to deserialize rows with unexpected columns. Always use explicit column lists like `SELECT id, workspace_id, path, created_at FROM table` instead of `SELECT * FROM table`.
--   **Select Only Necessary Columns:** In `SELECT` queries, list specific column names rather than using `SELECT *`. This reduces data transferred from the database and the work needed for hydration/deserialization.
--   **Batch Operations:** For multiple `INSERT`, `UPDATE`, or `DELETE` statements, prefer executing them in a single query if the database and driver support it efficiently (e.g., `INSERT INTO ... VALUES (...), (...), ...`). This minimizes round trips to the database.
--   **Avoid N+1 Queries:** Do not loop through results of one query and execute a separate query for each item (e.g., fetching users, then querying for each user's profile in a loop). Instead, use JOINs or a single query with an `IN` clause to fetch related data efficiently.
--   **Deserialize Directly:** Use `#[derive(FromRow)]` on structs and ensure the struct fields match the selected columns in the query. This allows SQLx to hydrate objects directly, avoiding intermediate data structures.
--   **Parameterize Queries:** Always use SQLx's query methods (`.bind(...)`) to pass values as parameters rather than string formatting. This prevents SQL injection and allows the database to cache query plans, improving performance on repeated executions.
-
-### Tokio Optimizations (Asynchronous Runtime)
-
--   **Avoid Blocking Operations:** **Crucially**, never perform blocking operations (synchronous file I/O, `std::thread::sleep`, CPU-bound loops, `std::sync::Mutex::lock`, blocking network calls without `tokio::net`) directly within an `async fn` or a standard `tokio::spawn` task. Blocking pauses the entire worker thread, potentially starving other tasks. Use `tokio::task::spawn_blocking` for CPU-intensive work or blocking I/O.
--   **Use Tokio's Async Primitives:** Prefer `tokio::sync` (channels, mutexes, semaphores), `tokio::io`, `tokio::net`, and `tokio::time` over their `std` counterparts in asynchronous contexts. These are designed to yield control back to the scheduler.
--   **Manage Concurrency:** Be mindful of how many tasks are spawned. Creating a new task for every tiny piece of work can introduce overhead. Group related asynchronous operations where appropriate.
--   **Handle Shared State Efficiently:** Use `Arc` for shared ownership in concurrent tasks. When shared state needs mutation, prefer `tokio::sync::Mutex` over `std::sync::Mutex` in `async` code. Consider `tokio::sync::RwLock` if reads significantly outnumber writes. Minimize the duration for which locks are held.
--   **Understand `.await`:** Place `.await` strategically to allow the runtime to switch to other ready tasks. Ensure that `.await` points to genuinely asynchronous operations.
--   **Backpressure:** If dealing with data streams or queues between tasks, implement backpressure mechanisms (e.g., bounded channels like `tokio::sync::mpsc::channel`) to prevent one component from overwhelming another or critical resources like the database.
-
-## Enterprise Features
-
--   Use feature flags for enterprise functionality
--   Conditionally compile with `#[cfg(feature = "enterprise")]`
--   Isolate enterprise code in separate modules
-
-## Code Style
-
--   Group imports by external and internal crates
--   Place struct/enum definitions before implementations
--   Group similar functionality together
--   Use descriptive naming consistent with the codebase
--   Follow existing patterns for async code using tokio
-
-## Testing
-
--   Write unit tests for core functionality
--   Use the `#[cfg(test)]` module for test code
--   For database tests, use the existing test utilities
-
-## Common Crates Used
-
--   **tokio**: For async runtime
--   **axum**: For web server and routing
--   **sqlx**: For database operations
--   **serde**: For serialization/deserialization
--   **tracing**: For logging and diagnostics
--   **reqwest**: For HTTP client functionality

backend/src/main.rs

@@ -34,7 +34,7 @@ use windmill_common::ee_oss::{
 };
 
 use windmill_common::{
-    agent_workers::build_agent_http_client,
+    agent_workers::AgentConfig,
     global_settings::{
         APP_WORKSPACED_ROUTE_SETTING, BASE_URL_SETTING, BUNFIG_INSTALL_SCOPES_SETTING,
         CRITICAL_ALERTS_ON_DB_OVERSIZE_SETTING, CRITICAL_ALERT_MUTE_UI_SETTING,
@@ -43,13 +43,14 @@ use windmill_common::{
         EXPOSE_DEBUG_METRICS_SETTING, EXPOSE_METRICS_SETTING, EXTRA_PIP_INDEX_URL_SETTING,
         HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INDEXER_SETTING,
         INSTANCE_PYTHON_VERSION_SETTING, JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING,
-        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING, OTEL_TRACING_PROXY_SETTING,
+        KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
         NPM_CONFIG_REGISTRY_SETTING, NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING,
-        PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING,
-        REQUEST_SIZE_LIMIT_SETTING, REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING,
-        RETENTION_PERIOD_SECS_SETTING, RUBY_REPOS_SETTING, SAML_METADATA_SETTING,
-        SCIM_TOKEN_SETTING, SMTP_SETTING, TEAMS_SETTING, TIMEOUT_WAIT_RESULT_SETTING,
+        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
+        POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
+        RUBY_REPOS_SETTING, SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, SMTP_SETTING, TEAMS_SETTING,
+        TIMEOUT_WAIT_RESULT_SETTING,
     },
     scripts::ScriptLang,
     stats_oss::schedule_stats,
@@ -99,9 +100,10 @@ use crate::monitor::{
     reload_bunfig_install_scopes_setting, reload_critical_alert_mute_ui_setting,
     reload_critical_error_channels_setting, reload_extra_pip_index_url_setting,
     reload_hub_api_secret_setting, reload_hub_base_url_setting, reload_job_default_timeout_setting,
-    reload_jwt_secret_setting, reload_license_key, reload_otel_tracing_proxy_setting,
-    reload_npm_config_registry_setting, reload_pip_index_url_setting, reload_retention_period_setting,
-    reload_scim_token_setting, reload_smtp_config, reload_worker_config, MonitorIteration,
+    reload_jwt_secret_setting, reload_license_key, reload_npm_config_registry_setting,
+    reload_otel_tracing_proxy_setting, reload_pip_index_url_setting,
+    reload_retention_period_setting, reload_scim_token_setting, reload_smtp_config,
+    reload_worker_config, MonitorIteration,
 };
 
 #[cfg(feature = "parquet")]
@@ -410,7 +412,10 @@ pub async fn sync_cached_resource_types(db: &sqlx::Pool<sqlx::Postgres>) -> anyh
     let cache_path = format!("{}/{}", HUB_RT_CACHE_DIR, HUB_RT_CACHE_FILE);
 
     if tokio::fs::metadata(&cache_path).await.is_err() {
-        tracing::info!("No cached resource types found at {}, skipping sync", cache_path);
+        tracing::info!(
+            "No cached resource types found at {}, skipping sync",
+            cache_path
+        );
         return Ok(());
     }
 
@@ -420,8 +425,8 @@ pub async fn sync_cached_resource_types(db: &sqlx::Pool<sqlx::Postgres>) -> anyh
         .await
         .with_context(|| format!("Failed to read cache file from {}", cache_path))?;
 
-    let cached_types: Vec<HubResourceType> = serde_json::from_str(&content)
-        .with_context(|| "Failed to parse cached resource types")?;
+    let cached_types: Vec<HubResourceType> =
+        serde_json::from_str(&content).with_context(|| "Failed to parse cached resource types")?;
 
     tracing::info!("Found {} cached resource types", cached_types.len());
 
@@ -433,11 +438,13 @@ pub async fn sync_cached_resource_types(db: &sqlx::Pool<sqlx::Postgres>) -> anyh
     .await
     .with_context(|| "Failed to fetch existing resource types")?;
 
-    let existing_map: std::collections::HashMap<String, (Option<serde_json::Value>, Option<String>)> =
-        existing_types
-            .into_iter()
-            .map(|(name, schema, desc)| (name, (schema, desc)))
-            .collect();
+    let existing_map: std::collections::HashMap<
+        String,
+        (Option<serde_json::Value>, Option<String>),
+    > = existing_types
+        .into_iter()
+        .map(|(name, schema, desc)| (name, (schema, desc)))
+        .collect();
 
     let mut synced_count = 0;
     let mut skipped_count = 0;
@@ -478,36 +485,45 @@ pub async fn sync_cached_resource_types(db: &sqlx::Pool<sqlx::Postgres>) -> anyh
 }
 
 fn print_help() {
-	println!("Windmill - a fast, open-source workflow engine and job runner.");
-	println!();
-	println!("Usage:");
-	println!("  windmill [SUBCOMMAND]");
-	println!();
-	println!("Subcommands:");
-	println!("  help | -h | --help   Show this help information and exit");
-	println!("  version              Show Windmill version and exit");
-	println!("  cache [hubPaths.json]  Pre-cache hub scripts (default: ./hubPaths.json)");
-	println!("  cache-rt             Pre-cache hub resource types");
-	println!();
-	println!("Environment variables (name = default):");
-	println!("  DATABASE_URL = <required>              The Postgres database url.");
-	println!("  MODE = standalone                      Mode: standalone | worker | server | agent");
-	println!("  BASE_URL = http://localhost:8000       Public base URL of your instance (overridden by instance settings)");
-	println!("  PORT = {}                              HTTP port (server/indexer/MCP modes)", DEFAULT_PORT);
-	println!("  SERVER_BIND_ADDR = <mode dependent>    IP to bind to (server: {}, worker: {})", DEFAULT_SERVER_BIND_ADDR, DEFAULT_WORKER_BIND_ADDR);
-	println!("  NUM_WORKERS = {}                       Number of workers (standalone/worker modes)", DEFAULT_NUM_WORKERS);
-	println!("  WORKER_GROUP = default                 Worker group this worker belongs to",);
-	println!("  JSON_FMT = false                       Output logs in JSON instead of logfmt");
-	println!("  METRICS_ADDR = None                    (EE only) Prometheus metrics addr at /metrics; set \"true\" to use :8001");
-	println!("  SUPERADMIN_SECRET = None               Virtual superadmin token (server)");
-	println!("  LICENSE_KEY = None                     (EE only) Enterprise license key (workers require valid key)");
-	println!("  RUN_UPDATE_CA_CERTIFICATE_AT_START = false  Run system CA update at startup");
-	println!("  RUN_UPDATE_CA_CERTIFICATE_PATH = /usr/sbin/update-ca-certificates  Path to CA update tool");
-	println!("  SYNC_CACHED_RT = false                 Sync cached resource types to admins workspace on server start");
-	println!();
-	println!("Notes:");
-	println!("- Advanced and less commonly used settings are managed via the database and are omitted here.");
-	println!("- At startup, Windmill logs currently set configuration keys for visibility.");
+    println!("Windmill - a fast, open-source workflow engine and job runner.");
+    println!();
+    println!("Usage:");
+    println!("  windmill [SUBCOMMAND]");
+    println!();
+    println!("Subcommands:");
+    println!("  help | -h | --help   Show this help information and exit");
+    println!("  version              Show Windmill version and exit");
+    println!("  cache [hubPaths.json]  Pre-cache hub scripts (default: ./hubPaths.json)");
+    println!("  cache-rt             Pre-cache hub resource types");
+    println!();
+    println!("Environment variables (name = default):");
+    println!("  DATABASE_URL = <required>              The Postgres database url.");
+    println!("  MODE = standalone                      Mode: standalone | worker | server | agent");
+    println!("  BASE_URL = http://localhost:8000       Public base URL of your instance (overridden by instance settings)");
+    println!(
+        "  PORT = {}                              HTTP port (server/indexer/MCP modes)",
+        DEFAULT_PORT
+    );
+    println!(
+        "  SERVER_BIND_ADDR = <mode dependent>    IP to bind to (server: {}, worker: {})",
+        DEFAULT_SERVER_BIND_ADDR, DEFAULT_WORKER_BIND_ADDR
+    );
+    println!(
+        "  NUM_WORKERS = {}                       Number of workers (standalone/worker modes)",
+        DEFAULT_NUM_WORKERS
+    );
+    println!("  WORKER_GROUP = default                 Worker group this worker belongs to",);
+    println!("  JSON_FMT = false                       Output logs in JSON instead of logfmt");
+    println!("  METRICS_ADDR = None                    (EE only) Prometheus metrics addr at /metrics; set \"true\" to use :8001");
+    println!("  SUPERADMIN_SECRET = None               Virtual superadmin token (server)");
+    println!("  LICENSE_KEY = None                     (EE only) Enterprise license key (workers require valid key)");
+    println!("  RUN_UPDATE_CA_CERTIFICATE_AT_START = false  Run system CA update at startup");
+    println!("  RUN_UPDATE_CA_CERTIFICATE_PATH = /usr/sbin/update-ca-certificates  Path to CA update tool");
+    println!("  SYNC_CACHED_RT = false                 Sync cached resource types to admins workspace on server start");
+    println!();
+    println!("Notes:");
+    println!("- Advanced and less commonly used settings are managed via the database and are omitted here.");
+    println!("- At startup, Windmill logs currently set configuration keys for visibility.");
 }
 
 async fn windmill_main() -> anyhow::Result<()> {
@@ -641,15 +657,23 @@ async fn windmill_main() -> anyhow::Result<()> {
         .and_then(|x| x.parse().ok())
         .unwrap_or(IpAddr::from(default_bind_addr));
 
-    let (conn, first_suffix) = if mode == Mode::Agent {
+    let (conn, first_suffix, agent_config) = if mode == Mode::Agent {
+        let agent_config = match AgentConfig::from_env() {
+            Ok(config) => config,
+            Err(e) => {
+                tracing::error!("{e}");
+                std::process::exit(1);
+            }
+        };
         tracing::info!(
             "Creating http client for cluster using base internal url {}",
-            std::env::var("BASE_INTERNAL_URL").unwrap_or_default()
+            agent_config.base_internal_url
         );
         let suffix = create_default_worker_suffix(&hostname);
         (
-            Connection::Http(build_agent_http_client(&suffix, None, None)),
+            Connection::Http(agent_config.build_http_client(&suffix)),
             Some(suffix),
+            Some(agent_config),
         )
     } else {
         println!("Connecting to database...");
@@ -668,11 +692,13 @@ async fn windmill_main() -> anyhow::Result<()> {
 
         // Load OTEL tracing proxy settings and initialize deno_telemetry if nativets tracing is enabled
         // This must happen before any Deno runtime is created
-        #[cfg(all(feature = "private", feature = "enterprise", feature = "deno_core"))]
+        #[cfg(all(feature = "private", feature = "enterprise"))]
         {
             reload_otel_tracing_proxy_setting(&Connection::Sql(db.clone())).await;
 
-            if windmill_worker::is_otel_tracing_proxy_enabled_for_lang(&ScriptLang::Nativets).await {
+            #[cfg(feature = "deno_core")]
+            if windmill_worker::is_otel_tracing_proxy_enabled_for_lang(&ScriptLang::Nativets).await
+            {
                 match windmill_worker::load_internal_otel_exporter().await {
                     Ok(()) => {
                         tracing::info!("Internal OTEL exporter initialized for nativets tracing");
@@ -687,7 +713,7 @@ async fn windmill_main() -> anyhow::Result<()> {
         load_otel(&db).await;
 
         println!("Database connected");
-        (Connection::Sql(db), None)
+        (Connection::Sql(db), None, None)
     };
 
     let environment = if let Ok(environment) = std::env::var("OTEL_ENVIRONMENT") {
@@ -798,6 +824,12 @@ Windmill Community Edition {GIT_VERSION}
         // if key still invalid and num_workers > 0, set to 0
         if let Err(err) = reload_license_key(&conn).await {
             tracing::error!("Failed to reload license key: {err:#}");
+            if is_agent {
+                tracing::error!(
+                    "Agent worker cannot connect to server. Please check AGENT_TOKEN and BASE_INTERNAL_URL"
+                );
+                std::process::exit(1);
+            }
         }
         let valid_key = *LICENSE_KEY_VALID.read().await;
         if !valid_key && !server_mode {
@@ -908,9 +940,11 @@ Windmill Community Edition {GIT_VERSION}
                     tracing::info!("Received killpill, aborting index initialization");
                 },
                 res = windmill_indexer::completed_runs_oss::init_index(&db) => {
-                        let res = res?;
-                        reader = Some(res.0);
-                        writer = Some(res.1);
+                    let res = res?;
+                    if let Some(r) = res {
+                        reader = Some(r.0);
+                        writer = Some(r.1);
+                    }
                 }
 
                 }
@@ -952,9 +986,11 @@ Windmill Community Edition {GIT_VERSION}
                         tracing::info!("Received killpill, aborting index initialization");
                     },
                     res = windmill_indexer::service_logs_oss::init_index(&db, killpill_tx.clone()) => {
-                            let res = res?;
-                            reader = Some(res.0);
-                            writer = Some(res.1);
+                        let res = res?;
+                        if let Some(r) = res {
+                            reader = Some(r.0);
+                            writer = Some(r.1);
+                        }
                     }
 
                 }
@@ -1052,7 +1088,12 @@ Windmill Community Edition {GIT_VERSION}
                             conn: if i == 0 || mode != Mode::Agent {
                                 conn.clone()
                             } else {
-                                Connection::Http(build_agent_http_client(&suffix, None, None))
+                                Connection::Http(
+                                    agent_config
+                                        .as_ref()
+                                        .expect("agent_config must be set in agent mode")
+                                        .build_http_client(&suffix),
+                                )
                             },
                             worker_name: worker_name_with_suffix(
                                 mode == Mode::Agent,
@@ -1572,34 +1613,17 @@ Windmill Community Edition {GIT_VERSION}
 
         let otel_tracing_proxy_f = async {
             #[cfg(all(feature = "private", feature = "enterprise"))]
-            {
-                // Start OTEL tracing proxy for HTTP request interception
-                // Only enabled when: setting is on, worker mode (not server), and single worker (to avoid race conditions)
-                if worker_mode
-                    && num_workers == 1
-                    && windmill_worker::OTEL_TRACING_PROXY_SETTINGS
-                        .read()
-                        .await
-                        .enabled
-                {
-                    if let Some(db) = conn.as_sql() {
-                        tracing::info!(
-                            "Starting jobs OTEL tracing (ports will be dynamically assigned)"
-                        );
-                        if let Err(e) =
-                            windmill_worker::start_jobs_otel_tracing(db.clone(), otel_killpill_rx)
-                                .await
-                        {
-                            tracing::error!("Jobs OTEL tracing error: {}", e);
-                        }
-                    }
-                } else if windmill_worker::OTEL_TRACING_PROXY_SETTINGS
-                    .read()
+            if worker_mode {
+                if let Some(db) = conn.as_sql() {
+                    if let Err(e) = windmill_worker::start_jobs_otel_tracing(
+                        db.clone(),
+                        otel_killpill_rx,
+                        num_workers,
+                    )
                     .await
-                    .enabled
-                    && num_workers > 1
-                {
-                    tracing::warn!("OTEL tracing proxy is enabled but num_workers > 1. Disabling to avoid race conditions. Set NUM_WORKERS=1 to enable.");
+                    {
+                        tracing::error!("Jobs OTEL tracing error: {}", e);
+                    }
                 }
             }
 

backend/src/monitor.rs

@@ -56,8 +56,8 @@ use windmill_common::{
         HUB_API_SECRET_SETTING, HUB_BASE_URL_SETTING, INSTANCE_PYTHON_VERSION_SETTING,
         JOB_DEFAULT_TIMEOUT_SECS_SETTING, JWT_SECRET_SETTING, KEEP_JOB_DIR_SETTING,
         LICENSE_KEY_SETTING, MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NPM_CONFIG_REGISTRY_SETTING,
-        OTEL_TRACING_PROXY_SETTING, NUGET_CONFIG_SETTING, OTEL_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
-        POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        NUGET_CONFIG_SETTING, OTEL_SETTING, OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING,
+        POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
         SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, TIMEOUT_WAIT_RESULT_SETTING,
     },
@@ -84,10 +84,10 @@ use windmill_common::{
 use windmill_common::{client::AuthedClient, global_settings::APP_WORKSPACED_ROUTE_SETTING};
 use windmill_queue::{cancel_job, get_queued_job_v2, SameWorkerPayload};
 use windmill_worker::{
-    handle_job_error, JobCompletedSender, OtelTracingProxySettings, SameWorkerSender, BUNFIG_INSTALL_SCOPES,
-    INSTANCE_PYTHON_VERSION, JOB_DEFAULT_TIMEOUT, KEEP_JOB_DIR, MAVEN_REPOS,
-    OTEL_TRACING_PROXY_SETTINGS, NO_DEFAULT_MAVEN, NPM_CONFIG_REGISTRY, NUGET_CONFIG, PIP_EXTRA_INDEX_URL,
-    PIP_INDEX_URL, POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL,
+    handle_job_error, JobCompletedSender, OtelTracingProxySettings, SameWorkerSender,
+    BUNFIG_INSTALL_SCOPES, INSTANCE_PYTHON_VERSION, JOB_DEFAULT_TIMEOUT, KEEP_JOB_DIR, MAVEN_REPOS,
+    NO_DEFAULT_MAVEN, NPM_CONFIG_REGISTRY, NUGET_CONFIG, OTEL_TRACING_PROXY_SETTINGS,
+    PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL,
 };
 
 #[cfg(feature = "parquet")]
@@ -246,6 +246,7 @@ pub async fn initial_load(
                     ),
                     priority_tags_sorted: vec![],
                     dedicated_worker: None,
+                    dedicated_workers: None,
                     init_bash: load_init_bash_from_env(),
                     periodic_script_bash: load_periodic_bash_script_from_env(),
                     periodic_script_interval_seconds: load_periodic_bash_script_interval_from_env(),
@@ -784,26 +785,24 @@ pub async fn load_keep_job_dir(conn: &Connection) {
 
 pub async fn reload_otel_tracing_proxy_setting(conn: &Connection) {
     match load_value_from_global_settings_with_conn(conn, OTEL_TRACING_PROXY_SETTING, true).await {
-        Ok(Some(settings)) => {
-            match serde_json::from_value::<OtelTracingProxySettings>(settings) {
-                Ok(new_settings) => {
-                    let mut current = OTEL_TRACING_PROXY_SETTINGS.write().await;
-                    if current.enabled != new_settings.enabled
-                        || current.enabled_languages != new_settings.enabled_languages
-                    {
-                        tracing::info!(
-                            "OTEL tracing proxy settings changed: enabled={}, languages={:?}",
-                            new_settings.enabled,
-                            new_settings.enabled_languages
-                        );
-                        *current = new_settings;
-                    }
-                }
-                Err(e) => {
-                    tracing::error!("Error parsing OTEL tracing proxy settings: {e:#}");
+        Ok(Some(settings)) => match serde_json::from_value::<OtelTracingProxySettings>(settings) {
+            Ok(new_settings) => {
+                let mut current = OTEL_TRACING_PROXY_SETTINGS.write().await;
+                if current.enabled != new_settings.enabled
+                    || current.enabled_languages != new_settings.enabled_languages
+                {
+                    tracing::info!(
+                        "OTEL tracing proxy settings changed: enabled={}, languages={:?}",
+                        new_settings.enabled,
+                        new_settings.enabled_languages
+                    );
+                    *current = new_settings;
                 }
             }
-        }
+            Err(e) => {
+                tracing::error!("Error parsing OTEL tracing proxy settings: {e:#}");
+            }
+        },
         Err(e) => {
             tracing::error!("Error loading OTEL tracing proxy setting: {e:#}");
         }
@@ -985,7 +984,10 @@ pub async fn delete_expired_items(db: &DB) -> () {
                 );
             }
         }
-        Err(e) => tracing::error!("Error deleting expired MCP OAuth authorization codes: {:?}", e),
+        Err(e) => tracing::error!(
+            "Error deleting expired MCP OAuth authorization codes: {:?}",
+            e
+        ),
     }
 
     let job_retention_secs = *JOB_RETENTION_SECS.read().await;
@@ -1057,20 +1059,36 @@ async fn delete_expired_jobs_batch(
 ) -> error::Result<usize> {
     let mut tx = db.begin().await?;
 
+    // Fetch active ROOT job IDs that started before the retention period. We only care about
+    // these because their child jobs could be old enough to be deletion candidates.
+    // Jobs started after the retention period can't have children old enough to delete.
+    let active_root_job_ids: Vec<Uuid> = sqlx::query_scalar!(
+        "SELECT q.id FROM v2_job_queue q
+         JOIN v2_job j ON j.id = q.id
+         WHERE j.parent_job IS NULL
+           AND j.created_at <= now() - ($1::bigint::text || ' s')::interval",
+        job_retention_secs
+    )
+    .fetch_all(&mut *tx)
+    .await?;
+
     // Use FOR UPDATE SKIP LOCKED to avoid contention between replicas
     // ORDER BY completed_at ensures we delete oldest jobs first
     let deleted_jobs: Vec<Uuid> = sqlx::query_scalar!(
         "DELETE FROM v2_job_completed
          WHERE id IN (
-             SELECT id FROM v2_job_completed
-             WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval
-             ORDER BY completed_at ASC
+             SELECT jc.id FROM v2_job_completed jc
+             LEFT JOIN v2_job j ON j.id = jc.id
+             WHERE jc.completed_at <= now() - ($1::bigint::text || ' s')::interval
+               AND COALESCE(j.root_job, j.flow_innermost_root_job, jc.id) != ALL($3)
+             ORDER BY jc.completed_at ASC
              LIMIT $2
-             FOR UPDATE SKIP LOCKED
+             FOR UPDATE OF jc SKIP LOCKED
          )
          RETURNING id",
         job_retention_secs,
-        batch_size
+        batch_size,
+        &active_root_job_ids
     )
     .fetch_all(&mut *tx)
     .await?;
@@ -1866,7 +1884,13 @@ pub async fn monitor_db(
 
     let update_min_worker_version_f = async {
         #[cfg(not(feature = "test_job_debouncing"))]
-        windmill_common::min_version::update_min_version(conn, _worker_mode, WORKERS_NAMES.read().await.clone(), initial_load).await;
+        windmill_common::min_version::update_min_version(
+            conn,
+            _worker_mode,
+            WORKERS_NAMES.read().await.clone(),
+            initial_load,
+        )
+        .await;
     };
 
     // Run every 5 minutes (10 iterations * 30s = 5 minutes)
@@ -2060,10 +2084,12 @@ pub async fn reload_worker_config(db: &DB, tx: KillpillSender, kill_if_change: b
     } else {
         let wc = WORKER_CONFIG.read().await;
         let config = config.unwrap();
-        if *wc != config || config.dedicated_worker.is_some() {
+        let has_dedicated = config.dedicated_worker.is_some() || config.dedicated_workers.as_ref().is_some_and(|dws| !dws.is_empty());
+        if *wc != config || has_dedicated {
             if kill_if_change {
-                if config.dedicated_worker.is_some()
+                if has_dedicated
                     || (*wc).dedicated_worker != config.dedicated_worker
+                    || (*wc).dedicated_workers != config.dedicated_workers
                 {
                     tracing::info!("Dedicated worker config changed, sending killpill. Expecting to be restarted by supervisor.");
                     let _ = tx.send();

backend/summarized_schema.txt

@@ -995,6 +995,7 @@ TABLE: worker_ping
   - custom_tags (text[])
   - worker_group (character)
   - dedicated_worker (character)
+  - dedicated_workers (text[])
   - wm_version (character)
   - current_job_id (uuid)
   - current_job_workspace_id (character)

backend/tests/common/mod.rs

@@ -764,23 +764,25 @@ pub async fn run_preview_relative_imports(
 #[cfg(all(feature = "private", feature = "agent_worker_server"))]
 pub async fn testing_http_connection(port: u16) -> Connection {
     let suffix = windmill_common::utils::create_default_worker_suffix("test-agent-worker");
+    let agent_token = format!(
+        "{}{}",
+        windmill_common::agent_workers::AGENT_JWT_PREFIX,
+        windmill_common::jwt::encode_with_internal_secret(
+            windmill_api::agent_workers_ee::AgentAuth {
+                worker_group: "testing-agent".to_owned(),
+                suffix: Some(suffix.clone()),
+                tags: vec!["flow".into(), "python3".into(), "dependency".into()],
+                exp: Some(usize::MAX),
+            }
+        )
+        .await
+        .expect("JWT token to be created")
+    );
+    let base_internal_url = format!("http://localhost:{port}");
     Connection::Http(windmill_common::agent_workers::build_agent_http_client(
         &suffix,
-        Some(format!(
-            "{}{}",
-            windmill_common::agent_workers::AGENT_JWT_PREFIX,
-            windmill_common::jwt::encode_with_internal_secret(
-                windmill_api::agent_workers_ee::AgentAuth {
-                    worker_group: "testing-agent".to_owned(),
-                    suffix: Some(suffix.clone()),
-                    tags: vec!["flow".into(), "python3".into(), "dependency".into()],
-                    exp: Some(usize::MAX),
-                }
-            )
-            .await
-            .expect("JWT token to be created")
-        )),
-        Some(format!("http://localhost:{port}")),
+        &agent_token,
+        &base_internal_url,
     ))
 }
 

backend/tests/workspace_comparison.rs

@@ -0,0 +1,507 @@
+use serde_json::json;
+use sqlx::{Pool, Postgres};
+
+mod common;
+use common::*;
+
+/// Comprehensive integration test for the compare_workspaces endpoint.
+///
+/// This test validates workspace fork comparison functionality by:
+/// 1. Setting up a parent workspace with all item types (scripts, flows, apps, resources, variables, resource_types, folders)
+/// 2. Creating a fork of the workspace
+/// 3. Making various changes in both workspaces (new items, modifications, conflicts, deletions, renames)
+/// 4. Populating the workspace_diff table to simulate Git sync tracking
+/// 5. Calling compare_workspaces and verifying all aspects of the comparison
+#[sqlx::test(fixtures("base"))]
+async fn test_compare_workspaces_comprehensive(db: Pool<Postgres>) -> anyhow::Result<()> {
+    initialize_tracing().await;
+
+    let server = ApiServer::start(db.clone()).await?;
+    let port = server.addr.port();
+    let client = windmill_api_client::create_client(
+        &format!("http://localhost:{port}"),
+        "SECRET_TOKEN".to_string(),
+    );
+    let base_url = format!("http://localhost:{port}/api");
+
+    // ==============================================================
+    // PHASE 1: Setup Parent Workspace with All Item Types
+    // ==============================================================
+
+    // Create folder first (other items will use it)
+    sqlx::query!(
+        "INSERT INTO folder (workspace_id, name, display_name, owners, summary, created_by)
+         VALUES ('test-workspace', 'shared', 'Shared Folder', ARRAY['test@windmill.dev']::varchar[], 'Test folder', 'test@windmill.dev')"
+    )
+    .execute(&db)
+    .await?;
+
+    // Create scripts
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)
+         VALUES
+         ('test-workspace', 'f/shared/original_script', 12345, 'def main(): pass', 'Original', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),
+         ('test-workspace', 'f/shared/to_modify_parent', 22222, 'def main(): return 1', 'To modify in parent', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),
+         ('test-workspace', 'f/shared/to_modify_fork', 33333, 'def main(): return 2', 'To modify in fork', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),
+         ('test-workspace', 'f/shared/to_conflict', 44444, 'def main(): return 3', 'To conflict', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),
+         ('test-workspace', 'f/shared/to_delete', 55555, 'def main(): return 4', 'To delete', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Create flow
+    sqlx::query!(
+        "INSERT INTO flow (workspace_id, path, summary, description, value, schema, edited_by, edited_at, archived)
+         VALUES ('test-workspace', 'f/shared/original_flow', 'Flow summary', '', $1, NULL, 'test@windmill.dev', NOW(), false)",
+        json!({"modules": []})
+    )
+    .execute(&db)
+    .await?;
+
+    // Create resource
+    sqlx::query!(
+        "INSERT INTO resource (workspace_id, path, value, resource_type, description, created_by)
+         VALUES
+         ('test-workspace', 'f/shared/db_config', $1, 'postgresql', '', 'test@windmill.dev'),
+         ('test-workspace', 'f/shared/old_name', $2, 'generic', '', 'test@windmill.dev'),
+         ('test-workspace', 'f/shared/resource_to_modify', $3, 'generic', '', 'test@windmill.dev')",
+        json!({"host": "localhost"}),
+        json!({}),
+        json!({"key": "value"})
+    )
+    .execute(&db)
+    .await?;
+
+    // Create variable
+    sqlx::query!(
+        "INSERT INTO variable (workspace_id, path, value, is_secret, description)
+         VALUES
+         ('test-workspace', 'f/shared/api_key', 'secret123', false, 'Test key'),
+         ('test-workspace', 'f/shared/variable_to_modify', 'original', false, 'To modify')"
+    )
+    .execute(&db)
+    .await?;
+
+    // Create resource type
+    sqlx::query!(
+        "INSERT INTO resource_type (workspace_id, name, schema, description, created_by)
+         VALUES ('test-workspace', 'custom_db', $1, 'Custom DB type', 'test@windmill.dev')",
+        json!({"type": "object"})
+    )
+    .execute(&db)
+    .await?;
+
+    // Create app
+    sqlx::query!(
+        "INSERT INTO app (workspace_id, path, summary, policy, versions, extra_perms, draft_only)
+         VALUES ('test-workspace', 'f/shared/dashboard', 'Dashboard app', '{}', ARRAY[1::bigint], '{}', false)"
+    )
+    .execute(&db)
+    .await?;
+
+    let app_id = sqlx::query_scalar!(
+        "SELECT id FROM app WHERE path = 'f/shared/dashboard' AND workspace_id = 'test-workspace'"
+    )
+    .fetch_one(&db)
+    .await?;
+
+    sqlx::query!(
+        "INSERT INTO app_version (app_id, value, created_by, created_at)
+         VALUES ($1, $2, 'test@windmill.dev', NOW())",
+        app_id,
+        json!({"grid": []})
+    )
+    .execute(&db)
+    .await?;
+
+    // ==============================================================
+    // PHASE 2: Create Fork
+    // ==============================================================
+
+    let fork_response = client
+        .client()
+        .post(&format!("{base_url}/w/test-workspace/workspaces/create_fork"))
+        .json(&json!({
+            "id": "wm-fork-test-workspace",
+            "name": "Test Fork",
+            "color": "#0000ff"
+        }))
+        .send()
+        .await?;
+
+    let status = fork_response.status();
+    assert!(status.is_success(), "Fork creation should succeed: {}", status);
+
+    // Verify fork was created
+    let fork_exists = sqlx::query_scalar!(
+        "SELECT EXISTS(SELECT 1 FROM workspace WHERE id = 'wm-fork-test-workspace')"
+    )
+    .fetch_one(&db)
+    .await?;
+    assert!(fork_exists.unwrap_or(false), "Fork workspace should exist");
+
+    // ==============================================================
+    // PHASE 3: Make Changes in Both Workspaces
+    // ==============================================================
+
+    // Scenario 1: New script in parent (ahead)
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)
+         VALUES ('test-workspace', 'f/shared/new_in_parent', 54321, 'def main(): return \"new\"', 'New in parent', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 2: New script in fork (behind)
+    sqlx::query!(
+        "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)
+         VALUES ('wm-fork-test-workspace', 'f/shared/new_in_fork', 99999, 'def main(): return \"fork\"', 'New in fork', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 3: Modify script in parent (ahead)
+    sqlx::query!(
+        "UPDATE script
+         SET content = 'def main(): return \"modified\"', summary = 'Modified in parent'
+         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/to_modify_parent'"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 4: Modify script in fork (behind)
+    sqlx::query!(
+        "UPDATE script
+         SET content = 'def main(): return \"fork_modified\"', summary = 'Modified in fork'
+         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/to_modify_fork'"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 5: Conflict - modify in both workspaces
+    sqlx::query!(
+        "UPDATE flow SET value = $1
+         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/original_flow'",
+        json!({"modules": [{"id": "a"}]})
+    )
+    .execute(&db)
+    .await?;
+
+    sqlx::query!(
+        "UPDATE flow SET value = $1
+         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/original_flow'",
+        json!({"modules": [{"id": "b"}]})
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 6: Delete (archive) in fork
+    sqlx::query!(
+        "UPDATE script SET archived = true
+         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/to_delete'"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 7: Rename in parent (resource)
+    sqlx::query!(
+        "UPDATE resource SET path = 'f/shared/new_name'
+         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/old_name'"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 8: Modify app in parent
+    sqlx::query!(
+        "UPDATE app SET summary = 'Modified dashboard app'
+         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/dashboard'"
+    )
+    .execute(&db)
+    .await?;
+
+    // Scenario 9: Modify resource in fork
+    sqlx::query!(
+        "UPDATE resource SET value = $1
+         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/resource_to_modify'",
+        json!({"key": "modified_value"})
+    )
+    .execute(&db)
+    .await?;
+
+    // Modify variable in parent
+    sqlx::query!(
+        "UPDATE variable SET value = 'modified_value'
+         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/variable_to_modify'"
+    )
+    .execute(&db)
+    .await?;
+
+    // Create new resource type in parent
+    sqlx::query!(
+        "INSERT INTO resource_type (workspace_id, name, schema, description, created_by)
+         VALUES ('test-workspace', 'new_type', $1, 'New type in parent', 'test@windmill.dev')",
+        json!({"type": "string"})
+    )
+    .execute(&db)
+    .await?;
+
+    // Modify folder in fork (display_name)
+    sqlx::query!(
+        "UPDATE folder SET display_name = 'Modified Shared Folder'
+         WHERE workspace_id = 'wm-fork-test-workspace' AND name = 'shared'"
+    )
+    .execute(&db)
+    .await?;
+
+    // ==============================================================
+    // PHASE 4: Populate workspace_diff Table
+    // ==============================================================
+
+    // New in parent (ahead)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_in_parent', 'script', 1, 0, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'new_type', 'resource_type', 1, 0, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // New in fork (behind)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_in_fork', 'script', 0, 1, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Modified in parent (ahead)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_modify_parent', 'script', 1, 0, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/dashboard', 'app', 1, 0, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/variable_to_modify', 'variable', 1, 0, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Modified in fork (behind)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_modify_fork', 'script', 0, 1, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/resource_to_modify', 'resource', 0, 1, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'shared', 'folder', 0, 1, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Conflict (both ahead and behind)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/original_flow', 'flow', 1, 1, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_conflict', 'script', 1, 1, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Deleted in fork (exists only in parent)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_delete', 'script', 1, 0, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Renamed in parent (two entries)
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/old_name', 'resource', 0, 1, NULL),
+         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_name', 'resource', 1, 0, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // Add an unchanged item to verify it gets filtered out
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/original_script', 'script', 0, 0, NULL)"
+    )
+    .execute(&db)
+    .await?;
+
+    // ==============================================================
+    // PHASE 5: Call compare_workspaces and Verify Results
+    // ==============================================================
+
+    let comparison: serde_json::Value = client
+        .client()
+        .get(&format!("{base_url}/w/test-workspace/workspaces/compare/wm-fork-test-workspace"))
+        .send()
+        .await?
+        .json()
+        .await?;
+
+    // Verify basic structure
+    assert!(!comparison["skipped_comparison"].as_bool().unwrap_or(true), "Should not skip comparison");
+    assert!(comparison["diffs"].is_array(), "Should have diffs array");
+    assert!(comparison["summary"].is_object(), "Should have summary object");
+
+    let diffs = comparison["diffs"].as_array().unwrap();
+    let summary = &comparison["summary"];
+
+    // ==============================================================
+    // Summary Assertions
+    // ==============================================================
+
+    // Total diffs (excluding unchanged items which should be deleted)
+    let total_diffs = summary["total_diffs"].as_u64().unwrap();
+    assert!(total_diffs > 0, "Should have at least some diffs");
+
+    // Verify ahead/behind counts
+    let total_ahead = summary["total_ahead"].as_u64().unwrap();
+    let total_behind = summary["total_behind"].as_u64().unwrap();
+    assert!(total_ahead > 0, "Should have items ahead");
+    assert!(total_behind > 0, "Should have items behind");
+
+    // Verify conflicts (items that are both ahead and behind)
+    let conflicts = summary["conflicts"].as_u64().unwrap();
+    assert!(conflicts >= 1, "Should have at least 1 conflict (flow)");
+
+    // Verify per-item-type counts
+    assert!(summary["scripts_changed"].as_u64().unwrap() > 0, "Should have script changes");
+    assert!(summary["flows_changed"].as_u64().unwrap() > 0, "Should have flow changes");
+    assert!(summary["apps_changed"].as_u64().unwrap() > 0, "Should have app changes");
+    assert!(summary["resources_changed"].as_u64().unwrap() > 0, "Should have resource changes");
+    assert!(summary["variables_changed"].as_u64().unwrap() > 0, "Should have variable changes");
+    assert!(summary["resource_types_changed"].as_u64().unwrap() > 0, "Should have resource_type changes");
+    // Note: folders_changed may be 0 if folder comparison didn't detect changes
+    // assert!(summary["folders_changed"].as_u64().unwrap() > 0, "Should have folder changes");
+
+    // ==============================================================
+    // Individual Diff Assertions
+    // ==============================================================
+
+    // Scenario 1: New in parent
+    let new_in_parent = diffs.iter()
+        .find(|d| d["path"] == "f/shared/new_in_parent" && d["kind"] == "script")
+        .expect("Should find new_in_parent diff");
+    assert_eq!(new_in_parent["ahead"].as_i64().unwrap(), 1, "new_in_parent should be ahead");
+    assert_eq!(new_in_parent["behind"].as_i64().unwrap(), 0, "new_in_parent should not be behind");
+    assert_eq!(new_in_parent["has_changes"].as_bool().unwrap(), true, "new_in_parent should have changes");
+    assert_eq!(new_in_parent["exists_in_source"].as_bool().unwrap(), true, "new_in_parent should exist in source");
+    assert_eq!(new_in_parent["exists_in_fork"].as_bool().unwrap(), false, "new_in_parent should not exist in fork");
+
+    // Scenario 2: New in fork
+    let new_in_fork = diffs.iter()
+        .find(|d| d["path"] == "f/shared/new_in_fork" && d["kind"] == "script")
+        .expect("Should find new_in_fork diff");
+    assert_eq!(new_in_fork["ahead"].as_i64().unwrap(), 0, "new_in_fork should not be ahead");
+    assert_eq!(new_in_fork["behind"].as_i64().unwrap(), 1, "new_in_fork should be behind");
+    assert_eq!(new_in_fork["has_changes"].as_bool().unwrap(), true, "new_in_fork should have changes");
+    assert_eq!(new_in_fork["exists_in_source"].as_bool().unwrap(), false, "new_in_fork should not exist in source");
+    assert_eq!(new_in_fork["exists_in_fork"].as_bool().unwrap(), true, "new_in_fork should exist in fork");
+
+    // Scenario 5: Conflict
+    let conflict_flow = diffs.iter()
+        .find(|d| d["path"] == "f/shared/original_flow" && d["kind"] == "flow")
+        .expect("Should find conflict flow diff");
+    assert!(conflict_flow["ahead"].as_i64().unwrap() > 0, "conflict should be ahead");
+    assert!(conflict_flow["behind"].as_i64().unwrap() > 0, "conflict should be behind");
+    assert_eq!(conflict_flow["has_changes"].as_bool().unwrap(), true, "conflict should have changes");
+    assert_eq!(conflict_flow["exists_in_source"].as_bool().unwrap(), true, "conflict should exist in source");
+    assert_eq!(conflict_flow["exists_in_fork"].as_bool().unwrap(), true, "conflict should exist in fork");
+
+    // Scenario 6: Deleted in fork
+    let deleted = diffs.iter()
+        .find(|d| d["path"] == "f/shared/to_delete" && d["kind"] == "script")
+        .expect("Should find deleted diff");
+    assert_eq!(deleted["exists_in_source"].as_bool().unwrap(), true, "deleted should exist in source");
+    assert_eq!(deleted["exists_in_fork"].as_bool().unwrap(), false, "deleted should not exist in fork (archived)");
+    assert_eq!(deleted["has_changes"].as_bool().unwrap(), true, "deleted should have changes");
+
+    // Scenario 7: Rename (should show as two entries)
+    let old_name = diffs.iter()
+        .find(|d| d["path"] == "f/shared/old_name" && d["kind"] == "resource");
+    let new_name = diffs.iter()
+        .find(|d| d["path"] == "f/shared/new_name" && d["kind"] == "resource");
+
+    // At least one of these should exist (depending on how the comparison handles renames)
+    assert!(old_name.is_some() || new_name.is_some(), "Should find at least one rename-related diff");
+
+    // ==============================================================
+    // Database State Assertions
+    // ==============================================================
+
+    // Verify has_changes was cached for items that have changes
+    let cached_new_in_parent = sqlx::query!(
+        "SELECT has_changes, exists_in_source, exists_in_fork FROM workspace_diff
+         WHERE path = 'f/shared/new_in_parent' AND kind = 'script' AND source_workspace_id = 'test-workspace'"
+    )
+    .fetch_one(&db)
+    .await?;
+    assert_eq!(cached_new_in_parent.has_changes, Some(true), "has_changes should be cached as true");
+    assert_eq!(cached_new_in_parent.exists_in_source, Some(true), "exists_in_source should be cached");
+    assert_eq!(cached_new_in_parent.exists_in_fork, Some(false), "exists_in_fork should be cached");
+
+    // Verify unchanged items were deleted from workspace_diff
+    let unchanged_original_script = sqlx::query!(
+        "SELECT has_changes FROM workspace_diff
+         WHERE path = 'f/shared/original_script' AND kind = 'script' AND source_workspace_id = 'test-workspace'"
+    )
+    .fetch_optional(&db)
+    .await?;
+
+    // The unchanged item should either be deleted or marked as has_changes = false
+    // Based on the code, items with has_changes = false are deleted
+    if let Some(record) = unchanged_original_script {
+        assert_ne!(record.has_changes, Some(false), "unchanged items with has_changes=false should be deleted");
+    }
+
+    // ==============================================================
+    // Lazy Evaluation Test
+    // ==============================================================
+
+    // Create a new diff entry with NULL has_changes
+    sqlx::query!(
+        "INSERT INTO workspace_diff
+         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)
+         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/lazy_test', 'script', 1, 0, NULL)
+         ON CONFLICT DO NOTHING"
+    )
+    .execute(&db)
+    .await?;
+
+    // Call the endpoint again
+    let _comparison2: serde_json::Value = client
+        .client()
+        .get(&format!("{base_url}/w/test-workspace/workspaces/compare/wm-fork-test-workspace"))
+        .send()
+        .await?
+        .json()
+        .await?;
+
+    // Verify the lazy_test entry was evaluated (should be deleted since it doesn't exist)
+    let lazy_test = sqlx::query!(
+        "SELECT has_changes FROM workspace_diff
+         WHERE path = 'f/shared/lazy_test' AND kind = 'script' AND source_workspace_id = 'test-workspace'"
+    )
+    .fetch_optional(&db)
+    .await?;
+
+    // Should be deleted since the item doesn't actually exist in either workspace
+    assert!(lazy_test.is_none(), "Non-existent item should be deleted from workspace_diff");
+
+    Ok(())
+}