feat: feature-gate heavy deps for faster default builds

Reduce default build from 761 to 609 crates (20% reduction) by making
heavy dependencies optional behind their appropriate feature flags.

Feature-gated deps:
- windmill-worker: hudsucker, rcgen, prost, opentelemetry-proto (EE otel proxy)
- windmill-common: aws-config, aws-credential-types, aws-smithy-types,
  systemstat, globset
- windmill-api: aws-sigv4, aws-sdk-config, windmill-parser-py-imports,
  windmill-autoscaling
- windmill-autoscaling: kube, k8s-openapi (EE only)
- windmill-parser-py-imports: removed unused malachite deps
- Root: removed 12 unused direct dependencies

Incremental compilation with additional local optimizations (mold linker,
split-debuginfo, line-tables-only) brings windmill-api rebuilds from
~5.6s to ~4.7s (16% faster).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/hooks/format-backend.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# Format backend Rust files with rustfmt after Claude edits them
+
+# Get the file path from the tool result (passed via stdin as JSON)
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit if no file path
+if [ -z "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if the file is in the backend directory and is a Rust file
+if [[ "$FILE_PATH" == *"/backend/"* ]] && [[ "$FILE_PATH" =~ \.rs$ ]]; then
+    cd "$CLAUDE_PROJECT_DIR/backend" || exit 0
+    # Run rustfmt with config from rustfmt.toml (edition=2021)
+    rustfmt --config-path rustfmt.toml "$FILE_PATH" 2>/dev/null || true
+fi
+
+exit 0

.claude/hooks/format-frontend.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# Format frontend files with prettier after Claude edits them
+
+# Get the file path from the tool result (passed via stdin as JSON)
+INPUT=$(cat)
+FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')
+
+# Exit if no file path
+if [ -z "$FILE_PATH" ]; then
+    exit 0
+fi
+
+# Check if the file is in the frontend directory
+if [[ "$FILE_PATH" == *"/frontend/"* ]]; then
+    # Check if it's a formattable file type
+    if [[ "$FILE_PATH" =~ \.(ts|js|svelte|json|css|html|md)$ ]]; then
+        cd "$CLAUDE_PROJECT_DIR/frontend" || exit 0
+        # Run prettier silently, don't fail the hook if prettier fails
+        npx prettier --write "$FILE_PATH" 2>/dev/null || true
+    fi
+fi
+
+exit 0

.claude/hooks/notify-user.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Notify user when Claude requires input (works on macOS and Linux)
+
+# Check if we're in an SSH session
+if [[ -n "$SSH_CLIENT" || -n "$SSH_TTY" || -n "$SSH_CONNECTION" ]]; then
+    # SSH session - use terminal bell
+    # If using VSCode, enable audible terminal bell for SSH sessions:
+    # Add the following to .vscode/settings.json:
+    #   "accessibility.signals.terminalBell": {
+    #     "sound": "on"
+    #   },
+    #   "terminal.integrated.enableVisualBell": true
+    printf '\a'
+else
+    # Local session - use native notifications
+    if [[ "$OSTYPE" == "darwin"* ]]; then
+        osascript -e 'display notification "Claude is waiting for your input" with title "Claude Code" sound name "Glass"' 2>/dev/null || printf '\a'
+    elif [[ "$OSTYPE" == "linux-gnu"* ]]; then
+        notify-send "Claude Code" "Claude is waiting for your input" 2>/dev/null || printf '\a'
+    else
+        printf '\a'
+    fi
+fi
+
+exit 0

.claude/settings.json

@@ -1,39 +1,4 @@
 {
-  "hooks": {
-    "UserPromptSubmit": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/resolve-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ],
-    "SessionEnd": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
-            "timeout": 30
-          }
-        ]
-      }
-    ]
-  },
   "permissions": {
     "allow": [
       "Bash(ls:*)",
@@ -58,7 +23,11 @@
       "Bash(git log:*)",
       "Bash(git branch:*)",
       "Bash(git show:*)",
-      "Bash(git blame:*)"
+      "Bash(git blame:*)",
+      "Bash(cargo check:*)",
+      "mcp__ide__getDiagnostics",
+      "Bash(npm run generate-backend-client:*)",
+      "Bash(npm run check:*)"
     ],
     "deny": [
       "Read(.env)",
@@ -93,8 +62,72 @@
     ]
   },
   "enableAllProjectMcpServers": true,
+  "hooks": {
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/resolve-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "SessionEnd": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/restore-symlinks.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/format-frontend.sh",
+            "timeout": 30
+          },
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/format-backend.sh",
+            "timeout": 30
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/notify-user.sh",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  },
   "enabledPlugins": {
     "rust-analyzer-lsp@claude-plugins-official": true,
-    "typescript-lsp@claude-plugins-official": true
+    "typescript-lsp@claude-plugins-official": true,
+    "code-review@claude-plugins-official": true
   }
 }

.claude/skills/commit/SKILL.md

@@ -0,0 +1,60 @@
+---
+name: commit
+user_invocable: true
+description: Create a git commit with conventional commit format. MUST use anytime you want to commit changes.
+---
+
+# Git Commit Skill
+
+Create a focused, single-line commit following conventional commit conventions.
+
+## Instructions
+
+1. **Analyze changes**: Run `git status` and `git diff` to understand what was modified
+2. **Stage only modified files**: Add files individually by name. NEVER use `git add -A` or `git add .`
+3. **Write commit message**: Follow the conventional commit format as a single line
+
+## Conventional Commit Format
+
+```
+<type>: <description>
+```
+
+### Types
+- `feat`: New feature or capability
+- `fix`: Bug fix
+- `refactor`: Code change that neither fixes a bug nor adds a feature
+- `docs`: Documentation only changes
+- `style`: Formatting, missing semicolons, etc (no code change)
+- `test`: Adding or correcting tests
+- `chore`: Maintenance tasks, dependency updates, etc
+- `perf`: Performance improvement
+
+### Rules
+- Message MUST be a single line (no multi-line messages)
+- Description should be lowercase, imperative mood ("add" not "added")
+- No period at the end
+- Keep under 72 characters total
+
+### Examples
+```
+feat: add token usage tracking for AI providers
+fix: resolve null pointer in job executor
+refactor: extract common validation logic
+docs: update API endpoint documentation
+chore: upgrade sqlx to 0.7
+```
+
+## Execution Steps
+
+1. Run `git status` to see all changes
+2. Run `git diff` to understand the changes in detail
+3. Run `git log --oneline -5` to see recent commit style
+4. Stage ONLY the modified/relevant files: `git add <file1> <file2> ...`
+5. Create the commit with conventional format:
+   ```bash
+   git commit -m "<type>: <description>
+
+   Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>"
+   ```
+6. Run `git status` to verify the commit succeeded

.claude/skills/pr/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: pr
+user_invocable: true
+description: Open a draft pull request on GitHub. MUST use when you want to create/open a PR.
+---
+
+# Pull Request Skill
+
+Create a draft pull request with a clear title and explicit description of changes.
+
+## Instructions
+
+1. **Analyze branch changes**: Understand all commits since diverging from main
+2. **Push to remote**: Ensure all commits are pushed
+3. **Create draft PR**: Always open as draft for review before merging
+
+## PR Title Format
+
+Follow conventional commit format for the PR title:
+```
+<type>: <description>
+```
+
+### Types
+- `feat`: New feature or capability
+- `fix`: Bug fix
+- `refactor`: Code restructuring
+- `docs`: Documentation changes
+- `chore`: Maintenance tasks
+- `perf`: Performance improvements
+
+### Title Rules
+- Keep under 70 characters
+- Use lowercase, imperative mood
+- No period at the end
+
+## PR Body Format
+
+The body MUST be explicit about what changed. Structure:
+
+```markdown
+## Summary
+<Clear description of what this PR does and why>
+
+## Changes
+- <Specific change 1>
+- <Specific change 2>
+- <Specific change 3>
+
+## Test plan
+- [ ] <How to verify change 1>
+- [ ] <How to verify change 2>
+
+---
+Generated with [Claude Code](https://claude.com/claude-code)
+```
+
+## Execution Steps
+
+1. Run `git status` to check for uncommitted changes
+2. Run `git log main..HEAD --oneline` to see all commits in this branch
+3. Run `git diff main...HEAD` to see the full diff against main
+4. Check if remote branch exists and is up to date:
+   ```bash
+   git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null || echo "no upstream"
+   ```
+5. Push to remote if needed: `git push -u origin HEAD`
+6. Create draft PR using gh CLI:
+   ```bash
+   gh pr create --draft --title "<type>: <description>" --body "$(cat <<'EOF'
+   ## Summary
+   <description>
+
+   ## Changes
+   - <change 1>
+   - <change 2>
+
+   ## Test plan
+   - [ ] <test 1>
+   - [ ] <test 2>
+
+   ---
+   Generated with [Claude Code](https://claude.com/claude-code)
+   EOF
+   )"
+   ```
+7. Return the PR URL to the user

.claude/skills/rust-backend/SKILL.md

@@ -0,0 +1,495 @@
+---
+name: rust-backend
+description: Rust coding guidelines for the Windmill backend. MUST use when writing or modifying Rust code in the backend directory.
+---
+
+# Rust Backend Coding Guidelines
+
+Apply these patterns when writing or modifying Rust code in the `backend/` directory.
+
+## Data Structure Design
+
+Choose between `struct`, `enum`, or `newtype` based on domain needs:
+
+- Use `enum` for state machines instead of boolean flags or loosely related fields
+- Model invariants explicitly using types (e.g., `NonZeroU32`, `Duration`, custom enums)
+- Consider ownership of each field:
+  - Use `&str` vs `String`, slices vs vectors
+  - Use `Arc<T>` when sharing across threads
+  - Use `Cow<'a, T>` for flexible ownership
+
+```rust
+// State machine with enum
+enum JobState {
+    Pending { scheduled_for: DateTime<Utc> },
+    Running { started_at: DateTime<Utc>, worker: String },
+    Completed { result: JobResult, duration_ms: i64 },
+    Failed { error: String, retries: u32 },
+}
+
+// Avoid multiple booleans
+struct Job {
+    is_pending: bool,   // Don't do this
+    is_running: bool,
+    is_completed: bool,
+}
+```
+
+## Impl Block Organization
+
+Place `impl` blocks immediately below the struct/enum they modify. Group methods logically:
+
+```rust
+struct JobQueue {
+    jobs: Vec<Job>,
+    capacity: usize,
+}
+
+impl JobQueue {
+    // Constructors first
+    pub fn new(capacity: usize) -> Self { ... }
+    pub fn with_jobs(jobs: Vec<Job>) -> Self { ... }
+
+    // Getters
+    pub fn len(&self) -> usize { ... }
+    pub fn is_empty(&self) -> bool { ... }
+
+    // Mutation methods
+    pub fn push(&mut self, job: Job) -> Result<()> { ... }
+    pub fn pop(&mut self) -> Option<Job> { ... }
+
+    // Domain logic
+    pub fn next_scheduled(&self) -> Option<&Job> { ... }
+}
+```
+
+## Iterator Chains Over For-Loops
+
+Prefer functional iterator chains (`.filter().map().collect()`) over imperative for-loops:
+
+```rust
+// Preferred
+let results: Vec<_> = items
+    .iter()
+    .filter(|item| item.is_valid())
+    .map(|item| item.transform())
+    .collect();
+
+// Avoid
+let mut results = Vec::new();
+for item in items.iter() {
+    if item.is_valid() {
+        results.push(item.transform());
+    }
+}
+```
+
+## Error Handling
+
+Use the `Error` type from `windmill_common::error`. Return `Result<T, Error>` or `JsonResult<T>` for fallible functions:
+
+```rust
+use windmill_common::error::{Error, Result};
+
+// Use ? operator for propagation
+pub async fn get_job(db: &DB, id: Uuid) -> Result<Job> {
+    let job = sqlx::query_as!(Job, "SELECT ... WHERE id = $1", id)
+        .fetch_optional(db)
+        .await?
+        .ok_or_else(|| Error::NotFound("job not found".to_string()))?;
+    Ok(job)
+}
+```
+
+Prefer `if let` for optional handling. Use `let...else` when early return makes code clearer:
+
+```rust
+let Some(config) = get_config() else {
+    return Err(Error::MissingConfig);
+};
+```
+
+Never panic in library code. Reserve `.unwrap()` for cases with compile-time guarantees. Keep functions short to help lifetime inference and clarity.
+
+## Early Returns
+
+Return early to avoid deep nesting. Handle error cases and edge conditions first:
+
+```rust
+// Preferred - early returns
+fn process_job(job: Option<Job>) -> Result<Output> {
+    let Some(job) = job else {
+        return Ok(Output::default());
+    };
+
+    if !job.is_valid() {
+        return Err(Error::InvalidJob);
+    }
+
+    if job.is_cached() {
+        return Ok(job.cached_result());
+    }
+
+    // Main logic at the end, not nested
+    execute_job(job)
+}
+
+// Avoid - deep nesting
+fn process_job(job: Option<Job>) -> Result<Output> {
+    if let Some(job) = job {
+        if job.is_valid() {
+            if !job.is_cached() {
+                execute_job(job)
+            } else {
+                Ok(job.cached_result())
+            }
+        } else {
+            Err(Error::InvalidJob)
+        }
+    } else {
+        Ok(Output::default())
+    }
+}
+```
+
+## Variable Shadowing
+
+Shadow variables instead of creating new names with prefixes:
+
+```rust
+// Preferred
+let data = fetch_raw_data();
+let data = parse(data);
+let data = validate(data)?;
+
+// Avoid
+let raw_data = fetch_raw_data();
+let parsed_data = parse(raw_data);
+let validated_data = validate(parsed_data)?;
+```
+
+## Minimal Comments
+
+- No inline comments explaining obvious code
+- No TODO/FIXME comments in committed code
+- Doc comments (`///`) only on public items
+- Let code be self-documenting through clear naming
+
+## Type Safety
+
+Use enums over boolean flags for clarity:
+
+```rust
+// Preferred
+enum JobStatus {
+    Pending,
+    Running,
+    Completed,
+}
+
+// Avoid
+struct Job {
+    is_running: bool,
+    is_completed: bool,
+}
+```
+
+## Pattern Matching
+
+Prefer explicit matching. Use wildcards strategically for fallback cases or ignored fields:
+
+```rust
+// Explicit matching preferred
+match status {
+    JobStatus::Pending => handle_pending(),
+    JobStatus::Running => handle_running(),
+    JobStatus::Completed => handle_completed(),
+}
+
+// Wildcards OK for fallback
+match result {
+    Ok(value) => process(value),
+    Err(_) => return default_value(),
+}
+
+// Wildcards OK for ignoring fields in destructuring
+let Point { x, y, .. } = point;
+```
+
+## Destructuring in Function Signatures
+
+Destructure structs directly in function parameters:
+
+```rust
+// Preferred
+async fn process_job(
+    Extension(db): Extension<DB>,
+    Path((workspace, job_id)): Path<(String, Uuid)>,
+    Query(pagination): Query<Pagination>,
+) -> Result<Json<Job>> {
+    // ...
+}
+
+// Avoid
+async fn process_job(
+    db_ext: Extension<DB>,
+    path: Path<(String, Uuid)>,
+    query: Query<Pagination>,
+) -> Result<Json<Job>> {
+    let Extension(db) = db_ext;
+    let Path((workspace, job_id)) = path;
+    // ...
+}
+```
+
+## Trait Implementations
+
+Use standard trait implementations to simplify conversions and reduce boilerplate:
+
+```rust
+// Implement From/Into for type conversions
+impl From<DbJob> for ApiJob {
+    fn from(db: DbJob) -> Self {
+        ApiJob {
+            id: db.id,
+            status: db.status.into(),
+        }
+    }
+}
+
+// Use TryFrom for fallible conversions
+impl TryFrom<String> for JobKind {
+    type Error = Error;
+    fn try_from(s: String) -> Result<Self, Self::Error> { ... }
+}
+```
+
+Apply `derive` macros to reduce boilerplate:
+
+```rust
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Job { ... }
+```
+
+## Module Structure
+
+- Use `pub(crate)` instead of `pub` when possible; expose only what needs exposing
+- Keep APIs small and expressive; avoid leaking internal types
+- Organize code into modules reflecting ownership and domain boundaries
+
+```rust
+// Prefer restricted visibility
+pub(crate) fn internal_helper() { ... }
+
+// Only pub for external API
+pub fn create_job(...) -> Result<Job> { ... }
+```
+
+## Code Navigation
+
+Always use rust-analyzer LSP for:
+- Go to definition
+- Find references
+- Type information
+- Import resolution
+
+Do not guess at module paths or type definitions.
+
+## JSON Handling
+
+Prefer `Box<serde_json::value::RawValue>` over `serde_json::Value` when:
+- Storing JSON in the database (JSONB columns)
+- Passing JSON through without modification
+- The JSON structure doesn't need inspection
+
+```rust
+// Preferred - avoids parsing/serialization overhead
+pub struct Job {
+    pub id: Uuid,
+    pub args: Option<Box<serde_json::value::RawValue>>,
+}
+
+// Only use Value when you need to inspect/modify JSON
+let value: serde_json::Value = serde_json::from_str(&json)?;
+if let Some(field) = value.get("field") {
+    // modify or inspect
+}
+```
+
+## Serde Optimizations
+
+Use serde attributes to optimize serialization:
+
+```rust
+#[derive(Serialize, Deserialize)]
+pub struct Job {
+    #[serde(rename = "jobId")]
+    pub id: Uuid,
+
+    #[serde(default)]
+    pub priority: i32,
+
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub parent_job: Option<Uuid>,
+
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub tags: Vec<String>,
+}
+```
+
+Prefer borrowing for zero-copy deserialization when lifetimes allow:
+
+```rust
+#[derive(Deserialize)]
+pub struct JobInput<'a> {
+    #[serde(borrow)]
+    pub workspace_id: Cow<'a, str>,
+
+    #[serde(borrow)]
+    pub script_path: &'a str,
+}
+```
+
+## SQLx Patterns
+
+**Never use `SELECT *`** - always list columns explicitly. This is critical for backwards compatibility when workers run behind the API server version:
+
+```rust
+// Preferred - explicit columns
+sqlx::query_as!(
+    Job,
+    "SELECT id, workspace_id, path, created_at FROM v2_job WHERE id = $1",
+    job_id
+)
+
+// Avoid - breaks when columns are added
+sqlx::query_as!(Job, "SELECT * FROM v2_job WHERE id = $1", job_id)
+```
+
+Use batch operations to minimize round trips:
+
+```rust
+// Preferred - single query with multiple values
+sqlx::query!(
+    "INSERT INTO job_logs (job_id, logs) VALUES ($1, $2), ($3, $4)",
+    id1, log1, id2, log2
+)
+
+// Avoid N+1 queries
+for id in ids {
+    sqlx::query!("SELECT ... WHERE id = $1", id).fetch_one(db).await?;
+}
+
+// Preferred - single query with IN clause
+sqlx::query!("SELECT ... WHERE id = ANY($1)", &ids[..]).fetch_all(db).await?
+```
+
+Use transactions for multi-step operations and parameterize all queries.
+
+## Async & Tokio Patterns
+
+Never block the async runtime. Use `spawn_blocking` for CPU-intensive or blocking I/O:
+
+```rust
+// Preferred - offload blocking work
+let result = tokio::task::spawn_blocking(move || {
+    expensive_computation(&data)
+}).await?;
+
+// Avoid - blocks the runtime
+let result = expensive_computation(&data);  // Don't do this in async
+```
+
+Use tokio primitives for sleep and channels:
+
+```rust
+use tokio::sync::mpsc;
+use tokio::time::sleep;
+
+// Avoid in async contexts
+use std::thread::sleep; // Blocks the runtime
+```
+
+Use bounded channels for backpressure:
+
+```rust
+// Preferred - bounded channel prevents overwhelming
+let (tx, rx) = tokio::sync::mpsc::channel(100);
+
+// Be careful with unbounded
+let (tx, rx) = tokio::sync::mpsc::unbounded_channel();
+```
+
+## Mutex Selection in Async Code
+
+**Prefer `std::sync::Mutex` (or `parking_lot::Mutex`) over `tokio::sync::Mutex`** for protecting data in async code. The async mutex is more expensive and only needed when holding locks across `.await` points.
+
+```rust
+// Preferred for data protection - std mutex is faster
+use std::sync::Mutex;
+
+struct Cache {
+    data: Mutex<HashMap<String, Value>>,
+}
+
+impl Cache {
+    fn get(&self, key: &str) -> Option<Value> {
+        self.data.lock().unwrap().get(key).cloned()
+    }
+
+    fn insert(&self, key: String, value: Value) {
+        self.data.lock().unwrap().insert(key, value);
+    }
+}
+```
+
+**Use `tokio::sync::Mutex` only when you must hold the lock across `.await` points**, typically for IO resources like database connections:
+
+```rust
+use tokio::sync::Mutex;
+use std::sync::Arc;
+
+// Async mutex for IO resources held across await points
+let conn = Arc::new(Mutex::new(db_connection));
+
+async fn execute_query(conn: Arc<Mutex<DbConn>>, query: &str) {
+    let mut lock = conn.lock().await;
+    lock.execute(query).await;  // Lock held across .await
+}
+```
+
+**Common pattern**: Wrap `Arc<Mutex<...>>` in a struct with non-async methods that lock internally, keeping lock scope minimal:
+
+```rust
+struct SharedState {
+    inner: std::sync::Mutex<StateInner>,
+}
+
+impl SharedState {
+    fn update(&self, value: i32) {
+        self.inner.lock().unwrap().value = value;
+    }
+
+    fn get(&self) -> i32 {
+        self.inner.lock().unwrap().value
+    }
+}
+```
+
+**Alternative for IO resources**: Spawn a dedicated task to manage the resource and communicate via message passing:
+
+```rust
+let (tx, mut rx) = tokio::sync::mpsc::channel(32);
+
+tokio::spawn(async move {
+    while let Some(cmd) = rx.recv().await {
+        handle_io_command(&mut resource, cmd).await;
+    }
+});
+```
+
+## Build & Tooling
+
+Build speed tips:
+- Use `cargo check` during rapid iteration over `cargo build`
+- Minimize unnecessary dependencies and feature flags

.github/DockerfileBackendTests

@@ -42,7 +42,7 @@ RUN wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VER
 RUN /usr/local/bin/python3 -m pip install pip-tools
 
 # Bun
-COPY --from=oven/bun:1.2.23 /usr/local/bin/bun /usr/bin/bun
+COPY --from=oven/bun:1.3.8 /usr/local/bin/bun /usr/bin/bun
 
 ARG TARGETPLATFORM
 

.github/workflows/backend-test.yml

@@ -44,7 +44,10 @@ jobs:
           go-version: 1.21.5
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.1.43
+          bun-version: 1.3.8
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
       - uses: astral-sh/setup-uv@v6.2.1
         with:
           version: "0.9.24"
@@ -67,6 +70,111 @@ jobs:
       - name: Substitute EE code (EE logic is behind feature flag)
         run: |
           ./substitute_ee_code.sh --copy --dir ./windmill-ee-private
+      - name: Setup private npm registry with test package
+        working-directory: /tmp
+        run: |
+          set -e
+
+          # Install Verdaccio globally
+          npm install -g verdaccio
+
+          # Create Verdaccio config that requires authentication for @windmill-test packages
+          mkdir -p /tmp/verdaccio/storage
+          cat > /tmp/verdaccio/config.yaml << 'VERDACCIO_CONFIG'
+          storage: /tmp/verdaccio/storage
+          auth:
+            htpasswd:
+              file: /tmp/verdaccio/htpasswd
+              max_users: 100
+          uplinks:
+            npmjs:
+              url: https://registry.npmjs.org/
+          packages:
+            '@windmill-test/*':
+              access: $authenticated
+              publish: $authenticated
+            '@*/*':
+              access: $all
+              publish: $authenticated
+              proxy: npmjs
+            '**':
+              access: $all
+              publish: $authenticated
+              proxy: npmjs
+          server:
+            keepAliveTimeout: 60
+          middlewares:
+            audit:
+              enabled: true
+          log: { type: stdout, format: pretty, level: warn }
+          VERDACCIO_CONFIG
+
+          # Create empty htpasswd file (users will be created via API)
+          touch /tmp/verdaccio/htpasswd
+
+          # Start Verdaccio in background
+          verdaccio --config /tmp/verdaccio/config.yaml &
+          VERDACCIO_PID=$!
+
+          # Wait for Verdaccio to be ready
+          echo "Waiting for Verdaccio to start..."
+          for i in {1..30}; do
+            if curl -s http://localhost:4873/-/ping > /dev/null 2>&1; then
+              echo "Verdaccio is ready"
+              break
+            fi
+            sleep 1
+          done
+
+          # Login to get a token
+          echo "Getting auth token..."
+          RESPONSE=$(curl -s -X PUT \
+            -H "Content-Type: application/json" \
+            -d '{"name":"testuser","password":"testpass123"}' \
+            http://localhost:4873/-/user/org.couchdb.user:testuser)
+
+          echo "Auth response: $RESPONSE"
+          NPM_TOKEN=$(echo "$RESPONSE" | jq -r '.token')
+
+          if [ -z "$NPM_TOKEN" ] || [ "$NPM_TOKEN" = "null" ]; then
+            echo "Failed to get NPM token from response"
+            exit 1
+          fi
+
+          echo "NPM_TOKEN=${NPM_TOKEN}" >> $GITHUB_ENV
+          echo "Got NPM token successfully: ${NPM_TOKEN:0:10}..."
+
+          # Configure npm globally with the auth token
+          echo "//localhost:4873/:_authToken=${NPM_TOKEN}" > ~/.npmrc
+          echo "Configured ~/.npmrc with auth token"
+
+          # Create a simple test package
+          mkdir -p /tmp/windmill-test-private-pkg
+          cat > /tmp/windmill-test-private-pkg/package.json << 'PKG_JSON'
+          {
+            "name": "@windmill-test/private-pkg",
+            "version": "1.0.0",
+            "main": "index.js"
+          }
+          PKG_JSON
+          cat > /tmp/windmill-test-private-pkg/index.js << 'PKG_JS'
+          module.exports.greet = (name) => `Hello from private package, ${name}!`;
+          PKG_JS
+
+          # Publish to Verdaccio with auth
+          cd /tmp/windmill-test-private-pkg
+          echo "Publishing package..."
+          npm publish --registry http://localhost:4873
+          echo "Package published successfully"
+
+          # Verify the package requires auth by trying anonymous access (should fail)
+          rm -f ~/.npmrc
+          echo "Testing anonymous access (should fail)..."
+          if npm view @windmill-test/private-pkg --registry http://localhost:4873 2>/dev/null; then
+            echo "ERROR: Package should require authentication but anonymous access worked"
+            exit 1
+          fi
+          echo "Verified: Package requires authentication for @windmill-test/private-pkg"
       - name: Cache DuckDB FFI module build
         uses: actions/cache@v3
         with:
@@ -84,9 +192,10 @@ jobs:
           RUST_LOG_STYLE: never
           CARGO_NET_GIT_FETCH_WITH_CLI: true
           WMDEBUG_FORCE_V0_WORKSPACE_DEPENDENCIES: 1
-          WMDEBUG_FORCE_RUNNABLE_SETTINGS_V0: 1          
+          WMDEBUG_FORCE_RUNNABLE_SETTINGS_V0: 1
           WMDEBUG_FORCE_NO_LEGACY_DEBOUNCING_COMPAT: 1
+          TEST_NPM_REGISTRY: "http://localhost:4873/:_authToken=${{ env.NPM_TOKEN }}"
         run: |
-          deno --version && bun -v && go version && python3 --version
+          deno --version && bun -v && node --version && go version && python3 --version
           cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd ..
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private --all -- --nocapture
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test --all -- --nocapture

.github/workflows/cli-tests.yml

@@ -79,6 +79,17 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Symlink Bun to /usr/bin/bun
+        run: sudo ln -sf $(which bun) /usr/bin/bun
+
+      - name: Symlink Node to /usr/bin/node
+        run: sudo ln -sf $(which node) /usr/bin/node
+
       - name: Generate Windmill clients
         working-directory: cli
         run: |
@@ -125,6 +136,20 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Get Bun and Node paths
+        id: runtime-paths
+        shell: pwsh
+        run: |
+          $bunPath = (Get-Command bun).Source
+          $nodePath = (Get-Command node).Source
+          echo "BUN_PATH=$bunPath" >> $env:GITHUB_OUTPUT
+          echo "NODE_BIN_PATH=$nodePath" >> $env:GITHUB_OUTPUT
+
       - name: Generate Windmill clients
         working-directory: cli
         shell: bash
@@ -138,6 +163,8 @@ jobs:
         env:
           DATABASE_URL: postgres://postgres:changeme@localhost:5432
           CI_MINIMAL_FEATURES: "true"
+          BUN_PATH: ${{ steps.runtime-paths.outputs.BUN_PATH }}
+          NODE_BIN_PATH: ${{ steps.runtime-paths.outputs.NODE_BIN_PATH }}
         run: |
           deno test --no-check --allow-all test/ `
             --ignore=test/cargo_backend_example.test.ts

.gitignore

@@ -13,3 +13,9 @@ backend/.minio-data
 .aider*
 !.aiderignore
 rust-client/Cargo.toml
+
+# Symlinked cache directories (for git worktrees)
+backend/target
+frontend/node_modules
+typescript-client/node_modules
+frontend/.svelte-kit

CHANGELOG.md

@@ -1,5 +1,88 @@
 # Changelog
 
+## [1.624.0](https://github.com/windmill-labs/windmill/compare/v1.623.1...v1.624.0) (2026-02-03)
+
+
+### Features
+
+* default to quickjs on ce for flow eval ([#7756](https://github.com/windmill-labs/windmill/issues/7756)) ([bdf9447](https://github.com/windmill-labs/windmill/commit/bdf9447e821c6d02198534198a5878849cac23e5))
+* runtime assets ([#7656](https://github.com/windmill-labs/windmill/issues/7656)) ([635a24f](https://github.com/windmill-labs/windmill/commit/635a24f82cae8e85b584efca115968872723889f))
+
+
+### Bug Fixes
+
+* **cli:** prevent branch-specific items from being marked for deletion on pull ([#7781](https://github.com/windmill-labs/windmill/issues/7781)) ([701eb4b](https://github.com/windmill-labs/windmill/commit/701eb4bae47a809e6da34c62b8e250ac6379db53))
+* Fix app multiselect not refreshing result when creating element ([#7766](https://github.com/windmill-labs/windmill/issues/7766)) ([3a719ce](https://github.com/windmill-labs/windmill/commit/3a719cea6b7b099f32054957eb04148c592786ad))
+* **frontend:** improve runs detail page ([#7694](https://github.com/windmill-labs/windmill/issues/7694)) ([3b5c165](https://github.com/windmill-labs/windmill/commit/3b5c1657c7d41178283d02017914543461565a3a))
+* Prettier and less invasive toasts ([#7758](https://github.com/windmill-labs/windmill/issues/7758)) ([df51f96](https://github.com/windmill-labs/windmill/commit/df51f9690520db80db2133e2e61002f399c0dfaf))
+* remove $schema field from Google AI output schema requests ([#7765](https://github.com/windmill-labs/windmill/issues/7765)) ([18d85f1](https://github.com/windmill-labs/windmill/commit/18d85f14127e50673ccb460bfa9ebe80730df68e))
+
+## [1.623.1](https://github.com/windmill-labs/windmill/compare/v1.623.0...v1.623.1) (2026-02-01)
+
+
+### Bug Fixes
+
+* prevent retention cleanup from deleting jobs of active flows ([4226ec8](https://github.com/windmill-labs/windmill/commit/4226ec826084eabbb9fff418ea6e67eb73e27cf0))
+* prevent retention cleanup from deleting jobs of active flows ([#7755](https://github.com/windmill-labs/windmill/issues/7755)) ([799db94](https://github.com/windmill-labs/windmill/commit/799db9468395adafe43630d861dac367e5559791))
+* resolve infinite effect loop in PocketIdSetting component ([#7753](https://github.com/windmill-labs/windmill/issues/7753)) ([a8523f5](https://github.com/windmill-labs/windmill/commit/a8523f552c39c4bbe3c585f97df5223903013bb2))
+
+## [1.623.0](https://github.com/windmill-labs/windmill/compare/v1.622.0...v1.623.0) (2026-01-31)
+
+
+### Features
+
+* add PocketID OAuth provider support ([#7318](https://github.com/windmill-labs/windmill/issues/7318)) ([720e3c5](https://github.com/windmill-labs/windmill/commit/720e3c543623c2612b1af704c13d032c53368efb))
+
+
+### Bug Fixes
+
+* add schema compatibility layer for MCP clients like n8n ([#7747](https://github.com/windmill-labs/windmill/issues/7747)) ([297aa23](https://github.com/windmill-labs/windmill/commit/297aa23ed46315dfd4b034d44361a5bd8aaca884))
+* preserve script envs field during sync push ([f405dff](https://github.com/windmill-labs/windmill/commit/f405dff2e22681dc8d4f3a9b7427e278c6cfb0cc))
+
+## [1.622.0](https://github.com/windmill-labs/windmill/compare/v1.621.2...v1.622.0) (2026-01-29)
+
+
+### Features
+
+* add token usage tracking to AI agent output ([#7738](https://github.com/windmill-labs/windmill/issues/7738)) ([ce23f21](https://github.com/windmill-labs/windmill/commit/ce23f21c0e0bc6365f616ace4c45fa341741c555))
+* workspace dedicated workers ([#7741](https://github.com/windmill-labs/windmill/issues/7741)) ([60858d1](https://github.com/windmill-labs/windmill/commit/60858d1e20e68b83fddcdbfc0ff34decaff5d1c5))
+
+
+### Bug Fixes
+
+* forward teams error to client ([#7746](https://github.com/windmill-labs/windmill/issues/7746)) ([ca8dbc0](https://github.com/windmill-labs/windmill/commit/ca8dbc0676dda619aff6fab7f6ff05ed773738e0))
+* indexer build error ([#7744](https://github.com/windmill-labs/windmill/issues/7744)) ([6679ecb](https://github.com/windmill-labs/windmill/commit/6679ecb9a2ead08d2252a64f2a27a6d539fa23e9))
+* remove uuid-ossp extension requirement for RDS compatibility ([ad5293c](https://github.com/windmill-labs/windmill/commit/ad5293c0edacfaf1431a3639ef5ea32d9bd761b0))
+* require AGENT_TOKEN and BASE_INTERNAL_URL for agent mode ([6c84a89](https://github.com/windmill-labs/windmill/commit/6c84a8905382e29a4bbe0ae947eda794bc4dc566))
+* visibility bug on deployment UI (issue when renaming items) + add tracking of folders and resource types ([#7739](https://github.com/windmill-labs/windmill/issues/7739)) ([998f11a](https://github.com/windmill-labs/windmill/commit/998f11a10da45c6d933d8b78ca24ed4f55a53f3b))
+
+## [1.621.2](https://github.com/windmill-labs/windmill/compare/v1.621.1...v1.621.2) (2026-01-29)
+
+
+### Bug Fixes
+
+* **cli:** revert findCodebase change that broke ../shared codebases ([#7740](https://github.com/windmill-labs/windmill/issues/7740)) ([20357f4](https://github.com/windmill-labs/windmill/commit/20357f41f55ce246220ec56ef257ea7d6ac82e3a))
+* do not quit indexer when receiving handoff during pull ([#7659](https://github.com/windmill-labs/windmill/issues/7659)) ([8bb6b63](https://github.com/windmill-labs/windmill/commit/8bb6b6331b74d43b1ecfa08d3393254f54a94f87))
+
+## [1.621.1](https://github.com/windmill-labs/windmill/compare/v1.621.0...v1.621.1) (2026-01-29)
+
+
+### Bug Fixes
+
+* add 32MB memory limit to QuickJS runtime for flow expressions ([db74470](https://github.com/windmill-labs/windmill/commit/db74470ec355ae317a50f350133fc140d2921595))
+
+## [1.621.0](https://github.com/windmill-labs/windmill/compare/v1.620.1...v1.621.0) (2026-01-29)
+
+
+### Features
+
+* add QuickJS as alternative JS engine for flow expression evaluation ([#7664](https://github.com/windmill-labs/windmill/issues/7664)) ([5c20b37](https://github.com/windmill-labs/windmill/commit/5c20b37a537bae09ce13ef133ac12fd5976d9c37))
+
+
+### Bug Fixes
+
+* return null for non-existent step access in flow expressions ([22cce51](https://github.com/windmill-labs/windmill/commit/22cce51db55fe2b08a4f38cbddf98c12c861542d))
+
 ## [1.620.1](https://github.com/windmill-labs/windmill/compare/v1.620.0...v1.620.1) (2026-01-28)
 
 

Dockerfile

@@ -234,7 +234,7 @@ COPY --from=windmill_duckdb_ffi_internal_builder /windmill-duckdb-ffi-internal/t
 
 COPY --from=denoland/deno:2.2.1 --chmod=755 /usr/bin/deno /usr/bin/deno
 
-COPY --from=oven/bun:1.2.23 /usr/local/bin/bun /usr/bin/bun
+COPY --from=oven/bun:1.3.8 /usr/local/bin/bun /usr/bin/bun
 
 COPY --from=php:8.3.7-cli /usr/local/bin/php /usr/bin/php
 COPY --from=composer:2.7.6 /usr/bin/composer /usr/bin/composer

README.md

@@ -3,10 +3,10 @@
 </p>
 
 <p align=center>
-Open-source developer infrastructure for internal tools (APIs, background jobs, workflows and UIs). Self-hostable alternative to Retool, Pipedream, Superblocks and a simplified Temporal with autogenerated UIs and custom UIs to trigger workflows and scripts as internal apps.
+Open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Self-hostable alternative to Retool, Pipedream, Superblocks and a simplified Temporal with autogenerated UIs and custom UIs to trigger workflows and scripts as internal apps.
 
 <p align=center>
-Scripts are turned into sharable UIs automatically, and can be composed together into flows or used into richer apps built with low-code. Supported script languages supported are: Python, TypeScript, Go, Bash, SQL, and GraphQL.
+Scripts are turned into sharable UIs automatically, and can be composed together into flows or used into richer apps built with low-code. Supported languages: Python, TypeScript, Go, Bash, SQL, GraphQL, PowerShell, Rust, and more.
 </p>
 
 <p align="center">
@@ -36,75 +36,58 @@ Scripts are turned into sharable UIs automatically, and can be composed together
 
 # Windmill - Developer platform for APIs, background jobs, workflows and UIs
 
-Windmill is <b>fully open-sourced (AGPLv3)</b> and Windmill Labs offers
-dedicated instance and commercial support and licenses.
+Windmill is fully open-sourced (AGPLv3) and Windmill Labs offers dedicated instances and commercial support and licenses.
 
 ![Windmill Diagram](./imgs/stacks.svg)
 
-https://github.com/windmill-labs/windmill/assets/122811744/0b132cd1-ee67-4505-822f-0c7ee7104252
+https://github.com/user-attachments/assets/d80de1d9-64de-4d89-aacd-6df23fa81fc4
 
 - [Windmill - Developer platform for APIs, background jobs, workflows and UIs](#windmill---developer-platform-for-apis-background-jobs-workflows-and-uis)
   - [Main Concepts](#main-concepts)
   - [Show me some actual script code](#show-me-some-actual-script-code)
-  - [CLI](#cli)
-    - [Running scripts locally](#running-scripts-locally)
+  - [Local Development](#local-development)
   - [Stack](#stack)
   - [Fastest Self-Hostable Workflow Engine](#fastest-self-hostable-workflow-engine)
   - [Security](#security)
-    - [Sandboxing](#sandboxing)
-    - [Secrets, credentials and sensitive values](#secrets-credentials-and-sensitive-values)
   - [Performance](#performance)
   - [Architecture](#architecture)
   - [How to self-host](#how-to-self-host)
     - [Docker compose](#docker-compose)
-    - [Kubernetes (k8s) and Helm charts](#kubernetes-k8s-and-helm-charts)
-    - [Run from binaries](#run-from-binaries)
+    - [Kubernetes (Helm charts)](#kubernetes-helm-charts)
+    - [Cloud providers](#cloud-providers)
     - [OAuth, SSO \& SMTP](#oauth-sso--smtp)
-    - [Commercial license](#commercial-license)
+    - [License](#license)
     - [Integrations](#integrations)
   - [Environment Variables](#environment-variables)
   - [Run a local dev setup](#run-a-local-dev-setup)
-    - [only Frontend](#only-frontend)
+    - [Frontend only](#frontend-only)
     - [Backend + Frontend](#backend--frontend)
   - [Contributors](#contributors)
   - [Copyright](#copyright)
 
 ## Main Concepts
 
-1. Define a minimal and generic script in Python, TypeScript, Go or Bash that
-   solves a specific task. The code can be defined in the
-   [provided Web IDE](https://www.windmill.dev/docs/code_editor) or
-   [synchronized with your own GitHub repo](https://www.windmill.dev/docs/advanced/cli/sync)
-   (e.g. through
-   [VS Code](https://www.windmill.dev/docs/cli_local_dev/vscode-extension)
-   extension):
+1. Define a minimal and generic script in Python, TypeScript, Go or Bash that solves a specific task. The code can be defined in the provided Web IDE or synchronized with your own GitHub repo (e.g. through VS Code extension): [provided Web IDE](https://www.windmill.dev/docs/code_editor) or [synchronized with your own GitHub repo](https://www.windmill.dev/docs/advanced/cli/sync) (e.g. through [VS Code](https://www.windmill.dev/docs/cli_local_dev/vscode-extension) extension):
 
-   ![Step 1](./imgs/windmill-editor.png)
+![Step 1](./imgs/windmill-editor.png)
 
-2. Your scripts parameters are automatically parsed and
-   [generate a frontend](https://www.windmill.dev/docs/core_concepts/auto_generated_uis).
+2. Your scripts parameters are automatically parsed and [generate a frontend](https://www.windmill.dev/docs/core_concepts/auto_generated_uis).
 
 ![Step 2](./imgs/windmill-run.png)
 
 ![Step 3](./imgs/windmill-result.png)
 
-3. Make it [flow](https://www.windmill.dev/docs/flows/flow_editor)! You can
-   chain your scripts or scripts made by the community shared on
-   [WindmillHub](https://hub.windmill.dev).
+3. Make it [flow](https://www.windmill.dev/docs/flows/flow_editor)! You can chain your scripts or scripts made by the community shared on [WindmillHub](https://hub.windmill.dev).
 
-   ![Step 3](./imgs/windmill-flow.png)
+![Step 3](./imgs/windmill-flow.png)
 
-4. Build [complex UIs](https://www.windmill.dev/docs/apps/app_editor) on top of
-   your scripts and flows.
+4. Build [complex UIs](https://www.windmill.dev/docs/apps/app_editor) on top of your scripts and flows.
 
-   ![Step 4](./imgs/windmill-builder.png)
+![Step 4](./imgs/windmill-builder.png)
 
-Scripts and flows can also be triggered by a
-[cron schedule](https://www.windmill.dev/docs/core_concepts/scheduling) (e.g.
-'_/5 _ \* \* \*') or through
-[webhooks](https://www.windmill.dev/docs/core_concepts/webhooks).
+Scripts and flows can be triggered by [schedules](https://www.windmill.dev/docs/core_concepts/scheduling), [webhooks](https://www.windmill.dev/docs/core_concepts/webhooks), [HTTP routes](https://www.windmill.dev/docs/core_concepts/http_routing), [Kafka](https://www.windmill.dev/docs/core_concepts/kafka_triggers), [WebSockets](https://www.windmill.dev/docs/core_concepts/websocket_triggers), [emails](https://www.windmill.dev/docs/core_concepts/email_triggers), and more.
 
-You can build your entire infra on top of Windmill!
+Build your entire infra on top of Windmill!
 
 ## Show me some actual script code
 
@@ -144,43 +127,31 @@ export async function main(
 }
 ```
 
-## CLI
+## Local Development
 
-We have a powerful CLI to interact with the windmill platform and sync your
-scripts from local files, GitHub repos and to run scripts and flows on the
-instance from local commands. See
-[more details](https://www.windmill.dev/docs/advanced/cli).
+Windmill supports multiple ways to develop locally and sync with your instance:
 
-![CLI Screencast](./cli/vhs/output/setup.gif)
+| Tool | Description |
+|------|-------------|
+| **[CLI](https://www.windmill.dev/docs/advanced/cli)** | Sync scripts from local files or GitHub, run scripts/flows from the command line |
+| **[VS Code Extension](https://www.windmill.dev/docs/cli_local_dev/vscode-extension)** | Edit and test scripts & flows directly from VS Code / Cursor with full IDE support |
+| **[Git Sync](https://www.windmill.dev/docs/advanced/git_sync)** | Two-way sync between Windmill and your Git repository |
+| **[Claude Code](https://www.windmill.dev/docs/core_concepts/ai_generation)** | AI-assisted development with Claude for scripts, flows, and apps |
 
-### Running scripts locally
+https://github.com/user-attachments/assets/c541c326-e9ae-4602-a09a-1989aaded1e9
 
-You can run your script locally easily, you simply need to pass the right
-environment variables for the `wmill` client library to fetch resources and
-variables from your instance if necessary. See more:
-<https://www.windmill.dev/docs/advanced/local_development>.
-
-To develop & test locally scripts & flows, we recommend using the Windmill VS
-Code extension: <https://www.windmill.dev/docs/cli_local_dev/vscode-extension>.
+You can run scripts locally by passing the right environment variables for the `wmill` client library to fetch resources and variables from your instance. See [local development docs](https://www.windmill.dev/docs/advanced/local_development).
 
 ## Stack
 
-- Postgres as the database.
-- Backend in Rust with the following highly-available and horizontally scalable.
-  Architecture:
-  - Stateless API backend.
-  - Workers that pull jobs from a queue in Postgres (and later, Kafka or Redis.
-    Upvote [#173](#https://github.com/windmill-labs/windmill/issues/173) if
-    interested).
-- Frontend in Svelte.
-- Scripts executions are sandboxed using Google's
-  [nsjail](https://github.com/google/nsjail).
-- Javascript runtime is the
-  [deno_core rust library](https://denolib.gitbook.io/guide/) (which itself uses
-  the [rusty_v8](https://github.com/denoland/rusty_v8) and hence V8 underneath).
-- TypeScript runtime is Bun and deno.
-- Python runtime is python3.
-- Golang runtime is 1.19.1.
+- **Database**: Postgres (compatible with Aurora, Cloud SQL, Neon, Azure PostgreSQL)
+- **Backend**: Rust - stateless API servers and workers pulling jobs from a Postgres queue
+- **Frontend**: Svelte 5
+- **Sandboxing**: [nsjail](https://github.com/google/nsjail) and PID namespace isolation
+- **Runtimes**:
+  - TypeScript/JavaScript: Bun (default) and Deno
+  - Python: python3 with uv for dependency management
+  - Go, Bash, PowerShell, PHP, Rust, C#, Java, Ansible
 
 ## Fastest Self-Hostable Workflow Engine
 
@@ -197,19 +168,10 @@ page.
 
 ## Security
 
-### Sandboxing
+- **Sandboxing**: [nsjail](https://github.com/google/nsjail) for filesystem/resource isolation, and PID namespace isolation (enabled by default) to prevent jobs from accessing worker process memory
+- **Secrets**: One encryption key per workspace for credentials stored in Windmill's K/V store. We recommend encrypting the Postgres database as well.
 
-Windmill can use [nsjail](https://github.com/google/nsjail). It is production
-multi-tenant grade secure. Do not take our word for it, take
-[fly.io's one](https://fly.io/blog/sandboxing-and-workload-isolation/).
-
-### Secrets, credentials and sensitive values
-
-There is one encryption key per workspace to encrypt the credentials and secrets
-stored in Windmill's K/V store.
-
-In addition, we strongly recommend that you encrypt the whole Postgres database.
-That is what we do at <https://app.windmill.dev>.
+See [Security documentation](https://www.windmill.dev/docs/advanced/security_isolation) for details.
 
 ## Performance
 
@@ -229,19 +191,13 @@ back to the database is ~50ms. A typical lightweight deno job will take around
 
 ## How to self-host
 
-We only provide docker-compose setup here. For more advanced setups, like
-compiling from source or using without a postgres super user, see
-[Self-Host documentation](https://www.windmill.dev/docs/advanced/self_host).
+For detailed setup options, see [Self-Host documentation](https://www.windmill.dev/docs/advanced/self_host).
 
 ### Docker compose
 
-Windmill can be deployed using 3 files:
-([docker-compose.yml](./docker-compose.yml), [Caddyfile](./Caddyfile) and a
-[.env](./.env)) in a single command.
+Deploy Windmill with 3 files ([docker-compose.yml](./docker-compose.yml), [Caddyfile](./Caddyfile), [.env](./.env)):
 
-Make sure Docker is started, and run:
-
-```
+```bash
 curl https://raw.githubusercontent.com/windmill-labs/windmill/main/docker-compose.yml -o docker-compose.yml
 curl https://raw.githubusercontent.com/windmill-labs/windmill/main/Caddyfile -o Caddyfile
 curl https://raw.githubusercontent.com/windmill-labs/windmill/main/.env -o .env
@@ -249,86 +205,45 @@ curl https://raw.githubusercontent.com/windmill-labs/windmill/main/.env -o .env
 docker compose up -d
 ```
 
-Go to http://localhost et voilà :)
+Go to http://localhost - default credentials: `admin@windmill.dev` / `changeme`
 
-The default super-admin user is: admin@windmill.dev / changeme.
+**Using an external database**: Set `DATABASE_URL` in `.env` to point to your managed Postgres (AWS RDS, GCP Cloud SQL, Azure, Neon, etc.) and set db replicas to 0.
 
-From there, you can follow the setup app and create other users.
-
-More details in
-[Self-Host Documention](https://www.windmill.dev/docs/advanced/self_host#docker).
-
-### Kubernetes (k8s) and Helm charts
-
-We publish helm charts at:
-<https://github.com/windmill-labs/windmill-helm-charts>.
-
-### Run from binaries
-
-Each release includes the corresponding binaries for x86_64. You can simply
-download the latest `windmill` binary using the following set of bash commands.
+### Kubernetes (Helm charts)
 
 ```bash
-BINARY_NAME='windmill-amd64' # or windmill-ee-amd64 for the enterprise edition
-LATEST_RELEASE=$(curl -L -s -H 'Accept: application/json' https://github.com/windmill-labs/windmill/releases/latest)
-LATEST_VERSION=$(echo $LATEST_RELEASE | sed -e 's/.*"tag_name":"\([^"]*\)".*/\1/')
-ARTIFACT_URL="https://github.com/windmill-labs/windmill/releases/download/$LATEST_VERSION/$BINARY_NAME"
-wget "$ARTIFACT_URL" -O windmill
+helm repo add windmill https://windmill-labs.github.io/windmill-helm-charts/
+helm install windmill-chart windmill/windmill --namespace=windmill --create-namespace
 ```
 
+See [windmill-helm-charts](https://github.com/windmill-labs/windmill-helm-charts) for configuration options.
+
+### Cloud providers
+
+Windmill works on AWS (EKS/ECS), GCP, Azure, Ubicloud, Fly.io, Render.com, Hetzner, Digital Ocean, and others. Rule of thumb: 1 worker per 1vCPU and 1-2 GB RAM.
+
 ### OAuth, SSO & SMTP
 
-Windmill Community Edition allows to configure the OAuth, SSO (including Google
-Workspace SSO, Microsoft/Azure and Okta) directly from the UI in the superadmin
-settings. Do note that there is a limit of 10 SSO users on the community
-edition.
+Configure OAuth and SSO (Google Workspace, Microsoft/Azure, Okta) directly from the superadmin UI. [See documentation](https://www.windmill.dev/docs/misc/setup_oauth).
 
-[See documentation](https://www.windmill.dev/docs/misc/setup_oauth).
+### License
 
-### Commercial license
+The Community Edition is free to use internally. For commercial redistribution or managed services, contact <sales@windmill.dev>. See [LICENSE](./LICENSE) and [Pricing](https://www.windmill.dev/pricing) for details.
 
-See the [LICENSE](https://github.com/windmill-labs/windmill/blob/main/LICENSE)
-file for the full license text.
+The "Community Edition" of Windmill available in the docker images hosted under ghcr.io/windmill-labs/windmill and the github binary releases contains the files under the AGPLv3 and Apache 2 sources but also includes proprietary and non-public code and features which are not open source and under the following terms: Windmill Labs, Inc. grants a right to use all the features of the "Community Edition" for free without restrictions other than the limits and quotas set in the software and a right to distribute the community edition as is but not to sell, resell, serve Windmill as a managed service, modify or wrap under any form without an explicit agreement.
 
-The "Community Edition" of Windmill available in the docker images hosted under
-ghcr.io/windmill-labs/windmill and the github binary releases contains the files
-under the AGPLv3 and Apache 2 sources but also includes proprietary and
-non-public code and features which are not open source and under the following
-terms: Windmill Labs, Inc. grants a right to use all the features of the
-"Community Edition" for free without restrictions other than the limits and
-quotas set in the software and a right to distribute the community edition as is
-but not to sell, resell, serve Windmill as a managed service, modify or wrap
-under any form without an explicit agreement.
+The binary compilable from source code in this repository without the "enterprise" feature flag is open-source under the [LICENSE-AGPLv3](https://github.com/windmill-labs/windmill/blob/main/LICENSE-AGPL) License terms and conditions.
 
-The binary compilable from source code in this repository without the
-"enterprise" feature flag is open-source under the
-[LICENSE-AGPLv3](https://github.com/windmill-labs/windmill/blob/main/LICENSE-AGPL)
-License terms and conditions.
+To [re-expose directly any Windmill parts to your users](https://www.windmill.dev/docs/misc/white_labelling) as a feature of your product, with the exception of iframed public Windmill "apps", or to build a feature on top of "Windmill Community Edition" that you sell commercially or embed in a distributable product or binary, you must get a commercial license. Contact us at <sales@windmill.dev> if you have any questions. To do the same from the binary compiled from the source code in this repository without the "enterprise" feature flag, you must comply with the AGPLv3 license terms and conditions or get a commercial license from Windmill Labs, Inc.
 
-To
-[re-expose directly any Windmill parts to your users](https://www.windmill.dev/docs/misc/white_labelling)
-as a feature of your product, with the exception of iframed public Windmill
-"apps", or to build a feature on top of "Windmill Community Edition" that you
-sell commercially or embed in a distributable product or binary, you must get a
-commercial license. Contact us at <sales@windmill.dev> if you have any
-questions. To do the same from the binary compiled from the source code in this
-repository without the "enterprise" feature flag, you must comply with the
-AGPLv3 license terms and conditions or get a commercial license from Windmill
-Labs, Inc.
-
-To use Windmill "Community Edition" as is internally in your organization, or to
-use its APIs as is, you do NOT need a commercial license.
+To use Windmill "Community Edition" as is internally in your organization, or to use its APIs as is, you do NOT need a commercial license.
 
 ### Integrations
 
-In Windmill, integrations are referred to as
-[resources and resource types](https://www.windmill.dev/docs/core_concepts/resources_and_types).
-Each Resource has a Resource Type that defines the schema that the resource
+In Windmill, integrations are referred to as [resources and resource types](https://www.windmill.dev/docs/core_concepts/resources_and_types). Each Resource has a Resource Type that defines the schema that the resource
 needs to implement.
 
-On self-hosted instances, you might want to import all the approved resource
-types from [WindmillHub](https://hub.windmill.dev). A setup script will prompt
-you to have it being synced automatically everyday.
+On self-hosted instances, you might want to import all the approved resource types from [WindmillHub](https://hub.windmill.dev). A setup script will prompt you to have it being synced automatically everyday.
 
 ## Environment Variables
 
@@ -369,30 +284,20 @@ you to have it being synced automatically everyday.
 
 ## Run a local dev setup
 
-Using [Nix](./frontend/README_DEV.md#nix) (Recommended).
+We recommend using [Nix](./frontend/README_DEV.md#nix). See [./frontend/README_DEV.md](./frontend/README_DEV.md) for all options.
 
-See the [./frontend/README_DEV.md](./frontend/README_DEV.md) file for all
-running options.
+### Frontend only
 
-### only Frontend
+Uses the backend of <https://app.windmill.dev> with local frontend (hot-reload):
 
-This will use the backend of <https://app.windmill.dev> but your own frontend
-with hot-code reloading. Note that you will need to use a username / password
-login due to CSRF checks using a different auth provider.
-
-In the `frontend/` directory:
-
-1. install the dependencies with `npm install` (or `pnpm install` or `yarn`)
-2. generate the windmill client:
-
-```
-npm run generate-backend-client
-## on mac use
-npm run generate-backend-client-mac
+```bash
+cd frontend
+npm install
+npm run generate-backend-client  # or generate-backend-client-mac on Mac
+npm run dev
 ```
 
-3. Run your dev server with `npm run dev`
-4. Et voilà, windmill should be available at `http://localhost/`
+Windmill available at `http://localhost/`
 
 ### Backend + Frontend
 
@@ -419,7 +324,7 @@ running options.
 6. Go to `backend/`:
    1. `env DATABASE_URL=<YOUR_DATABASE_URL> RUST_LOG=info cargo run`
    2. You can specify any feature flag you want to enable, for example `cargo run --features python` to enable the python executor.
-7. Et voilà, windmill should be available at `http://localhost:3000`
+7. Windmill should be available at `http://localhost:3000`
 
 ## Contributors
 
@@ -429,4 +334,4 @@ running options.
 
 ## Copyright
 
-Windmill Labs, Inc 2023
+© 2023-2026 Windmill Labs, Inc.

backend/.sqlx/query-02bf9763298f301d4fc75490c070a0663142d4d23a2df007361622b94d4783e1.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT flow_version.value AS \"value!: sqlx::types::Json<Box<sqlx::types::JsonRawValue>>\" \n                FROM flow \n                LEFT JOIN flow_version \n                    ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]\n                WHERE flow.path = $1 AND flow.workspace_id = $2",
+  "query": "SELECT flow_version.value AS \"value!: sqlx::types::Json<Box<sqlx::types::JsonRawValue>>\"\n                FROM flow\n                LEFT JOIN flow_version\n                    ON flow_version.id = flow.versions[array_upper(flow.versions, 1)]\n                WHERE flow.path = $1 AND flow.workspace_id = $2",
   "describe": {
     "columns": [
       {
@@ -19,5 +19,5 @@
       false
     ]
   },
-  "hash": "bbce3e1eae78c48409d4204cd6cb3b9db088f6e51bea5e74a494c4e9f4c3b78e"
+  "hash": "02bf9763298f301d4fc75490c070a0663142d4d23a2df007361622b94d4783e1"
 }

backend/.sqlx/query-02e526146f3584cd599dec708e1be48db3b0cd1c74adbfa2e4039377daa016f0.json

@@ -0,0 +1,37 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        DELETE FROM asset\n        WHERE (workspace_id, path, kind) IN (\n            SELECT workspace_id, path, kind FROM (\n                SELECT a.workspace_id, a.path, a.kind, a.usage_kind, ROW_NUMBER() OVER (\n                    PARTITION BY a.workspace_id, a.path, a.kind\n                    ORDER BY a.created_at DESC\n                ) as rn,\n                limits.max_n\n                FROM asset a\n                INNER JOIN (\n                    SELECT * FROM UNNEST(\n                        $1::varchar[], \n                        $2::varchar[], \n                        $3::asset_kind[],\n                        $4::int[]\n                    ) AS t(workspace_id, path, kind, max_n)\n                ) limits\n                ON a.workspace_id = limits.workspace_id \n                AND a.path = limits.path \n                AND a.kind = limits.kind\n                WHERE a.usage_kind = 'job'\n            ) ranked\n            WHERE rn > max_n\n        )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "VarcharArray",
+        "VarcharArray",
+        {
+          "Custom": {
+            "name": "asset_kind[]",
+            "kind": {
+              "Array": {
+                "Custom": {
+                  "name": "asset_kind",
+                  "kind": {
+                    "Enum": [
+                      "s3object",
+                      "resource",
+                      "variable",
+                      "ducklake",
+                      "datatable"
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "Int4Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "02e526146f3584cd599dec708e1be48db3b0cd1c74adbfa2e4039377daa016f0"
+}

backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json

@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
+      false,
+      false,
+      false,
+      false,
+      false,
       true,
       true
     ]

backend/.sqlx/query-14110b9c1b68cf29a6cbdfa737707a44bda831246736e60d63696c3227491adb.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/old_name', 'resource', 0, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_name', 'resource', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "14110b9c1b68cf29a6cbdfa737707a44bda831246736e60d63696c3227491adb"
+}

backend/.sqlx/query-18272dde939afcd87464d74c03bc3c8ee4395919fbfa50565d8d800e3886911e.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET value = $1\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/original_flow'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "18272dde939afcd87464d74c03bc3c8ee4395919fbfa50565d8d800e3886911e"
+}

backend/.sqlx/query-1d32bd9309bf2066399b446e8c47502a0ec72ffc07b22593311915ab5e98f80a.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n    SELECT \n        tag\n    FROM \n        v2_job\n    WHERE \n        id = $1\n    ",
+  "query": "\n    SELECT\n        tag\n    FROM\n        v2_job\n    WHERE\n        id = $1\n    ",
   "describe": {
     "columns": [
       {
@@ -18,5 +18,5 @@
       false
     ]
   },
-  "hash": "49e2430af74ec10857e5df7f7e1ad1b53ba70bb51b0259a1f765f76db9b733ad"
+  "hash": "1d32bd9309bf2066399b446e8c47502a0ec72ffc07b22593311915ab5e98f80a"
 }

backend/.sqlx/query-1ed8d27979cd903cfd12f52461aada26f807236364fb56bf826228983bdab3ab.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_in_parent', 'script', 1, 0, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'new_type', 'resource_type', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "1ed8d27979cd903cfd12f52461aada26f807236364fb56bf826228983bdab3ab"
+}

backend/.sqlx/query-21941635afc295e5a42aceffce7aad910477c4537e9fe40b227e4ecc7eae76d3.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script SET archived = true\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/to_delete'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "21941635afc295e5a42aceffce7aad910477c4537e9fe40b227e4ecc7eae76d3"
+}

backend/.sqlx/query-2248e2c5ca8e6fe58704e45066477a1257b15cde7ea44962ce8566d6d7396add.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/new_in_fork', 'script', 0, 1, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "2248e2c5ca8e6fe58704e45066477a1257b15cde7ea44962ce8566d6d7396add"
+}

backend/.sqlx/query-306e0156ee1541710c1c6512ecb4f61baeb3ae6f31ba3fd57a3ec485108a7f49.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM v2_job_completed\n         WHERE id IN (\n             SELECT id FROM v2_job_completed\n             WHERE completed_at <= now() - ($1::bigint::text || ' s')::interval\n             ORDER BY completed_at ASC\n             LIMIT $2\n             FOR UPDATE SKIP LOCKED\n         )\n         RETURNING id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Int8"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "306e0156ee1541710c1c6512ecb4f61baeb3ae6f31ba3fd57a3ec485108a7f49"
-}

backend/.sqlx/query-31eada57708ac3347d1e0a4fb5fd412a4a0c6046dbe4cf91849def2eea2e4c62.json

@@ -0,0 +1,53 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO asset (workspace_id, path, kind, usage_access_type, usage_path, usage_kind, asset_detection_kind, job_id)\n                VALUES ($1, $2, $3, $4, $5, $6, 'static', NULL) ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        {
+          "Custom": {
+            "name": "asset_kind",
+            "kind": {
+              "Enum": [
+                "s3object",
+                "resource",
+                "variable",
+                "ducklake",
+                "datatable"
+              ]
+            }
+          }
+        },
+        {
+          "Custom": {
+            "name": "asset_access_type",
+            "kind": {
+              "Enum": [
+                "r",
+                "w",
+                "rw"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        {
+          "Custom": {
+            "name": "asset_usage_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "31eada57708ac3347d1e0a4fb5fd412a4a0c6046dbe4cf91849def2eea2e4c62"
+}

backend/.sqlx/query-338f8f878aba9d9361b17329ee448ee4582194cbbc853d26abd285c259642c60.json

@@ -0,0 +1,32 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT has_changes, exists_in_source, exists_in_fork FROM workspace_diff\n         WHERE path = 'f/shared/new_in_parent' AND kind = 'script' AND source_workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_changes",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "exists_in_source",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 2,
+        "name": "exists_in_fork",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "338f8f878aba9d9361b17329ee448ee4582194cbbc853d26abd285c259642c60"
+}

backend/.sqlx/query-33ad6eb46a13dd49605fdb863a03602878c9d1f40f61e349e06698140133153f.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script\n         SET content = 'def main(): return \"fork_modified\"', summary = 'Modified in fork'\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/to_modify_fork'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "33ad6eb46a13dd49605fdb863a03602878c9d1f40f61e349e06698140133153f"
+}

backend/.sqlx/query-3439a44ea40ea748346af50bc1529dc8fd135c8cb54b7e39d03b326c30a0ab25.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)\n         VALUES\n         ('test-workspace', 'f/shared/original_script', 12345, 'def main(): pass', 'Original', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_modify_parent', 22222, 'def main(): return 1', 'To modify in parent', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_modify_fork', 33333, 'def main(): return 2', 'To modify in fork', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_conflict', 44444, 'def main(): return 3', 'To conflict', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false),\n         ('test-workspace', 'f/shared/to_delete', 55555, 'def main(): return 4', 'To delete', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "3439a44ea40ea748346af50bc1529dc8fd135c8cb54b7e39d03b326c30a0ab25"
+}

backend/.sqlx/query-3c6bed058591ad5438428b8c154ba6ee737e59aa033d833843b54e9f58eef3f2.json

@@ -0,0 +1,42 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO asset (workspace_id, path, kind, usage_access_type, usage_path, usage_kind, asset_detection_kind, job_id)\n                VALUES ($1, $2, $3, NULL, $4, $5, 'runtime', $6) ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        {
+          "Custom": {
+            "name": "asset_kind",
+            "kind": {
+              "Enum": [
+                "s3object",
+                "resource",
+                "variable",
+                "ducklake",
+                "datatable"
+              ]
+            }
+          }
+        },
+        "Varchar",
+        {
+          "Custom": {
+            "name": "asset_usage_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow"
+              ]
+            }
+          }
+        },
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "3c6bed058591ad5438428b8c154ba6ee737e59aa033d833843b54e9f58eef3f2"
+}

backend/.sqlx/query-45997fcb4d9d62c7f7011966bf59bdb86e12ce1d0c8e925e738d2645121a5c1f.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM v2_job_completed\n         WHERE id IN (\n             SELECT jc.id FROM v2_job_completed jc\n             LEFT JOIN v2_job j ON j.id = jc.id\n             WHERE jc.completed_at <= now() - ($1::bigint::text || ' s')::interval\n               AND COALESCE(j.root_job, j.flow_innermost_root_job, jc.id) != ALL($3)\n             ORDER BY jc.completed_at ASC\n             LIMIT $2\n             FOR UPDATE OF jc SKIP LOCKED\n         )\n         RETURNING id",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Int8",
+        "UuidArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "45997fcb4d9d62c7f7011966bf59bdb86e12ce1d0c8e925e738d2645121a5c1f"
+}

backend/.sqlx/query-46395d77f3393a058e25ff4efb0b61c743c58418ba2ae1104bcfc99fae7925e4.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM asset WHERE workspace_id = $1 AND usage_kind = 'script' AND usage_path = (SELECT path FROM script WHERE hash = $2 AND workspace_id = $1) AND asset_detection_kind = 'static'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "46395d77f3393a058e25ff4efb0b61c743c58418ba2ae1104bcfc99fae7925e4"
+}

backend/.sqlx/query-46f6a3665d11ef573e27ab14be8a80c78d7eb735bc9615ebf2668a5715d83349.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT (large_file_storage IS NOT NULL\n                     AND large_file_storage != 'null'::jsonb\n                     AND jsonb_typeof(large_file_storage) = 'object') AS \"has_primary!\"\n            FROM workspace_settings WHERE workspace_id = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_primary!",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "46f6a3665d11ef573e27ab14be8a80c78d7eb735bc9615ebf2668a5715d83349"
+}

backend/.sqlx/query-49e4bef9d5e366c179d33794472201bfca768ee5ead967e0232fa87a59b9747c.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT id FROM app WHERE path = 'f/shared/dashboard' AND workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "49e4bef9d5e366c179d33794472201bfca768ee5ead967e0232fa87a59b9747c"
+}

backend/.sqlx/query-4c1dac4ddeca8f053abb35c833acd6993448d0327404cf1ad089ec3df6f2db35.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO agent_token_blacklist (token, expires_at, blacklisted_by)\n         VALUES ($1, $2, $3)\n         ON CONFLICT (token) DO UPDATE SET\n            expires_at = EXCLUDED.expires_at,\n            blacklisted_at = NOW(),\n            blacklisted_by = EXCLUDED.blacklisted_by",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Timestamp",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "4c1dac4ddeca8f053abb35c833acd6993448d0327404cf1ad089ec3df6f2db35"
+}

backend/.sqlx/query-4ef7fcfa9a8962497c1eace31e59138cb8b252b207122a823185b36c44c10045.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE script\n         SET content = 'def main(): return \"modified\"', summary = 'Modified in parent'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/to_modify_parent'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "4ef7fcfa9a8962497c1eace31e59138cb8b252b207122a823185b36c44c10045"
+}

backend/.sqlx/query-56e6be86747e953e4eb75b434906bea7f471c22923ac29894feae9c199d78788.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_modify_fork', 'script', 0, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/resource_to_modify', 'resource', 0, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'shared', 'folder', 0, 1, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "56e6be86747e953e4eb75b434906bea7f471c22923ac29894feae9c199d78788"
+}

backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json

@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      null
+      true
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"

backend/.sqlx/query-5a3cf6f0958a559c147a37e29458b48eb7488446eb69adeddf2007ae7ae897a7.json

@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n                VALUES ($1, $2, $3, $4, 1, 0, NULL)\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    ahead = workspace_diff.ahead + 1,\n                    has_changes = NULL",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5a3cf6f0958a559c147a37e29458b48eb7488446eb69adeddf2007ae7ae897a7"
+}

backend/.sqlx/query-5b3b4119469b7b110657926e6f99093c8fa5980ad061804cf73dc29151beac4b.json

@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n                SELECT $1, unnest($2::varchar[]), $3, $4, 0, 1, NULL\n                ON CONFLICT (source_workspace_id, fork_workspace_id, path, kind)\n                DO UPDATE SET\n                    behind = workspace_diff.behind + 1,\n                    has_changes = NULL",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "VarcharArray",
+        "Varchar",
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "5b3b4119469b7b110657926e6f99093c8fa5980ad061804cf73dc29151beac4b"
+}

backend/.sqlx/query-6974521dec19adbc4c4497cc50e11a3f3be2a76a68287b3da2b999a925f972b4.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, created_by)\n         VALUES ('test-workspace', 'custom_db', $1, 'Custom DB type', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "6974521dec19adbc4c4497cc50e11a3f3be2a76a68287b3da2b999a925f972b4"
+}

backend/.sqlx/query-752fc50d3374ee5ccdb49f10c11e50bbffeec1088364a64f0849fb9b25e11ef4.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM asset WHERE workspace_id = $1 AND usage_kind = 'script' AND usage_path = $2 AND asset_detection_kind = 'static'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "752fc50d3374ee5ccdb49f10c11e50bbffeec1088364a64f0849fb9b25e11ef4"
+}

backend/.sqlx/query-77929b1ab186a01113436b5739240285dc111218efb4df8dbb0c72280a4c6a2c.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT has_changes FROM workspace_diff\n         WHERE path = 'f/shared/original_script' AND kind = 'script' AND source_workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_changes",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "77929b1ab186a01113436b5739240285dc111218efb4df8dbb0c72280a4c6a2c"
+}

backend/.sqlx/query-7bc9fc05dbd162866bef1fdd3e7faeb50429881ed1bc962903f06e4b3d5f8d44.json

@@ -0,0 +1,35 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT schema, description, format_extension\n         FROM resource_type\n         WHERE workspace_id = $1 AND name = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "schema",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 1,
+        "name": "description",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "format_extension",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "7bc9fc05dbd162866bef1fdd3e7faeb50429881ed1bc962903f06e4b3d5f8d44"
+}

backend/.sqlx/query-7cbfad812eeb80cff00336697052f266693cf838d62a8b1e581c7239ec42095b.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by \n             FROM agent_token_blacklist \n             ORDER BY blacklisted_at DESC",
+  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by\n             FROM agent_token_blacklist\n             ORDER BY blacklisted_at DESC",
   "describe": {
     "columns": [
       {
@@ -34,5 +34,5 @@
       false
     ]
   },
-  "hash": "1c5d3556fc8436ddd294f39c5431e1f501a821d6143c5d8aece20814237a6b86"
+  "hash": "7cbfad812eeb80cff00336697052f266693cf838d62a8b1e581c7239ec42095b"
 }

backend/.sqlx/query-7d73a51d5a83b11c1c4088678dd22ef369e9e26fafb75b351abfdef2b8a7a3e4.json

@@ -0,0 +1,34 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n                jsonb_build_object(\n                    'path', path,\n                    'kind', kind,\n                    'access_type', usage_access_type\n                ) as \"list!: _\"\n            FROM asset\n            WHERE workspace_id = $1 AND usage_path = $2 AND usage_kind = $3\n              AND asset_detection_kind = 'static'\n            ORDER BY path, kind",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "list!: _",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "asset_usage_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "7d73a51d5a83b11c1c4088678dd22ef369e9e26fafb75b351abfdef2b8a7a3e4"
+}

backend/.sqlx/query-8039b459914ceefe0c0a31b97473a5522e47b4b2fd3ddeff8f221560bc9c6f57.json

@@ -0,0 +1,41 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT display_name, owners, extra_perms, summary\n         FROM folder\n         WHERE workspace_id = $1 AND name = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "display_name",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "owners",
+        "type_info": "VarcharArray"
+      },
+      {
+        "ordinal": 2,
+        "name": "extra_perms",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 3,
+        "name": "summary",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true
+    ]
+  },
+  "hash": "8039b459914ceefe0c0a31b97473a5522e47b4b2fd3ddeff8f221560bc9c6f57"
+}

backend/.sqlx/query-85711709ee4c9684cd46af85c2d21124bfaa6aa07eadeb8d55b4b9b9e3073f10.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/lazy_test', 'script', 1, 0, NULL)\n         ON CONFLICT DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "85711709ee4c9684cd46af85c2d21124bfaa6aa07eadeb8d55b4b9b9e3073f10"
+}

backend/.sqlx/query-8c0596e2a1c7cf9eef4e4ce3249a8bdd6cb4ead841591d873e5ec8c9c214b6b5.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT has_changes FROM workspace_diff\n         WHERE path = 'f/shared/lazy_test' AND kind = 'script' AND source_workspace_id = 'test-workspace'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "has_changes",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      true
+    ]
+  },
+  "hash": "8c0596e2a1c7cf9eef4e4ce3249a8bdd6cb4ead841591d873e5ec8c9c214b6b5"
+}

backend/.sqlx/query-8d1920926cbdce897305c775b1d286fed8fa2f4258bde54b9d771c91923751ff.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT EXISTS(SELECT 1 FROM workspace WHERE id = 'wm-fork-test-workspace')",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "exists",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "8d1920926cbdce897305c775b1d286fed8fa2f4258bde54b9d771c91923751ff"
+}

backend/.sqlx/query-8ff8b53147d857db7829889ccbb59d2ca0492704a0b4a3cc8d1f4f733e0c794b.json

@@ -0,0 +1,26 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM asset WHERE workspace_id = $1 AND usage_path = $2 AND usage_kind = $3 AND asset_detection_kind = 'static'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "asset_usage_kind",
+            "kind": {
+              "Enum": [
+                "script",
+                "flow"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8ff8b53147d857db7829889ccbb59d2ca0492704a0b4a3cc8d1f4f733e0c794b"
+}

backend/.sqlx/query-907025d53448ea70760420f90cd95ad1d93ef6d4ebe0295cdc1e70108320f6a9.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource_type (workspace_id, name, schema, description, created_by)\n         VALUES ('test-workspace', 'new_type', $1, 'New type in parent', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "907025d53448ea70760420f90cd95ad1d93ef6d4ebe0295cdc1e70108320f6a9"
+}

backend/.sqlx/query-93def20ecf1bcbffe57c54bb12f0a5da22d9d2845d69e998cad8b68954b7a289.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/original_script', 'script', 0, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "93def20ecf1bcbffe57c54bb12f0a5da22d9d2845d69e998cad8b68954b7a289"
+}

backend/.sqlx/query-96406f7d7a42ec5a614415ed2fbf6f24291e869aa028ef3190390aaeadd10a46.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE folder SET display_name = 'Modified Shared Folder'\n         WHERE workspace_id = 'wm-fork-test-workspace' AND name = 'shared'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "96406f7d7a42ec5a614415ed2fbf6f24291e869aa028ef3190390aaeadd10a46"
+}

backend/.sqlx/query-97101fae34227628efbcd72457a83a683745a6e2fb120329deba5117cc523bf2.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM asset WHERE workspace_id = $1 AND usage_kind = 'flow' AND usage_path = $2 AND asset_detection_kind = 'static'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "97101fae34227628efbcd72457a83a683745a6e2fb120329deba5117cc523bf2"
+}

backend/.sqlx/query-9775cbe9f8592743575b06ae60b4afdca78d46a5934521314bb7a7d8688f9a35.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)\n         VALUES ('wm-fork-test-workspace', 'f/shared/new_in_fork', 99999, 'def main(): return \"fork\"', 'New in fork', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9775cbe9f8592743575b06ae60b4afdca78d46a5934521314bb7a7d8688f9a35"
+}

backend/.sqlx/query-97c61b6a9a5112ea484565236959a544511d5d501fb737da8110a8725b883465.json

@@ -0,0 +1,24 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, dedicated_workers, wm_version, vcpus, memory, job_isolation) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) ON CONFLICT (worker)\n        DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group, dedicated_workers = EXCLUDED.dedicated_workers",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Varchar",
+        "TextArray",
+        "Varchar",
+        "Int8",
+        "Int8",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "97c61b6a9a5112ea484565236959a544511d5d501fb737da8110a8725b883465"
+}

backend/.sqlx/query-9a7f4786fc29ed2b561d9eb96c274c66da29fdfb3e862e06c10c5deb4a2b5771.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app (workspace_id, path, summary, policy, versions, extra_perms, draft_only)\n         VALUES ('test-workspace', 'f/shared/dashboard', 'Dashboard app', '{}', ARRAY[1::bigint], '{}', false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9a7f4786fc29ed2b561d9eb96c274c66da29fdfb3e862e06c10c5deb4a2b5771"
+}

backend/.sqlx/query-9b7d0f980267e62fb50545570e83daae65e4458a88b53b65870523b64d183231.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE resource SET path = 'f/shared/new_name'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/old_name'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9b7d0f980267e62fb50545570e83daae65e4458a88b53b65870523b64d183231"
+}

backend/.sqlx/query-9df747dec3f3c245b1cd3a5039f0a4a69d0667e328ad838c1a2f9bb9fee2d121.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE variable SET value = 'modified_value'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/variable_to_modify'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "9df747dec3f3c245b1cd3a5039f0a4a69d0667e328ad838c1a2f9bb9fee2d121"
+}

backend/.sqlx/query-a14d43c1baebcdf7e8cebcb7c752f78a2212fe55d4247c2321b37d182d2a4386.json

@@ -0,0 +1,37 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        DELETE FROM asset\n        WHERE id IN (\n            SELECT id FROM (\n                SELECT a.id, ROW_NUMBER() OVER (\n                    PARTITION BY a.workspace_id, a.path, a.kind\n                    ORDER BY a.created_at DESC\n                ) as rn,\n                limits.max_n\n                FROM asset a\n                INNER JOIN (\n                    SELECT * FROM UNNEST(\n                        $1::varchar[], \n                        $2::varchar[], \n                        $3::asset_kind[],\n                        $4::int[]\n                    ) AS t(workspace_id, path, kind, max_n)\n                ) limits\n                ON a.workspace_id = limits.workspace_id \n                AND a.path = limits.path \n                AND a.kind = limits.kind\n                WHERE a.asset_detection_kind = 'runtime'\n            ) ranked\n            WHERE rn > max_n\n        )",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "VarcharArray",
+        "VarcharArray",
+        {
+          "Custom": {
+            "name": "asset_kind[]",
+            "kind": {
+              "Array": {
+                "Custom": {
+                  "name": "asset_kind",
+                  "kind": {
+                    "Enum": [
+                      "s3object",
+                      "resource",
+                      "variable",
+                      "ducklake",
+                      "datatable"
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "Int4Array"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a14d43c1baebcdf7e8cebcb7c752f78a2212fe55d4247c2321b37d182d2a4386"
+}

backend/.sqlx/query-a17539823e5f2b0ffa8d3f270801d6d41db9e2ef4c33f09565a858d6c55cc3a9.json

@@ -0,0 +1,16 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO resource (workspace_id, path, value, resource_type, description, created_by)\n         VALUES\n         ('test-workspace', 'f/shared/db_config', $1, 'postgresql', '', 'test@windmill.dev'),\n         ('test-workspace', 'f/shared/old_name', $2, 'generic', '', 'test@windmill.dev'),\n         ('test-workspace', 'f/shared/resource_to_modify', $3, 'generic', '', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb",
+        "Jsonb",
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "a17539823e5f2b0ffa8d3f270801d6d41db9e2ef4c33f09565a858d6c55cc3a9"
+}

backend/.sqlx/query-a1f8d5c97404166603de2fe214d965243ddf8a37685a7f62b593718d195dab06.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/original_flow', 'flow', 1, 1, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_conflict', 'script', 1, 1, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a1f8d5c97404166603de2fe214d965243ddf8a37685a7f62b593718d195dab06"
+}

backend/.sqlx/query-a21337dac33ef7a1aff1c6797a3ca47fed231f542d5bd8725d6c86b8dd1a2535.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT\n            jsonb_strip_nulls(jsonb_build_object(\n                'path', asset.path,\n                'kind', asset.kind,\n                'usages', ARRAY_AGG(DISTINCT jsonb_build_object(\n                    'path', asset.usage_path,\n                    'kind', asset.usage_kind,\n                    'access_type', asset.usage_access_type,\n                    'detection_kinds', (\n                      SELECT ARRAY_AGG(DISTINCT a2.asset_detection_kind)\n                      FROM asset a2\n                      WHERE a2.workspace_id = asset.workspace_id\n                        AND a2.path = asset.path\n                        AND a2.kind = asset.kind\n                        AND a2.usage_path = asset.usage_path\n                        AND a2.usage_kind = asset.usage_kind\n                    )\n                )),\n                'metadata', (CASE\n                  WHEN asset.kind = 'resource' THEN\n                    jsonb_build_object('resource_type', resource.resource_type)\n                  ELSE\n                    NULL\n                  END\n                )\n            )) as \"list!: _\"\n        FROM asset\n        LEFT JOIN resource ON asset.kind = 'resource'\n          AND array_to_string((string_to_array(asset.path, '/'))[1:3], '/') = resource.path -- With specific table, asset path can be e.g u/diego/pg_db/table_name\n          AND resource.workspace_id = $1\n        WHERE asset.workspace_id = $1\n          AND (asset.kind <> 'resource' OR resource.path IS NOT NULL)\n          AND (asset.usage_kind <> 'flow' OR asset.usage_path = ANY(SELECT path FROM flow WHERE workspace_id = $1))\n          AND (asset.usage_kind <> 'script' OR asset.usage_path = ANY(SELECT path FROM script WHERE workspace_id = $1))\n          GROUP BY asset.path, asset.kind, resource.resource_type\n        ORDER BY asset.path, asset.kind",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "list!: _",
+        "type_info": "Jsonb"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "a21337dac33ef7a1aff1c6797a3ca47fed231f542d5bd8725d6c86b8dd1a2535"
+}

backend/.sqlx/query-a962567ecfcbf251a8fcc12db894580b53f209d5f9f771bfaf0453b8d704bf31.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO script (workspace_id, path, hash, content, summary, description, language, created_by, created_at, archived, schema_validation, ws_error_handler_muted, deleted)\n         VALUES ('test-workspace', 'f/shared/new_in_parent', 54321, 'def main(): return \"new\"', 'New in parent', '', 'python3', 'test@windmill.dev', NOW(), false, false, false, false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "a962567ecfcbf251a8fcc12db894580b53f209d5f9f771bfaf0453b8d704bf31"
+}

backend/.sqlx/query-b32c7c24440137d6749e1fc3095512b0f5bc8b81e0b644b01256398664ecf9b1.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO flow (workspace_id, path, summary, description, value, schema, edited_by, edited_at, archived)\n         VALUES ('test-workspace', 'f/shared/original_flow', 'Flow summary', '', $1, NULL, 'test@windmill.dev', NOW(), false)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "b32c7c24440137d6749e1fc3095512b0f5bc8b81e0b644b01256398664ecf9b1"
+}

backend/.sqlx/query-b95b6ee787c590dd21969965a687fef33fc9fbc80ca87f96aced906570e28c18.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT name FROM resource_type\n                     WHERE workspace_id = $1 AND name = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "b95b6ee787c590dd21969965a687fef33fc9fbc80ca87f96aced906570e28c18"
+}

backend/.sqlx/query-ba3149ec0aa62dba41c459a1bf5be86aebccee68172abefe82f4bb76fc7a80ee.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO folder (workspace_id, name, display_name, owners, summary, created_by)\n         VALUES ('test-workspace', 'shared', 'Shared Folder', ARRAY['test@windmill.dev']::varchar[], 'Test folder', 'test@windmill.dev')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "ba3149ec0aa62dba41c459a1bf5be86aebccee68172abefe82f4bb76fc7a80ee"
+}

backend/.sqlx/query-bda182047ae37e263b0011248d86c1b20d8b7908bb8a8ae4c5ed83b51db5446a.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO app_version (app_id, value, created_by, created_at)\n         VALUES ($1, $2, 'test@windmill.dev', NOW())",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8",
+        "Json"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bda182047ae37e263b0011248d86c1b20d8b7908bb8a8ae4c5ed83b51db5446a"
+}

backend/.sqlx/query-c01a94ec75990c8fb4068485c91211af295a1d2630861bf53a33966abc4562ec.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT q.id FROM v2_job_queue q\n         JOIN v2_job j ON j.id = q.id\n         WHERE j.parent_job IS NULL\n           AND j.created_at <= now() - ($1::bigint::text || ' s')::interval",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "c01a94ec75990c8fb4068485c91211af295a1d2630861bf53a33966abc4562ec"
+}

backend/.sqlx/query-c64288c867ba944e834a44c5a6af7231efd899a148d3607316a5537f4e7b031c.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO deployment_metadata (workspace_id, path, script_hash, callback_job_ids, deployment_msg) VALUES ($1, $2, $3, $4, $5) \n                            ON CONFLICT (workspace_id, script_hash) WHERE script_hash IS NOT NULL DO UPDATE SET callback_job_ids = EXCLUDED.callback_job_ids, deployment_msg = EXCLUDED.deployment_msg",
+  "query": "INSERT INTO deployment_metadata (workspace_id, path, script_hash, callback_job_ids, deployment_msg) VALUES ($1, $2, $3, $4, $5)\n                            ON CONFLICT (workspace_id, script_hash) WHERE script_hash IS NOT NULL DO UPDATE SET callback_job_ids = EXCLUDED.callback_job_ids, deployment_msg = EXCLUDED.deployment_msg",
   "describe": {
     "columns": [],
     "parameters": {
@@ -14,5 +14,5 @@
     },
     "nullable": []
   },
-  "hash": "8e750d4b3af9b5844c11b1b92741f2ee9d2d3412d4a2c96c6ccc87ec1c382384"
+  "hash": "c64288c867ba944e834a44c5a6af7231efd899a148d3607316a5537f4e7b031c"
 }

backend/.sqlx/query-c925a52d90231f9e6f3af652ddfddd67bff8c3d306794e3583af86818b7054d0.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_modify_parent', 'script', 1, 0, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/dashboard', 'app', 1, 0, NULL),\n         ('test-workspace', 'wm-fork-test-workspace', 'f/shared/variable_to_modify', 'variable', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "c925a52d90231f9e6f3af652ddfddd67bff8c3d306794e3583af86818b7054d0"
+}

backend/.sqlx/query-c9c040ec228a8fe4fda08439420141bee63339d4e3d5e2d68aabb12009f691c6.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO agent_token_blacklist (token, expires_at, blacklisted_by) \n         VALUES ($1, $2, $3) \n         ON CONFLICT (token) DO UPDATE SET \n            expires_at = EXCLUDED.expires_at,\n            blacklisted_at = NOW(),\n            blacklisted_by = EXCLUDED.blacklisted_by",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Timestamp",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "c9c040ec228a8fe4fda08439420141bee63339d4e3d5e2d68aabb12009f691c6"
-}

backend/.sqlx/query-d20d6c43b16b762fb4cdb2cafe1fe9a2920124f398fca5bd54cb805b03b94763.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by \n             FROM agent_token_blacklist \n             WHERE expires_at > $1 \n             ORDER BY blacklisted_at DESC",
+  "query": "SELECT token, expires_at, blacklisted_at, blacklisted_by\n             FROM agent_token_blacklist\n             WHERE expires_at > $1\n             ORDER BY blacklisted_at DESC",
   "describe": {
     "columns": [
       {
@@ -36,5 +36,5 @@
       false
     ]
   },
-  "hash": "d56722c25877222af9affd5da5bb83b28fa8cbb528a2cfc90684cb10a69e4375"
+  "hash": "d20d6c43b16b762fb4cdb2cafe1fe9a2920124f398fca5bd54cb805b03b94763"
 }

backend/.sqlx/query-d6ce9016308da0f20c2118c047349d8110d899121c9c00795c55217b9f1886c2.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE app SET summary = 'Modified dashboard app'\n         WHERE workspace_id = 'test-workspace' AND path = 'f/shared/dashboard'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d6ce9016308da0f20c2118c047349d8110d899121c9c00795c55217b9f1886c2"
+}

backend/.sqlx/query-d8c5c64006cdd52570bbc56b0fa5df9b597d9a45353391411efa86959a7512bc.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO variable (workspace_id, path, value, is_secret, description)\n         VALUES\n         ('test-workspace', 'f/shared/api_key', 'secret123', false, 'Test key'),\n         ('test-workspace', 'f/shared/variable_to_modify', 'original', false, 'To modify')",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "d8c5c64006cdd52570bbc56b0fa5df9b597d9a45353391411efa86959a7512bc"
+}

backend/.sqlx/query-df290155c071e823a1d60573a3cba932d070ed730a37450cd30ba9b90205ed3b.json

@@ -0,0 +1,37 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(DISTINCT asset.job_id)::bigint as \"count!\"\n        FROM asset\n        WHERE asset.workspace_id = $1\n          AND asset.path = $2\n          AND asset.kind = $3\n          AND asset.asset_detection_kind = 'runtime'\n          AND asset.job_id IS NOT NULL",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count!",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "asset_kind",
+            "kind": {
+              "Enum": [
+                "s3object",
+                "resource",
+                "variable",
+                "ducklake",
+                "datatable"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "df290155c071e823a1d60573a3cba932d070ed730a37450cd30ba9b90205ed3b"
+}

backend/.sqlx/query-df804e2a8795af329aa84ccfeb90329383524232276908af181f6ecb3c8fc804.json

@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT name FROM folder\n                     WHERE workspace_id = $1 AND name = ANY($2)",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "name",
+        "type_info": "Varchar"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "TextArray"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "df804e2a8795af329aa84ccfeb90329383524232276908af181f6ecb3c8fc804"
+}

backend/.sqlx/query-e42bb9155be93cbc750702cf7f9a3c54d1a236421861880fe3749052bd2ab43f.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE flow SET value = $1\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/original_flow'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e42bb9155be93cbc750702cf7f9a3c54d1a236421861880fe3749052bd2ab43f"
+}

backend/.sqlx/query-e881a777b8e67c76cf458828a02f7d5234ae76da567195f5da11cd11d7ebbc05.json

@@ -0,0 +1,12 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO workspace_diff\n         (source_workspace_id, fork_workspace_id, path, kind, ahead, behind, has_changes)\n         VALUES ('test-workspace', 'wm-fork-test-workspace', 'f/shared/to_delete', 'script', 1, 0, NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": []
+  },
+  "hash": "e881a777b8e67c76cf458828a02f7d5234ae76da567195f5da11cd11d7ebbc05"
+}

backend/.sqlx/query-e9e6c8ba034b4f80fada2e07e500a78983aeb1a7b1185b5267229c3197d6f714.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE resource SET value = $1\n         WHERE workspace_id = 'wm-fork-test-workspace' AND path = 'f/shared/resource_to_modify'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Jsonb"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "e9e6c8ba034b4f80fada2e07e500a78983aeb1a7b1185b5267229c3197d6f714"
+}

backend/.sqlx/query-ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO worker_ping (worker_instance, worker, ip, custom_tags, worker_group, dedicated_worker, wm_version, vcpus, memory, job_isolation) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10) ON CONFLICT (worker)\n        DO UPDATE set ip = EXCLUDED.ip, custom_tags = EXCLUDED.custom_tags, worker_group = EXCLUDED.worker_group",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "TextArray",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "ed90b9fcc57f530bab2d2d7426795bb358c91ebdd9dab50d7e3d2fdce63b947c"
-}

backend/.sqlx/query-fb6656bc8fbd2e1b2c59f9ecbab55e5cdccdd7c99af0b61946694c6e03e7f636.json

@@ -0,0 +1,63 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT DISTINCT\n            v2_job.id,\n            v2_job.created_at,\n            v2_job.created_by,\n            v2_job.runnable_path,\n            CASE\n              WHEN v2_job_completed.id IS NOT NULL THEN v2_job_completed.status::text\n              ELSE NULL\n            END as status\n        FROM asset\n        INNER JOIN v2_job ON asset.job_id = v2_job.id\n        LEFT JOIN v2_job_completed ON v2_job.id = v2_job_completed.id\n        WHERE asset.workspace_id = $1\n          AND asset.path = $2\n          AND asset.kind = $3\n          AND asset.asset_detection_kind = 'runtime'\n          AND asset.job_id IS NOT NULL\n        ORDER BY v2_job.created_at DESC\n        LIMIT $4 OFFSET $5",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Uuid"
+      },
+      {
+        "ordinal": 1,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 2,
+        "name": "created_by",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 3,
+        "name": "runnable_path",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 4,
+        "name": "status",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text",
+        {
+          "Custom": {
+            "name": "asset_kind",
+            "kind": {
+              "Enum": [
+                "s3object",
+                "resource",
+                "variable",
+                "ducklake",
+                "datatable"
+              ]
+            }
+          }
+        },
+        "Int8",
+        "Int8"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      true,
+      null
+    ]
+  },
+  "hash": "fb6656bc8fbd2e1b2c59f9ecbab55e5cdccdd7c99af0b61946694c6e03e7f636"
+}

backend/CLAUDE.md

@@ -1,22 +1,61 @@
 # Backend Development (Rust)
 
-## Core Principles
+## Project Structure
 
-- Follow @rust-best-practices.mdc for detailed guidelines
-- Database schema reference: @summarized_schema.txt
-- The API routes prefixes are all listed in windmill-api/src/lib.rs
-- This repository is the open source side of the project. The enterprise files (\*\_ee.rs) are in the `windmill-ee-private` folder (a sibling directory). Those files are symlinked into their corresponding locations within each crate's `src/` directory.
+Windmill uses a workspace-based architecture with multiple crates:
 
-## JSON Handling
+- **windmill-api**: API server functionality
+- **windmill-worker**: Job execution
+- **windmill-common**: Shared code used by all crates
+- **windmill-queue**: Job & flow queuing
+- **windmill-audit**: Audit logging
+- Other specialized crates (git-sync, autoscaling, etc.)
 
-- **Prefer `Box<serde_json::value::RawValue>` over `serde_json::Value`** when possible, especially:
-  - When storing JSON in the database (JSONB columns)
-  - When passing JSON through without modification
-  - When the JSON structure doesn't need to be inspected or manipulated
-- This avoids unnecessary parsing/serialization overhead and preserves the original JSON format
-- Use `serde_json::Value` only when you need to inspect, modify, or construct JSON programmatically
+## Key References (MUST FOLLOW THESE)
 
-## Adding New Features
+- You MUST follow best-practices by using the `rust-backend` skill, everytime you write RUST code.
+- When working with the database: read `summarized_schema.txt` before starting 
+- When working with the API routes: you can read `windmill-api/src/lib.rs` to get started
 
-1. Update database schema with migration if necessary
-2. Update backend/windmill-api/openapi.yaml after modifying API endpoints
+## Adding New Code
+
+### Module Organization
+
+- Place new code in the appropriate crate based on functionality
+- For API endpoints, create or modify files in `windmill-api/src/` organized by domain
+- For shared functionality, use `windmill-common/src/`
+- Follow existing patterns for file structure and organization
+
+### API Endpoints
+
+- Follow existing patterns in the `windmill-api` crate
+- Use axum's routing system and extractors
+- Update `backend/windmill-api/openapi.yaml` after modifying API endpoints
+
+### Database Changes
+
+- Update database schema with migration if necessary
+- Use `sqlx` for database operations with prepared statements
+- Use transactions for multi-step operations
+
+## Enterprise Features
+
+- Enterprise files use the `*_ee.rs` suffix
+- Enterprise source is in `windmill-ee-private` folder (sibling directory), symlinked into each crate's `src/`
+- Use feature flags: `#[cfg(feature = "enterprise")]`
+- Isolate enterprise code in separate modules
+
+## Testing
+
+- Write unit tests for core functionality
+- Use the `#[cfg(test)]` module for test code
+- For database tests, use the existing test utilities
+
+## Common Crates
+
+- **tokio**: Async runtime
+- **axum**: Web server and routing
+- **sqlx**: Database operations
+- **serde**: Serialization/deserialization
+- **tracing**: Logging and diagnostics
+- **reqwest**: HTTP client

backend/COMPILATION_OPTIMIZATION.md

@@ -0,0 +1,97 @@
+# Backend Compilation Optimization
+
+## Summary
+
+Feature-gated heavy dependencies that were compiled by default but only used behind enterprise/EE feature flags. This reduces the default build from **761 crates to 609 crates** (20% reduction).
+
+## Changes
+
+### Root `Cargo.toml`
+- Removed 12 unused direct dependencies: `kube`, `k8s-openapi`, `aws-sigv4`, `aws-sdk-config`, `opentelemetry-proto`, `systemstat`, `globset`, `libloading`, `bitflags`, `memchr`, `quote`, `pep440_rs`
+
+### `windmill-worker/Cargo.toml`
+- Made optional (only needed for EE OTEL tracing proxy): `hudsucker`, `hyper-http-proxy`, `hyper-tls`, `hyper-util`, `rcgen`, `opentelemetry-proto`, `prost`
+- Made optional (only needed for EE features): `aws-config`, `aws-credential-types`, `aws-smithy-types`
+- Created `otel_proxy` feature to group the OTEL proxy deps
+- Updated `private` feature to include `otel_proxy`
+
+### `windmill-common/Cargo.toml`
+- Made optional: `aws-config`, `aws-credential-types`, `aws-smithy-types`, `systemstat`, `globset`
+- Added AWS deps to `private`, `parquet`, `aws_auth`, `bedrock` features
+- Added `systemstat` to `private` feature
+- Added `globset` to `parquet` feature
+
+### `windmill-api/Cargo.toml`
+- Made optional: `aws-sigv4`, `aws-sdk-config`, `aws-credential-types`, `aws-smithy-types`, `windmill-parser-py-imports`, `windmill-autoscaling`
+- Added AWS deps to `parquet` and `bedrock` features
+- Added `windmill-parser-py-imports` to `python` and `agent_worker_server` features
+- Added `windmill-autoscaling` to `enterprise` feature
+
+### `windmill-autoscaling/Cargo.toml`
+- Made optional: `kube`, `k8s-openapi` (only used in EE code)
+- Added to `private` feature
+
+### `parsers/windmill-parser-py-imports/Cargo.toml`
+- Removed unused direct dependencies: `malachite`, `malachite-bigint` (still available transitively via `rustpython-parser`)
+
+## Benchmarks
+
+### Default build (no features)
+
+| Metric | Before | After |
+|---|---|---|
+| Crates compiled | 761 | 609 |
+| Notable deps eliminated | - | aws-sdk-config (9.5s), k8s-openapi (7.3s), zstd-sys (7.7s), kube-client (1.9s) |
+
+### Incremental compilation (stable-state, warm cache)
+
+| Scenario | Before | After |
+|---|---|---|
+| Touch `windmill-api/src/users.rs` | ~5.6s | ~5.4s |
+| Touch `windmill-worker/src/worker.rs` | ~6.7s | ~6.2s |
+| Touch `windmill-common/src/worker.rs` (cascade) | ~8.5s | ~8.5s |
+
+Incremental compilation improvement from feature-gating alone is modest because the bottleneck is the compilation of the windmill crates themselves (especially windmill-api at 90k LOC), not the dependencies.
+
+## Developer-Local Speed Tips
+
+These settings are **not committed** because they are developer-local preferences that depend on toolchain availability. Combined, they yield ~16% faster incremental compilation.
+
+### mold linker (~6% improvement)
+
+Install `mold` and add to `.cargo/config.toml`:
+
+```toml
+[target.x86_64-unknown-linux-gnu]
+linker = "clang"
+rustflags = ["-C", "link-arg=-fuse-ld=mold"]
+```
+
+### Reduced debug info (~10% improvement)
+
+Add to `[profile.dev]` in `Cargo.toml`:
+
+```toml
+split-debuginfo = "unpacked"
+debug = "line-tables-only"
+```
+
+### SQLX offline mode (~4% improvement)
+
+If you're not modifying SQL queries:
+
+```bash
+export SQLX_OFFLINE=true
+```
+
+### Combined effect
+
+| Scenario | Baseline | With all tips |
+|---|---|---|
+| Touch `windmill-api` file | 5.6s | **4.7s** |
+| Touch `windmill-worker` file | 6.7s | **6.0s** |
+| Touch `windmill-common` file (cascade) | 8.5s | **7.6s** |
+
+## What would help more (future work)
+
+The single biggest improvement would be **splitting `windmill-api`** (90k LOC) into smaller crates. Currently, any file change in the crate triggers re-analysis of all 90k lines. However, this requires significant refactoring due to tight coupling between the triggers subsystem, jobs, users, and the axum router initialization.

backend/Cargo.lock

@@ -234,9 +234,9 @@ dependencies = [
 
 [[package]]
 name = "arc-swap"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d03449bb8ca2cc2ef70869af31463d1ae5ccc8fa3e334b307203fbf815207e"
+checksum = "9ded5f9a03ac8f24d1b8a25101ee812cd32cdc8c50a4c50237de2c4915850e73"
 dependencies = [
  "rustversion",
 ]
@@ -490,7 +490,7 @@ dependencies = [
  "memchr",
  "num",
  "regex",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
@@ -828,7 +828,7 @@ dependencies = [
  "aws-sdk-ssooidc",
  "aws-sdk-sts",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -890,7 +890,7 @@ dependencies = [
  "aws-sigv4",
  "aws-smithy-async",
  "aws-smithy-eventstream",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
@@ -914,7 +914,7 @@ dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-observability",
  "aws-smithy-runtime",
@@ -939,7 +939,7 @@ dependencies = [
  "aws-sigv4",
  "aws-smithy-async",
  "aws-smithy-eventstream",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-observability",
  "aws-smithy-runtime",
@@ -963,7 +963,7 @@ dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -987,7 +987,7 @@ dependencies = [
  "aws-runtime",
  "aws-sigv4",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-observability",
  "aws-smithy-query",
@@ -1012,7 +1012,7 @@ dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -1034,7 +1034,7 @@ dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -1056,7 +1056,7 @@ dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-runtime",
  "aws-smithy-runtime-api",
@@ -1078,7 +1078,7 @@ dependencies = [
  "aws-credential-types",
  "aws-runtime",
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-json",
  "aws-smithy-query",
  "aws-smithy-runtime",
@@ -1100,7 +1100,7 @@ checksum = "69e523e1c4e8e7e8ff219d732988e22bfeae8a1cafdbe6d9eca1546fa080be7c"
 dependencies = [
  "aws-credential-types",
  "aws-smithy-eventstream",
- "aws-smithy-http",
+ "aws-smithy-http 0.62.6",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
@@ -1117,9 +1117,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-async"
-version = "1.2.8"
+version = "1.2.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9330762ee48c6cecfad2cb37b1506c16c8e858c90638eda2b1a7272b56f88bd5"
+checksum = "52eec3db979d18cb807fc1070961cc51d87d069abe9ab57917769687368a8c6c"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -1128,9 +1128,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.60.15"
+version = "0.60.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0810b22ae554f5076c3eabe1fe89b01aee61c354c575789f67e248e83c5f472b"
+checksum = "35b9c7354a3b13c66f60fe4616d6d1969c9fd36b1b5333a5dfb3ee716b33c588"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -1160,10 +1160,31 @@ dependencies = [
 ]
 
 [[package]]
-name = "aws-smithy-http-client"
-version = "1.1.6"
+name = "aws-smithy-http"
+version = "0.63.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec918f18147cec121cb142a91b0038f66d99bbe903e585dccf871920e90b22ab"
+checksum = "630e67f2a31094ffa51b210ae030855cb8f3b7ee1329bdd8d085aaf61e8b97fc"
+dependencies = [
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "futures-util",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "percent-encoding",
+ "pin-project-lite",
+ "pin-utils",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-http-client"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12fb0abf49ff0cab20fd31ac1215ed7ce0ea92286ba09e2854b42ba5cabe7525"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -1200,18 +1221,18 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-observability"
-version = "0.2.1"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a700a7702874cd78b85fecdc9f64f3f72eb22fb713791cb445bcfd2a15bc1ecf"
+checksum = "c0a46543fbc94621080b3cf553eb4cbbdc41dd9780a30c4756400f0139440a1d"
 dependencies = [
  "aws-smithy-runtime-api",
 ]
 
 [[package]]
 name = "aws-smithy-query"
-version = "0.60.10"
+version = "0.60.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adc4a6cdc289a37be7fddb7f4365448187d62c603a40e6d46d13c68e5e81900f"
+checksum = "0cebbddb6f3a5bd81553643e9c7daf3cc3dc5b0b5f398ac668630e8a84e6fff0"
 dependencies = [
  "aws-smithy-types",
  "urlencoding",
@@ -1219,12 +1240,12 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.9.8"
+version = "1.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb5b6167fcdf47399024e81ac08e795180c576a20e4d4ce67949f9a88ae37dc1"
+checksum = "f3df87c14f0127a0d77eb261c3bc45d5b4833e2a1f63583ebfb728e4852134ee"
 dependencies = [
  "aws-smithy-async",
- "aws-smithy-http",
+ "aws-smithy-http 0.63.3",
  "aws-smithy-http-client",
  "aws-smithy-observability",
  "aws-smithy-runtime-api",
@@ -1235,6 +1256,7 @@ dependencies = [
  "http 1.4.0",
  "http-body 0.4.6",
  "http-body 1.0.1",
+ "http-body-util",
  "pin-project-lite",
  "pin-utils",
  "tokio",
@@ -1243,9 +1265,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.11.0"
+version = "1.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c47b1e62accf759b01aba295e40479d1ba8fb77c2a54f0fed861c809ca49761"
+checksum = "49952c52f7eebb72ce2a754d3866cc0f87b97d2a46146b79f80f3a93fb2b3716"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-types",
@@ -1260,9 +1282,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.4.0"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2d447863bdec38c899e5753a48c0abcf590f3ec629e257ad5a9ef8806ad7714"
+checksum = "3b3a26048eeab0ddeba4b4f9d51654c79af8c3b32357dc5f336cee85ab331c33"
 dependencies = [
  "base64-simd 0.8.0",
  "bytes",
@@ -1286,9 +1308,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types-convert"
-version = "0.60.11"
+version = "0.60.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b70bc27e41d5ed80b376602ff4becdab6ea8489403fad3abbfea2c9c825c1e1e"
+checksum = "059deaa8583331f9f610b44c7cbc005d0cccec6dec3a7b387de096dbe6c06b8a"
 dependencies = [
  "aws-smithy-types",
  "chrono",
@@ -1842,7 +1864,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0686c856aa6aac0c4498f936d7d6a02df690f614c03e4d906d1018062b5c5e2c"
 dependencies = [
  "once_cell",
- "proc-macro-crate",
+ "proc-macro-crate 3.4.0",
  "proc-macro2",
  "quote",
  "syn 2.0.114",
@@ -1947,7 +1969,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c6d47a4e2961fb8721bcfc54feae6455f2f64e7054f9bc67e875f0e77f4c58d"
 dependencies = [
  "rust_decimal",
- "schemars 1.2.0",
+ "schemars 1.2.1",
  "serde",
  "utf8-width",
 ]
@@ -1976,9 +1998,9 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.24.0"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fbdf580320f38b612e485521afda1ee26d10cc9884efaaa750d383e13e3c5f4"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 dependencies = [
  "bytemuck_derive",
 ]
@@ -2002,9 +2024,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 dependencies = [
  "serde",
 ]
@@ -2150,9 +2172,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.54"
+version = "1.2.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6354c81bbfd62d9cfa9cb3c773c2b7b2a3a482d569de977fd0e961f6e7c00583"
+checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -2265,9 +2287,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.55"
+version = "4.5.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e34525d5bbbd55da2bb745d34b36121baac88d07619a9a09cfcf4a6c0832785"
+checksum = "6899ea499e3fb9305a65d5ebf6e3d2248c5fab291f300ad0a704fbe142eae31a"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -2275,9 +2297,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.55"
+version = "4.5.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59a20016a20a3da95bef50ec7238dbd09baeef4311dcdd38ec15aba69812fb61"
+checksum = "7b12c8b680195a62a8364d16b8447b01b6c2c8f9aaf68bee653be34d4245e238"
 dependencies = [
  "anstream",
  "anstyle",
@@ -3449,7 +3471,7 @@ dependencies = [
  "log",
  "recursive",
  "regex",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
@@ -5456,7 +5478,7 @@ checksum = "6e24cb5a94bcae1e5408b0effca5cd7172ea3c5755049c5f3af4cd283a165298"
 dependencies = [
  "bit-set 0.8.0",
  "regex-automata",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
@@ -5467,7 +5489,7 @@ checksum = "72cf461f865c862bb7dc573f643dd6a2b6842f7c30b07882b56bd148cc2761b8"
 dependencies = [
  "bit-set 0.8.0",
  "regex-automata",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
@@ -5566,9 +5588,9 @@ dependencies = [
 
 [[package]]
 name = "find-msvc-tools"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8591b0bcc8a98a64310a2fae1bb3e9b8564dd10e381e6e28010fde8e8e8568db"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
 
 [[package]]
 name = "fixedbitset"
@@ -5588,9 +5610,9 @@ dependencies = [
 
 [[package]]
 name = "flate2"
-version = "1.1.8"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b375d6465b98090a5f25b1c7703f3859783755aa9a80433b36e0379a3ec2f369"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "libz-sys",
@@ -5609,9 +5631,9 @@ dependencies = [
 
 [[package]]
 name = "float8"
-version = "0.6.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f463a8a37ede13dac13316d1a1eeafa992300906a0c4c7fa1177f366d10bcbf"
+checksum = "719a903cc23e4a89e87962c2a80fdb45cdaad0983a89bd150bb57b4c8571a7d5"
 dependencies = [
  "half",
  "num-traits",
@@ -6161,7 +6183,7 @@ dependencies = [
  "bstr",
  "log",
  "regex-automata",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
@@ -6986,14 +7008,13 @@ dependencies = [
 
 [[package]]
 name = "hyper-util"
-version = "0.1.19"
+version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "727805d60e7938b76b826a6ef209eb70eaa1812794f9424d4a4e2d740662df5f"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures-channel",
- "futures-core",
  "futures-util",
  "http 1.4.0",
  "http-body 1.0.1",
@@ -8550,7 +8571,7 @@ dependencies = [
  "darling 0.20.11",
  "heck 0.5.0",
  "num-bigint",
- "proc-macro-crate",
+ "proc-macro-crate 3.4.0",
  "proc-macro-error2",
  "proc-macro2",
  "quote",
@@ -9119,7 +9140,7 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff32365de1b6743cb203b710788263c44a03de03802daf96092f2da4fe6ba4d7"
 dependencies = [
- "proc-macro-crate",
+ "proc-macro-crate 3.4.0",
  "proc-macro2",
  "quote",
  "syn 2.0.114",
@@ -10054,9 +10075,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f89776e4d69bb58bc6993e99ffa1d11f228b839984854c7daeb5d37f87cbe950"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postgres-native-tls"
@@ -10192,6 +10213,16 @@ dependencies = [
  "elliptic-curve",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
 [[package]]
 name = "proc-macro-crate"
 version = "3.4.0"
@@ -10856,32 +10887,32 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.2"
+version = "1.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843bc0191f75f3e22651ae5f1e72939ab2f72a4bc30fa80a066bd66edefc24d4"
+checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-automata",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
 ]
 
 [[package]]
 name = "regex-lite"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d942b98df5e658f56f20d592c7f868833fe38115e65c33003d8cd224b0155da"
+checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
 
 [[package]]
 name = "regex-syntax"
@@ -10891,9 +10922,15 @@ checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
+
+[[package]]
+name = "relative-path"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
 
 [[package]]
 name = "rend"
@@ -11146,7 +11183,7 @@ dependencies = [
  "rand 0.9.0",
  "reqwest 0.12.28",
  "rmcp-macros",
- "schemars 1.2.0",
+ "schemars 1.2.1",
  "serde",
  "serde_json",
  "sse-stream",
@@ -11185,6 +11222,53 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "rquickjs"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d16661bff09e9ed8e01094a188b463de45ec0693ade55b92ed54027d7ba7c40c"
+dependencies = [
+ "rquickjs-core",
+ "rquickjs-macro",
+]
+
+[[package]]
+name = "rquickjs-core"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c8db6379e204ef84c0811e90e7cc3e3e4d7688701db68a00d14a6db6849087b"
+dependencies = [
+ "async-lock",
+ "relative-path",
+ "rquickjs-sys",
+]
+
+[[package]]
+name = "rquickjs-macro"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6041104330c019fcd936026ae05e2446f5e8a2abef329d924f25424b7052a2f3"
+dependencies = [
+ "convert_case 0.6.0",
+ "fnv",
+ "ident_case",
+ "indexmap 2.11.1",
+ "proc-macro-crate 1.3.1",
+ "proc-macro2",
+ "quote",
+ "rquickjs-core",
+ "syn 2.0.114",
+]
+
+[[package]]
+name = "rquickjs-sys"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bc352c6b663604c3c186c000cfcc6c271f4b50bc135a285dd6d4f2a42f9790a"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "rsa"
 version = "0.9.10"
@@ -11755,14 +11839,14 @@ dependencies = [
 
 [[package]]
 name = "schemars"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54e910108742c57a770f492731f99be216a52fadd361b06c8fb59d74ccc267d2"
+checksum = "a2b42f36aa1cd011945615b92222f6bf73c599a102a300334cd7f8dbeec726cc"
 dependencies = [
  "chrono",
  "dyn-clone",
  "ref-cast",
- "schemars_derive 1.2.0",
+ "schemars_derive 1.2.1",
  "serde",
  "serde_json",
 ]
@@ -11781,9 +11865,9 @@ dependencies = [
 
 [[package]]
 name = "schemars_derive"
-version = "1.2.0"
+version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4908ad288c5035a8eb12cfdf0d49270def0a268ee162b75eeee0f85d155a7c45"
+checksum = "7d115b50f4aaeea07e79c1912f645c7513d81715d0420f8bc77a18c6260b307f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -12090,7 +12174,7 @@ dependencies = [
  "indexmap 1.9.3",
  "indexmap 2.11.1",
  "schemars 0.9.0",
- "schemars 1.2.0",
+ "schemars 1.2.1",
  "serde",
  "serde_derive",
  "serde_json",
@@ -12336,9 +12420,9 @@ dependencies = [
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "slotmap"
@@ -13383,9 +13467,9 @@ dependencies = [
 
 [[package]]
 name = "system-configuration"
-version = "0.6.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
  "bitflags 2.9.4",
  "core-foundation 0.9.4",
@@ -13515,7 +13599,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d60769b80ad7953d8a7b2c70cdfe722bbcdcac6bccc8ac934c40c034d866fc18"
 dependencies = [
  "byteorder",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
  "utf8-ranges",
 ]
 
@@ -14448,7 +14532,7 @@ checksum = "0203df02a3b6dd63575cc1d6e609edc2181c9a11867a271b25cfd2abff3ec5ca"
 dependencies = [
  "cc",
  "regex",
- "regex-syntax 0.8.8",
+ "regex-syntax 0.8.9",
  "tree-sitter-language",
 ]
 
@@ -14474,9 +14558,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter-language"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ae62f7eae5eb549c71b76658648b72cc6111f2d87d24a1e31fa907f4943e3ce"
+checksum = "009994f150cc0cd50ff54917d5bc8bffe8cad10ca10d81c34da2ec421ae61782"
 
 [[package]]
 name = "tree-sitter-ruby"
@@ -15403,14 +15487,11 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "windmill"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
- "aws-sdk-config",
- "aws-sigv4",
  "axum 0.7.9",
  "base64 0.22.1",
- "bitflags 2.9.4",
  "chrono",
  "constant_time_eq 0.3.1",
  "deno_core",
@@ -15418,18 +15499,10 @@ dependencies = [
  "futures",
  "gethostname",
  "git-version",
- "globset",
- "k8s-openapi",
- "kube",
  "lazy_static",
- "libloading 0.8.9",
- "memchr",
  "object_store",
  "once_cell",
- "opentelemetry-proto 0.29.0",
- "pep440_rs",
  "prometheus",
- "quote",
  "rand 0.9.0",
  "reqwest 0.13.1",
  "rustls 0.23.35",
@@ -15442,7 +15515,7 @@ dependencies = [
  "sql-builder",
  "sqlx",
  "strum 0.27.2",
- "systemstat",
+ "tempfile",
  "tikv-jemalloc-ctl",
  "tikv-jemalloc-sys",
  "tikv-jemallocator",
@@ -15466,7 +15539,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "argon2",
@@ -15589,6 +15662,7 @@ dependencies = [
  "windmill-parser",
  "windmill-parser-py",
  "windmill-parser-py-imports",
+ "windmill-parser-sql",
  "windmill-parser-ts",
  "windmill-queue",
  "windmill-worker",
@@ -15596,7 +15670,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-api-client"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "reqwest 0.12.28",
  "serde",
@@ -15606,7 +15680,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-audit"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "chrono",
  "lazy_static",
@@ -15620,7 +15694,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-autoscaling"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "axum 0.7.9",
@@ -15639,7 +15713,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-common"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -15735,7 +15809,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-git-sync"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "regex",
  "serde",
@@ -15750,7 +15824,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-indexer"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "astral-tokio-tar",
@@ -15774,7 +15848,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-macros"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "itertools 0.14.0",
  "lazy_static",
@@ -15790,7 +15864,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-mcp"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -15810,7 +15884,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-oauth"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "async-oauth2",
@@ -15834,7 +15908,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "convert_case 0.6.0",
  "serde",
@@ -15843,7 +15917,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-bash"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15855,7 +15929,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-csharp"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15867,7 +15941,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-go"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "gosyn",
@@ -15879,7 +15953,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-graphql"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15891,7 +15965,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-java"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "serde_json",
@@ -15903,7 +15977,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-nu"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "nu-parser",
@@ -15914,7 +15988,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-php"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15925,7 +15999,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "itertools 0.14.0",
@@ -15938,14 +16012,12 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-py-imports"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "async-recursion",
  "itertools 0.14.0",
  "lazy_static",
- "malachite",
- "malachite-bigint",
  "pep440_rs",
  "phf 0.11.3",
  "regex",
@@ -15962,7 +16034,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ruby"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -15976,7 +16048,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-rust"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "convert_case 0.6.0",
@@ -15993,7 +16065,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-sql"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16007,7 +16079,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-ts"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "lazy_static",
@@ -16026,7 +16098,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-parser-yaml"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -16037,7 +16109,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-queue"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "async-recursion",
@@ -16074,7 +16146,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-sql-datatype-parser-wasm"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-test",
@@ -16084,7 +16156,7 @@ dependencies = [
 
 [[package]]
 name = "windmill-worker"
-version = "1.620.1"
+version = "1.624.0"
 dependencies = [
  "anyhow",
  "async-once-cell",
@@ -16156,6 +16228,7 @@ dependencies = [
  "regex",
  "reqwest 0.13.1",
  "reqwest-middleware",
+ "rquickjs",
  "rust_decimal",
  "rustls-pemfile 2.2.0",
  "serde",
@@ -16984,18 +17057,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.35"
+version = "0.8.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdea86ddd5568519879b8187e1cf04e24fce28f7fe046ceecbce472ff19a2572"
+checksum = "57cf3aa6855b23711ee9852dfc97dfaa51c45feaba5b645d0c777414d494a961"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.35"
+version = "0.8.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c15e1b46eff7c6c91195752e0eeed8ef040e391cdece7c25376957d5f15df22"
+checksum = "8a616990af1a287837c4fe6596ad77ef57948f787e46ce28e166facc0cc1cb75"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -17090,9 +17163,9 @@ dependencies = [
 
 [[package]]
 name = "zlib-rs"
-version = "0.5.5"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40990edd51aae2c2b6907af74ffb635029d5788228222c4bb811e9351c0caad3"
+checksum = "a7948af682ccbc3342b6e9420e8c51c1fe5d7bf7756002b4a3c6cabfe96a7e3c"
 
 [[package]]
 name = "zstd"

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.620.1"
+version = "1.624.0"
 authors.workspace = true
 edition.workspace = true
 
@@ -35,7 +35,7 @@ members = [
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.620.1"
+version = "1.624.0"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -68,6 +68,7 @@ jemalloc = ["windmill-common/jemalloc", "dep:tikv-jemallocator", "dep:tikv-jemal
 tantivy = ["dep:windmill-indexer", "windmill-api/tantivy", "windmill-indexer/enterprise", "windmill-indexer/parquet", "windmill-common/tantivy", "enterprise", "parquet"]
 sqlx = ["windmill-worker/sqlx"]
 deno_core = ["windmill-worker/deno_core", "windmill-api/deno_core", "dep:deno_core", "dep:v8"]
+quickjs = ["windmill-worker/quickjs"]
 deno_core_mac = ["deno_core", "windmill-worker/libffi_mac"]
 kafka = ["windmill-api/kafka"]
 nats = ["windmill-api/nats"]
@@ -89,6 +90,7 @@ zip = ["windmill-api/zip"]
 static_frontend = ["windmill-api/static_frontend"]
 scoped_cache = ["windmill-common/scoped_cache"]
 test_job_debouncing = []
+private_registry_test = []
 # Languages
 python = ["windmill-worker/python", "windmill-api/python"]
 rust = ["windmill-worker/rust"]
@@ -148,21 +150,13 @@ deno_core = { workspace = true, optional = true }
 object_store = { workspace = true, optional = true }
 sha1 = { workspace = true, optional = true }
 constant_time_eq = { workspace = true, optional = true }
-quote.workspace = true
-memchr.workspace = true
+
+
 v8 = { workspace = true, optional = true }
 rustls.workspace = true
-pep440_rs.workspace = true
 strum.workspace = true
-aws-sigv4.workspace = true
-aws-sdk-config.workspace = true
-kube.workspace = true
-k8s-openapi.workspace = true
-libloading.workspace = true
-bitflags.workspace = true
-globset.workspace = true
-opentelemetry-proto.workspace = true
-systemstat.workspace = true
+
+
 
 [target.'cfg(windows)'.dependencies]
 windows-service = "0.7"
@@ -181,6 +175,7 @@ axum.workspace = true
 serde.workspace = true
 windmill-api-client.workspace = true
 deno_core = { workspace = true, features = ["include_js_files_for_snapshotting", "unsafe_use_unprotected_platform"] }
+tempfile.workspace = true
 
 
 [workspace.dependencies]
@@ -391,8 +386,11 @@ nu-parser = { version = "0.101.0", default-features = false }
 globset = "0.4.16"
 croner = "2.2.0"
 rmcp = { version = "^0", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
+rquickjs = { version = "0.8", features = ["futures", "parallel", "macro"] }
 process-wrap = { version = "8.2.1", features = ["tokio1"] }
 
+systemstat = "0.2.4"
+
 datafusion = "47.0.0"
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7", features = ["aws", "azure", "gcp"] }
 openidconnect = { version = "4.0.0-rc.1" }
@@ -407,7 +405,6 @@ aws-sdk-sso = "=1.77.0"
 aws-sdk-ssooidc = "=1.78.0"
 rustls = "=0.23.35"
 async-once-cell = "0.5.4"
-systemstat = "0.2.4"
 size = "0.5.0"
 
 aws-smithy-types-convert = { version = "^0", features = ["convert-chrono"] }

backend/QUICKJS_MIGRATION_ANALYSIS.md

@@ -0,0 +1,370 @@
+# QuickJS Migration - Potential Breaking Changes Analysis
+
+## Summary
+
+This document details the comprehensive investigation into potential breaking changes when migrating flow expressions from Deno Core (V8) to QuickJS.
+
+## 1. Areas Already Tested (60+ Parity Tests)
+
+The following areas have comprehensive parity tests in `js_eval_parity_tests.rs`:
+
+- **Arithmetic operations**: +, -, *, /, %, **
+- **Comparison operators**: ===, !==, >, <, >=, <=, ==, !=
+- **Logical operators**: &&, ||, !, ??, ?.
+- **Bitwise operators**: &, |, ^, ~, <<, >>, >>>
+- **Object operations**: property access, spread, destructuring, Object.keys/values/entries
+- **Array operations**: map, filter, reduce, find, some, every, slice, flat, etc.
+- **String operations**: split, replace, includes, startsWith, trim, etc.
+- **Template literals**: ${} interpolation
+- **Optional chaining**: ?. for properties, methods, computed properties
+- **Nullish coalescing**: ??
+- **Try-catch blocks**
+- **Arrow functions**
+- **Destructuring**
+- **Date operations** (with fixed dates)
+- **JSON.parse/stringify**
+- **Math functions**
+- **Set and Map operations**
+- **Regular expressions** (basic patterns)
+- **flow_input, flow_env, previous_result access**
+- **Error extraction logic** (from parallel results)
+
+## 2. Potential Breaking Changes Identified
+
+### 2.1 Number Handling Edge Cases (MEDIUM RISK)
+
+**Implementation Difference:**
+```rust
+// QuickJS json_to_js:
+if i >= i32::MIN as i64 && i <= i32::MAX as i64 {
+    Ok(Value::new_int(ctx.clone(), i as i32))
+} else {
+    Ok(Value::new_float(ctx.clone(), i as f64))
+}
+```
+
+**Potential Issues:**
+- Numbers outside i32 range (-2147483648 to 2147483647) are stored as floats
+- Large integers (between i32::MAX and 2^53) might lose precision
+- **Timestamps** (e.g., 1704067200000) are typically in this range
+
+**Test Case Needed:**
+```javascript
+// Numbers just above i32::MAX
+2147483648 + 1  // i32::MAX + 2
+9007199254740991 - 1  // Near MAX_SAFE_INTEGER
+```
+
+### 2.2 Object Property Order (LOW RISK)
+
+**Implementation Difference:**
+- QuickJS: `obj.props::<String, Value>()` iteration order
+- V8: Guaranteed insertion order for string keys
+
+**Potential Impact:**
+- `Object.keys()`, `Object.values()`, `Object.entries()` order might differ
+- Object spread `{...obj}` order might differ
+
+**Mitigated by:**
+- JSON comparison in tests normalizes order
+- Most flow expressions don't depend on property order
+
+### 2.3 Missing Browser/Deno APIs (MEDIUM RISK)
+
+**APIs NOT available in QuickJS:**
+- `atob()` / `btoa()` - Base64 encoding/decoding
+- `TextEncoder` / `TextDecoder`
+- `fetch()` (not relevant for expressions)
+- `Blob`, `ArrayBuffer` (limited support)
+- `Intl.*` - Internationalization APIs
+- `console.log()` - No effect (not breaking, just no output)
+
+**Expressions that would break:**
+```javascript
+atob("SGVsbG8=")  // Would throw: atob is not defined
+btoa("Hello")     // Would throw: btoa is not defined
+new TextEncoder().encode("test")  // Would throw
+"test".toLocaleUpperCase('tr-TR') // Might behave differently
+```
+
+### 2.4 Regular Expression Differences (LOW RISK)
+
+**QuickJS RegExp limitations:**
+- No `d` flag (indices)
+- No lookbehind assertions `(?<=...)` and `(?<!...)`
+- No named capture groups `(?<name>...)`
+
+**Expressions that might break:**
+```javascript
+"test123".match(/(?<=test)\d+/)  // Lookbehind not supported
+/(?<name>\w+)/.exec("test")?.groups?.name  // Named groups not supported
+```
+
+### 2.5 Prototype Method Availability (LOW RISK)
+
+**Methods that might differ:**
+- `Array.prototype.at()` - ES2022
+- `String.prototype.at()` - ES2022
+- `Object.hasOwn()` - ES2022
+- `String.prototype.replaceAll()` - ES2021
+
+**Test Case:**
+```javascript
+[1,2,3].at(-1)  // Might not exist
+"hello".at(-1)  // Might not exist
+```
+
+### 2.6 NaN/Infinity/Special Values (LOW RISK)
+
+**Implementation:**
+```rust
+// QuickJS js_to_json:
+if let Some(n) = serde_json::Number::from_f64(f) {
+    return Ok(serde_json::Value::Number(n));
+} else {
+    return Ok(serde_json::Value::Null);  // NaN, Infinity -> null
+}
+```
+
+Both engines convert NaN/Infinity to null in JSON, so this is consistent.
+
+### 2.7 Fallback for Unsupported Types (LOW RISK)
+
+**QuickJS fallback:**
+```rust
+// Fallback
+Ok(serde_json::Value::String("[object]".to_string()))
+```
+
+Types that would trigger this:
+- Symbol
+- WeakMap/WeakRef
+- Generator objects
+- Custom objects with non-enumerable properties only
+
+### 2.8 Date Object Timezone Handling (MEDIUM RISK)
+
+**Potential Issue:**
+- `new Date()` without arguments uses system time
+- Timezone-dependent methods might vary
+
+**Safe patterns (already tested):**
+```javascript
+new Date('2024-01-15T00:00:00.000Z').getUTCFullYear()  // OK - UTC methods
+Date.parse('2024-01-15T00:00:00.000Z')  // OK - explicit timezone
+```
+
+**Risky patterns:**
+```javascript
+new Date().toLocaleDateString()  // Timezone dependent
+new Date().getHours()  // Timezone dependent
+```
+
+## 3. Edge Cases NOT Currently Tested
+
+### 3.1 Very Large Numbers
+```javascript
+9007199254740991  // MAX_SAFE_INTEGER
+9007199254740992  // MAX_SAFE_INTEGER + 1 (loses precision)
+2147483648        // i32::MAX + 1
+```
+
+### 3.2 Negative Zero
+```javascript
+-0 === 0  // true
+Object.is(-0, 0)  // false
+1/-0  // -Infinity
+```
+
+### 3.3 Sparse Arrays
+```javascript
+const arr = [1, , 3]  // Hole at index 1
+arr.map(x => x * 2)  // Holes might be handled differently
+arr.filter(x => true)  // Holes might be skipped or preserved
+```
+
+### 3.4 Unicode Edge Cases
+```javascript
+"🎉".length  // 2 (surrogate pairs)
+"🎉".split('')  // Might differ
+[..."🎉"]  // Might differ
+"café" === "café"  // NFC vs NFD normalization
+```
+
+### 3.5 Prototype Chain
+```javascript
+const obj = Object.create({ inherited: 1 });
+obj.own = 2;
+Object.keys(obj)  // Should only return ['own']
+```
+
+### 3.6 Getter/Setter Properties
+```javascript
+const obj = {
+  get prop() { return 42; },
+  set prop(v) { }
+};
+obj.prop  // Should return 42
+```
+
+### 3.7 Circular References
+```javascript
+const obj = { a: 1 };
+obj.self = obj;
+JSON.stringify(obj)  // Should throw in both
+```
+
+### 3.8 Array-like Objects
+```javascript
+const arrayLike = { 0: 'a', 1: 'b', length: 2 };
+Array.from(arrayLike)  // Should work in both
+```
+
+## 4. Recommended Additional Tests
+
+### High Priority (Add to parity tests):
+1. Large integers (i32 boundary, MAX_SAFE_INTEGER boundary)
+2. `Array.prototype.at()` and `String.prototype.at()`
+3. Sparse arrays with holes
+4. Emoji/surrogate pair handling
+5. Object property order verification
+
+### Medium Priority:
+1. Getter/setter access
+2. Prototype chain behavior
+3. Array-like object conversion
+4. Error message format differences
+
+### Low Priority (Unlikely to be used in expressions):
+1. WeakMap/WeakSet
+2. Generators
+3. Symbols
+4. Proxy edge cases
+
+## 5. Known Safe Patterns
+
+These patterns are safe to use and have been verified:
+- All arithmetic and comparison operators
+- All standard array methods (map, filter, reduce, etc.)
+- All standard string methods
+- Object spread and destructuring
+- Optional chaining and nullish coalescing
+- Template literals
+- Arrow functions
+- Try-catch blocks
+- `flow_input`, `flow_env`, `previous_result`, `results` access
+- JSON operations
+- Date operations with UTC methods
+- Regular expressions (basic patterns without lookbehind)
+
+## 6. Test Coverage Summary
+
+### Unit Parity Tests (114 tests in js_eval_parity_tests.rs)
+- Basic arithmetic, comparison, logical, and bitwise operators
+- Object operations: property access, spread, destructuring
+- Array operations: map, filter, reduce, find, some, every, slice, flat, etc.
+- String operations: all standard methods
+- Template literals with complex expressions
+- Optional chaining and nullish coalescing
+- Set and Map operations
+- JSON parse/stringify
+- Date operations with UTC methods
+- Error handling with try-catch
+- Large integer handling (i32 boundaries, timestamps, MAX_SAFE_INTEGER)
+- Unicode and special characters
+- Type coercion
+
+### Flow Engine Parity Tests (19 tests in flow_engine_parity.rs)
+All tests pass with both Deno Core and QuickJS:
+
+1. **Linear flow with input transforms** - `results.a.property` access
+2. **For-loop with complex iterator** - `results.a.users.filter(...)`
+3. **Branch conditions** - `results.a.status === 'premium' && results.a.score >= 90`
+4. **Previous result aggregation** - `previous_result.value`, `results.a.value + results.b.value`
+5. **Nested complexity** - Deep result access across loop iterations
+6. **Parallel for-loops** - Multiple concurrent iterations
+7. **Skip-if expressions** - Conditional step execution
+8. **Object transformations** - Complex data manipulation
+9. **Template literals** - `\`Status: ${results.a.status}\``
+10. **Optional chaining** - `results.a.user?.name`, `results.a?.missing?.value ?? 'default'`
+11. **Flow env access** - `flow_env.CONFIG.apiUrl`
+12. **Combined flow_input and flow_env**
+13. **Results optional chaining** - Deep optional chaining with results proxy
+14. **Large integers** - Timestamps, i32 boundaries through results
+15. **Unicode and emoji** - Strings with unicode through flow results
+16. **Complex array operations** - Sort, filter/map chains, reduce through results
+17. **Multiline expressions** - Multi-statement expressions with semicolons and return
+18. **Spread operators** - `{...results.a.config}`, `[...results.a.tags]`
+19. **Nested for-loop results access** - Accessing outer step results from inner loops
+
+## 7. Conclusion
+
+The QuickJS migration is **safe** for the vast majority of flow expressions. Comprehensive testing shows:
+
+- **133 total parity tests pass** (114 unit + 19 flow engine)
+- All tests pass with both Deno Core and QuickJS
+- No behavioral differences detected in production-like scenarios
+
+### ES2022+ Method Support (All SUPPORTED in both engines):
+
+Tested and verified to work identically:
+- `Array.prototype.at()` - ES2022 ✅
+- `String.prototype.at()` - ES2022 ✅
+- `Object.hasOwn()` - ES2022 ✅
+- `String.prototype.replaceAll()` - ES2021 ✅
+- `Array.prototype.findLast()` - ES2023 ✅
+- `Array.prototype.findLastIndex()` - ES2023 ✅
+- `Array.prototype.toSorted()` - ES2023 ✅
+- `Array.prototype.toReversed()` - ES2023 ✅
+- `Array.prototype.toSpliced()` - ES2023 ✅
+- `Array.prototype.with()` - ES2023 ✅
+- `Object.groupBy()` - ES2024 ✅
+
+### Regex Feature Support (All SUPPORTED in both engines):
+
+- Lookbehind assertions `(?<=...)` ✅
+- Negative lookbehind `(?<!...)` ✅
+- Named capture groups `(?<name>...)` ✅
+- `d` flag (indices) ✅
+
+### Browser API Parity (Both engines return undefined):
+
+These APIs are NOT available in either engine (consistent behavior):
+- `atob` / `btoa` - Both return `typeof === "undefined"` ✅
+- `TextEncoder` / `TextDecoder` - Both return `typeof === "undefined"` ✅
+- `URL` / `URLSearchParams` - Both return `typeof === "undefined"` ✅
+
+### BREAKING CHANGE IDENTIFIED:
+
+**Intl API** - ONLY breaking change found:
+- Deno Core: `typeof Intl === "object"` (available)
+- QuickJS: `typeof Intl === "undefined"` (NOT available)
+
+Expressions using these will FAIL with QuickJS:
+- `new Intl.NumberFormat('en-US').format(1234567.89)`
+- `new Intl.DateTimeFormat('en-US').format(new Date())`
+- `num.toLocaleString('de-DE')`
+- `date.toLocaleDateString('fr-FR')`
+
+**Mitigation**: Search production logs for `Intl` usage in flow expressions before migration.
+
+### Recommendations:
+
+1. ✅ Run the parity tests to verify current implementation (132 unit tests + 19 flow engine tests pass)
+2. ✅ Add tests for edge cases (large integers, optional chaining, spread, multiline)
+3. ✅ Test ES2022+ methods - All supported (Array.at, Object.hasOwn, etc.)
+4. ✅ Test regex features - All supported (lookbehind, named groups)
+5. ⚠️ **Search production for `Intl` usage** - Only confirmed breaking change
+6. Run `USE_QUICKJS_FOR_FLOW_EVAL=1` in staging before full production rollout
+7. Consider adding `Intl` polyfill to QuickJS if production usage is found
+
+### Commands to Run Tests:
+
+```bash
+# Run all parity tests (132 tests)
+cargo test --features deno_core,quickjs -p windmill-worker -- parity_
+
+# Run flow engine tests with both engines (19 tests)
+cargo test --features deno_core -p windmill --test flow_engine_parity
+USE_QUICKJS_FOR_FLOW_EVAL=1 cargo test --features deno_core,quickjs -p windmill --test flow_engine_parity
+```

backend/ee-repo-ref.txt

@@ -1 +1 @@
-5d841b358dd32130c9f34b54f59b96b5c322f213
+138a4f5f868f3bded5bb7cb77b222b532c07e4af

backend/migrations/20260128194102_runtime_assets.down.sql

@@ -0,0 +1,5 @@
+ALTER TABLE asset
+  DROP COLUMN IF EXISTS created_at,
+  DROP COLUMN IF EXISTS id;
+
+DELETE FROM asset WHERE usage_kind = 'job';

backend/migrations/20260128194102_runtime_assets.up.sql

@@ -0,0 +1,11 @@
+ALTER TABLE asset
+  ADD COLUMN created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+  ADD COLUMN id BIGSERIAL UNIQUE;
+DO
+$do$
+BEGIN
+  ALTER TYPE ASSET_USAGE_KIND ADD VALUE 'job';
+EXCEPTION WHEN OTHERS THEN
+  RAISE NOTICE 'Couldn''t create ASSET_USAGE_KIND::job: %', SQLERRM;
+END
+$do$;

backend/migrations/20260128194103_assets_index.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS idx_asset_job_pruning;
+DROP INDEX IF EXISTS idx_asset_workspace_created_id;

backend/migrations/20260128194103_assets_index.up.sql

@@ -0,0 +1,9 @@
+-- Postgres requires indexes to be created in a separate migration (transaction) after columns are added.
+
+-- Index for pagination queries that use workspace_id, created_at, and id for cursor pagination
+-- Supports: SELECT with GROUP BY path, kind ORDER BY MAX(created_at) DESC, MAX(id) DESC
+CREATE INDEX idx_asset_workspace_created_id ON asset (workspace_id, created_at DESC, id DESC);
+
+-- Filtered index for job pruning operations that delete old job assets
+-- Supports: DELETE queries with WHERE usage_kind = 'job' and window functions on (workspace_id, path, kind) ORDER BY created_at DESC
+CREATE INDEX idx_asset_job_pruning ON asset (workspace_id, path, kind, created_at DESC) WHERE usage_kind = 'job';

backend/migrations/20260129161851_dedicated_workers_column.down.sql

@@ -0,0 +1 @@
+ALTER TABLE worker_ping DROP COLUMN IF EXISTS dedicated_workers;

backend/migrations/20260129161851_dedicated_workers_column.up.sql

@@ -0,0 +1 @@
+ALTER TABLE worker_ping ADD COLUMN IF NOT EXISTS dedicated_workers TEXT[];

backend/migrations/20260129165755_reset_cached_workspace_diffs.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20260129165755_reset_cached_workspace_diffs.up.sql

@@ -0,0 +1,2 @@
+-- Add up migration script here
+UPDATE workspace_diff SET has_changes = NULL;

backend/migrations/20260203172950_polling_based_events.down.sql

@@ -0,0 +1,121 @@
+-- Revert to pg_notify based event system
+
+-- Restore notify_config_change function
+CREATE OR REPLACE FUNCTION notify_config_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_config_change', NEW.name::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_global_setting_change function
+CREATE OR REPLACE FUNCTION notify_global_setting_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_global_setting_change', NEW.name::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_global_setting_delete function
+CREATE OR REPLACE FUNCTION notify_global_setting_delete()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_global_setting_change', OLD.name::text);
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_webhook_change function
+CREATE OR REPLACE FUNCTION notify_webhook_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_webhook_change', NEW.workspace_id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_workspace_envs_change function
+CREATE OR REPLACE FUNCTION notify_workspace_envs_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_workspace_envs_change', NEW.workspace_id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_workspace_premium_change function
+CREATE OR REPLACE FUNCTION notify_workspace_premium_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_workspace_premium_change', NEW.id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_team_plan_status_change function
+CREATE OR REPLACE FUNCTION notify_team_plan_status_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_workspace_premium_change', NEW.workspace_id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_runnable_version_change function
+CREATE OR REPLACE FUNCTION notify_runnable_version_change()
+RETURNS TRIGGER AS $$
+DECLARE
+    source_type TEXT;
+    kind TEXT;
+BEGIN
+    source_type := TG_ARGV[0];
+
+    IF source_type = 'script' THEN
+        kind := NEW.kind;
+    ELSE
+        kind := 'flow';
+    END IF;
+
+    PERFORM pg_notify('notify_runnable_version_change', NEW.workspace_id || ':' || source_type || ':' || NEW.path || ':' || kind);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_http_trigger_change function
+CREATE OR REPLACE FUNCTION notify_http_trigger_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    PERFORM pg_notify('notify_http_trigger_change', NEW.workspace_id || ':' || NEW.path);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_token_invalidation function
+CREATE OR REPLACE FUNCTION notify_token_invalidation()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF OLD.label = 'session' AND OLD.email IS NOT NULL THEN
+        PERFORM pg_notify('notify_token_invalidation', OLD.token);
+    END IF;
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Restore notify_workspace_key_change function
+CREATE OR REPLACE FUNCTION notify_workspace_key_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF TG_OP = 'DELETE' THEN
+        PERFORM pg_notify('notify_workspace_key_change', OLD.workspace_id);
+        RETURN OLD;
+    ELSE
+        PERFORM pg_notify('notify_workspace_key_change', NEW.workspace_id);
+        RETURN NEW;
+    END IF;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Drop the notify_event table
+DROP TABLE IF EXISTS notify_event;

backend/migrations/20260203172950_polling_based_events.up.sql

@@ -0,0 +1,135 @@
+-- Create notify_event table for polling-based event system
+-- This replaces PostgreSQL LISTEN/NOTIFY with a table-based approach
+
+CREATE TABLE IF NOT EXISTS notify_event (
+    id BIGSERIAL PRIMARY KEY,
+    channel TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS notify_event_created_at_idx ON notify_event (created_at);
+
+-- Drop redundant index if it exists (id is already the PRIMARY KEY)
+DROP INDEX IF EXISTS notify_event_id_idx;
+
+-- Update notify_config_change function
+CREATE OR REPLACE FUNCTION notify_config_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_config_change', NEW.name::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_global_setting_change function
+CREATE OR REPLACE FUNCTION notify_global_setting_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_global_setting_change', NEW.name::text);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_global_setting_delete function
+CREATE OR REPLACE FUNCTION notify_global_setting_delete()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_global_setting_change', OLD.name::text);
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_webhook_change function
+CREATE OR REPLACE FUNCTION notify_webhook_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_webhook_change', NEW.workspace_id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_workspace_envs_change function
+CREATE OR REPLACE FUNCTION notify_workspace_envs_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_workspace_envs_change', COALESCE(NEW.workspace_id, OLD.workspace_id));
+    RETURN COALESCE(NEW, OLD);
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_workspace_premium_change function
+CREATE OR REPLACE FUNCTION notify_workspace_premium_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_workspace_premium_change', NEW.id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_team_plan_status_change function
+CREATE OR REPLACE FUNCTION notify_team_plan_status_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_workspace_premium_change', NEW.workspace_id);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_runnable_version_change function
+CREATE OR REPLACE FUNCTION notify_runnable_version_change()
+RETURNS TRIGGER AS $$
+DECLARE
+    source_type TEXT;
+    kind TEXT;
+BEGIN
+    source_type := TG_ARGV[0];
+
+    IF source_type = 'script' THEN
+        kind := NEW.kind;
+    ELSE
+        kind := 'flow';
+    END IF;
+
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_runnable_version_change', NEW.workspace_id || ':' || source_type || ':' || NEW.path || ':' || kind);
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_http_trigger_change function
+CREATE OR REPLACE FUNCTION notify_http_trigger_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO notify_event (channel, payload) VALUES ('notify_http_trigger_change', COALESCE(NEW.workspace_id, OLD.workspace_id) || ':' || COALESCE(NEW.path, OLD.path));
+    RETURN COALESCE(NEW, OLD);
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_token_invalidation function
+CREATE OR REPLACE FUNCTION notify_token_invalidation()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF OLD.label = 'session' AND OLD.email IS NOT NULL THEN
+        INSERT INTO notify_event (channel, payload) VALUES ('notify_token_invalidation', OLD.token);
+    END IF;
+    RETURN OLD;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Update notify_workspace_key_change function
+CREATE OR REPLACE FUNCTION notify_workspace_key_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF TG_OP = 'DELETE' THEN
+        INSERT INTO notify_event (channel, payload) VALUES ('notify_workspace_key_change', OLD.workspace_id);
+        RETURN OLD;
+    ELSE
+        INSERT INTO notify_event (channel, payload) VALUES ('notify_workspace_key_change', NEW.workspace_id);
+        RETURN NEW;
+    END IF;
+END;
+$$ LANGUAGE plpgsql;
+
+-- NOTE: var_cache_invalidation / resource_cache_invalidation triggers were
+-- intentionally dropped in migration 20250902085504. We do NOT re-create them
+-- here to keep this migration scoped to the LISTEN/NOTIFY → polling swap only.

backend/parsers/windmill-parser-py-imports/Cargo.toml

@@ -18,8 +18,6 @@ regex.workspace = true
 windmill-parser.workspace = true
 windmill-common.workspace = true
 rustpython-parser.workspace = true
-malachite.workspace = true
-malachite-bigint.workspace = true
 phf.workspace = true
 itertools.workspace = true
 serde_json.workspace = true

backend/parsers/windmill-parser-py/src/asset_parser.rs

@@ -205,30 +205,15 @@ impl AssetsFinder {
                     Some(Expr::Constant(ExprConstant { value: Constant::Str(sql), .. })) => sql,
                     _ => return Err(()),
                 };
-                let duckdb_conn_prefix = match kind {
-                    AssetKind::DataTable => "datatable",
-                    AssetKind::Ducklake => "ducklake",
-                    _ => return Ok(()),
-                };
-                let sql = format!("ATTACH '{duckdb_conn_prefix}://{path}' AS dt; USE dt; {sql}");
-
-                // We use the SQL parser to detect if it's a read or write query
-                match windmill_parser_sql::parse_assets(&sql) {
-                    Ok(mut sql_assets) => {
-                        if let Some(schema_name) = schema {
-                            for asset in &mut sql_assets.assets {
-                                if asset.kind == *kind && asset.path.starts_with(path.as_str()) {
-                                    asset.path = format!(
-                                        "{}/{}.{}",
-                                        path,
-                                        schema_name,
-                                        &asset.path[path.len() + 1..]
-                                    );
-                                }
-                            }
-                        }
-                        self.assets.extend(sql_assets.assets);
-                    }
+                // We use the SQL parser to detect RW, specific tables, etc.
+                let sql_assets = windmill_parser_sql::parse_wmill_sdk_sql_assets(
+                    *kind,
+                    path,
+                    schema.as_deref(),
+                    &sql,
+                );
+                match sql_assets {
+                    Ok(Some(sql_assets)) => self.assets.extend(sql_assets),
                     _ => {}
                 }
                 return Ok(());