generate skills in plugin skills folder

.github/workflows/backend-check.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache: false
-          toolchain: 1.93.0
+          toolchain: 1.90.0
       - name: cargo check
         working-directory: ./backend
         timeout-minutes: 16
@@ -39,12 +39,12 @@ jobs:
       - name: install xmlsec1 and gssapi
         run: |
           sudo apt-get update
-          sudo apt-get install -y libxml2-dev libxmlsec1-dev libkrb5-dev libsasl2-dev libcurl4-openssl-dev mold clang
+          sudo apt-get install -y libxml2-dev libxmlsec1-dev libkrb5-dev libsasl2-dev mold clang
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache: false
-          toolchain: 1.93.0
+          toolchain: 1.90.0
       - name: cargo check
         working-directory: ./backend
         timeout-minutes: 16
@@ -81,7 +81,7 @@ jobs:
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache: false
-          toolchain: 1.93.0
+          toolchain: 1.90.0
       - name: cargo check
         working-directory: ./backend
         timeout-minutes: 16
@@ -109,7 +109,7 @@ jobs:
       - name: install xmlsec1 and gssapi
         run: |
           sudo apt-get update
-          sudo apt-get install -y libxml2-dev libxmlsec1-dev libkrb5-dev libsasl2-dev libcurl4-openssl-dev mold clang
+          sudo apt-get install -y libxml2-dev libxmlsec1-dev libkrb5-dev libsasl2-dev mold clang
 
       - name: Substitute EE code (EE logic is behind feature flag)
         run: |
@@ -118,7 +118,7 @@ jobs:
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache-workspaces: backend
-          toolchain: 1.93.0
+          toolchain: 1.90.0
       - name: cargo check
         timeout-minutes: 16
         working-directory: ./backend

.github/workflows/backend-test.yml

@@ -72,12 +72,12 @@ jobs:
           bundler-cache: false
       - name: Install PowerShell, mold and clang
         run: |
-          sudo apt-get update && sudo apt-get install -y powershell mold clang libcurl4-openssl-dev
+          sudo apt-get update && sudo apt-get install -y powershell mold clang
         working-directory: /
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache: false
-          toolchain: 1.93.0
+          toolchain: 1.90.0
       - name: Read EE repo commit hash
         run: |
           echo "ee_repo_ref=$(cat ./ee-repo-ref.txt)" >> "$GITHUB_ENV"
@@ -222,4 +222,4 @@ jobs:
         run: |
           deno --version && bun -v && node --version && go version && python3 --version && php --version && ruby --version && pwsh --version && dotnet --version
           cd windmill-duckdb-ffi-internal && ./build_dev.sh && cd ..
-          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) PHP_PATH=$(which php) COMPOSER_PATH=$(which composer) RUBY_PATH=$(which ruby) RUBY_BUNDLE_PATH=$(which bundle) RUBY_GEM_PATH=$(which gem) POWERSHELL_PATH=$(which pwsh) DOTNET_PATH=$(which dotnet) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp --all -- --nocapture --test-threads=10
+          DENO_PATH=$(which deno) BUN_PATH=$(which bun) NODE_BIN_PATH=$(which node) GO_PATH=$(which go) UV_PATH=$(which uv) PHP_PATH=$(which php) COMPOSER_PATH=$(which composer) RUBY_PATH=$(which ruby) RUBY_BUNDLE_PATH=$(which bundle) RUBY_GEM_PATH=$(which gem) POWERSHELL_PATH=$(which pwsh) DOTNET_PATH=$(which dotnet) cargo test --features enterprise,deno_core,duckdb,license,python,rust,scoped_cache,parquet,private,private_registry_test,csharp,php,ruby,mysql,quickjs,mcp --all -- --nocapture --test-threads=16

.github/workflows/build_windows_worker_.yml

@@ -11,7 +11,7 @@ env:
 
 jobs:
   cargo_build_windows:
-    runs-on: blacksmith-16vcpu-windows-2025
+    runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -30,40 +30,33 @@ jobs:
           token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
           fetch-depth: 0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
         with:
-          cache-workspaces: backend
-          toolchain: 1.93.0
+          toolchain: 1.90.0
+          override: true
 
       - name: Substitute EE code
         shell: bash
         run: |
           ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
 
-      - name: Cargo check (fail fast on warnings)
-        timeout-minutes: 60
-        env:
-          RUSTFLAGS: "-D warnings"
-        run: |
-          mkdir frontend/build && cd backend
-          New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
-          cargo check --features=ee_windows
-
       - name: Cargo build dynamic libraries windows
-        timeout-minutes: 180
+        timeout-minutes: 90
         run: |
           cd backend/windmill-duckdb-ffi-internal
           cargo build --release -p windmill_duckdb_ffi_internal
 
       - name: Cargo build binary windows
-        timeout-minutes: 180
+        timeout-minutes: 90
         run: |
           vcpkg.exe install openssl-windows:x64-windows
           vcpkg.exe install openssl:x64-windows-static
           vcpkg.exe integrate install
           $env:VCPKGRS_DYNAMIC=1
           $env:OPENSSL_DIR="${Env:VCPKG_INSTALLATION_ROOT}\installed\x64-windows-static"
-          cd backend
+          mkdir frontend/build && cd backend
+          New-Item -Path . -Name "windmill-api/openapi-deref.yaml" -ItemType "File" -Force
           cargo build --release --features=ee_windows
       - name: Rename binary with corresponding architecture
         run: |

.github/workflows/check-org-membership.yml

@@ -4,10 +4,9 @@ on:
   workflow_call:
     inputs:
       commenter:
-        required: false
+        required: true
         type: string
-        default: ''
-        description: 'The username to check. Auto-detected from the event context if not provided.'
+        description: 'The username to check for organization membership'
       organization:
         required: false
         type: string
@@ -33,27 +32,11 @@ jobs:
     outputs:
       is_member: ${{ steps.check-membership.outputs.is_member }}
     steps:
-      - name: Determine commenter
-        id: determine-commenter
-        run: |
-          COMMENTER="${{ inputs.commenter }}"
-          if [[ -z "$COMMENTER" ]]; then
-            if [[ "${{ github.event_name }}" == "issue_comment" || \
-                  "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
-              COMMENTER="${{ github.event.comment.user.login }}"
-            elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
-              COMMENTER="${{ github.event.review.user.login }}"
-            else
-              COMMENTER="${{ github.event.issue.user.login }}"
-            fi
-          fi
-          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT
-
       - name: Check organization membership
         id: check-membership
         env:
           ORG_ACCESS_TOKEN: ${{ secrets.access_token }}
-          COMMENTER: ${{ steps.determine-commenter.outputs.commenter }}
+          COMMENTER: ${{ inputs.commenter }}
           ORG: ${{ inputs.organization }}
           TRUSTED_BOT: ${{ inputs.trusted_bot }}
         run: |

.github/workflows/claude-fast.yml

@@ -11,18 +11,40 @@ on:
     types: [submitted]
 
 jobs:
-  check-membership:
+  determine-commenter:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/ai-fast')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '/ai-fast')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '/ai-fast')) ||
       (github.event_name == 'issues' && contains(github.event.issue.body, '/ai-fast'))
+    runs-on: ubicloud-standard-2
+    outputs:
+      commenter: ${{ steps.determine-commenter.outputs.commenter }}
+    steps:
+      - name: Determine commenter
+        id: determine-commenter
+        run: |
+          # Work out who wrote the comment / review
+          if [[ "${{ github.event_name }}" == "issue_comment" || \
+                "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
+            COMMENTER="${{ github.event.comment.user.login }}"
+          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
+            COMMENTER="${{ github.event.review.user.login }}"
+          else
+            COMMENTER="${{ github.event.issue.user.login }}"
+          fi
+          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT
+
+  check-membership:
+    needs: determine-commenter
     uses: ./.github/workflows/check-org-membership.yml
+    with:
+      commenter: ${{ needs.determine-commenter.outputs.commenter }}
     secrets:
       access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
 
   claude-code-action:
-    needs: check-membership
+    needs: [determine-commenter, check-membership]
     if: |
       needs.check-membership.outputs.is_member == 'true'
     runs-on: ubicloud-standard-8

.github/workflows/claude-plan.yml

@@ -11,18 +11,40 @@ on:
     types: [submitted]
 
 jobs:
-  check-membership:
+  determine-commenter:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/plan')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '/plan')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '/plan')) ||
       (github.event_name == 'issues' && contains(github.event.issue.body, '/plan'))
+    runs-on: ubicloud-standard-2
+    outputs:
+      commenter: ${{ steps.determine-commenter.outputs.commenter }}
+    steps:
+      - name: Determine commenter
+        id: determine-commenter
+        run: |
+          # Work out who wrote the comment / review
+          if [[ "${{ github.event_name }}" == "issue_comment" || \
+                "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
+            COMMENTER="${{ github.event.comment.user.login }}"
+          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
+            COMMENTER="${{ github.event.review.user.login }}"
+          else
+            COMMENTER="${{ github.event.issue.user.login }}"
+          fi
+          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT
+
+  check-membership:
+    needs: determine-commenter
     uses: ./.github/workflows/check-org-membership.yml
+    with:
+      commenter: ${{ needs.determine-commenter.outputs.commenter }}
     secrets:
       access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
 
   claude-plan-action:
-    needs: check-membership
+    needs: [determine-commenter, check-membership]
     if: |
       needs.check-membership.outputs.is_member == 'true'
     runs-on: ubicloud-standard-4

.github/workflows/claude.yml

@@ -11,18 +11,40 @@ on:
     types: [submitted]
 
 jobs:
-  check-membership:
+  determine-commenter:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/ai')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '/ai')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '/ai')) ||
       (github.event_name == 'issues' && contains(github.event.issue.body, '/ai'))
+    runs-on: ubicloud-standard-2
+    outputs:
+      commenter: ${{ steps.determine-commenter.outputs.commenter }}
+    steps:
+      - name: Determine commenter
+        id: determine-commenter
+        run: |
+          # Work out who wrote the comment / review
+          if [[ "${{ github.event_name }}" == "issue_comment" || \
+                "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
+            COMMENTER="${{ github.event.comment.user.login }}"
+          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
+            COMMENTER="${{ github.event.review.user.login }}"
+          else
+            COMMENTER="${{ github.event.issue.user.login }}"
+          fi
+          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT
+
+  check-membership:
+    needs: determine-commenter
     uses: ./.github/workflows/check-org-membership.yml
+    with:
+      commenter: ${{ needs.determine-commenter.outputs.commenter }}
     secrets:
       access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
 
   claude-code-action:
-    needs: check-membership
+    needs: [determine-commenter, check-membership]
     if: |
       needs.check-membership.outputs.is_member == 'true'
     runs-on: ubicloud-standard-8
@@ -56,18 +78,18 @@ jobs:
       - name: install xmlsec1 and gssapi
         run: |
           sudo apt-get update
-          sudo apt-get install -y libxml2-dev libxmlsec1-dev libkrb5-dev libsasl2-dev libcurl4-openssl-dev mold clang
+          sudo apt-get install -y libxml2-dev libxmlsec1-dev libkrb5-dev libsasl2-dev
 
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache-workspaces: backend
-          toolchain: 1.93.0
+          toolchain: 1.90.0
 
       - name: cargo check
         working-directory: ./backend
         timeout-minutes: 16
         run: |
-          SQLX_OFFLINE=true cargo check --features all_sqlx_features
+          SQLX_OFFLINE=true cargo check --features $(./all_features_oss.sh)
 
       - name: Run Claude PR Action
         uses: anthropics/claude-code-action@v1
@@ -97,7 +119,7 @@ jobs:
             - Fix all warnings and errors before proceeding
 
             **Backend Changes:**
-            - Run: \`cargo check --features all_sqlx_features\` in the backend directory
+            - Run: \`cargo check --features $(./all_features_oss.sh)\` in the backend directory
             - Fix all warnings and errors before proceeding
 
             **Pull Request Creation:**

.github/workflows/create-docs.yml

@@ -0,0 +1,39 @@
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  check-membership:
+    if: ${{ github.event.issue.pull_request && startsWith(github.event.comment.body, '/docs') }}
+    uses: ./.github/workflows/check-org-membership.yml
+    with:
+      commenter: ${{ github.event.comment.user.login }}
+    secrets:
+      access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
+
+  generate-token:
+    needs: check-membership
+    if: ${{ needs.check-membership.outputs.is_member == 'true' }}
+    runs-on: ubicloud-standard-2
+    outputs:
+      app_token: ${{ steps.app.outputs.token }}
+    steps:
+      - name: Generate an installation token
+        id: app
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ vars.INTERNAL_APP_ID }}
+          private-key: ${{ secrets.INTERNAL_APP_KEY }}
+          owner: windmill-labs
+
+  trigger-docs:
+    needs: [generate-token, check-membership]
+    if: ${{ needs.check-membership.outputs.is_member == 'true' }}
+    uses: windmill-labs/windmilldocs/.github/workflows/create-docs.yml@main
+    with:
+      pr_number: ${{ github.event.issue.number }}
+      repo: ${{ github.event.repository.name }}
+      comment_text: ${{ github.event.comment.body }}
+    secrets:
+      DOCS_TOKEN: ${{ needs.generate-token.outputs.app_token }}
+      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}

.github/workflows/git-commands.yaml

@@ -5,21 +5,8 @@ on:
     types: [created]
 
 jobs:
-  check-membership:
-    if: >-
-      github.event.issue.pull_request && (
-        startsWith(github.event.comment.body, '/updatesqlx') ||
-        startsWith(github.event.comment.body, '/demo') ||
-        startsWith(github.event.comment.body, '/eeref') ||
-        startsWith(github.event.comment.body, '/docs')
-      )
-    uses: ./.github/workflows/check-org-membership.yml
-    secrets:
-      access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
-
   update-sqlx:
-    needs: check-membership
-    if: needs.check-membership.outputs.is_member == 'true' && startsWith(github.event.comment.body, '/updatesqlx')
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/updatesqlx')
     runs-on: ubicloud-standard-8
     permissions:
       contents: write
@@ -75,17 +62,17 @@ jobs:
           path: windmill-ee-private
           token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
 
-      # Setup Rust toolchain
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      # Cache rust dependencies
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
         with:
-          cache-workspaces: backend
-          toolchain: 1.93.0
+          workspaces: "./backend -> target"
 
       - name: Install xmlsec and gssapi build-time deps
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            pkg-config libxml2-dev libssl-dev libkrb5-dev libsasl2-dev libcurl4-openssl-dev mold clang \
+            pkg-config libxml2-dev libssl-dev libkrb5-dev \
             xmlsec1 libxmlsec1-dev libxmlsec1-openssl
 
       - name: Run update-sqlx script
@@ -134,8 +121,7 @@ jobs:
             })
 
   demo:
-    needs: check-membership
-    if: needs.check-membership.outputs.is_member == 'true' && startsWith(github.event.comment.body, '/demo')
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/demo')
     runs-on: ubicloud-standard-2
     permissions:
       contents: read
@@ -214,8 +200,7 @@ jobs:
           fi
 
   update-ee-ref:
-    needs: check-membership
-    if: needs.check-membership.outputs.is_member == 'true' && startsWith(github.event.comment.body, '/eeref')
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/eeref')
     runs-on: ubicloud-standard-2
     permissions:
       contents: write
@@ -298,35 +283,3 @@ jobs:
               repo: context.repo.repo,
               body: 'Successfully updated ee-repo-ref.txt'
             })
-
-  update-docs:
-    needs: check-membership
-    if: needs.check-membership.outputs.is_member == 'true' && startsWith(github.event.comment.body, '/docs')
-    runs-on: ubicloud-standard-2
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-    steps:
-      - uses: actions/create-github-app-token@v2
-        id: app
-        with:
-          app-id: ${{ vars.INTERNAL_APP_ID }}
-          private-key: ${{ secrets.INTERNAL_APP_KEY }}
-          owner: ${{ github.repository_owner }}
-          repositories: |
-            windmilldocs
-
-      - name: Trigger docs update
-        env:
-          GH_TOKEN: ${{ steps.app.outputs.token }}
-          COMMENT_TEXT: ${{ github.event.comment.body }}
-        run: |
-          jq -n \
-            --argjson pr_number ${{ github.event.issue.number }} \
-            --arg repo "${{ github.event.repository.name }}" \
-            --arg comment "$COMMENT_TEXT" \
-            '{event_type: "create-docs", client_payload: {pr_number: $pr_number, repo: $repo, comment_text: $comment}}' | \
-          gh api repos/windmill-labs/windmilldocs/dispatches \
-            --method POST \
-            --input -

.github/workflows/publish_windows_worker.yml

@@ -13,7 +13,7 @@ env:
 
 jobs:
   cargo_build_windows:
-    runs-on: blacksmith-16vcpu-windows-2025
+    runs-on: windows-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -32,10 +32,11 @@ jobs:
           token: ${{ secrets.WINDMILL_EE_PRIVATE_ACCESS }}
           fetch-depth: 0
 
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Setup Rust
+        uses: actions-rs/toolchain@v1
         with:
-          cache-workspaces: backend
-          toolchain: 1.93.0
+          toolchain: 1.90.0
+          override: true
 
       - name: Substitute EE code
         shell: bash
@@ -43,13 +44,13 @@ jobs:
           ./backend/substitute_ee_code.sh --copy --dir ./windmill-ee-private
 
       - name: Cargo build dynamic libraries windows
-        timeout-minutes: 180
+        timeout-minutes: 90
         run: |
           cd backend/windmill-duckdb-ffi-internal
           cargo build --release -p windmill_duckdb_ffi_internal
 
       - name: Cargo build windows
-        timeout-minutes: 180
+        timeout-minutes: 90
         run: |
           vcpkg.exe install openssl-windows:x64-windows
           vcpkg.exe install openssl:x64-windows-static

.github/workflows/spawn-ephemeral-backend.yml

@@ -13,16 +13,38 @@ on:
         type: number
 
 jobs:
-  check-membership:
+  determine-commenter:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '/spawnbackend')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '/spawnbackend'))
+    runs-on: ubicloud-standard-2
+    outputs:
+      commenter: ${{ steps.determine-commenter.outputs.commenter }}
+    steps:
+      - name: Determine commenter
+        id: determine-commenter
+        run: |
+          # Work out who wrote the comment / review
+          if [[ "${{ github.event_name }}" == "issue_comment" || \
+                "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
+            COMMENTER="${{ github.event.comment.user.login }}"
+          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
+            COMMENTER="${{ github.event.review.user.login }}"
+          else
+            COMMENTER="${{ github.event.issue.user.login }}"
+          fi
+          echo "commenter=$COMMENTER" >> $GITHUB_OUTPUT
+
+  check-membership:
+    needs: determine-commenter
     uses: ./.github/workflows/check-org-membership.yml
+    with:
+      commenter: ${{ needs.determine-commenter.outputs.commenter }}
     secrets:
       access_token: ${{ secrets.ORG_ACCESS_TOKEN }}
 
   spawn-backend:
-    needs: check-membership
+    needs: [determine-commenter, check-membership]
     # Only run on PR comments that contain /spawn-backend, or manual dispatch
     if: |
       github.event_name == 'workflow_dispatch' ||

.gitignore

@@ -19,4 +19,3 @@ backend/target
 frontend/node_modules
 typescript-client/node_modules
 frontend/.svelte-kit
-backend/chrome_profiler.json

CHANGELOG.md

@@ -1,138 +1,5 @@
 # Changelog
 
-## [1.633.1](https://github.com/windmill-labs/windmill/compare/v1.633.0...v1.633.1) (2026-02-12)
-
-
-### Bug Fixes
-
-* add private registries support for RUST + java home nit ([e2c28e4](https://github.com/windmill-labs/windmill/commit/e2c28e42dbda0f7bf119efc8d587da0d30636a44))
-
-## [1.633.0](https://github.com/windmill-labs/windmill/compare/v1.632.0...v1.633.0) (2026-02-12)
-
-
-### Features
-
-* /health endpoints ([#7727](https://github.com/windmill-labs/windmill/issues/7727)) ([7df4aa4](https://github.com/windmill-labs/windmill/commit/7df4aa4fec021fc728950fc10db4d0401a205087))
-
-
-### Bug Fixes
-
-* save deployment msg in CE ([#7923](https://github.com/windmill-labs/windmill/issues/7923)) ([e9be616](https://github.com/windmill-labs/windmill/commit/e9be616d3c079a0c6fd98733c66560f2cc1ee40d))
-
-## [1.632.0](https://github.com/windmill-labs/windmill/compare/v1.631.2...v1.632.0) (2026-02-12)
-
-
-### Features
-
-* **ai:** add AWS bedrock session token support ([#7908](https://github.com/windmill-labs/windmill/issues/7908)) ([d95e4db](https://github.com/windmill-labs/windmill/commit/d95e4db8f31e70a645a5f41e287557933b257db8))
-
-
-### Bug Fixes
-
-* add kafka kerberos runtime packages ([#7918](https://github.com/windmill-labs/windmill/issues/7918)) ([22f22c2](https://github.com/windmill-labs/windmill/commit/22f22c26612b904c2b82b415ec9337213ef593c3))
-* **frontend:** redesign instance settings ([#7916](https://github.com/windmill-labs/windmill/issues/7916)) ([dd419ad](https://github.com/windmill-labs/windmill/commit/dd419ade94a992073dfd1a979bfeb8a5fadfb051))
-* hash long dedicated worker tags ([#7914](https://github.com/windmill-labs/windmill/issues/7914)) ([aaa1b92](https://github.com/windmill-labs/windmill/commit/aaa1b92300bdc0794de5356ef6750bab5d8d81a0))
-
-## [1.631.2](https://github.com/windmill-labs/windmill/compare/v1.631.1...v1.631.2) (2026-02-11)
-
-
-### Bug Fixes
-
-* **frontend:** revert CloseButton refactor that broke tag removal in MultiSelect ([#7909](https://github.com/windmill-labs/windmill/issues/7909)) ([b11d6ed](https://github.com/windmill-labs/windmill/commit/b11d6ed7940faddfe74a22b25bcb132527cbcec8))
-* nix flake libz.so for deno_core ([#7905](https://github.com/windmill-labs/windmill/issues/7905)) ([900c76c](https://github.com/windmill-labs/windmill/commit/900c76ccad09f58fc6adcfa8151db780249617f6))
-* strip unsupported schema fields for Google AI ([#7894](https://github.com/windmill-labs/windmill/issues/7894)) ([5effb87](https://github.com/windmill-labs/windmill/commit/5effb87a36793e20d17e678619091ef458fe8f0a)), closes [#7759](https://github.com/windmill-labs/windmill/issues/7759)
-
-## [1.631.1](https://github.com/windmill-labs/windmill/compare/v1.631.0...v1.631.1) (2026-02-11)
-
-
-### Bug Fixes
-
-* add kafka-gssapi support to ee builds ([2815cfa](https://github.com/windmill-labs/windmill/commit/2815cfae1a5eefb2c553e893dc926e62ad1df528))
-
-## [1.631.0](https://github.com/windmill-labs/windmill/compare/v1.630.2...v1.631.0) (2026-02-11)
-
-
-### Features
-
-* **ai:** support 1M context window for Anthropic resources ([#7891](https://github.com/windmill-labs/windmill/issues/7891)) ([f22eb96](https://github.com/windmill-labs/windmill/commit/f22eb964e47defe9922ecdb6ab471dd4ca267952))
-* **uv:** index resolve strategy ([#7885](https://github.com/windmill-labs/windmill/issues/7885)) ([097d928](https://github.com/windmill-labs/windmill/commit/097d9288c58076882f1991e2fb33e4441fe332d3))
-
-
-### Bug Fixes
-
-* **frontend:** improve time picker ([#7893](https://github.com/windmill-labs/windmill/issues/7893)) ([31bfccc](https://github.com/windmill-labs/windmill/commit/31bfccc74588af10fc11fbbb0bc4833d65ff6421))
-* otel gracefully handle no native ts ([92c6018](https://github.com/windmill-labs/windmill/commit/92c601860f1e1211aa34838cd08900ba7334a20c))
-* waitJob getJob and streamJob in raw apps ([#7901](https://github.com/windmill-labs/windmill/issues/7901)) ([754b48c](https://github.com/windmill-labs/windmill/commit/754b48cb898dffe196339cea1c1598c9e1765cdc))
-* worker do not apply migrations anymore but wait for servers to do so ([7eb239f](https://github.com/windmill-labs/windmill/commit/7eb239f1e2eb1b71234a8d4265c7c5813e5861ae))
-
-## [1.630.2](https://github.com/windmill-labs/windmill/compare/v1.630.1...v1.630.2) (2026-02-11)
-
-
-### Bug Fixes
-
-* bump rust version from 1.90.0 to 1.93.0 ([1a109a7](https://github.com/windmill-labs/windmill/commit/1a109a7797d1a50a0d85f3fff236d707b2cfb81d))
-
-## [1.630.1](https://github.com/windmill-labs/windmill/compare/v1.630.0...v1.630.1) (2026-02-10)
-
-
-### Bug Fixes
-
-* enforce self-approval check on flow resume owner endpoint ([#7886](https://github.com/windmill-labs/windmill/issues/7886)) ([7147dde](https://github.com/windmill-labs/windmill/commit/7147dde5118d7b3a179e4b310c74b148838b5afe))
-
-## [1.630.0](https://github.com/windmill-labs/windmill/compare/v1.629.1...v1.630.0) (2026-02-10)
-
-
-### Features
-
-* add workspace search and runnable details tools to AI chat modes ([#7874](https://github.com/windmill-labs/windmill/issues/7874)) ([a7e269f](https://github.com/windmill-labs/windmill/commit/a7e269f9f3c82db0d7e6a70e174ac19d3df730d2))
-* **aiagent:** add prompt caching for Anthropic models ([#7878](https://github.com/windmill-labs/windmill/issues/7878)) ([6272cd1](https://github.com/windmill-labs/windmill/commit/6272cd17a4f1300e22e7f0ae27b1a57571deb203))
-* download encrypted usage ([#7804](https://github.com/windmill-labs/windmill/issues/7804)) ([8363ff1](https://github.com/windmill-labs/windmill/commit/8363ff1eeef06f284e6d165fbf2dfb190ead573d))
-* **mcp:** add endpoint tools for scripts, flows, apps, and jobs ([#7859](https://github.com/windmill-labs/windmill/issues/7859)) ([03eb16a](https://github.com/windmill-labs/windmill/commit/03eb16a7c6c3cd9411840814940d09e22ce23305))
-* restriction rulesets for workspaces ([#7879](https://github.com/windmill-labs/windmill/issues/7879)) ([2851b6b](https://github.com/windmill-labs/windmill/commit/2851b6b7caac4a55f5202ace82aba68fd157c52a))
-
-
-### Bug Fixes
-
-* **backend:** correct early return with stream + prevent delta miss ([#7872](https://github.com/windmill-labs/windmill/issues/7872)) ([1150eec](https://github.com/windmill-labs/windmill/commit/1150eec7571d5828d10b295cb61cca8edfbdffe0))
-* gate Permissions import behind #[cfg(unix)] for Windows build ([cf596f3](https://github.com/windmill-labs/windmill/commit/cf596f370ae7cc232ca63f4752d7727a74cd449b))
-* retry js eval up to 3 times on timeout from slow DB ([#7890](https://github.com/windmill-labs/windmill/issues/7890)) ([4c87e7a](https://github.com/windmill-labs/windmill/commit/4c87e7ac2e09ec83cfb998a1cebcb9b9c5ef8027))
-
-## [1.629.1](https://github.com/windmill-labs/windmill/compare/v1.629.0...v1.629.1) (2026-02-10)
-
-
-### Bug Fixes
-
-* remove unecessary drop index on labeled_jobs_on_jobs ([0803164](https://github.com/windmill-labs/windmill/commit/08031640a02ebd5971793942e8534d69f4f71d28))
-
-## [1.629.0](https://github.com/windmill-labs/windmill/compare/v1.628.3...v1.629.0) (2026-02-09)
-
-
-### Features
-
-* customer portal extra workspace stats ([#7841](https://github.com/windmill-labs/windmill/issues/7841)) ([153dd32](https://github.com/windmill-labs/windmill/commit/153dd32187a3e32e3f26ab88b62195a0f9a359b9))
-
-
-### Bug Fixes
-
-* adapt mysql and ruby test assertions ([477832d](https://github.com/windmill-labs/windmill/commit/477832dbeeafb88fd16c174d5d1df8ed042e6f31))
-* add missing :name param to groups/is_owner route ([fa53a87](https://github.com/windmill-labs/windmill/commit/fa53a87107158c9e8a7e5b522242b0076a78ce46))
-* **backend:** prevent sqs hanging ([#7857](https://github.com/windmill-labs/windmill/issues/7857)) ([a3fc27b](https://github.com/windmill-labs/windmill/commit/a3fc27b23224aef2949c19f7c123d28e6cfaf968))
-* box push() future to prevent stack overflow in nested async chains ([67c8aef](https://github.com/windmill-labs/windmill/commit/67c8aef9faea5afe8ce330b477f16b4aed1779a5))
-* **frontend:** reorganize workspace settings ([#7788](https://github.com/windmill-labs/windmill/issues/7788)) ([dd42184](https://github.com/windmill-labs/windmill/commit/dd421845ba148bba70bcbafbc6a39f3012eb037c))
-* improve scheduling reliability in extreme pool contention conditions ([#7825](https://github.com/windmill-labs/windmill/issues/7825)) ([bbb397b](https://github.com/windmill-labs/windmill/commit/bbb397b6ad954052f0bd33cc4ff8897eed66e4db))
-* improve tracing behavior with NO_PROXY ([4cce13f](https://github.com/windmill-labs/windmill/commit/4cce13f5228a05da1bbce43bed7e856ce0bcf979))
-* incorrect raw app public workspaceStore derived ([edb0d4a](https://github.com/windmill-labs/windmill/commit/edb0d4a05da567b3b0be5d94c9b2856d68ecb0ff))
-* increase test thread stack size to 8MB in CI ([5548098](https://github.com/windmill-labs/windmill/commit/5548098e083af76a0b7d6f645a5458592d9c8ddc))
-* install mold+clang in Docker for cargo linker config ([99bc383](https://github.com/windmill-labs/windmill/commit/99bc383f9e94a415ff1dcef1c45ccc4c8dab1a9e))
-* make V8 runtime init idempotent and auto-initialize before isolate creation ([aa9f3da](https://github.com/windmill-labs/windmill/commit/aa9f3da429da92a059aaabb28481d33b8dacd37b))
-* parse Python datetime.datetime and datetime.date type annotations ([#7856](https://github.com/windmill-labs/windmill/issues/7856)) ([ff70a4e](https://github.com/windmill-labs/windmill/commit/ff70a4e9d105cac58c0fb0aba8fbec9875533aa4))
-* prevent V8 SIGSEGV by serializing isolate creation and fixing use-after-free ([05106d7](https://github.com/windmill-labs/windmill/commit/05106d7deeda92b7ae0e1708554f6dcb088c4a08))
-* reduce DB pool contention by eliminating dual-connection patterns ([#7861](https://github.com/windmill-labs/windmill/issues/7861)) ([4343b73](https://github.com/windmill-labs/windmill/commit/4343b73485843c3b482c21e60052f171ada9b843))
-* remove mold linker config that breaks Docker builds ([fea0954](https://github.com/windmill-labs/windmill/commit/fea0954f20f9f7c5a43b25b23df530faeac94999))
-* restart after empty branchone + improve UI ([#7838](https://github.com/windmill-labs/windmill/issues/7838)) ([b1d6ac9](https://github.com/windmill-labs/windmill/commit/b1d6ac91bd3af073feac0b31d97f7b4414d8786e))
-* use unprotected V8 platform to prevent SIGSEGV on x86_64 Linux ([90d0103](https://github.com/windmill-labs/windmill/commit/90d010347c65086b17f9802dd9a7d2da90dc68eb))
-* wmill workspace list to list local profiles ([#7843](https://github.com/windmill-labs/windmill/issues/7843)) ([f924a82](https://github.com/windmill-labs/windmill/commit/f924a8268461c49a0fec26e3216ec9546601b8de))
-
 ## [1.628.3](https://github.com/windmill-labs/windmill/compare/v1.628.2...v1.628.3) (2026-02-06)
 
 

CLAUDE.md

@@ -17,32 +17,19 @@ When implementing new features in Windmill, follow these best practices:
 
 ## Language-Specific Guides
 
-- Backend (Rust): see `backend/CLAUDE.md` and the `rust-backend` skill: `.claude/skills/rust-backend/SKILL.md`
-- Frontend (Svelte 5): see `frontend/CLAUDE.md` and the `svelte-frontend` skill: `.claude/skills/svelte-frontend/SKILL.md`
-
-## Code Validation (MUST DO)
-
-After making code changes, you MUST run the appropriate checks and fix all errors before considering the work done:
-
-- **Backend**: Run `cargo check` from the `backend/` directory. Only enable the feature flags needed for the code you changed — check `backend/Cargo.toml` `[features]` section to identify which flags gate the crates/modules you modified. For example: `cargo check --features enterprise,parquet` if you only touched enterprise and parquet code.
-- **Frontend**: Run `npm run check` from the `frontend/` directory.
+- Backend (Rust): @backend/rust-best-practices.mdc + @backend/summarized_schema.txt
+- Frontend (Svelte 5): @frontend/svelte5-best-practices.mdc
 
 ## Querying the Database
 
-`backend/summarized_schema.txt` provides a compact overview of all tables, columns, types, ENUMs, and foreign keys. Use it to quickly understand the data model and relationships. Note: this file is a simplified summary — it omits indexes, constraints details, and other metadata.
-
-For exact table definitions (indexes, constraints, column defaults, etc.), query the database directly:
+To query the database directly, use psql with the following connection string:
 
 ```bash
 psql postgres://postgres:changeme@localhost:5432/windmill
 ```
 
-Useful psql commands:
-- `\d <table_name>` — full table definition with indexes and constraints
-- `\di <table_name>*` — list indexes for a table
-- `\d+ <table_name>` — extended table info including storage and descriptions
+This can be helpful for:
 
-This is also helpful for:
 - Inspecting database state during development
 - Testing queries before implementing them in Rust
 - Debugging data-related issues

Dockerfile

@@ -1,5 +1,5 @@
 ARG DEBIAN_IMAGE=debian:bookworm-slim
-ARG RUST_IMAGE=rust:1.93-slim-bookworm
+ARG RUST_IMAGE=rust:1.90-slim-bookworm
 
 FROM debian:bookworm-slim AS nsjail
 
@@ -97,7 +97,7 @@ ARG features=""
 
 COPY --from=planner /windmill/recipe.json recipe.json
 
-RUN apt-get update && apt-get install -y libxml2-dev=2.9.* libxmlsec1-dev=1.2.* libkrb5-dev libsasl2-dev libcurl4-openssl-dev clang=1:14.0-55.* libclang-dev=1:14.0-55.* cmake=3.25.* && \
+RUN apt-get update && apt-get install -y libxml2-dev=2.9.* libxmlsec1-dev=1.2.* libkrb5-dev libsasl2-dev clang=1:14.0-55.* libclang-dev=1:14.0-55.* cmake=3.25.* && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/*
 
@@ -132,7 +132,6 @@ ARG WITH_POWERSHELL=true
 ARG WITH_KUBECTL=true
 ARG WITH_HELM=true
 ARG WITH_GIT=true
-ARG features=""
 
 # To change latest stable version:
 # 1. Change placeholder in instanceSettings.ts
@@ -150,8 +149,7 @@ ENV PATH /usr/local/bin:/root/.local/bin:/tmp/.local/bin:$PATH
 
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends netbase tzdata ca-certificates wget curl jq unzip build-essential unixodbc xmlsec1 software-properties-common tini \
-    && if echo "$features" | grep -q "ee"; then apt-get install -y --no-install-recommends libsasl2-modules-gssapi-mit krb5-user; fi \
+    && apt-get install -y --no-install-recommends netbase tzdata ca-certificates wget curl jq unzip build-essential unixodbc xmlsec1 software-properties-common tini libsasl2-modules-gssapi-mit \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 

backend/.sqlx/query-052d42b46d5faba6b41f1fdcbf6a012db51b9e5a255ec0da9a8a0999d668d336.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM worker_ping WHERE ping_at > now() - interval '5 minutes'",
+  "query": "SELECT COUNT(*) as count FROM variable WHERE is_secret = true AND value != 'CLEARED'",
   "describe": {
     "columns": [
       {
@@ -16,5 +16,5 @@
       null
     ]
   },
-  "hash": "bbf166552ba15ce7cd76f812cdf7223414fa5c8a4860f3fe829d649baa1c5465"
+  "hash": "052d42b46d5faba6b41f1fdcbf6a012db51b9e5a255ec0da9a8a0999d668d336"
 }

backend/.sqlx/query-1074c6c98e6a0c83ac04172a39abea21c793f58947051d39931d4da0868a1d77.json

@@ -1,21 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO email_trigger (\n            path, local_part, workspaced_local_part, script_path,\n            is_flow, workspace_id, edited_by, email\n        )\n        VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Bool",
-        "Varchar",
-        "Bool",
-        "Varchar",
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1074c6c98e6a0c83ac04172a39abea21c793f58947051d39931d4da0868a1d77"
-}

backend/.sqlx/query-12c3101e02f197ad731b66f539fe677ad25520fcc9c5a2378a293122956bed4c.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT error_handler->>'path' FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "?column?",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "12c3101e02f197ad731b66f539fe677ad25520fcc9c5a2378a293122956bed4c"
-}

backend/.sqlx/query-18d1a6ac94f2c87d5ea8c48a228f061135be4065dca33fbc429d8b0186c5ccb3.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET error_handler = '{\"path\": \"script/f/test/error_handler\", \"extra_args\": {\"notify\": true}, \"muted_on_cancel\": true, \"muted_on_user_path\": false}'::jsonb\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "18d1a6ac94f2c87d5ea8c48a228f061135be4065dca33fbc429d8b0186c5ccb3"
-}

backend/.sqlx/query-1bceaf6e9f25745b7f70128054ca81d68f3d56d4782e99e05b4f1cb362683514.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "WITH inserted_concurrency_counter AS (\n                INSERT INTO concurrency_counter (concurrency_id, job_uuids) \n                VALUES ($1, '{}'::jsonb)\n                ON CONFLICT DO NOTHING\n            )\n            INSERT INTO concurrency_key(key, job_id) VALUES ($1, $2)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "1bceaf6e9f25745b7f70128054ca81d68f3d56d4782e99e05b4f1cb362683514"
+}

backend/.sqlx/query-2031c5138a785367e5127180ccb6734efa41ee6cb3b4819c1c517798b2b23e4a.json

@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE email_trigger SET script_path = $1, local_part = $2 WHERE workspace_id = $3 AND path = $4",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "2031c5138a785367e5127180ccb6734efa41ee6cb3b4819c1c517798b2b23e4a"
-}

backend/.sqlx/query-212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8.json

@@ -1,87 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT id, runnable_path, trigger_kind AS \"trigger_kind: String\",\n                   args AS \"args: sqlx::types::Json<serde_json::Value>\"\n            FROM v2_job\n            WHERE runnable_path = $1\n              AND trigger_kind = $2::job_trigger_kind\n            ORDER BY created_at DESC\n            LIMIT 1\n            ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "runnable_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "trigger_kind: String",
-        "type_info": {
-          "Custom": {
-            "name": "job_trigger_kind",
-            "kind": {
-              "Enum": [
-                "webhook",
-                "http",
-                "websocket",
-                "kafka",
-                "email",
-                "nats",
-                "schedule",
-                "app",
-                "ui",
-                "postgres",
-                "sqs",
-                "gcp",
-                "mqtt",
-                "nextcloud",
-                "google"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 3,
-        "name": "args: sqlx::types::Json<serde_json::Value>",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        {
-          "Custom": {
-            "name": "job_trigger_kind",
-            "kind": {
-              "Enum": [
-                "webhook",
-                "http",
-                "websocket",
-                "kafka",
-                "email",
-                "nats",
-                "schedule",
-                "app",
-                "ui",
-                "postgres",
-                "sqs",
-                "gcp",
-                "mqtt",
-                "nextcloud",
-                "google"
-              ]
-            }
-          }
-        }
-      ]
-    },
-    "nullable": [
-      false,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "212553c83e4dcdc6d045eb2fe2dadbb2860ce52d37a56b2861de1215260ecff8"
-}

backend/.sqlx/query-25bf3956b4365a4d4f96368bcc6e33817ae284ab26c195eee53d988d74263e86.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT (error_handler->>'muted_on_cancel')::boolean FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "bool",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "25bf3956b4365a4d4f96368bcc6e33817ae284ab26c195eee53d988d74263e86"
-}

backend/.sqlx/query-28b8264a427e8c19be823d2b8e40736a7b7675780672b503d91737cd0c617657.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT (error_handler->>'muted_on_user_path')::boolean FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "bool",
-        "type_info": "Bool"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "28b8264a427e8c19be823d2b8e40736a7b7675780672b503d91737cd0c617657"
-}

backend/.sqlx/query-302bc55d0c227c5b12458ccde6569c4b531ff494d1ede0a655872ae05215f8a6.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT value FROM variable WHERE workspace_id = $1 AND path = $2 AND is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "value",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "302bc55d0c227c5b12458ccde6569c4b531ff494d1ede0a655872ae05215f8a6"
-}

backend/.sqlx/query-33fff66efe810ad7e92b36ca9b287938437182d7817387707e800519d9f5bafc.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE variable SET value = $1 WHERE workspace_id = $2 AND path = $3 AND is_secret = true",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "33fff66efe810ad7e92b36ca9b287938437182d7817387707e800519d9f5bafc"
-}

backend/.sqlx/query-3b5295a7c4b99aefa52c9a8ae1e0dd12bf4a0be1bf755caf7a1fa863e7950562.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM mqtt_trigger WHERE workspace_id = $1 AND path = $2",
+  "query": "SELECT COUNT(*) FROM raw_app WHERE workspace_id = $1",
   "describe": {
     "columns": [
       {
@@ -11,7 +11,6 @@
     ],
     "parameters": {
       "Left": [
-        "Text",
         "Text"
       ]
     },
@@ -19,5 +18,5 @@
       null
     ]
   },
-  "hash": "f149d740301a65a62664fd407abe89c972e50837b6c54ac7a3ccd5f60ca05d3c"
+  "hash": "3b5295a7c4b99aefa52c9a8ae1e0dd12bf4a0be1bf755caf7a1fa863e7950562"
 }

backend/.sqlx/query-40971d637c5b4d2af8e67872722880058cc067fca5e807ab3e1ed17d180cb7f7.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM email_trigger WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "40971d637c5b4d2af8e67872722880058cc067fca5e807ab3e1ed17d180cb7f7"
-}

backend/.sqlx/query-454a611a5a162b2ace137c139bd5383bc7fe142c515dac3edd47991839485e51.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM job_result_stream_v2\n         WHERE job_id NOT IN (SELECT id FROM v2_job_queue)\n           AND job_id NOT IN (\n               SELECT id FROM v2_job_completed\n               WHERE completed_at > NOW() - INTERVAL '60 seconds'\n           )\n         RETURNING job_id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "job_id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "454a611a5a162b2ace137c139bd5383bc7fe142c515dac3edd47991839485e51"
-}

backend/.sqlx/query-485dc289a61a06595acae28d4968f3b6b2aeb6a8aee863dc999d6c8d58397814.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n            SELECT j.id AS \"id!\", COALESCE(s.flow_status, s.workflow_as_code_status) as flow_status, q.suspend AS \"suspend!\", j.runnable_path as script_path, j.permissioned_as_email as email\n            FROM v2_job_queue q JOIN v2_job j USING (id) LEFT JOIN v2_job_status s USING (id)\n            WHERE j.id = $1\n            ",
+  "query": "\n            SELECT j.id AS \"id!\", COALESCE(s.flow_status, s.workflow_as_code_status) as flow_status, q.suspend AS \"suspend!\", j.runnable_path as script_path\n            FROM v2_job_queue q JOIN v2_job j USING (id) LEFT JOIN v2_job_status s USING (id)\n            WHERE j.id = $1\n            ",
   "describe": {
     "columns": [
       {
@@ -22,11 +22,6 @@
         "ordinal": 3,
         "name": "script_path",
         "type_info": "Varchar"
-      },
-      {
-        "ordinal": 4,
-        "name": "email",
-        "type_info": "Varchar"
       }
     ],
     "parameters": {
@@ -38,9 +33,8 @@
       false,
       null,
       false,
-      true,
-      false
+      true
     ]
   },
-  "hash": "5c6e158aee5db3c4bf41a0aedfa5d6c73f5e04ebfd8703dc631bc49f2e797dd4"
+  "hash": "485dc289a61a06595acae28d4968f3b6b2aeb6a8aee863dc999d6c8d58397814"
 }

backend/.sqlx/query-4cfb35e423a75ca2701f03d5a30a7c0778af5e548254f3e0f29004d7f2058eef.json

@@ -1,46 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            SELECT\n                workspace_id,\n                name,\n                rules as \"rules: ProtectionRules\",\n                bypass_groups,\n                bypass_users\n            FROM workspace_protection_rule\n            WHERE workspace_id = $1\n            ORDER BY name\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "workspace_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "name",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "rules: ProtectionRules",
-        "type_info": "Int4"
-      },
-      {
-        "ordinal": 3,
-        "name": "bypass_groups",
-        "type_info": "TextArray"
-      },
-      {
-        "ordinal": 4,
-        "name": "bypass_users",
-        "type_info": "TextArray"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "4cfb35e423a75ca2701f03d5a30a7c0778af5e548254f3e0f29004d7f2058eef"
-}

backend/.sqlx/query-51f18c817d4014e847486f5a8dbf205ffa0e53d5bd3fdb97777e988389b1d69e.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/success_script', 'export function main() { return \"ok\"; }', 'deno', 'script', 'test-user', '{}', '', '', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "51f18c817d4014e847486f5a8dbf205ffa0e53d5bd3fdb97777e988389b1d69e"
-}

backend/.sqlx/query-5a9cf9cc229f7b7ddbee2485cda4e9f7a91240a00f10d24d3f28d5b722f68768.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "WITH inserted_concurrency_counter AS (\n                INSERT INTO concurrency_counter (concurrency_id, job_uuids)\n                VALUES ($1, '{}'::jsonb)\n                ON CONFLICT DO NOTHING\n            )\n            INSERT INTO concurrency_key(key, job_id) VALUES ($1, $2)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Uuid"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "5a9cf9cc229f7b7ddbee2485cda4e9f7a91240a00f10d24d3f28d5b722f68768"
-}

backend/.sqlx/query-5f5bdd667f699a5a1c05e07d805a97afb06252541d06b4785063819c3893b674.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO group_ (workspace_id, name, summary, extra_perms)\n        VALUES ('test-workspace', 'error_handler', 'The group the error handler acts on behalf of', '{\"u/test-user\": true}')\n        ON CONFLICT DO NOTHING\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "5f5bdd667f699a5a1c05e07d805a97afb06252541d06b4785063819c3893b674"
-}

backend/.sqlx/query-60a666a7cffce2d7631682095ccfd31e99997e88374496d4800eaa7b5152a464.json

@@ -1,39 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT delivery_type AS \"delivery_type: String\",\n               delivery_config\n        FROM gcp_trigger\n        WHERE workspace_id = $1 AND path = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "delivery_type: String",
-        "type_info": {
-          "Custom": {
-            "name": "delivery_mode",
-            "kind": {
-              "Enum": [
-                "push",
-                "pull"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 1,
-        "name": "delivery_config",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      true
-    ]
-  },
-  "hash": "60a666a7cffce2d7631682095ccfd31e99997e88374496d4800eaa7b5152a464"
-}

backend/.sqlx/query-65b12bed9438900518b20dc268d71a2dba6ec66aee2971faef76b6ed56a05b6f.json

@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            UPDATE workspace_protection_rule\n            SET rules = $1, bypass_groups = $2, bypass_users = $3\n            WHERE workspace_id = $4 AND name = $5\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int4",
-        "TextArray",
-        "TextArray",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "65b12bed9438900518b20dc268d71a2dba6ec66aee2971faef76b6ed56a05b6f"
-}

backend/.sqlx/query-66e66da2ed6eace5d7ec2a41a7b11ae255f5dc212d1ff41c2905b303c8c13b18.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        WITH job_info AS (\n            SELECT id, kind::text AS kind, parent_job\n            FROM v2_job\n            WHERE id = $1\n        )\n        SELECT\n            q.id AS \"id!\",\n            s.flow_status,\n            q.suspend AS \"suspend!\",\n            j.runnable_path AS script_path,\n            j.permissioned_as_email AS email,\n            (ji.kind IN ('flow', 'flowpreview')) AS \"is_flow_level!\"\n        FROM job_info ji\n        JOIN v2_job_queue q ON q.id = CASE\n            WHEN ji.kind IN ('flow', 'flowpreview') THEN ji.id\n            ELSE ji.parent_job\n        END\n        JOIN v2_job j ON j.id = q.id\n        JOIN v2_job_status s ON s.id = q.id\n        FOR UPDATE OF q\n        ",
+  "query": "\n        WITH job_info AS (\n            SELECT id, kind::text AS kind, parent_job\n            FROM v2_job\n            WHERE id = $1\n        )\n        SELECT\n            q.id AS \"id!\",\n            s.flow_status,\n            q.suspend AS \"suspend!\",\n            j.runnable_path AS script_path,\n            (ji.kind IN ('flow', 'flowpreview')) AS \"is_flow_level!\"\n        FROM job_info ji\n        JOIN v2_job_queue q ON q.id = CASE\n            WHEN ji.kind IN ('flow', 'flowpreview') THEN ji.id\n            ELSE ji.parent_job\n        END\n        JOIN v2_job j ON j.id = q.id\n        JOIN v2_job_status s ON s.id = q.id\n        FOR UPDATE OF q\n        ",
   "describe": {
     "columns": [
       {
@@ -25,11 +25,6 @@
       },
       {
         "ordinal": 4,
-        "name": "email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 5,
         "name": "is_flow_level!",
         "type_info": "Bool"
       }
@@ -44,9 +39,8 @@
       true,
       false,
       true,
-      false,
       null
     ]
   },
-  "hash": "1a0ab65bbf2751f702fc696c1e32a7dd9524cdd806be1ad8e9ab88d4c88d3f82"
+  "hash": "66e66da2ed6eace5d7ec2a41a7b11ae255f5dc212d1ff41c2905b303c8c13b18"
 }

backend/.sqlx/query-782c259ccdf71c5e2fa8dcb27515e7c5ff83009774dc15095ed0dbcb0ecdbdde.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock, ws_error_handler_muted)\n        VALUES ('test-workspace', $1, 'f/test/muted_failing_script', 'export function main() { throw new Error(\"fail\"); }', 'deno', 'script', 'test-user', '{}', '', '', '', true)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "782c259ccdf71c5e2fa8dcb27515e7c5ff83009774dc15095ed0dbcb0ecdbdde"
-}

backend/.sqlx/query-79648f03eb50385183c34d57bda1ac984cf6502609df9ee51b7d684b585b8447.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET error_handler = NULL\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "79648f03eb50385183c34d57bda1ac984cf6502609df9ee51b7d684b585b8447"
-}

backend/.sqlx/query-7ddc2c3f1ce74f9b7acdd51b94431386e7782c52251cf094e06ddb198a958b43.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM workspace_protection_rule WHERE workspace_id = $1 AND name = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "7ddc2c3f1ce74f9b7acdd51b94431386e7782c52251cf094e06ddb198a958b43"
-}

backend/.sqlx/query-7f98c013682aca6d269ef6ef754a7247b6e2dd4958d0968a3f2eb49cc320e877.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 3333333333, 'f/test/error_handler', 'export function main() { return \"handled\"; }', 'deno', 'script', 'test-user', '{}', '', '', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "7f98c013682aca6d269ef6ef754a7247b6e2dd4958d0968a3f2eb49cc320e877"
-}

backend/.sqlx/query-8002f7f1521846056278f18e8b003fe48a4d3d827ac8b212e0f3d3bc2ed42f37.json

@@ -1,29 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT script_path, local_part FROM email_trigger WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "local_part",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "8002f7f1521846056278f18e8b003fe48a4d3d827ac8b212e0f3d3bc2ed42f37"
-}

backend/.sqlx/query-80864158f61adaad8df934acc54ba523c9f17d106298d8781885134d28553d36.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE alerts \n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $2 THEN\n               CASE\n                 WHEN $1::text IS NOT NULL THEN true\n                 ELSE acknowledged_workspace\n               END\n             ELSE true\n           END\n         WHERE ($1::text IS NOT NULL AND workspace_id = $1)\n            OR ($1::text IS NULL)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Bool"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "80864158f61adaad8df934acc54ba523c9f17d106298d8781885134d28553d36"
+}

backend/.sqlx/query-8364505b9a4d0d6f7406e4a5425360682ac2295bbf6746c7641141ed7bf47bf6.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM email_trigger WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "8364505b9a4d0d6f7406e4a5425360682ac2295bbf6746c7641141ed7bf47bf6"
-}

backend/.sqlx/query-84bbd11f7bb0c65dcfb2e12038b8a9cb51d303480ac3c5f8a5e833a53c40ed9b.json

@@ -0,0 +1,17 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO raw_app\n            (workspace_id, path, summary, extra_perms, data)\n            VALUES ($1, $2, $3, '{}', $4)",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar",
+        "Varchar",
+        "Varchar",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "84bbd11f7bb0c65dcfb2e12038b8a9cb51d303480ac3c5f8a5e833a53c40ed9b"
+}

backend/.sqlx/query-899a162192d93c7fb7d47d38f4fb0fadcafc2bb0c61efa8ee496af7252d18270.json

@@ -1,62 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT mqtt_resource_path, client_version AS \"client_version: String\",\n               script_path, mode AS \"mode: String\"\n        FROM mqtt_trigger\n        WHERE workspace_id = $1 AND path = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "mqtt_resource_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "client_version: String",
-        "type_info": {
-          "Custom": {
-            "name": "mqtt_client_version",
-            "kind": {
-              "Enum": [
-                "v3",
-                "v5"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 2,
-        "name": "script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "mode: String",
-        "type_info": {
-          "Custom": {
-            "name": "trigger_mode",
-            "kind": {
-              "Enum": [
-                "enabled",
-                "disabled",
-                "suspended"
-              ]
-            }
-          }
-        }
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "899a162192d93c7fb7d47d38f4fb0fadcafc2bb0c61efa8ee496af7252d18270"
-}

backend/.sqlx/query-8c3cc09c1bbb6209467c75723dd02e97dddb99789422012e85e86c3151a9f2e9.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO kafka_trigger (\n            path, kafka_resource_path, topics, group_id,\n            script_path, is_flow, workspace_id, edited_by, email\n        )\n        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "VarcharArray",
-        "Varchar",
-        "Varchar",
-        "Bool",
-        "Varchar",
-        "Varchar",
-        "Varchar"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "8c3cc09c1bbb6209467c75723dd02e97dddb99789422012e85e86c3151a9f2e9"
-}

backend/.sqlx/query-9f07510019ebe6f0c5fa17bf31c2d14755474cba82b3b388a47585a8bb325b1a.json

@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO deployment_metadata (workspace_id, path, script_hash, deployment_msg) VALUES ($1, $2, $3, $4) ON CONFLICT (workspace_id, script_hash) WHERE script_hash IS NOT NULL DO UPDATE SET deployment_msg = EXCLUDED.deployment_msg",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "9f07510019ebe6f0c5fa17bf31c2d14755474cba82b3b388a47585a8bb325b1a"
-}

backend/.sqlx/query-a086a5fa28dcff80911c7e5de73f204fc42625e58b967b0376ff7b382e38fa11.json

@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT script_path FROM mqtt_trigger WHERE workspace_id = $1 AND path = $2",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "script_path",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "a086a5fa28dcff80911c7e5de73f204fc42625e58b967b0376ff7b382e38fa11"
-}

backend/.sqlx/query-a7468e9054beed88636786c5495ac3b9d9a6086ae6212ad9237b39a0346d7d26.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n                                SELECT\n                                    flow_version.id AS version,\n                                    flow_version.value->>'early_return' as early_return,\n                                    flow_version.value->>'preprocessor_module' IS NOT NULL as has_preprocessor,\n                                    (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled,\n                                    flow.tag,\n                                    flow.dedicated_worker,\n                                    flow.on_behalf_of_email,\n                                    flow.edited_by\n                                FROM\n                                    flow_version\n                                INNER JOIN flow\n                                    ON flow.path = flow_version.path AND\n                                       flow.workspace_id = flow_version.workspace_id\n                                WHERE\n                                    flow_version.workspace_id = $1 AND\n                                    flow_version.path = $2 AND\n                                    flow_version.id = $3\n                            ",
+  "query": "\n                                SELECT\n                                    flow_version.id AS version,\n                                    flow_version.value->>'early_return' as early_return, \n                                    flow_version.value->>'preprocessor_module' IS NOT NULL as has_preprocessor, \n                                    (flow_version.value->>'chat_input_enabled')::boolean as chat_input_enabled, \n                                    flow.tag, \n                                    flow.dedicated_worker, \n                                    flow.on_behalf_of_email, \n                                    flow.edited_by\n                                FROM \n                                    flow_version\n                                INNER JOIN flow\n                                    ON flow.path = flow_version.path AND\n                                       flow.workspace_id = flow_version.workspace_id\n                                WHERE \n                                    flow_version.workspace_id = $1 AND\n                                    flow_version.path = $2 AND\n                                    flow_version.id = $3\n                            ",
   "describe": {
     "columns": [
       {
@@ -62,5 +62,5 @@
       false
     ]
   },
-  "hash": "209dc4c1b91eeab1c12ffcd9f9e16f315c689ca772c736b333dcdf07c8086087"
+  "hash": "a7468e9054beed88636786c5495ac3b9d9a6086ae6212ad9237b39a0346d7d26"
 }

backend/.sqlx/query-a80a17cda8ad722a97f16526d8576b76c7377066a06dba98a2921a68928aa644.json

@@ -1,84 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT gcp_resource_path, topic_id, subscription_id,\n               delivery_type AS \"delivery_type: String\",\n               subscription_mode AS \"subscription_mode: String\",\n               mode AS \"mode: String\"\n        FROM gcp_trigger\n        WHERE workspace_id = $1 AND path = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "gcp_resource_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "topic_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "subscription_id",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "delivery_type: String",
-        "type_info": {
-          "Custom": {
-            "name": "delivery_mode",
-            "kind": {
-              "Enum": [
-                "push",
-                "pull"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 4,
-        "name": "subscription_mode: String",
-        "type_info": {
-          "Custom": {
-            "name": "gcp_subscription_mode",
-            "kind": {
-              "Enum": [
-                "create_update",
-                "existing"
-              ]
-            }
-          }
-        }
-      },
-      {
-        "ordinal": 5,
-        "name": "mode: String",
-        "type_info": {
-          "Custom": {
-            "name": "trigger_mode",
-            "kind": {
-              "Enum": [
-                "enabled",
-                "disabled",
-                "suspended"
-              ]
-            }
-          }
-        }
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "a80a17cda8ad722a97f16526d8576b76c7377066a06dba98a2921a68928aa644"
-}

backend/.sqlx/query-b2b2b7251be2b80207f47b10eeff78d61c84161caaf16b8fd25d82b97aac1186.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM mqtt_trigger WHERE workspace_id = $1 AND path = $2",
+  "query": "DELETE FROM raw_app WHERE path = $1 AND workspace_id = $2",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,5 +11,5 @@
     },
     "nullable": []
   },
-  "hash": "3481e65196e500ad914f10b87884c19d8a3636ae955788c3366365194fe2ef57"
+  "hash": "b2b2b7251be2b80207f47b10eeff78d61c84161caaf16b8fd25d82b97aac1186"
 }

backend/.sqlx/query-ba0c3dad5d2a77922821c9c6d58e06a65e6666e197f3e59b880470df35c27bec.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO group_ (workspace_id, name, summary, extra_perms)\n        VALUES ('test-workspace', 'error_handler', 'Error handler group', '{\"u/test-user\": true}')\n        ON CONFLICT DO NOTHING\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "ba0c3dad5d2a77922821c9c6d58e06a65e6666e197f3e59b880470df35c27bec"
-}

backend/.sqlx/query-bb46e5dcf5490ef3511faa131ad5693dedf34366e51044ddf30695995d194090.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM job_result_stream_v2 WHERE job_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "bb46e5dcf5490ef3511faa131ad5693dedf34366e51044ddf30695995d194090"
+}

backend/.sqlx/query-bb4cde84157126f29680cb36075848e7cde2ab7c6b7f0861becd4c0b8c330a8d.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        UPDATE workspace_settings\n        SET error_handler = '{\"path\": \"script/f/test/error_handler\"}'::jsonb\n        WHERE workspace_id = 'test-workspace'\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "bb4cde84157126f29680cb36075848e7cde2ab7c6b7f0861becd4c0b8c330a8d"
-}

backend/.sqlx/query-c4b3ab3d87f158b20f0557f78c6307c50620425aeb43636e19931c142b5ce0d7.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM workspace_protection_rule WHERE workspace_id = $1 AND name = $2)",
+  "query": "SELECT EXISTS(SELECT 1 FROM raw_app WHERE path = $1 AND workspace_id = $2)",
   "describe": {
     "columns": [
       {
@@ -19,5 +19,5 @@
       null
     ]
   },
-  "hash": "b1b26cb02dcc0748c63411c933e5e6bdfe82466134ba28408a530e22c66656de"
+  "hash": "c4b3ab3d87f158b20f0557f78c6307c50620425aeb43636e19931c142b5ce0d7"
 }

backend/.sqlx/query-c825fa5c6e287068aeaad994c0b42b8ad59b9129f032c6b918c27426ab304f2b.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM job_perms\nWHERE job_id NOT IN (SELECT id FROM v2_job_queue)\nRETURNING job_id",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "job_id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "c825fa5c6e287068aeaad994c0b42b8ad59b9129f032c6b918c27426ab304f2b"
-}

backend/.sqlx/query-cabef30aa1e308bc656660c4ac0d3e77b020de05465f81a4fb4b0c07bd0d7439.json

@@ -1,52 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT local_part, workspaced_local_part, script_path,\n               mode AS \"mode: String\"\n        FROM email_trigger\n        WHERE workspace_id = $1 AND path = $2\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "local_part",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "workspaced_local_part",
-        "type_info": "Bool"
-      },
-      {
-        "ordinal": 2,
-        "name": "script_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "mode: String",
-        "type_info": {
-          "Custom": {
-            "name": "trigger_mode",
-            "kind": {
-              "Enum": [
-                "enabled",
-                "disabled",
-                "suspended"
-              ]
-            }
-          }
-        }
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      false
-    ]
-  },
-  "hash": "cabef30aa1e308bc656660c4ac0d3e77b020de05465f81a4fb4b0c07bd0d7439"
-}

backend/.sqlx/query-cdc594b30855e9384481f561b2c16200d4e6dacb1eb274513c8f1795235dfe20.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 5555555555, 'f/test/error_handler', 'export function main() { return \"handled\"; }', 'deno', 'script', 'test-user', '{}', '', '', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": []
-  },
-  "hash": "cdc594b30855e9384481f561b2c16200d4e6dacb1eb274513c8f1795235dfe20"
-}

backend/.sqlx/query-d2a9a9af4d00c1c05276c14e6f32044437800a4b0c60aa364ab2f362a4fd9a2c.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', $1, 'f/test/failing_script', $2, 'deno', 'script', 'test-user', '{}', 'Failing test script', 'A script that always fails', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "d2a9a9af4d00c1c05276c14e6f32044437800a4b0c60aa364ab2f362a4fd9a2c"
-}

backend/.sqlx/query-d5f1a2bfbac206a33b991d58f9ff4b8e8e4a3840ea1c65d409576379dede41ed.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT error_handler->'extra_args' FROM workspace_settings WHERE workspace_id = 'test-workspace'",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "?column?",
-        "type_info": "Jsonb"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "d5f1a2bfbac206a33b991d58f9ff4b8e8e4a3840ea1c65d409576379dede41ed"
-}

backend/.sqlx/query-d7d11b2c288fa0282539edde0c5450e4b5f8355821617b6c1ce3db64f6ceaf69.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM variable WHERE is_secret = true",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "d7d11b2c288fa0282539edde0c5450e4b5f8355821617b6c1ce3db64f6ceaf69"
-}

backend/.sqlx/query-dbf2982f43577999dec0c488dfb67f56e5bd0e5fbf8da5132f6fc5a282d2b0e1.json

@@ -1,18 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n            INSERT INTO workspace_protection_rule (workspace_id, name, rules, bypass_groups, bypass_users)\n            VALUES ($1, $2, $3, $4, $5)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int4",
-        "TextArray",
-        "TextArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "dbf2982f43577999dec0c488dfb67f56e5bd0e5fbf8da5132f6fc5a282d2b0e1"
-}

backend/.sqlx/query-e004ebd5b5532a4b85984a62f8ad48a81aa3460c1ca07701f386135d72cdecf5.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT 1",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "?column?",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "e004ebd5b5532a4b85984a62f8ad48a81aa3460c1ca07701f386135d72cdecf5"
-}

backend/.sqlx/query-e00f7877d7bd33cf81e7bf48b1a37a507ab0a8f8b4bd7a38cf44d181f8f2d940.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE alerts\n         SET\n           acknowledged = true,\n           acknowledged_workspace = CASE\n             WHEN $2 THEN\n               CASE\n                 WHEN $1::text IS NOT NULL THEN true\n                 ELSE acknowledged_workspace\n               END\n             ELSE true\n           END\n         WHERE ($1::text IS NOT NULL AND workspace_id = $1)\n            OR ($1::text IS NULL)",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Bool"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "e00f7877d7bd33cf81e7bf48b1a37a507ab0a8f8b4bd7a38cf44d181f8f2d940"
-}

backend/.sqlx/query-e485c82978d10379c6d1b7cd850f3bf764e6c5bf775f3d710ba36a79f5e424eb.json

@@ -1,21 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO websocket_trigger (\n            path, url, script_path, is_flow, workspace_id,\n            edited_by, email, initial_messages\n        )\n        VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "Bool",
-        "Varchar",
-        "Varchar",
-        "Varchar",
-        "JsonbArray"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "e485c82978d10379c6d1b7cd850f3bf764e6c5bf775f3d710ba36a79f5e424eb"
-}

backend/.sqlx/query-e4c9f3bca6bd636c3ee31fc643182ed5ca48a45da895fb992d820682f5169f7c.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT id\n        FROM v2_job\n        WHERE workspace_id = 'test-workspace'\n            AND permissioned_as_email = 'error_handler@windmill.dev'\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "e4c9f3bca6bd636c3ee31fc643182ed5ca48a45da895fb992d820682f5169f7c"
-}

backend/.sqlx/query-f0eb9d49021668673880aa20227c24a130cada07fba3f43e32d904fde97106d3.json

@@ -1,16 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE mqtt_trigger SET script_path = $1 WHERE workspace_id = $2 AND path = $3",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "f0eb9d49021668673880aa20227c24a130cada07fba3f43e32d904fde97106d3"
-}

backend/.sqlx/query-f8ac5379ecfbff7b8ae75c821680737b249a64c8d9e8f7dbcc46fce98e874571.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics",
+  "query": "VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, concurrency_key, log_file, metrics",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,5 +8,5 @@
     },
     "nullable": []
   },
-  "hash": "f0070b36f7c4fc84dc9c23bb6c73d8ba80993a28b2c2e5df70968acf6d7cebe4"
+  "hash": "f8ac5379ecfbff7b8ae75c821680737b249a64c8d9e8f7dbcc46fce98e874571"
 }

backend/.sqlx/query-f912b91c940900b9961920ac0f71b7ba1e8cd50ce90c0c17336e9dd9c684f348.json

@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            worker_group,\n            wm_version\n        FROM worker_ping\n        WHERE ping_at > now() - interval '5 minutes'\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "worker_group",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 1,
-        "name": "wm_version",
-        "type_info": "Varchar"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "f912b91c940900b9961920ac0f71b7ba1e8cd50ce90c0c17336e9dd9c684f348"
-}

backend/.sqlx/query-fdf0a16a72bc2eca2025d64750e2e6a7e7ff90b5ad4b42e6aab53992b447a20e.json

@@ -1,38 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        SELECT\n            id,\n            runnable_path,\n            permissioned_as_email,\n            parent_job\n        FROM v2_job\n        WHERE workspace_id = 'test-workspace'\n            AND permissioned_as_email = 'error_handler@windmill.dev'\n        ORDER BY created_at DESC\n        LIMIT 1\n        ",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "id",
-        "type_info": "Uuid"
-      },
-      {
-        "ordinal": 1,
-        "name": "runnable_path",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 2,
-        "name": "permissioned_as_email",
-        "type_info": "Varchar"
-      },
-      {
-        "ordinal": 3,
-        "name": "parent_job",
-        "type_info": "Uuid"
-      }
-    ],
-    "parameters": {
-      "Left": []
-    },
-    "nullable": [
-      false,
-      true,
-      false,
-      true
-    ]
-  },
-  "hash": "fdf0a16a72bc2eca2025d64750e2e6a7e7ff90b5ad4b42e6aab53992b447a20e"
-}

backend/.sqlx/query-fe17aff543f28cf4d6d09ea7c4c7d18ff6a95a8402468131f5a5f33df91c59e4.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "\n        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)\n        VALUES ('test-workspace', 1111111111, 'f/test/error_handler', $1, 'deno', 'script', 'test-user', '{}', 'Error handler script', 'Handles failed job completions', '')\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "fe17aff543f28cf4d6d09ea7c4c7d18ff6a95a8402468131f5a5f33df91c59e4"
-}

backend/CLAUDE.md

@@ -37,40 +37,14 @@ Windmill uses a workspace-based architecture with multiple crates:
 - Update database schema with migration if necessary
 - Use `sqlx` for database operations with prepared statements
 - Use transactions for multi-step operations
-- To apply pending migrations: `sqlx migrate run` (never manually run .sql files)
-- **Never use `SQLX_OFFLINE=true`** — a live database is always available for compilation
-- After all code changes are done, run `./update-sqlx` to regenerate the offline query cache
 
 ## Enterprise Features
 
 - Enterprise files use the `*_ee.rs` suffix
-- Enterprise source is in `windmill-ee-private` folder (sibling directory at `../../windmill-ee-private`), symlinked into each crate's `src/`
-- You can and should modify `windmill-ee-private` directly when needed (e.g., when creating new crates that need EE code, mirror the package structure there)
+- Enterprise source is in `windmill-ee-private` folder (sibling directory), symlinked into each crate's `src/`
 - Use feature flags: `#[cfg(feature = "enterprise")]`
 - Isolate enterprise code in separate modules
 
-## Code Validation (MUST DO)
-
-After making backend changes, you MUST run `cargo check` and fix all errors and warnings before considering the work done.
-
-Only enable the feature flags relevant to your changes — do NOT use `all_sqlx_features` as it compiles the entire codebase and is very slow. Check the `[features]` section in `Cargo.toml` to identify which flags gate the crates/modules you modified.
-
-Examples:
-```bash
-# Changed core code (no feature-gated modules)
-cargo check
-
-# Changed code behind the enterprise feature
-cargo check --features enterprise
-
-# Changed kafka trigger code
-cargo check --features kafka
-```
-
-## Git Workflow
-
-- **Never push directly to main** — always create a branch and open a pull request
-
 ## Testing
 
 - Write unit tests for core functionality

backend/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "windmill"
-version = "1.633.1"
+version = "1.628.3"
 authors.workspace = true
 edition.workspace = true
 
@@ -9,7 +9,6 @@ resolver = "2"
 members = [
     "./windmill-api",
     "./windmill-api-scripts",
-    "./windmill-api-flows",
     "./windmill-api-users",
     "./windmill-api-workspaces",
     "./windmill-api-groups",
@@ -27,19 +26,7 @@ members = [
     "./windmill-trigger-gcp",
     "./windmill-trigger-http",
     "./windmill-native-triggers",
-    "./windmill-alerting",
-    "./windmill-api-agent-workers",
-    "./windmill-api-assets",
-    "./windmill-api-configs",
-    "./windmill-api-debug",
     "./windmill-api-embeddings",
-    "./windmill-api-flow-conversations",
-    "./windmill-api-inputs",
-    "./windmill-api-npm-proxy",
-    "./windmill-api-openapi",
-    "./windmill-api-schedule",
-    "./windmill-api-settings",
-    "./windmill-api-workers",
     "./windmill-store",
     "./windmill-queue",
     "./windmill-worker",
@@ -67,14 +54,12 @@ members = [
     "./parsers/windmill-parser-py",
     "./parsers/windmill-parser-py-imports",
     "./parsers/windmill-sql-datatype-parser-wasm",
-    "./parsers/windmill-parser-yaml", "windmill-macros", "parsers/windmill-parser-nu",
-    "./windmill-test-utils",
-    "./windmill-api-integration-tests",
+    "./parsers/windmill-parser-yaml", "windmill-macros", "parsers/windmill-parser-nu"
 ]
 exclude = ["./windmill-duckdb-ffi-internal"]
 
 [workspace.package]
-version = "1.633.1"
+version = "1.628.3"
 authors = ["Ruben Fiszel <ruben@windmill.dev>"]
 edition = "2021"
 
@@ -95,9 +80,9 @@ lto = "thin"
 
 [features]
 default = []
-private = ["windmill-api/private", "windmill-api-agent-workers?/private", "windmill-autoscaling/private", "windmill-common/private", "windmill-git-sync/private", "windmill-indexer/private", "windmill-queue/private", "windmill-worker/private", "windmill-test-utils/private"]
-agent_worker_server = ["windmill-api/agent_worker_server", "dep:windmill-api-agent-workers", "windmill-test-utils/agent_worker_server"]
-enterprise = ["windmill-worker/enterprise", "windmill-queue/enterprise", "windmill-api/enterprise", "windmill-api-agent-workers?/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "windmill-git-sync/enterprise", "windmill-common/prometheus", "windmill-common/enterprise"]
+private = ["windmill-api/private", "windmill-autoscaling/private", "windmill-common/private", "windmill-git-sync/private", "windmill-indexer/private", "windmill-queue/private", "windmill-worker/private"]
+agent_worker_server = ["windmill-api/agent_worker_server"]
+enterprise = ["windmill-worker/enterprise", "windmill-queue/enterprise", "windmill-api/enterprise", "dep:windmill-autoscaling", "windmill-autoscaling/enterprise", "windmill-git-sync/enterprise", "windmill-common/prometheus", "windmill-common/enterprise"]
 local_reports = ["windmill-common/local_reports"]
 enterprise_saml = ["windmill-api/enterprise_saml", "oauth2"]
 stripe = ["windmill-api/stripe"]
@@ -112,7 +97,7 @@ cloud = ["windmill-queue/cloud", "windmill-worker/cloud", "windmill-common/cloud
 jemalloc = ["windmill-common/jemalloc", "dep:tikv-jemallocator", "dep:tikv-jemalloc-sys", "dep:tikv-jemalloc-ctl"]
 tantivy = ["dep:windmill-indexer", "windmill-api/tantivy", "windmill-indexer/enterprise", "windmill-indexer/parquet", "windmill-common/tantivy", "enterprise", "parquet"]
 sqlx = ["windmill-worker/sqlx"]
-deno_core = ["windmill-worker/deno_core", "dep:windmill-runtime-nativets", "windmill-test-utils/deno_core"]
+deno_core = ["windmill-worker/deno_core", "dep:windmill-runtime-nativets"]
 deno_core_mac = ["deno_core", "windmill-worker/libffi_mac"]
 kafka = ["windmill-api/kafka"]
 kafka-gssapi = ["windmill-api/kafka-gssapi"]
@@ -129,7 +114,7 @@ native_trigger = ["windmill-api/native_trigger"]
 sqs_trigger = ["windmill-api/sqs_trigger", "windmill-common/aws_auth", "windmill-api/openidconnect"]
 gcp_trigger = ["windmill-api/gcp_trigger"]
 smtp = ["windmill-api/smtp", "windmill-common/smtp", "windmill-queue/smtp"]
-license = ["windmill-api/license", "windmill-api-settings/license"]
+license = ["windmill-api/license"]
 oauth2 = ["windmill-api/oauth2"]
 zip = ["windmill-api/zip"]
 static_frontend = ["windmill-api/static_frontend"]
@@ -137,7 +122,7 @@ scoped_cache = ["windmill-common/scoped_cache"]
 no_auth = ["windmill-api/no_auth"]
 private_registry_test = []
 # Languages
-python = ["windmill-worker/python", "windmill-api/python", "windmill-test-utils/python"]
+python = ["windmill-worker/python", "windmill-api/python"]
 rust = ["windmill-worker/rust"]
 mysql = ["windmill-worker/mysql"]
 oracledb = ["windmill-worker/oracledb"]
@@ -175,14 +160,13 @@ oss = ["oss_core", "all_languages", "no_auth"]
 ce_rpi = ["ce_core", "all_languages"]
 ce = ["ce_rpi", "jemalloc", "dind", "agent_worker_server"]
 # Edition meta-features: EE variants
-ee = ["ce", "ee_core", "ee_server", "kafka-gssapi"]
-ee_rhel = ["ce_core", "ee_core", "kafka-gssapi", "all_languages"]
+ee = ["ce", "ee_core", "ee_server"]
+ee_rhel = ["ce_core", "ee_core", "all_languages"]
 ee_windows = ["ce_core", "ee_core", "all_languages_windows"]
 all_sqlx_features = ["all_languages", "enterprise", "enterprise_saml", "embedding", "parquet", "prometheus", "flow_testing",
  "openidconnect", "cloud", "jemalloc", "tantivy", "sqlx", "kafka", "kafka-gssapi", "nats", "otel", "dind", "websocket", "http_trigger",
   "postgres_trigger", "mcp", "mqtt_trigger", "sqs_trigger", "gcp_trigger", "smtp", "stripe",
-   "license", "oauth2", "zip", "static_frontend", "scoped_cache", "agent_worker_server", "bedrock", "native_trigger", "quickjs",
-   "windmill-git-sync/all_sqlx_features"]
+   "license", "oauth2", "zip", "static_frontend", "scoped_cache", "agent_worker_server", "bedrock", "native_trigger", "quickjs"]
 
 [patch.crates-io]
 object_store = { git = "https://github.com/apache/arrow-rs-object-store", rev = "36752c975d4f29e20b57c91f81a10872dcd48ae7" }
@@ -198,8 +182,6 @@ windmill-queue.workspace = true
 windmill-common = { workspace = true, default-features = false }
 windmill-git-sync.workspace = true
 windmill-api = { workspace = true, default-features = false }
-windmill-api-agent-workers = { workspace = true, optional = true }
-windmill-api-settings.workspace = true
 windmill-worker.workspace = true
 windmill-indexer = { workspace = true, optional = true }
 windmill-autoscaling = { workspace = true, optional = true }
@@ -243,17 +225,10 @@ serde_json.workspace = true
 reqwest.workspace = true
 windmill-queue = { workspace = true, features = ["failpoints"] }
 windmill-dep-map.workspace = true
-windmill-test-utils.workspace = true
 axum.workspace = true
 serde.workspace = true
 windmill-api-client.workspace = true
 tempfile.workspace = true
-rumqttc.workspace = true
-rdkafka.workspace = true
-async-nats.workspace = true
-aws-sdk-sqs.workspace = true
-aws-config.workspace = true
-aws-credential-types.workspace = true
 
 
 [workspace.dependencies]
@@ -272,7 +247,6 @@ windmill-oauth = {path = "./windmill-oauth"}
 windmill-macros = {path = "./windmill-macros"}
 windmill-api-auth = { path = "./windmill-api-auth" }
 windmill-api-scripts = { path = "./windmill-api-scripts" }
-windmill-api-flows = { path = "./windmill-api-flows" }
 windmill-api-users = { path = "./windmill-api-users" }
 windmill-api-workspaces = { path = "./windmill-api-workspaces" }
 windmill-api-groups = { path = "./windmill-api-groups" }
@@ -289,19 +263,7 @@ windmill-trigger-sqs = { path = "./windmill-trigger-sqs" }
 windmill-trigger-gcp = { path = "./windmill-trigger-gcp" }
 windmill-trigger-http = { path = "./windmill-trigger-http" }
 windmill-native-triggers = { path = "./windmill-native-triggers" }
-windmill-alerting = { path = "./windmill-alerting" }
-windmill-api-agent-workers = { path = "./windmill-api-agent-workers" }
-windmill-api-assets = { path = "./windmill-api-assets" }
-windmill-api-configs = { path = "./windmill-api-configs" }
-windmill-api-debug = { path = "./windmill-api-debug" }
 windmill-api-embeddings = { path = "./windmill-api-embeddings" }
-windmill-api-flow-conversations = { path = "./windmill-api-flow-conversations" }
-windmill-api-inputs = { path = "./windmill-api-inputs" }
-windmill-api-npm-proxy = { path = "./windmill-api-npm-proxy" }
-windmill-api-openapi = { path = "./windmill-api-openapi" }
-windmill-api-schedule = { path = "./windmill-api-schedule" }
-windmill-api-settings = { path = "./windmill-api-settings" }
-windmill-api-workers = { path = "./windmill-api-workers" }
 windmill-store = { path = "./windmill-store" }
 windmill-parser = { path = "./parsers/windmill-parser" }
 windmill-parser-ts = { path = "./parsers/windmill-parser-ts" }
@@ -321,7 +283,6 @@ windmill-parser-php = { path = "./parsers/windmill-parser-php" }
 windmill-jseval = { path = "./windmill-jseval" }
 windmill-runtime-nativets = { path = "./windmill-runtime-nativets" }
 windmill-api-client = { path = "./windmill-api-client" }
-windmill-test-utils = { path = "./windmill-test-utils" }
 
 reqwest-retry = "^0"
 reqwest-middleware = { version = "^0", features = ["json"] }
@@ -452,7 +413,7 @@ const_format = { version = "0.2.35", features = ["rust_1_64", "rust_1_51"] }
 const-str = "0.5"
 constant_time_eq = "0.3.1"
 rsa = "^0"
-aes-gcm = "0.10.3"
+aes-gcm = "^0"
 async_zip = { version = "0.0.17", features = ["tokio", "tokio-fs", "deflate", "chrono"] }
 once_cell = "1.17.1"
 dashmap = "6.1.0"
@@ -502,7 +463,7 @@ nkeys = "0.4.4"
 nu-parser = { version = "0.101.0", default-features = false }
 globset = "0.4.16"
 croner = "2.2.0"
-rmcp = { version = "=0.15.0", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
+rmcp = { version = "^0", features = ["client", "transport-streamable-http-client", "transport-streamable-http-client-reqwest"] }
 rquickjs = { version = "0.8", features = ["futures", "parallel", "macro"] }
 process-wrap = { version = "8.2.1", features = ["tokio1"] }
 

backend/all_features_oss.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# This script outputs all features except private. Usage :
+#  > cargo build --features $(./all_features_oss.sh)
+
+# Path to the Cargo.toml file
+CARGO_TOML_PATH="./Cargo.toml"
+
+# Extract features from Cargo.toml and output them separated by commas
+if [[ -f "$CARGO_TOML_PATH" ]]; then
+    grep -A 100 '\[features\]' "$CARGO_TOML_PATH" | \
+    sed -n '/\[features\]/,/^\[/p' | \
+    grep -E '^[a-zA-Z0-9_-]+' | \
+    grep -v 'private' | \
+    grep -v 'benchmark' | \
+    cut -d' ' -f1 | \
+    paste -sd ',' -
+else
+    echo "Cargo.toml not found at $CARGO_TOML_PATH"
+    exit 1
+fi

backend/ee-repo-ref.txt

@@ -1 +1 @@
-e7f80bca9320580e1cb96b4f4ca9942649abce7f
+cd2713671bc7ac5762302704ee4ecb81e023301f

backend/generate_mcp_endpoints_tools/generate_mcp_tools.py

@@ -29,39 +29,7 @@ def load_openapi_spec(file_path: str) -> Dict[str, Any]:
         print(f"Error loading OpenAPI spec: {e}", file=sys.stderr)
         sys.exit(1)
 
-def flatten_allof_schema(schema: Dict[str, Any]) -> Dict[str, Any]:
-    """Flatten an allOf schema into a single object schema by merging all properties."""
-    if 'allOf' not in schema:
-        return schema
-
-    merged = {"type": "object", "properties": {}, "required": []}
-
-    def collect_from(s: Dict[str, Any]):
-        if 'allOf' in s:
-            for item in s['allOf']:
-                if isinstance(item, dict):
-                    collect_from(item)
-        if 'properties' in s:
-            merged['properties'].update(s['properties'])
-        if 'required' in s and isinstance(s['required'], list):
-            merged['required'].extend(s['required'])
-        if 'description' in s and 'description' not in merged:
-            merged['description'] = s['description']
-
-    collect_from(schema)
-
-    # Preserve additional top-level keys from the original schema
-    preserved_keys = {'additionalProperties', 'title', 'nullable', 'default', 'example'}
-    for key in preserved_keys:
-        if key in schema and key not in merged:
-            merged[key] = schema[key]
-
-    if not merged['required']:
-        del merged['required']
-
-    return merged
-
-def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Optional[Dict[str, Any]], spec: Dict[str, Any], required_fields: Optional[List[str]] = None, base_path: str = "", include_fields: Optional[List[str]] = None, opaque_fields: Optional[List[str]] = None, include_query_params: Optional[List[str]] = None) -> tuple:
+def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Optional[Dict[str, Any]], spec: Dict[str, Any], required_fields: Optional[List[str]] = None, base_path: str = "") -> tuple:
     """Extract separate schemas for path parameters, query parameters, and request body."""
     path_params_schema = {
         "type": "object",
@@ -104,7 +72,7 @@ def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Opt
                 path_params_schema['properties'][param_name] = param_schema
                 if param_required:
                     path_params_schema['required'].append(param_name)
-        elif param_in == 'query' and (include_query_params is None or param_name in include_query_params):
+        elif param_in == 'query':
             query_params_schema['properties'][param_name] = param_schema
             if param_required:
                 query_params_schema['required'].append(param_name)
@@ -112,28 +80,7 @@ def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Opt
     # Process request body if present
     if request_body:
         body_schema = extract_request_body_schema(request_body, spec, base_path)
-
-        # Flatten allOf schemas into a single object schema for filtering
-        if body_schema and (include_fields is not None or opaque_fields):
-            body_schema = flatten_allof_schema(body_schema)
-
-        # Apply include_fields filter: only keep listed top-level properties
-        if body_schema and include_fields is not None and 'properties' in body_schema:
-            body_schema['properties'] = {
-                k: v for k, v in body_schema['properties'].items()
-                if k in include_fields
-            }
-            if 'required' in body_schema:
-                body_schema['required'] = [
-                    r for r in body_schema['required'] if r in include_fields
-                ]
-
-        # Apply opaque_fields: simplify listed properties to {"type": "object"}
-        if body_schema and opaque_fields and 'properties' in body_schema:
-            for field in opaque_fields:
-                if field in body_schema['properties']:
-                    body_schema['properties'][field] = {"type": "object"}
-
+        
         # If we have required fields specified and a body schema, update the required array
         if body_schema and required_fields:
             if 'required' not in body_schema:
@@ -148,60 +95,11 @@ def extract_separate_schemas(parameters: List[Dict[str, Any]], request_body: Opt
                     # Log warning when a required field is missing from schema properties
                     print(f"Warning: Required field '{field}' not found in body schema properties", file=sys.stderr)
     
-    # Sanitize empty schemas for JSON Schema draft 2020-12 compliance
-    path_params_schema = sanitize_empty_schemas(path_params_schema)
-    query_params_schema = sanitize_empty_schemas(query_params_schema)
-    body_schema = sanitize_empty_schemas(body_schema)
-
-    # Convert enums to descriptions for client compatibility
-    path_params_schema = convert_enums_to_descriptions(path_params_schema)
-    query_params_schema = convert_enums_to_descriptions(query_params_schema)
-    body_schema = convert_enums_to_descriptions(body_schema)
-
-    # Detect overlapping property names across schemas and rename with suffixes
-    path_keys = set(path_params_schema['properties'].keys()) if path_params_schema and path_params_schema.get('properties') else set()
-    query_keys = set(query_params_schema['properties'].keys()) if query_params_schema and query_params_schema.get('properties') else set()
-    body_keys = set(body_schema['properties'].keys()) if body_schema and body_schema.get('properties') else set()
-
-    conflicts = (path_keys & query_keys) | (path_keys & body_keys) | (query_keys & body_keys)
-
-    path_field_renames = {}
-    query_field_renames = {}
-    body_field_renames = {}
-
-    for field in conflicts:
-        schemas_and_renames = [
-            (path_params_schema, path_keys, '__path', path_field_renames),
-            (query_params_schema, query_keys, '__query', query_field_renames),
-            (body_schema, body_keys, '__body', body_field_renames),
-        ]
-        for schema, keys, suffix, renames_map in schemas_and_renames:
-            if field in keys and schema and 'properties' in schema:
-                new_name = field + suffix
-                # Rename in properties
-                schema['properties'][new_name] = schema['properties'].pop(field)
-                # Update description to clarify the renamed field
-                if 'description' not in schema['properties'][new_name]:
-                    schema['properties'][new_name] = dict(schema['properties'][new_name])
-                prop = schema['properties'][new_name]
-                if isinstance(prop, dict):
-                    existing_desc = prop.get('description', '')
-                    location = suffix.lstrip('_')
-                    if not existing_desc:
-                        prop['description'] = f"({location} parameter)"
-                    else:
-                        prop['description'] = f"{existing_desc} ({location} parameter)"
-                # Rename in required array
-                if 'required' in schema and field in schema['required']:
-                    schema['required'] = [new_name if r == field else r for r in schema['required']]
-                # Store the reverse mapping: renamed -> original
-                renames_map[new_name] = field
-
     # Return None for empty schemas
-    path_params_schema = path_params_schema if path_params_schema and path_params_schema.get('properties') else None
-    query_params_schema = query_params_schema if query_params_schema and query_params_schema.get('properties') else None
-
-    return (path_params_schema, query_params_schema, body_schema, path_field_renames, query_field_renames, body_field_renames)
+    path_params_schema = path_params_schema if path_params_schema['properties'] else None
+    query_params_schema = query_params_schema if query_params_schema['properties'] else None
+    
+    return (path_params_schema, query_params_schema, body_schema)
 
 # Cache for loaded external files
 _external_file_cache: Dict[str, Dict[str, Any]] = {}
@@ -262,25 +160,18 @@ def resolve_ref(ref_path: str, spec: Dict[str, Any], base_path: str = "") -> tup
 
     return (current if isinstance(current, dict) else None), spec
 
-def resolve_schema_refs(schema: Dict[str, Any], spec: Dict[str, Any], base_path: str = "", _visited_refs: Optional[set] = None) -> Dict[str, Any]:
+def resolve_schema_refs(schema: Dict[str, Any], spec: Dict[str, Any], base_path: str = "") -> Dict[str, Any]:
     """Recursively resolve all $ref references in a schema."""
-    if _visited_refs is None:
-        _visited_refs = set()
-
     if not isinstance(schema, dict):
         return schema
 
     # If this is a $ref, resolve it
     if '$ref' in schema:
         ref_path = schema['$ref']
-        if ref_path in _visited_refs:
-            # Circular reference detected - return empty object to break the cycle
-            return {"type": "object"}
-        _visited_refs = _visited_refs | {ref_path}
         resolved, resolved_spec = resolve_ref(ref_path, spec, base_path)
         if resolved:
             # Recursively resolve any refs in the resolved schema using the appropriate spec
-            return resolve_schema_refs(resolved, resolved_spec, base_path, _visited_refs)
+            return resolve_schema_refs(resolved, resolved_spec, base_path)
         else:
             print(f"Warning: Could not resolve $ref: {ref_path}")
             return schema
@@ -289,10 +180,10 @@ def resolve_schema_refs(schema: Dict[str, Any], spec: Dict[str, Any], base_path:
     resolved_schema = {}
     for key, value in schema.items():
         if isinstance(value, dict):
-            resolved_schema[key] = resolve_schema_refs(value, spec, base_path, _visited_refs)
+            resolved_schema[key] = resolve_schema_refs(value, spec, base_path)
         elif isinstance(value, list):
             resolved_schema[key] = [
-                resolve_schema_refs(item, spec, base_path, _visited_refs) if isinstance(item, dict) else item
+                resolve_schema_refs(item, spec, base_path) if isinstance(item, dict) else item
                 for item in value
             ]
         else:
@@ -300,56 +191,6 @@ def resolve_schema_refs(schema: Dict[str, Any], spec: Dict[str, Any], base_path:
 
     return resolved_schema
 
-def convert_enums_to_descriptions(schema: Any) -> Any:
-    """Recursively convert enum arrays into description text to avoid client compatibility issues."""
-    if isinstance(schema, list):
-        return [convert_enums_to_descriptions(item) for item in schema]
-    if not isinstance(schema, dict):
-        return schema
-
-    result = {}
-    enum_value = None
-    # First pass: copy all non-enum keys so 'description' is available before enum processing
-    for key, value in schema.items():
-        if key == 'enum':
-            enum_value = value
-        else:
-            result[key] = convert_enums_to_descriptions(value)
-
-    # Second pass: process enum using the already-copied description
-    if enum_value is not None:
-        values_str = ', '.join(str(v) for v in enum_value)
-        existing = result.get('description', '')
-        enum_desc = f"Possible values: {values_str}"
-        result['description'] = f"{existing}. {enum_desc}" if existing else enum_desc
-
-    return result
-
-def sanitize_empty_schemas(schema: Any) -> Any:
-    """Replace empty {} schemas with valid JSON Schema draft 2020-12 equivalents.
-
-    In OpenAPI, {} means 'any value' but strict JSON Schema validators (e.g. Claude's API)
-    reject empty objects. This converts them to proper schemas.
-    """
-    if isinstance(schema, list):
-        return [sanitize_empty_schemas(item) for item in schema]
-    if not isinstance(schema, dict):
-        return schema
-
-    result = {}
-    for key, value in schema.items():
-        if key == 'additionalProperties' and isinstance(value, dict) and len(value) == 0:
-            result[key] = True
-        elif key == 'properties' and isinstance(value, dict):
-            # properties is a map of name -> schema; sanitize each property schema
-            result[key] = {
-                k: {"type": "object"} if isinstance(v, dict) and len(v) == 0 else sanitize_empty_schemas(v)
-                for k, v in value.items()
-            }
-        else:
-            result[key] = sanitize_empty_schemas(value)
-    return result
-
 def extract_request_body_schema(request_body: Dict[str, Any], spec: Dict[str, Any], base_path: str = "") -> Optional[Dict[str, Any]]:
     """Extract request body schema from OpenAPI requestBody definition and resolve refs."""
     if not request_body:
@@ -402,9 +243,6 @@ def find_mcp_tools(spec: Dict[str, Any]) -> List[Dict[str, Any]]:
                     'parameters': operation.get('parameters', []),
                     'requestBody': operation.get('requestBody'),
                     'required_fields': operation.get('x-mcp-required-fields', []),
-                    'include_fields': operation.get('x-mcp-tool-include-fields'),
-                    'opaque_fields': operation.get('x-mcp-tool-opaque-fields'),
-                    'include_query_params': operation.get('x-mcp-tool-include-query-params'),
                 }
                 tools.append(tool)
     
@@ -440,18 +278,14 @@ export const mcpEndpointTools: EndpointTool[] = [];
         method = tool['method'].upper()
 
         # Generate separate schemas
-        path_params_schema, query_params_schema, body_schema, path_field_renames, query_field_renames, body_field_renames = extract_separate_schemas(
-            tool['parameters'], tool['requestBody'], spec, tool['required_fields'], base_path,
-            tool.get('include_fields'), tool.get('opaque_fields'), tool.get('include_query_params')
+        path_params_schema, query_params_schema, body_schema = extract_separate_schemas(
+            tool['parameters'], tool['requestBody'], spec, tool['required_fields'], base_path
         )
 
         # Convert schemas to TypeScript - use 'as const' for better type inference
         path_params_ts = json.dumps(path_params_schema, indent=8) if path_params_schema else "undefined"
         query_params_ts = json.dumps(query_params_schema, indent=8) if query_params_schema else "undefined"
         body_schema_ts = json.dumps(body_schema, indent=8) if body_schema else "undefined"
-        path_field_renames_ts = json.dumps(path_field_renames, indent=8) if path_field_renames else "undefined"
-        query_field_renames_ts = json.dumps(query_field_renames, indent=8) if query_field_renames else "undefined"
-        body_field_renames_ts = json.dumps(body_field_renames, indent=8) if body_field_renames else "undefined"
 
         # Generate tool definition
         tool_def = f"""    {{
@@ -462,10 +296,7 @@ export const mcpEndpointTools: EndpointTool[] = [];
         method: "{method}",
         pathParamsSchema: {path_params_ts},
         queryParamsSchema: {query_params_ts},
-        bodySchema: {body_schema_ts},
-        pathFieldRenames: {path_field_renames_ts},
-        queryFieldRenames: {query_field_renames_ts},
-        bodyFieldRenames: {body_field_renames_ts}
+        bodySchema: {body_schema_ts}
     }}"""
         tool_definitions.append(tool_def)
 
@@ -484,9 +315,6 @@ export interface EndpointTool {{
     pathParamsSchema?: object;
     queryParamsSchema?: object;
     bodySchema?: object;
-    pathFieldRenames?: Record<string, string>;
-    queryFieldRenames?: Record<string, string>;
-    bodyFieldRenames?: Record<string, string>;
 }}
 
 export const mcpEndpointTools: EndpointTool[] = [
@@ -516,17 +344,13 @@ pub fn all_tools() -> Vec<EndpointTool> {{
         method = tool['method'].upper()
 
         # Generate separate schemas
-        path_params_schema, query_params_schema, body_schema, path_field_renames, query_field_renames, body_field_renames = extract_separate_schemas(
-            tool['parameters'], tool['requestBody'], spec, tool['required_fields'], base_path,
-            tool.get('include_fields'), tool.get('opaque_fields'), tool.get('include_query_params')
+        path_params_schema, query_params_schema, body_schema = extract_separate_schemas(
+            tool['parameters'], tool['requestBody'], spec, tool['required_fields'], base_path
         )
 
         path_params_rust = schema_to_rust_value(path_params_schema)
         query_params_rust = schema_to_rust_value(query_params_schema)
         body_schema_rust = schema_to_rust_value(body_schema)
-        path_field_renames_rust = schema_to_rust_value(path_field_renames if path_field_renames else None)
-        query_field_renames_rust = schema_to_rust_value(query_field_renames if query_field_renames else None)
-        body_field_renames_rust = schema_to_rust_value(body_field_renames if body_field_renames else None)
 
         # Generate tool definition
         tool_def = f"""    EndpointTool {{
@@ -538,9 +362,6 @@ pub fn all_tools() -> Vec<EndpointTool> {{
         path_params_schema: {path_params_rust},
         query_params_schema: {query_params_rust},
         body_schema: {body_schema_rust},
-        path_field_renames: {path_field_renames_rust},
-        query_field_renames: {query_field_renames_rust},
-        body_field_renames: {body_field_renames_rust},
     }}"""
         tool_definitions.append(tool_def)
 

backend/migrations/20260114180000_add_protection_rules.down.sql

@@ -1,2 +0,0 @@
--- Drop the workspace_protection_rule table and its indexes
-DROP TABLE IF EXISTS workspace_protection_rule;

backend/migrations/20260114180000_add_protection_rules.up.sql

@@ -1,10 +0,0 @@
--- Add workspace_protection_rule table for fine-grained access control
-CREATE TABLE workspace_protection_rule (
-    workspace_id VARCHAR(50) NOT NULL REFERENCES workspace(id) ON DELETE CASCADE,
-    name VARCHAR(255) NOT NULL,
-    rules INTEGER NOT NULL,
-    bypass_groups TEXT[] NOT NULL DEFAULT '{}',
-    bypass_users TEXT[] NOT NULL DEFAULT '{}',
-    created_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
-    PRIMARY KEY (workspace_id, name)
-);

backend/migrations/20260204181621_delete_saved_telemetry.down.sql

@@ -1 +0,0 @@
--- No-op: cannot restore deleted telemetry data

backend/migrations/20260204181621_delete_saved_telemetry.up.sql

@@ -1,2 +0,0 @@
--- Delete all saved telemetry data from metrics table
-DELETE FROM metrics WHERE id = 'telemetry';

backend/parsers/windmill-parser-py-imports/src/mapping.rs

@@ -328,7 +328,6 @@ pub static FULL_IMPORTS_MAP: PyMap = phf_map! {
     "azure.keyvault.secrets" => "azure-keyvault-secrets",
     "azure.storage.blob" => "azure-storage-blob",
     "azure.storage.filedatalake" => "azure-storage-file-datalake",
-    "azure.identity" => "azure-identity",
     // Add new entry here ^
 };
 
@@ -382,6 +381,5 @@ pub static SHORT_IMPORTS_MAP: PyMap = phf_map! {
     "docx" => "python-docx",
     "vt" => "vt-py",
     "grpc" => "grpcio",
-    "serpapi" => "google-search-results",
     // Add new entry here ^
 };

backend/parsers/windmill-parser-py/src/lib.rs

@@ -422,15 +422,11 @@ fn parse_expr(
     match e.as_ref() {
         Expr::Name(ExprName { id, .. }) => (parse_typ(id.as_ref(), enums, module), false),
         Expr::Attribute(x) => {
-            if let Some(name) = x.value.as_name_expr() {
-                match name.id.as_str() {
-                    "wmill" => (parse_typ(x.attr.as_str(), enums, module), false),
-                    "datetime" => {
-                        let full_name = format!("datetime.{}", x.attr.as_str());
-                        (parse_typ(&full_name, enums, module), false)
-                    }
-                    _ => (Typ::Unknown, false),
-                }
+            if x.value
+                .as_name_expr()
+                .is_some_and(|x| x.id.as_str() == "wmill")
+            {
+                (parse_typ(x.attr.as_str(), enums, module), false)
             } else {
                 (Typ::Unknown, false)
             }
@@ -497,8 +493,6 @@ fn parse_typ(id: &str, enums: &HashMap<String, EnumInfo>, module: Option<&[Stmt]
         "bytes" => Typ::Bytes,
         "datetime" => Typ::Datetime,
         "datetime.datetime" => Typ::Datetime,
-        "date" => Typ::Date,
-        "datetime.date" => Typ::Date,
         "Sql" | "sql" => Typ::Sql,
         x @ _ if x.starts_with("DynSelect_") => {
             Typ::DynSelect(x.strip_prefix("DynSelect_").unwrap().to_string())
@@ -626,7 +620,7 @@ def main(test1: str, name: datetime.datetime = datetime.now(), byte: bytes = byt
                     Arg {
                         otyp: None,
                         name: "name".to_string(),
-                        typ: Typ::Datetime,
+                        typ: Typ::Unknown,
                         default: Some(json!("<function call>")),
                         has_default: true,
                         oidx: None
@@ -715,7 +709,7 @@ def main(test1: str,
                     Arg {
                         otyp: None,
                         name: "name".to_string(),
-                        typ: Typ::Datetime,
+                        typ: Typ::Unknown,
                         default: Some(json!("<function call>")),
                         has_default: true,
                         oidx: None

backend/parsers/windmill-parser-py/src/pydantic_parser.rs

@@ -295,7 +295,6 @@ fn extract_field_type(
             "bool" => Typ::Bool,
             "bytes" => Typ::Bytes,
             "datetime" => Typ::Datetime,
-            "date" => Typ::Date,
             "Any" => Typ::Unknown, // typing.Any maps to Unknown
             // Custom class - check if it's a model
             custom_type => {

backend/parsers/windmill-parser/src/lib.rs

@@ -65,7 +65,6 @@ pub enum Typ {
     List(Box<Typ>),
     Bytes,
     Datetime,
-    Date,
     Resource(String),
     Email,
     Sql,

backend/parsers/windmill-sql-datatype-parser-wasm/src/lib.rs

@@ -10,7 +10,6 @@ fn to_str(typ: Typ) -> String {
         Typ::List(t) => format!("list-{}", to_str(*t)),
         Typ::Bytes => "bytes".to_string(),
         Typ::Datetime => "datetime".to_string(),
-        Typ::Date => "date".to_string(),
         _ => "unknown".to_string(),
     }
 }

backend/src/db_connect.rs

@@ -1,159 +0,0 @@
-use windmill_common::{
-    error::{self, Error},
-    get_database_url, DatabaseUrl,
-};
-
-pub const DEFAULT_MAX_CONNECTIONS_SERVER: u32 = 50;
-pub const DEFAULT_MAX_CONNECTIONS_WORKER: u32 = 5;
-pub const DEFAULT_MAX_CONNECTIONS_INDEXER: u32 = 5;
-
-pub async fn initial_connection() -> Result<sqlx::Pool<sqlx::Postgres>, error::Error> {
-    let connect_options = get_database_url().await?.connect_options().await?;
-    sqlx::postgres::PgPoolOptions::new()
-        .max_connections(2)
-        .connect_with(connect_options)
-        .await
-        .map_err(|err| Error::ConnectingToDatabase(err.to_string()))
-}
-
-pub async fn connect_db(
-    server_mode: bool,
-    indexer_mode: bool,
-    worker_mode: bool,
-    #[cfg(feature = "private")] mut killpill_rx: tokio::sync::broadcast::Receiver<()>,
-) -> anyhow::Result<sqlx::Pool<sqlx::Postgres>> {
-    use anyhow::Context;
-
-    let database_url = get_database_url().await?;
-
-    let max_connections = match std::env::var("DATABASE_CONNECTIONS") {
-        Ok(n) => n.parse::<u32>().context("invalid DATABASE_CONNECTIONS")?,
-        Err(_) => {
-            if server_mode {
-                DEFAULT_MAX_CONNECTIONS_SERVER
-            } else if indexer_mode {
-                DEFAULT_MAX_CONNECTIONS_INDEXER
-            } else {
-                DEFAULT_MAX_CONNECTIONS_WORKER
-                    + std::env::var("NUM_WORKERS")
-                        .ok()
-                        .map(|x| x.parse().ok())
-                        .flatten()
-                        .unwrap_or(1)
-                    - 1
-            }
-        }
-    };
-
-    let pool = connect(database_url.clone(), max_connections, worker_mode).await?;
-    #[cfg(all(feature = "enterprise", feature = "private"))]
-    let pool2 = pool.clone();
-    #[cfg(all(feature = "enterprise", feature = "private"))]
-    if let DatabaseUrl::IamRds(database_url) = database_url {
-        tokio::spawn(async move {
-            loop {
-                tokio::select! {
-                    _ = killpill_rx.recv() => {
-                        break;
-                    }
-                    _ = tokio::time::sleep(std::time::Duration::from_secs(10)) => {
-                        let needs_refresh = {
-                            let read_guard = database_url.read().await;
-                            read_guard.needs_refresh()
-                        };
-                        if needs_refresh {
-                            let new_url = tokio::time::timeout(std::time::Duration::from_secs(10), get_database_url()).await;
-                            match new_url {
-                                Ok(Ok(new_url)) => {
-                                    match new_url.connect_options().await {
-                                        Ok(connect_options) => {
-                                            pool2.set_connect_options(connect_options);
-                                            tracing::info!("Refreshed IAM RDS URL successfully");
-                                        }
-                                        Err(e) => {
-                                            tracing::error!("Error getting IAM RDS connect options, retrying in 10s: {}", e);
-                                            continue;
-                                        }
-                                    }
-                                }
-                                Ok(Err(e)) => {
-                                    tracing::error!("Error refreshing IAM RDS URL, trying again in 10s: {}", e);
-                                    continue;
-                                }
-                                Err(e) => {
-                                    tracing::error!("Timeout after 10s refreshing IAM RDS URL, trying again in 10 seconds: {}", e);
-                                    continue;
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        });
-    }
-
-    Ok(pool)
-}
-
-pub async fn connect(
-    database_url: DatabaseUrl,
-    max_connections: u32,
-    worker_mode: bool,
-) -> Result<sqlx::Pool<sqlx::Postgres>, error::Error> {
-    use sqlx::Executor;
-    use std::time::Duration;
-    let mut pool_options = sqlx::postgres::PgPoolOptions::new()
-        .min_connections((max_connections / 5).clamp(1, max_connections))
-        .max_connections(max_connections)
-        .max_lifetime(Duration::from_secs(30 * 60)); // 30 mins
-    if worker_mode {
-        pool_options = pool_options.idle_timeout(Duration::from_secs(60));
-    }
-    pool_options
-        .after_connect(move |conn, _| {
-            if worker_mode {
-                Box::pin(async move {
-                    if let Err(e) = conn
-                        .execute(
-                            r#"
-        SET enable_seqscan = OFF;
-        SET statement_timeout = '5min';
-        SET idle_in_transaction_session_timeout = '10min';
-        SET tcp_keepalives_idle = 300;
-        SET tcp_keepalives_interval = 60;
-        SET tcp_keepalives_count = 10;"#,
-                        )
-                        .await
-                    {
-                        tracing::error!("Error setting postgres settings: {}", e);
-                    }
-                    Ok(())
-                })
-            } else {
-                Box::pin(async move {
-                    if let Err(e) = conn
-                        .execute(
-                            r#"
-        SET statement_timeout = '5min';
-        SET idle_in_transaction_session_timeout = '10min';
-        SET tcp_keepalives_idle = 300;
-        SET tcp_keepalives_interval = 60;
-        SET tcp_keepalives_count = 10;"#,
-                        )
-                        .await
-                    {
-                        tracing::error!("Error setting postgres settings: {}", e);
-                    }
-                    Ok(())
-                })
-            }
-        })
-        .connect_with(
-            database_url
-                .connect_options()
-                .await?
-                .statement_cache_capacity(400),
-        )
-        .await
-        .map_err(|err| Error::ConnectingToDatabase(err.to_string()))
-}

backend/src/main.rs

@@ -46,8 +46,8 @@ use windmill_common::{
         KEEP_JOB_DIR_SETTING, LICENSE_KEY_SETTING, MAVEN_REPOS_SETTING,
         MONITOR_LOGS_ON_OBJECT_STORE_SETTING, NO_DEFAULT_MAVEN_SETTING,
         NPM_CONFIG_REGISTRY_SETTING, NUGET_CONFIG_SETTING, OAUTH_SETTING, OTEL_SETTING,
-        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, UV_INDEX_STRATEGY_SETTING,
-        POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
+        OTEL_TRACING_PROXY_SETTING, PIP_INDEX_URL_SETTING, POWERSHELL_REPO_PAT_SETTING,
+        POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
         RUBY_REPOS_SETTING, SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, SMTP_SETTING, TEAMS_SETTING,
         TIMEOUT_WAIT_RESULT_SETTING,
@@ -103,7 +103,7 @@ use crate::monitor::{
     reload_jwt_secret_setting, reload_license_key, reload_npm_config_registry_setting,
     reload_otel_tracing_proxy_setting, reload_pip_index_url_setting,
     reload_retention_period_setting, reload_scim_token_setting, reload_smtp_config,
-    reload_uv_index_strategy_setting, reload_worker_config, MonitorIteration,
+    reload_worker_config, MonitorIteration,
 };
 
 #[cfg(feature = "parquet")]
@@ -117,7 +117,6 @@ const BIND_ADDR_ENV: &str = "SERVER_BIND_ADDR";
 
 #[cfg(target_os = "linux")]
 mod cgroups;
-mod db_connect;
 #[cfg(feature = "private")]
 pub mod ee;
 mod ee_oss;
@@ -666,7 +665,7 @@ async fn windmill_main() -> anyhow::Result<()> {
     } else {
         println!("Connecting to database...");
 
-        let db = crate::db_connect::initial_connection().await?;
+        let db = windmill_common::initial_connection().await?;
 
         let num_version = sqlx::query_scalar!("SELECT version()").fetch_one(&db).await;
 
@@ -735,12 +734,8 @@ async fn windmill_main() -> anyhow::Result<()> {
                 .unwrap_or(false);
 
             if !skip_migration {
-                if mode == Mode::Worker {
-                    windmill_api::wait_for_db_migrations(&db, killpill_rx.resubscribe()).await?;
-                } else {
-                    migration_handle =
-                        windmill_api::migrate_db(&db, killpill_rx.resubscribe()).await?;
-                }
+                // migration code to avoid break
+                migration_handle = windmill_api::migrate_db(&db, killpill_rx.resubscribe()).await?;
             } else {
                 tracing::info!("SKIP_MIGRATION set, skipping db migration...")
             }
@@ -775,12 +770,8 @@ async fn windmill_main() -> anyhow::Result<()> {
     let conn = if mode == Mode::Agent {
         conn
     } else {
-        // Drop the initial connection pool before creating the main one.
-        // With low PostgreSQL max_connections, both pools existing simultaneously
-        // can exhaust all available connection slots, causing connect_db to hang.
-        drop(conn);
-
-        let db = crate::db_connect::connect_db(
+        // This time we use a pool of connections
+        let db = windmill_common::connect_db(
             server_mode,
             indexer_mode,
             worker_mode,
@@ -1564,7 +1555,6 @@ async fn process_notify_event(
                 SCIM_TOKEN_SETTING => reload_scim_token_setting(conn).await,
                 EXTRA_PIP_INDEX_URL_SETTING => reload_extra_pip_index_url_setting(conn).await,
                 PIP_INDEX_URL_SETTING => reload_pip_index_url_setting(conn).await,
-                UV_INDEX_STRATEGY_SETTING => reload_uv_index_strategy_setting(conn).await,
                 INSTANCE_PYTHON_VERSION_SETTING => {
                     reload_instance_python_version_setting(conn).await
                 }

backend/src/monitor.rs

@@ -60,7 +60,6 @@ use windmill_common::{
         POWERSHELL_REPO_PAT_SETTING, POWERSHELL_REPO_URL_SETTING, REQUEST_SIZE_LIMIT_SETTING,
         REQUIRE_PREEXISTING_USER_FOR_OAUTH_SETTING, RETENTION_PERIOD_SECS_SETTING,
         SAML_METADATA_SETTING, SCIM_TOKEN_SETTING, TIMEOUT_WAIT_RESULT_SETTING,
-        UV_INDEX_STRATEGY_SETTING,
     },
     indexer::load_indexer_config,
     jwt::JWT_SECRET,
@@ -86,10 +85,10 @@ use windmill_common::{client::AuthedClient, global_settings::APP_WORKSPACED_ROUT
 use windmill_queue::{cancel_job, get_queued_job_v2, SameWorkerPayload};
 use windmill_worker::{
     result_processor::handle_job_error, JobCompletedSender, OtelTracingProxySettings,
-    SameWorkerSender, BUNFIG_INSTALL_SCOPES, CARGO_REGISTRIES, INSTANCE_PYTHON_VERSION,
-    JOB_DEFAULT_TIMEOUT, KEEP_JOB_DIR, MAVEN_REPOS, NO_DEFAULT_MAVEN, NPM_CONFIG_REGISTRY,
-    NUGET_CONFIG, OTEL_TRACING_PROXY_SETTINGS, PIP_EXTRA_INDEX_URL, PIP_INDEX_URL,
-    POWERSHELL_REPO_PAT, POWERSHELL_REPO_URL, UV_INDEX_STRATEGY,
+    SameWorkerSender, BUNFIG_INSTALL_SCOPES, INSTANCE_PYTHON_VERSION, JOB_DEFAULT_TIMEOUT,
+    KEEP_JOB_DIR, MAVEN_REPOS, NO_DEFAULT_MAVEN, NPM_CONFIG_REGISTRY, NUGET_CONFIG,
+    OTEL_TRACING_PROXY_SETTINGS, PIP_EXTRA_INDEX_URL, PIP_INDEX_URL, POWERSHELL_REPO_PAT,
+    POWERSHELL_REPO_URL,
 };
 
 #[cfg(feature = "parquet")]
@@ -318,7 +317,6 @@ pub async fn initial_load(
         reload_job_default_timeout_setting(&conn).await;
         reload_extra_pip_index_url_setting(&conn).await;
         reload_pip_index_url_setting(&conn).await;
-        reload_uv_index_strategy_setting(&conn).await;
         reload_npm_config_registry_setting(&conn).await;
         reload_bunfig_install_scopes_setting(&conn).await;
         reload_instance_python_version_setting(&conn).await;
@@ -328,7 +326,6 @@ pub async fn initial_load(
         reload_maven_repos_setting(&conn).await;
         reload_no_default_maven_setting(&conn).await;
         reload_ruby_repos_setting(&conn).await;
-        reload_cargo_registries_setting(&conn).await;
     }
 }
 
@@ -1106,6 +1103,7 @@ async fn delete_expired_jobs_batch(
             job_retention_secs
         );
 
+        // Delete related records for this batch
         if let Err(e) = sqlx::query!(
             "DELETE FROM job_stats WHERE job_id = ANY($1)",
             &deleted_jobs
@@ -1253,16 +1251,6 @@ pub async fn reload_pip_index_url_setting(conn: &Connection) {
     .await;
 }
 
-pub async fn reload_uv_index_strategy_setting(conn: &Connection) {
-    reload_option_setting_with_tracing(
-        conn,
-        UV_INDEX_STRATEGY_SETTING,
-        "UV_INDEX_STRATEGY",
-        UV_INDEX_STRATEGY.clone(),
-    )
-    .await;
-}
-
 pub async fn reload_instance_python_version_setting(conn: &Connection) {
     reload_option_setting_with_tracing(
         conn,
@@ -1359,16 +1347,6 @@ pub async fn reload_ruby_repos_setting(conn: &Connection) {
     .await;
 }
 
-pub async fn reload_cargo_registries_setting(conn: &Connection) {
-    reload_option_setting_with_tracing(
-        conn,
-        windmill_common::global_settings::CARGO_REGISTRIES_SETTING,
-        "CARGO_REGISTRIES",
-        CARGO_REGISTRIES.clone(),
-    )
-    .await;
-}
-
 pub async fn reload_hub_api_secret_setting(conn: &Connection) {
     reload_option_setting_with_tracing(
         conn,
@@ -1805,19 +1783,6 @@ pub async fn monitor_db(
         }
     };
 
-    let cleanup_job_live_rows_f = async {
-        if server_mode && !initial_load {
-            if let Some(db) = conn.as_sql() {
-                if let Err(e) = cleanup_job_perms_orphaned(&db).await {
-                    tracing::error!("Error cleaning up orphaned job_perms: {:?}", e);
-                }
-                if let Err(e) = cleanup_job_result_stream_orphaned_jobs(&db).await {
-                    tracing::error!("Error cleaning up orphaned job_result_stream_v2: {:?}", e);
-                }
-            }
-        }
-    };
-
     // run every hour (60 minutes / 30 seconds = 120)
     let cleanup_worker_group_stats_f = async {
         if server_mode && iteration.is_some() && iteration.as_ref().unwrap().should_run(120) {
@@ -1991,7 +1956,6 @@ pub async fn monitor_db(
         cleanup_debounce_keys_f,
         cleanup_debounce_keys_completed_f,
         cleanup_flow_iterator_data_f,
-        cleanup_job_live_rows_f,
         cleanup_worker_group_stats_f,
         native_triggers_sync_f,
         cleanup_notify_events_f,
@@ -1999,7 +1963,7 @@ pub async fn monitor_db(
 }
 
 async fn vacuuming_tables(db: &Pool<Postgres>) -> error::Result<()> {
-    sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, job_perms, concurrency_key, log_file, metrics")
+    sqlx::query!("VACUUM v2_job, v2_job_completed, job_result_stream_v2, job_stats, job_logs, concurrency_key, log_file, metrics")
         .execute(db)
         .await?;
     Ok(())
@@ -3098,43 +3062,6 @@ RETURNING key,job_id
     Ok(())
 }
 
-async fn cleanup_job_perms_orphaned(db: &DB) -> error::Result<()> {
-    let result = sqlx::query_scalar!(
-        "DELETE FROM job_perms
-WHERE job_id NOT IN (SELECT id FROM v2_job_queue)
-RETURNING job_id"
-    )
-    .fetch_all(db)
-    .await?;
-
-    if !result.is_empty() {
-        tracing::info!("Cleaned up {} orphaned job_perms rows", result.len());
-    }
-    Ok(())
-}
-
-async fn cleanup_job_result_stream_orphaned_jobs(db: &DB) -> error::Result<()> {
-    let result = sqlx::query!(
-        "DELETE FROM job_result_stream_v2
-         WHERE job_id NOT IN (SELECT id FROM v2_job_queue)
-           AND job_id NOT IN (
-               SELECT id FROM v2_job_completed
-               WHERE completed_at > NOW() - INTERVAL '60 seconds'
-           )
-         RETURNING job_id",
-    )
-    .fetch_all(db)
-    .await?;
-
-    if result.len() > 0 {
-        tracing::info!(
-            "Cleaned up {} orphaned job_result_stream_v2 rows",
-            result.len()
-        );
-    }
-    Ok(())
-}
-
 async fn cleanup_flow_iterator_data_orphaned_jobs(db: &DB) -> error::Result<()> {
     let result = sqlx::query!(
         "

backend/summarize_schema.py

@@ -1,6 +1,6 @@
 # This script is used to summarize the database schema.
 # You can use pg_dump to dump the schema to a file.
-# pg_dump --file "schema.sql" --format=p --large-objects --schema-only --no-owner --no-privileges --no-tablespaces --no-unlogged-table-data --no-comments --no-publications --no-subscriptions --no-security-labels --no-toast-compression --no-table-access-method --verbose --schema "public" "postgresql://postgres:changeme@localhost:5432/windmill"
+# pg_dump --file "schema.sql" --host "localhost" --port "5432" --username "postgres" --no-password --format=c --large-objects --schema-only --no-owner --no-privileges --no-tablespaces --no-unlogged-table-data --no-comments --no-publications --no-subscriptions --no-security-labels --no-toast-compression --no-table-access-method --verbose --schema "public" "windmill"
 # Then you can run python summarize_schema.py schema.sql to get the summarized schema.
 
 import re
@@ -17,7 +17,6 @@ def summarize_schema(file_path):
     # Use state variables to parse multi-line definitions
     current_table = None
     current_enum = None
-    pending_alter_table = None  # For multi-line ALTER TABLE ... ADD CONSTRAINT
 
     with open(file_path, 'r', encoding='utf-8') as f:
         for line in f:
@@ -55,9 +54,6 @@ def summarize_schema(file_path):
                 match_column = re.match(r'^"?(\w+)"?\s+([\w\d\.\[\]\(\)]+)', line)
                 if match_column:
                     col_name = match_column.group(1)
-                    # Skip CONSTRAINT definitions (e.g., CHECK, UNIQUE) mistakenly matched as columns
-                    if col_name.upper() == 'CONSTRAINT':
-                        continue
                     col_type = match_column.group(2)
                     tables[current_table]['columns'].append(f"{col_name} ({col_type})")
                 
@@ -69,22 +65,16 @@ def summarize_schema(file_path):
                     tables[current_table]['pks'].update(pk_cols)
                 continue
             
-            # --- Parse Foreign Keys (defined outside CREATE TABLE, may span 2 lines) ---
-            match_alter = re.match(r"ALTER TABLE ONLY public\.(\w+)$", line)
-            if match_alter:
-                pending_alter_table = match_alter.group(1)
-                continue
-
-            if pending_alter_table:
-                match_fk = re.match(r"ADD CONSTRAINT \w+ FOREIGN KEY \(([\w,\s\"]+)\) REFERENCES public\.(\w+)\(([\w,\s\"]+)\)", line)
-                if match_fk:
-                    from_cols, to_table, to_cols = match_fk.groups()
-                    from_cols_clean = ', '.join([c.strip().strip('"') for c in from_cols.split(',')])
-                    to_cols_clean = ', '.join([c.strip().strip('"') for c in to_cols.split(',')])
-                    fk_string = f"({from_cols_clean}) -> {to_table}({to_cols_clean})"
-                    tables[pending_alter_table]['fks'].append(fk_string)
-                pending_alter_table = None
-                continue
+            # --- Parse Foreign Keys (defined outside CREATE TABLE) ---
+            match_fk = re.match(r"ALTER TABLE ONLY public\.(\w+)\s+ADD CONSTRAINT \w+ FOREIGN KEY \(([\w,\s\"]+)\) REFERENCES public\.(\w+)\(([\w,\s\"]+)\);", line)
+            if match_fk:
+                from_table, from_cols, to_table, to_cols = match_fk.groups()
+                # Clean up column names
+                from_cols_clean = ', '.join([c.strip().strip('"') for c in from_cols.split(',')])
+                to_cols_clean = ', '.join([c.strip().strip('"') for c in to_cols.split(',')])
+                
+                fk_string = f"({from_cols_clean}) -> {to_table}({to_cols_clean})"
+                tables[from_table]['fks'].append(fk_string)
             
             # --- Parse Index definitions ---
             match_index = re.match(r"CREATE (UNIQUE )?INDEX (\w+) ON public\.(\w+) USING (\w+) \((.+)\);", line)
@@ -104,73 +94,44 @@ def summarize_schema(file_path):
 
     return enums, tables
 
-TYPE_ABBREVIATIONS = {
-    'character': 'char',
-    'integer': 'int',
-    'bigint': 'bigint',
-    'smallint': 'smallint',
-    'boolean': 'bool',
-    'timestamp': 'ts',
-    'bytea': 'bytes',
-    'real': 'float',
-    'json': 'json',
-    'jsonb': 'jsonb',
-    'text': 'text',
-    'uuid': 'uuid',
-    'bit(64)': 'bit64',
-}
-
-def shorten_type(col_str):
-    """Shorten a 'name (type)' string to 'name(short_type)'."""
-    match = re.match(r'^(\w+) \((.+)\)$', col_str)
-    if not match:
-        return col_str
-    name, typ = match.group(1), match.group(2)
-    # Strip public. prefix from enum types
-    typ = re.sub(r'^public\.', '', typ)
-    # Apply abbreviations (prefix-based to handle parametrized types like character(64) and array types like integer[])
-    for prefix, abbr in TYPE_ABBREVIATIONS.items():
-        if typ.startswith(prefix):
-            typ = abbr + typ[len(prefix):]
-            break
-    return f"{name}({typ})"
-
 def format_output(enums, tables):
     """
-    Formats the parsed schema data into a compact, LLM-friendly string.
+    Formats the parsed schema data into a clean, readable string.
     """
     output = []
-
-    output.append("# Database Schema")
-    output.append("")
-    output.append("## ENUMs")
+    
+    output.append("### Simplified Database Schema ###")
+    output.append("\n--- Custom Data Types (ENUMs) ---\n")
     if not enums:
-        output.append("(none)")
+        output.append("No custom ENUM types found.")
     else:
         for name, values in sorted(enums.items()):
-            output.append(f"{name}: {', '.join(values)}")
+            output.append(f"{name}:")
+            for v in values:
+                output.append(f"  - {v}")
+            output.append("")
 
-    output.append("")
-    output.append("## Tables")
+    output.append("\n--- Tables and Relationships ---\n")
     if not tables:
-        output.append("(none)")
+        output.append("No tables found.")
     else:
         for name, data in sorted(tables.items()):
-            # Columns: inline, comma-separated, with PK marker and shortened types
-            cols = []
+            output.append(f"TABLE: {name}")
             for col in data['columns']:
-                col_short = shorten_type(col)
                 col_name = col.split(' ')[0]
-                if col_name in data['pks']:
-                    col_short += " PK"
-                cols.append(col_short)
-            output.append(f"{name}: {', '.join(cols)}")
-
-            # Foreign keys on one indented line
+                marker = " (PK)" if col_name in data['pks'] else ""
+                output.append(f"  - {col}{marker}")
+            
             if data['fks']:
-                output.append(f"  FK: {' | '.join(data['fks'])}")
-
-            # Indexes omitted for brevity — query the database for exact index info
+                output.append("  Relationships:")
+                for fk in data['fks']:
+                    output.append(f"    - {fk}")
+            
+            if data['indexes']:
+                output.append("  Indexes:")
+                for idx in data['indexes']:
+                    output.append(f"    - {idx}")
+            output.append("-" * 20)
 
     return "\n".join(output)
 

backend/tests/agent_workers.rs

@@ -1,267 +0,0 @@
-#![cfg(all(feature = "private", feature = "agent_worker_server"))]
-
-use windmill_test_utils::*;
-use serde_json::json;
-use sqlx::{Pool, Postgres};
-use windmill_common::{
-    jobs::{JobPayload, RawCode},
-    scripts::ScriptLang,
-};
-
-fn bun_code(code: &str) -> RawCode {
-    RawCode {
-        hash: None,
-        content: code.to_string(),
-        path: None,
-        language: ScriptLang::Bun,
-        lock: None,
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        concurrency_settings:
-            windmill_common::runnable_settings::ConcurrencySettings::default().into(),
-        debouncing_settings: windmill_common::runnable_settings::DebouncingSettings::default(),
-    }
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_simple_script(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (_client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    let result = RunJob::from(JobPayload::Code(bun_code(
-        "export function main() { return 42; }",
-    )))
-    .run_until_complete(&db, false, port)
-    .await;
-
-    assert!(result.success, "job should succeed");
-    assert_eq!(result.json_result(), Some(json!(42)));
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_script_with_args(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (_client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    let result = RunJob::from(JobPayload::Code(bun_code(
-        "export function main(x: number, y: number) { return x + y; }",
-    )))
-    .arg("x", json!(10))
-    .arg("y", json!(32))
-    .run_until_complete(&db, false, port)
-    .await;
-
-    assert!(result.success, "job should succeed");
-    assert_eq!(result.json_result(), Some(json!(42)));
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_script_with_logs(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (_client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    let result = RunJob::from(JobPayload::Code(bun_code(
-        r#"export function main() {
-    console.log("hello from agent worker");
-    console.log("processing step 1");
-    console.log("processing step 2");
-    return "done";
-}"#,
-    )))
-    .run_until_complete(&db, false, port)
-    .await;
-
-    assert!(result.success, "job should succeed");
-    assert_eq!(result.json_result(), Some(json!("done")));
-
-    let logs = sqlx::query_scalar::<_, String>(
-        "SELECT logs FROM job_logs WHERE job_id = $1 AND workspace_id = 'test-workspace'",
-    )
-    .bind(result.id)
-    .fetch_optional(&db)
-    .await?;
-
-    let logs = logs.expect("logs should exist");
-    assert!(
-        logs.contains("hello from agent worker"),
-        "logs should contain the printed output, got: {logs}"
-    );
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_script_failure(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (_client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    let result = RunJob::from(JobPayload::Code(bun_code(
-        "export function main() { throw new Error('test error'); }",
-    )))
-    .run_until_complete(&db, false, port)
-    .await;
-
-    assert!(!result.success, "job should fail");
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_complex_result(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (_client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    let result = RunJob::from(JobPayload::Code(bun_code(
-        r#"export function main() {
-    return {
-        items: [1, 2, 3],
-        metadata: { key: "value" },
-        count: 3,
-    };
-}"#,
-    )))
-    .run_until_complete(&db, false, port)
-    .await;
-
-    assert!(result.success, "job should succeed");
-    let json = result.json_result().unwrap();
-    assert_eq!(json["items"], json!([1, 2, 3]));
-    assert_eq!(json["metadata"]["key"], json!("value"));
-    assert_eq!(json["count"], json!(3));
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_token_creation(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (client, _port, _server) = init_client_agent_mode(db.clone()).await;
-
-    // client.baseurl() already includes /api
-    let resp = client
-        .client()
-        .post(format!(
-            "{}/agent_workers/create_agent_token",
-            client.baseurl()
-        ))
-        .json(&json!({
-            "worker_group": "lifecycle-test",
-            "tags": ["bun", "flow", "dependency"],
-            "exp": usize::MAX
-        }))
-        .send()
-        .await?;
-
-    assert!(
-        resp.status().is_success(),
-        "create_agent_token should succeed, got: {}",
-        resp.status()
-    );
-
-    let token = resp.text().await?;
-    let token = token.trim_matches('"');
-    assert!(
-        token.starts_with("jwt_agent_"),
-        "token should start with jwt_agent_ prefix, got: {token}"
-    );
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_token_and_ping(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    let resp = client
-        .client()
-        .post(format!(
-            "{}/agent_workers/create_agent_token",
-            client.baseurl()
-        ))
-        .json(&json!({
-            "worker_group": "lifecycle-test",
-            "tags": ["bun", "flow", "dependency"],
-            "exp": usize::MAX
-        }))
-        .send()
-        .await?;
-
-    assert!(resp.status().is_success());
-    let token = resp.text().await?;
-    let token = token.trim_matches('"');
-
-    let suffix = windmill_common::utils::create_default_worker_suffix("lifecycle-test");
-    let base_url = format!("http://localhost:{port}");
-    let http_client =
-        windmill_common::agent_workers::build_agent_http_client(&suffix, &token, &base_url);
-
-    // Initial ping inserts the worker record into the database
-    let resp = http_client
-        .client
-        .post(format!("{}/api/agent_workers/update_ping", base_url))
-        .json(&json!({
-            "worker_instance": "test-instance",
-            "ip": "127.0.0.1",
-            "tags": ["bun"],
-            "version": "test",
-            "vcpus": 4,
-            "memory": 8192,
-            "ping_type": "Initial"
-        }))
-        .send()
-        .await?;
-
-    assert!(
-        resp.status().is_success(),
-        "initial ping should succeed, got: {}",
-        resp.status()
-    );
-
-    // Verify the ping was recorded in the database
-    let worker_count = sqlx::query_scalar::<_, i64>(
-        "SELECT COUNT(*) FROM worker_ping WHERE worker_instance = 'test-instance'",
-    )
-    .fetch_one(&db)
-    .await?;
-
-    assert!(worker_count > 0, "worker ping should be recorded in database");
-
-    // MainLoop ping updates the existing record
-    let resp = http_client
-        .client
-        .post(format!("{}/api/agent_workers/update_ping", base_url))
-        .json(&json!({
-            "tags": ["bun"],
-            "vcpus": 4,
-            "memory": 8192,
-            "jobs_executed": 0,
-            "ping_type": "MainLoop"
-        }))
-        .send()
-        .await?;
-
-    assert!(
-        resp.status().is_success(),
-        "main loop ping should succeed, got: {}",
-        resp.status()
-    );
-
-    Ok(())
-}
-
-#[sqlx::test(fixtures("base"))]
-async fn test_agent_worker_multiple_jobs_sequential(db: Pool<Postgres>) -> anyhow::Result<()> {
-    let (_client, port, _server) = init_client_agent_mode(db.clone()).await;
-
-    for i in 0..3 {
-        let result = RunJob::from(JobPayload::Code(bun_code(&format!(
-            "export function main() {{ return {i}; }}"
-        ))))
-        .run_until_complete(&db, false, port)
-        .await;
-
-        assert!(result.success, "job {i} should succeed");
-        assert_eq!(result.json_result(), Some(json!(i)));
-    }
-
-    Ok(())
-}

backend/tests/apps.rs

@@ -1,7 +1,8 @@
 use serde_json::json;
 use sqlx::{Pool, Postgres};
 
-use windmill_test_utils::*;
+mod common;
+use common::*;
 
 fn app_url(port: u16, endpoint: &str, path: &str) -> String {
     format!("http://localhost:{port}/api/w/test-workspace/apps/{endpoint}/{path}")
@@ -39,7 +40,7 @@ fn new_app(path: &str, summary: &str) -> serde_json::Value {
     })
 }
 
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+#[sqlx::test(fixtures("base"))]
 async fn test_app_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
     let server = ApiServer::start(db.clone()).await?;

backend/tests/bun_jobs.rs

@@ -1,4 +1,5 @@
-use windmill_test_utils::*;
+mod common;
+use crate::common::*;
 use sqlx::postgres::Postgres;
 use sqlx::Pool;
 use windmill_common::jobs::{JobPayload, RawCode};
@@ -859,7 +860,7 @@ export function main() {
 // ============================================================================
 
 mod dedicated_worker_protocol {
-    use windmill_test_utils::{parse_dedicated_worker_line, DedicatedWorkerResult};
+    use crate::common::{parse_dedicated_worker_line, DedicatedWorkerResult};
     use std::io::{BufRead, BufReader, Write};
     use std::process::{Command, Stdio};
     use windmill_worker::{

backend/tests/common/mod.rs

@@ -87,12 +87,6 @@ impl ApiServer {
         Self::start_inner(db, true).await
     }
 
-    /// Start the API server with server_mode=true so trigger listeners are active.
-    /// Alias for `start_agent_mode` with a clearer name for trigger e2e tests.
-    pub async fn start_with_listeners(db: Pool<Postgres>) -> anyhow::Result<Self> {
-        Self::start_inner(db, true).await
-    }
-
     async fn start_inner(db: Pool<Postgres>, agent_mode: bool) -> anyhow::Result<Self> {
         let (tx, rx) = tokio::sync::broadcast::channel::<()>(1);
 
@@ -149,17 +143,11 @@ pub struct RunJob {
     pub payload: JobPayload,
     pub args: serde_json::Map<String, serde_json::Value>,
     pub scheduled_for_o: Option<chrono::DateTime<chrono::Utc>>,
-    pub email: String,
 }
 
 impl From<JobPayload> for RunJob {
     fn from(payload: JobPayload) -> Self {
-        Self {
-            payload,
-            args: Default::default(),
-            scheduled_for_o: None,
-            email: "test@windmill.dev".to_string(),
-        }
+        Self { payload, args: Default::default(), scheduled_for_o: None }
     }
 }
 
@@ -177,13 +165,8 @@ impl RunJob {
         self
     }
 
-    pub fn email(mut self, email: impl Into<String>) -> Self {
-        self.email = email.into();
-        self
-    }
-
     pub async fn push(self, db: &Pool<Postgres>) -> Uuid {
-        let RunJob { payload, args, scheduled_for_o, email } = self;
+        let RunJob { payload, args, scheduled_for_o } = self;
         let mut hm_args = std::collections::HashMap::new();
         for (k, v) in args {
             hm_args.insert(k, windmill_common::worker::to_raw_value(&v));
@@ -197,7 +180,7 @@ impl RunJob {
             payload,
             windmill_queue::PushArgs::from(&hm_args),
             /* user */ "test-user",
-            /* email  */ &email,
+            /* email  */ "test@windmill.dev",
             /* permissioned_as */ "u/test-user".to_string(),
             /* token_prefix */ None,
             scheduled_for_o,
@@ -227,52 +210,6 @@ impl RunJob {
         uuid
     }
 
-    /// Push the job as a specific user (for testing permissions)
-    pub async fn push_as(self, db: &Pool<Postgres>, username: &str, email: &str) -> Uuid {
-        let RunJob { payload, args, scheduled_for_o, .. } = self;
-        let mut hm_args = std::collections::HashMap::new();
-        for (k, v) in args {
-            hm_args.insert(k, windmill_common::worker::to_raw_value(&v));
-        }
-
-        let tx = PushIsolationLevel::IsolatedRoot(db.clone());
-        let (uuid, tx) = windmill_queue::push(
-            db,
-            tx,
-            "test-workspace",
-            payload,
-            windmill_queue::PushArgs::from(&hm_args),
-            username,
-            email,
-            format!("u/{}", username),
-            /* token_prefix */ None,
-            scheduled_for_o,
-            /* schedule_path */ None,
-            /* parent_job */ None,
-            /* root job  */ None,
-            /* flow_innermost_root_job */ None,
-            /* job_id */ None,
-            /* is_flow_step */ false,
-            /* same_worker */ false,
-            None,
-            true,
-            None,
-            None,
-            None,
-            None,
-            None,
-            false,
-            None,
-            None,
-            None,
-        )
-        .await
-        .expect("push has to succeed");
-        tx.commit().await.unwrap();
-
-        uuid
-    }
-
     /// push the job, spawn a worker, wait until the job is in completed_job
     pub async fn run_until_complete(
         self,
@@ -574,6 +511,7 @@ pub async fn test_for_versions<F: Future<Output = ()>>(
 
 use futures::StreamExt;
 
+// #[cfg(feature = "python")]
 pub async fn assert_lockfile(
     db: &Pool<Postgres>,
     script_content: String,
@@ -837,7 +775,7 @@ pub async fn testing_http_connection(port: u16) -> Connection {
         "{}{}",
         windmill_common::agent_workers::AGENT_JWT_PREFIX,
         windmill_common::jwt::encode_with_internal_secret(
-            windmill_api_agent_workers::AgentAuth {
+            windmill_api::agent_workers_ee::AgentAuth {
                 worker_group: "testing-agent".to_owned(),
                 suffix: Some(suffix.clone()),
                 tags: vec!["flow".into(), "python3".into(), "dependency".into()],

backend/tests/dependency_map.rs

@@ -2,9 +2,8 @@ use sqlx::{Pool, Postgres};
 use tokio_stream::StreamExt;
 
 use windmill_api_client::types::NewScript;
-use windmill_test_utils::{
-    in_test_worker, init_client, listen_for_completed_jobs, rebuild_dmap, ApiServer,
-};
+mod common;
+use common::{in_test_worker, init_client, listen_for_completed_jobs, ApiServer};
 
 mod dependency_map {
     use super::*;
@@ -171,7 +170,7 @@ mod dependency_map {
         let (client, _port, _s) = init(db.clone()).await;
         assert_dmap(&db, None, CORRECT_DMAP.clone()).await;
         // rebuild map
-        assert!(rebuild_dmap(&client).await);
+        assert!(common::rebuild_dmap(&client).await);
         assert_dmap(&db, None, CORRECT_DMAP.clone()).await;
         Ok(())
     }
@@ -184,7 +183,7 @@ mod dependency_map {
         // Spawn first rebuild
         let handle = {
             let client = client.clone();
-            tokio::spawn(async move { rebuild_dmap(&client).await })
+            tokio::spawn(async move { common::rebuild_dmap(&client).await })
         };
 
         // Immidiately spawn another

backend/tests/drafts.rs

@@ -1,7 +1,8 @@
 use serde_json::json;
 use sqlx::{Pool, Postgres};
 
-use windmill_test_utils::*;
+mod common;
+use common::*;
 
 fn client() -> reqwest::Client {
     reqwest::Client::new()
@@ -11,7 +12,7 @@ fn authed(builder: reqwest::RequestBuilder) -> reqwest::RequestBuilder {
     builder.header("Authorization", "Bearer SECRET_TOKEN")
 }
 
-#[sqlx::test(migrations = "../migrations", fixtures("base"))]
+#[sqlx::test(fixtures("base"))]
 async fn test_draft_endpoints(db: Pool<Postgres>) -> anyhow::Result<()> {
     initialize_tracing().await;
     let server = ApiServer::start(db.clone()).await?;

backend/tests/error_handler.rs

@@ -1,410 +0,0 @@
-use sqlx::{Pool, Postgres};
-
-use windmill_test_utils::*;
-
-/// Test that workspace error handler can be set and removed via database operations
-#[cfg(feature = "deno_core")]
-#[sqlx::test(fixtures("base"))]
-async fn test_error_handler_settings(db: Pool<Postgres>) -> anyhow::Result<()> {
-    initialize_tracing().await;
-
-    let _server = ApiServer::start(db.clone()).await?;
-
-    // Initially error_handler should be NULL
-    let initial = sqlx::query_scalar!(
-        r#"SELECT error_handler->>'path' FROM workspace_settings WHERE workspace_id = 'test-workspace'"#
-    )
-    .fetch_one(&db)
-    .await?;
-    assert!(initial.is_none());
-
-    // Set error handler with all options
-    sqlx::query!(
-        r#"
-        UPDATE workspace_settings
-        SET error_handler = '{"path": "script/f/test/error_handler", "extra_args": {"notify": true}, "muted_on_cancel": true, "muted_on_user_path": false}'::jsonb
-        WHERE workspace_id = 'test-workspace'
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    let after_set = sqlx::query_scalar!(
-        r#"SELECT error_handler->>'path' FROM workspace_settings WHERE workspace_id = 'test-workspace'"#
-    )
-    .fetch_one(&db)
-    .await?;
-    assert_eq!(
-        after_set,
-        Some("script/f/test/error_handler".to_string())
-    );
-
-    // Verify extra_args
-    let extra_args = sqlx::query_scalar!(
-        r#"SELECT error_handler->'extra_args' FROM workspace_settings WHERE workspace_id = 'test-workspace'"#
-    )
-    .fetch_one(&db)
-    .await?;
-    assert!(extra_args.is_some());
-
-    // Verify muted_on_cancel
-    let muted_on_cancel = sqlx::query_scalar!(
-        r#"SELECT (error_handler->>'muted_on_cancel')::boolean FROM workspace_settings WHERE workspace_id = 'test-workspace'"#
-    )
-    .fetch_one(&db)
-    .await?;
-    assert_eq!(muted_on_cancel, Some(true));
-
-    // Verify muted_on_user_path
-    let muted_on_user_path = sqlx::query_scalar!(
-        r#"SELECT (error_handler->>'muted_on_user_path')::boolean FROM workspace_settings WHERE workspace_id = 'test-workspace'"#
-    )
-    .fetch_one(&db)
-    .await?;
-    assert_eq!(muted_on_user_path, Some(false));
-
-    // Remove error handler
-    sqlx::query!(
-        r#"
-        UPDATE workspace_settings
-        SET error_handler = NULL
-        WHERE workspace_id = 'test-workspace'
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    let after_remove = sqlx::query_scalar!(
-        r#"SELECT error_handler->>'path' FROM workspace_settings WHERE workspace_id = 'test-workspace'"#
-    )
-    .fetch_one(&db)
-    .await?;
-    assert!(after_remove.is_none());
-
-    Ok(())
-}
-
-/// Test that a failed job triggers the workspace error handler
-#[cfg(all(feature = "deno_core", feature = "enterprise", feature = "private"))]
-#[sqlx::test(fixtures("base"))]
-async fn test_error_handler_triggered_on_failure(db: Pool<Postgres>) -> anyhow::Result<()> {
-    use windmill_common::jobs::JobPayload;
-    use windmill_common::runnable_settings::{ConcurrencySettings, DebouncingSettings};
-    use windmill_common::scripts::{ScriptHash, ScriptLang};
-
-    initialize_tracing().await;
-
-    let server = ApiServer::start(db.clone()).await?;
-
-    // Create the error handler script
-    let error_handler_code = r#"
-export async function main(path: string, email: string, job_id: string, is_flow: boolean, workspace_id: string, error: any) {
-    console.log("Error handler called for job:", job_id);
-    return { handled: true, original_path: path };
-}
-"#;
-
-    sqlx::query!(
-        r#"
-        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 1111111111, 'f/test/error_handler', $1, 'deno', 'script', 'test-user', '{}', 'Error handler script', 'Handles failed job completions', '')
-        "#,
-        error_handler_code
-    )
-    .execute(&db)
-    .await?;
-
-    // Create a script that will fail
-    let failing_script_code = "export function main() { throw new Error('intentional failure'); }";
-    let failing_script_hash: i64 = 2222222222;
-
-    sqlx::query!(
-        r#"
-        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', $1, 'f/test/failing_script', $2, 'deno', 'script', 'test-user', '{}', 'Failing test script', 'A script that always fails', '')
-        "#,
-        failing_script_hash,
-        failing_script_code
-    )
-    .execute(&db)
-    .await?;
-
-    // Set up the error handler in workspace_settings
-    sqlx::query!(
-        r#"
-        UPDATE workspace_settings
-        SET error_handler = '{"path": "script/f/test/error_handler"}'::jsonb
-        WHERE workspace_id = 'test-workspace'
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    // Create the error_handler group
-    sqlx::query!(
-        r#"
-        INSERT INTO group_ (workspace_id, name, summary, extra_perms)
-        VALUES ('test-workspace', 'error_handler', 'The group the error handler acts on behalf of', '{"u/test-user": true}')
-        ON CONFLICT DO NOTHING
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    // Run the failing script
-    let completed_job = RunJob::from(JobPayload::ScriptHash {
-        hash: ScriptHash(failing_script_hash),
-        path: "f/test/failing_script".to_string(),
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        language: ScriptLang::Deno,
-        priority: None,
-        apply_preprocessor: false,
-        concurrency_settings: ConcurrencySettings::default(),
-        debouncing_settings: DebouncingSettings::default(),
-    })
-    .run_until_complete(&db, false, server.addr.port())
-    .await;
-
-    // Verify the job actually failed
-    assert!(!completed_job.success, "Job should have failed");
-
-    let main_job_id = completed_job.id;
-
-    // Wait for the error handler job to be created
-    tokio::time::sleep(tokio::time::Duration::from_millis(500)).await;
-
-    // Verify the error handler job was created
-    let error_handler_job = sqlx::query!(
-        r#"
-        SELECT
-            id,
-            runnable_path,
-            permissioned_as_email,
-            parent_job
-        FROM v2_job
-        WHERE workspace_id = 'test-workspace'
-            AND permissioned_as_email = 'error_handler@windmill.dev'
-        ORDER BY created_at DESC
-        LIMIT 1
-        "#
-    )
-    .fetch_optional(&db)
-    .await?;
-
-    assert!(
-        error_handler_job.is_some(),
-        "Error handler job should have been created"
-    );
-
-    let handler_job = error_handler_job.unwrap();
-
-    assert_eq!(
-        handler_job.runnable_path.as_deref(),
-        Some("f/test/error_handler"),
-        "Error handler should run the configured script"
-    );
-    assert_eq!(
-        handler_job.permissioned_as_email.as_str(),
-        "error_handler@windmill.dev",
-        "Error handler should run as error_handler user"
-    );
-    assert_eq!(
-        handler_job.parent_job,
-        Some(main_job_id),
-        "Error handler should have the failed job as parent"
-    );
-
-    Ok(())
-}
-
-/// Test that error handler is NOT triggered when ws_error_handler_muted is set on the script
-#[cfg(all(feature = "deno_core", feature = "enterprise", feature = "private"))]
-#[sqlx::test(fixtures("base"))]
-async fn test_error_handler_muted_on_script(db: Pool<Postgres>) -> anyhow::Result<()> {
-    use windmill_common::jobs::JobPayload;
-    use windmill_common::runnable_settings::{ConcurrencySettings, DebouncingSettings};
-    use windmill_common::scripts::{ScriptHash, ScriptLang};
-
-    initialize_tracing().await;
-
-    let server = ApiServer::start(db.clone()).await?;
-
-    // Create the error handler script
-    sqlx::query!(
-        r#"
-        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 3333333333, 'f/test/error_handler', 'export function main() { return "handled"; }', 'deno', 'script', 'test-user', '{}', '', '', '')
-        "#,
-    )
-    .execute(&db)
-    .await?;
-
-    // Create a failing script with ws_error_handler_muted = true
-    let failing_script_hash: i64 = 4444444444;
-    sqlx::query!(
-        r#"
-        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock, ws_error_handler_muted)
-        VALUES ('test-workspace', $1, 'f/test/muted_failing_script', 'export function main() { throw new Error("fail"); }', 'deno', 'script', 'test-user', '{}', '', '', '', true)
-        "#,
-        failing_script_hash,
-    )
-    .execute(&db)
-    .await?;
-
-    // Set up the error handler
-    sqlx::query!(
-        r#"
-        UPDATE workspace_settings
-        SET error_handler = '{"path": "script/f/test/error_handler"}'::jsonb
-        WHERE workspace_id = 'test-workspace'
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    sqlx::query!(
-        r#"
-        INSERT INTO group_ (workspace_id, name, summary, extra_perms)
-        VALUES ('test-workspace', 'error_handler', 'Error handler group', '{"u/test-user": true}')
-        ON CONFLICT DO NOTHING
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    // Run the muted failing script
-    let completed_job = RunJob::from(JobPayload::ScriptHash {
-        hash: ScriptHash(failing_script_hash),
-        path: "f/test/muted_failing_script".to_string(),
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        language: ScriptLang::Deno,
-        priority: None,
-        apply_preprocessor: false,
-        concurrency_settings: ConcurrencySettings::default(),
-        debouncing_settings: DebouncingSettings::default(),
-    })
-    .run_until_complete(&db, false, server.addr.port())
-    .await;
-
-    assert!(!completed_job.success, "Job should have failed");
-
-    // Wait and check that NO error handler job was created
-    tokio::time::sleep(tokio::time::Duration::from_millis(500)).await;
-
-    let error_handler_job = sqlx::query_scalar!(
-        r#"
-        SELECT id
-        FROM v2_job
-        WHERE workspace_id = 'test-workspace'
-            AND permissioned_as_email = 'error_handler@windmill.dev'
-        "#
-    )
-    .fetch_optional(&db)
-    .await?;
-
-    assert!(
-        error_handler_job.is_none(),
-        "Error handler should NOT have been triggered for a muted script"
-    );
-
-    Ok(())
-}
-
-/// Test that error handler is NOT triggered on successful job completion
-#[cfg(all(feature = "deno_core", feature = "enterprise", feature = "private"))]
-#[sqlx::test(fixtures("base"))]
-async fn test_error_handler_not_triggered_on_success(db: Pool<Postgres>) -> anyhow::Result<()> {
-    use windmill_common::jobs::JobPayload;
-    use windmill_common::runnable_settings::{ConcurrencySettings, DebouncingSettings};
-    use windmill_common::scripts::{ScriptHash, ScriptLang};
-
-    initialize_tracing().await;
-
-    let server = ApiServer::start(db.clone()).await?;
-
-    // Create the error handler script
-    sqlx::query!(
-        r#"
-        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', 5555555555, 'f/test/error_handler', 'export function main() { return "handled"; }', 'deno', 'script', 'test-user', '{}', '', '', '')
-        "#,
-    )
-    .execute(&db)
-    .await?;
-
-    // Create a successful script
-    let success_script_hash: i64 = 6666666666;
-    sqlx::query!(
-        r#"
-        INSERT INTO script (workspace_id, hash, path, content, language, kind, created_by, schema, summary, description, lock)
-        VALUES ('test-workspace', $1, 'f/test/success_script', 'export function main() { return "ok"; }', 'deno', 'script', 'test-user', '{}', '', '', '')
-        "#,
-        success_script_hash,
-    )
-    .execute(&db)
-    .await?;
-
-    // Set up the error handler
-    sqlx::query!(
-        r#"
-        UPDATE workspace_settings
-        SET error_handler = '{"path": "script/f/test/error_handler"}'::jsonb
-        WHERE workspace_id = 'test-workspace'
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    sqlx::query!(
-        r#"
-        INSERT INTO group_ (workspace_id, name, summary, extra_perms)
-        VALUES ('test-workspace', 'error_handler', 'Error handler group', '{"u/test-user": true}')
-        ON CONFLICT DO NOTHING
-        "#
-    )
-    .execute(&db)
-    .await?;
-
-    // Run the successful script
-    let completed_job = RunJob::from(JobPayload::ScriptHash {
-        hash: ScriptHash(success_script_hash),
-        path: "f/test/success_script".to_string(),
-        cache_ttl: None,
-        cache_ignore_s3_path: None,
-        dedicated_worker: None,
-        language: ScriptLang::Deno,
-        priority: None,
-        apply_preprocessor: false,
-        concurrency_settings: ConcurrencySettings::default(),
-        debouncing_settings: DebouncingSettings::default(),
-    })
-    .run_until_complete(&db, false, server.addr.port())
-    .await;
-
-    assert!(completed_job.success, "Job should have succeeded");
-
-    // Wait and check that NO error handler job was created
-    tokio::time::sleep(tokio::time::Duration::from_millis(500)).await;
-
-    let error_handler_job = sqlx::query_scalar!(
-        r#"
-        SELECT id
-        FROM v2_job
-        WHERE workspace_id = 'test-workspace'
-            AND permissioned_as_email = 'error_handler@windmill.dev'
-        "#
-    )
-    .fetch_optional(&db)
-    .await?;
-
-    assert!(
-        error_handler_job.is_none(),
-        "Error handler should NOT have been triggered for a successful job"
-    );
-
-    Ok(())
-}

backend/tests/fixtures/secret_backend.sql

@@ -14,18 +14,18 @@ INSERT INTO workspace_key(workspace_id, kind, key)
 VALUES ('test-workspace-2', 'cloud', 'test-key-2')
 ON CONFLICT DO NOTHING;
 
--- Insert test variables with placeholder values.
--- Secret values are encrypted by the test setup using build_crypt + encrypt
--- with the workspace key, matching production behavior.
+-- Insert test secrets for workspace 1
+-- Note: The 'value' column stores encrypted values in production,
+-- but for tests we'll use plain text that the migration will handle
 INSERT INTO variable (workspace_id, path, value, is_secret, description, extra_perms)
 VALUES
-    ('test-workspace', 'u/test-user/db_password', 'PLACEHOLDER', true, 'Database password', '{}'),
-    ('test-workspace', 'u/test-user/api_key', 'PLACEHOLDER', true, 'API key for external service', '{}'),
+    ('test-workspace', 'u/test-user/db_password', 'encrypted-db-pass-123', true, 'Database password', '{}'),
+    ('test-workspace', 'u/test-user/api_key', 'encrypted-api-key-abc', true, 'API key for external service', '{}'),
     ('test-workspace', 'u/test-user/public_var', 'not-a-secret', false, 'A non-secret variable', '{}')
 ON CONFLICT DO NOTHING;
 
 -- Insert test secrets for workspace 2 (to test isolation)
 INSERT INTO variable (workspace_id, path, value, is_secret, description, extra_perms)
 VALUES
-    ('test-workspace-2', 'u/test-user/other_secret', 'PLACEHOLDER', true, 'Secret in workspace 2', '{}')
+    ('test-workspace-2', 'u/test-user/other_secret', 'encrypted-other-secret', true, 'Secret in workspace 2', '{}')
 ON CONFLICT DO NOTHING;