windmill-cli 1.666.0 → 1.668.0

package/esm/main.js

@@ -4244,6 +4244,7 @@ var exports_log = {};
 __export(exports_log, {
   warn: () => warn,
   setup: () => setup,
+  setSilent: () => setSilent,
   info: () => info,
   error: () => error,
   debug: () => debug
@@ -4251,20 +4252,27 @@ __export(exports_log, {
 function setup(level) {
   logLevel = level;
 }
+function setSilent(silent) {
+  silentMode = silent;
+}
 function debug(msg) {
   if (levels[logLevel] <= levels.DEBUG)
     console.log(`\x1B[90m${String(msg)}\x1B[39m`);
 }
 function info(msg) {
+  if (silentMode)
+    return;
   console.log(`\x1B[34m${String(msg)}\x1B[39m`);
 }
 function warn(msg) {
+  if (silentMode)
+    return;
   console.log(`\x1B[33m${String(msg)}\x1B[39m`);
 }
 function error(msg) {
-  console.log(`\x1B[31m${String(msg)}\x1B[39m`);
+  console.error(`\x1B[31m${String(msg)}\x1B[39m`);
 }
-var logLevel = "INFO", levels;
+var logLevel = "INFO", silentMode = false, levels;
 var init_log = __esm(() => {
   levels = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
 });
@@ -11618,21 +11626,40 @@ var require_dist = __commonJS((exports) => {
 import { readFile } from "node:fs/promises";
 async function yamlParseFile(path, options = {}) {
   try {
-    return import_yaml.parse(await readFile(path, "utf-8"), options);
+    return import_yaml.parse(await readFile(path, "utf-8"), {
+      ...options,
+      customTags: [...WINDMILL_CUSTOM_TAGS, ...options.customTags ?? []]
+    });
   } catch (e) {
     throw new Error(`Error parsing yaml ${path}`, { cause: e });
   }
 }
 function yamlParseContent(path, content, options = {}) {
   try {
-    return import_yaml.parse(content, options);
+    return import_yaml.parse(content, {
+      ...options,
+      customTags: [...WINDMILL_CUSTOM_TAGS, ...options.customTags ?? []]
+    });
   } catch (e) {
     throw new Error(`Error parsing yaml ${path}`, { cause: e });
   }
 }
-var import_yaml;
+var import_yaml, inlineTag, inlineFilesetTag, WINDMILL_CUSTOM_TAGS;
 var init_yaml = __esm(() => {
   import_yaml = __toESM(require_dist(), 1);
+  inlineTag = {
+    tag: "!inline",
+    resolve(value) {
+      return "!inline " + value;
+    }
+  };
+  inlineFilesetTag = {
+    tag: "!inline_fileset",
+    resolve(value) {
+      return "!inline_fileset " + value;
+    }
+  };
+  WINDMILL_CUSTOM_TAGS = [inlineTag, inlineFilesetTag];
 });
 
 // gen/core/ApiError.ts
@@ -11785,7 +11812,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv2("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.666.0",
+    VERSION: "1.668.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -12344,6 +12371,7 @@ __export(exports_services_gen, {
   importQueuedJobs: () => importQueuedJobs,
   importInstallation: () => importInstallation,
   importCompletedJobs: () => importCompletedJobs,
+  impersonateServiceAccount: () => impersonateServiceAccount,
   globalWhoami: () => globalWhoami,
   globalUsersOverwrite: () => globalUsersOverwrite,
   globalUsersExport: () => globalUsersExport,
@@ -12521,6 +12549,7 @@ __export(exports_services_gen, {
   exportInstanceGroups: () => exportInstanceGroups,
   exportInstallation: () => exportInstallation,
   exportCompletedJobs: () => exportCompletedJobs,
+  exitImpersonation: () => exitImpersonation,
   existsWorkspace: () => existsWorkspace,
   existsWorkersWithTags: () => existsWorkersWithTags,
   existsWebsocketTrigger: () => existsWebsocketTrigger,
@@ -12635,6 +12664,7 @@ __export(exports_services_gen, {
   createToken: () => createToken,
   createTemplateScript: () => createTemplateScript,
   createSqsTrigger: () => createSqsTrigger,
+  createServiceAccount: () => createServiceAccount,
   createScript: () => createScript,
   createSchedule: () => createSchedule,
   createResourceType: () => createResourceType,
@@ -13374,6 +13404,36 @@ var backendVersion = () => {
     body: data2.requestBody,
     mediaType: "application/json"
   });
+}, createServiceAccount = (data2) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/workspaces/create_service_account",
+    path: {
+      workspace: data2.workspace
+    },
+    body: data2.requestBody,
+    mediaType: "application/json"
+  });
+}, impersonateServiceAccount = (data2) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/users/impersonate_service_account",
+    path: {
+      workspace: data2.workspace
+    },
+    body: data2.requestBody,
+    mediaType: "application/json"
+  });
+}, exitImpersonation = (data2) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/users/exit_impersonation",
+    path: {
+      workspace: data2.workspace
+    },
+    body: data2.requestBody,
+    mediaType: "application/json"
+  });
 }, deleteInvite = (data2) => {
   return request(OpenAPI, {
     method: "POST",
@@ -19451,6 +19511,10 @@ var init_gen = __esm(() => {
 });
 
 // src/core/client.ts
+var exports_client = {};
+__export(exports_client, {
+  setClient: () => setClient
+});
 function setClient(token, baseUrl2) {
   if (baseUrl2 === undefined) {
     baseUrl2 = process.env["BASE_INTERNAL_URL"] ?? process.env["BASE_URL"] ?? "http://localhost:8000";
@@ -24449,6 +24513,12 @@ function isRawAppMetadataFile(p) {
 function isRawAppFolderMetadataFile(p) {
   return p.endsWith(getMetadataPathSuffix("raw_app", "yaml")) || p.endsWith(getMetadataPathSuffix("raw_app", "json"));
 }
+function isAppFolderMetadataFile(p) {
+  return p.endsWith(getMetadataPathSuffix("app", "yaml")) || p.endsWith(getMetadataPathSuffix("app", "json"));
+}
+function isFlowFolderMetadataFile(p) {
+  return p.endsWith(getMetadataPathSuffix("flow", "yaml")) || p.endsWith(getMetadataPathSuffix("flow", "json"));
+}
 function getModuleFolderSuffix() {
   return MODULE_SUFFIX;
 }
@@ -24704,6 +24774,9 @@ function toCamel(s) {
 function capitalize(str) {
   return str.charAt(0).toUpperCase() + str.slice(1);
 }
+function formatTimestamp(ts) {
+  return new Date(ts).toISOString().replace("T", " ").substring(0, 19);
+}
 var isWin = undefined;
 var init_utils = __esm(async () => {
   init_colors2();
@@ -24972,28 +25045,46 @@ async function createWorkspaceFork2(opts, workspaceName, workspaceId = undefined
   }
   const newBranchName = `${WM_FORK_PREFIX}/${clonedBranchName}/${workspaceId}`;
   info(`Created forked workspace ${trueWorkspaceId}. To start contributing to your fork, create and push edits to the branch \`${newBranchName}\` by using the command:
-    
+
 	` + colors.white(`git checkout -b ${newBranchName}`) + `
-    
-When doing operations on the forked workspace, it will use the remote setup in gitBranches for the branch it was forked from.`);
+
+When doing operations on the forked workspace, it will use the remote setup in gitBranches for the branch it was forked from.
+
+To merge changes back to the parent workspace, you can:
+  - Use the Merge UI from the forked workspace home page
+  - Deploy individual items via the Deploy to staging/prod UI
+  - Use git: ` + colors.white(`git checkout ${clonedBranchName} && git merge ${newBranchName} && wmill sync push`) + `
+  See: https://www.windmill.dev/docs/advanced/workspace_forks`);
 }
 async function deleteWorkspaceFork(opts, name) {
+  let forkWorkspaceId;
+  let token;
+  let remote;
+  let hasLocalProfile = false;
   const orgWorkspaces = await allWorkspaces(opts.configDir);
   const idxOf = orgWorkspaces.findIndex((x) => x.name === name);
-  if (idxOf === -1) {
-    info(colors.red.bold(`! Workspace profile ${name} does not exist locally`));
-    info("available workspace profiles:");
-    await list(opts);
-    return;
-  }
-  const workspace = orgWorkspaces[idxOf];
-  if (!workspace.workspaceId.startsWith(WM_FORK_PREFIX)) {
-    throw new Error(`You can only delete forked workspaces where the workspace id starts with \`${WM_FORK_PREFIX}.\` Failed while attempting to delete \`${workspace.workspaceId}\``);
+  if (idxOf !== -1) {
+    const workspace = orgWorkspaces[idxOf];
+    if (!workspace.workspaceId.startsWith(WM_FORK_PREFIX)) {
+      throw new Error(`You can only delete forked workspaces where the workspace id starts with \`${WM_FORK_PREFIX}.\` Failed while attempting to delete \`${workspace.workspaceId}\``);
+    }
+    forkWorkspaceId = workspace.workspaceId;
+    token = workspace.token;
+    remote = workspace.remote;
+    hasLocalProfile = true;
+  } else {
+    const parentWorkspace = await tryResolveBranchWorkspace(opts);
+    if (!parentWorkspace) {
+      throw new Error("Could not resolve parent workspace. Make sure you are in a git repo with gitBranches configured in wmill.yaml, or create a local workspace profile for the fork.");
+    }
+    forkWorkspaceId = name.startsWith(`${WM_FORK_PREFIX}-`) ? name : `${WM_FORK_PREFIX}-${name}`;
+    token = parentWorkspace.token;
+    remote = parentWorkspace.remote;
   }
   if (!opts.yes) {
     const { Select: Select2 } = await init_select().then(() => exports_select);
     const choice = await Select2.prompt({
-      message: `Are you sure you want to delete the forked workspace with id: \`${workspace.workspaceId}\`? This action will delete the workspace `,
+      message: `Are you sure you want to delete the forked workspace \`${forkWorkspaceId}\`?`,
       options: [
         { name: "Yes", value: "confirm" },
         { name: "No", value: "cancel" }
@@ -25004,14 +25095,15 @@ async function deleteWorkspaceFork(opts, name) {
       return;
     }
   }
-  const remote = workspace.remote;
-  setClient(workspace.token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
+  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
   const result = await deleteWorkspace({
-    workspace: workspace.workspaceId
+    workspace: forkWorkspaceId
   });
-  info(colors.green(`✅ Forked workspace '${workspace.workspaceId}' deleted successfully!
+  info(colors.green(`✅ Forked workspace '${forkWorkspaceId}' deleted successfully!
 ${result}`));
-  await removeWorkspace(name, false, opts);
+  if (hasLocalProfile) {
+    await removeWorkspace(name, false, opts);
+  }
 }
 var init_fork = __esm(async () => {
   init_colors2();
@@ -25090,11 +25182,14 @@ function findWmillYaml() {
 function getWmillYamlPath() {
   return findWmillYaml();
 }
-async function readConfigFile() {
+async function readConfigFile(opts) {
+  const warnIfMissing = opts?.warnIfMissing ?? true;
   try {
     const wmillYamlPath = findWmillYaml();
     if (!wmillYamlPath) {
-      warn("No wmill.yaml found. Use 'wmill init' to bootstrap it.");
+      if (warnIfMissing) {
+        warn("No wmill.yaml found. Use 'wmill init' to bootstrap it.");
+      }
       return {};
     }
     const conf = await yamlParseFile(wmillYamlPath);
@@ -25324,7 +25419,7 @@ var exports_workspace = {};
 __export(exports_workspace, {
   setActiveWorkspace: () => setActiveWorkspace,
   removeWorkspace: () => removeWorkspace,
-  list: () => list,
+  list: () => list2,
   getWorkspaceByName: () => getWorkspaceByName,
   getActiveWorkspaceOrFallback: () => getActiveWorkspaceOrFallback,
   getActiveWorkspace: () => getActiveWorkspace,
@@ -25378,7 +25473,7 @@ async function getWorkspaceByName(workspaceName, configDirOverride) {
   }
   return;
 }
-async function list(opts) {
+async function list2(opts) {
   const workspaces = await allWorkspaces(opts.configDir);
   const activeName = await getActiveWorkspaceName(opts);
   new Table2().header(["name", "remote", "workspace id"]).padding(2).border(true).body(workspaces.map((x) => {
@@ -25481,8 +25576,12 @@ async function add(opts, workspaceName, workspaceId, remote) {
     info(colors.red.bold(`! Workspace at id ${workspaceId} on ${remote} does not exist. Re-run with --create to create it. Aborting.`));
     info("On that instance and with those credentials, the workspaces that you can access are:");
     const workspaces = await listWorkspaces();
-    for (const workspace of workspaces) {
-      info(`- ${workspace.id} (name: ${workspace.name})`);
+    if (workspaces.length === 0) {
+      info("  (none)");
+    } else {
+      for (const workspace of workspaces) {
+        info(`- ${workspace.id} (name: ${workspace.name})`);
+      }
     }
     process10.exit(1);
   }
@@ -25550,7 +25649,7 @@ async function removeWorkspace(name, silent, opts) {
     if (!silent) {
       info(colors.red.bold(`! Workspace profile ${name} does not exist locally`));
       info("available workspace profiles:");
-      await list(opts);
+      await list2(opts);
     }
     return;
   }
@@ -25573,21 +25672,67 @@ async function whoami2(_opts) {
   const whoamiInfo = await globalWhoami();
   info(JSON.stringify(whoamiInfo, null, 2));
   const activeName = await getActiveWorkspaceName(_opts);
-  info("Active: " + colors.green.bold(activeName || "none"));
+  const { getCurrentGitBranch: getCurrentGitBranch2, getOriginalBranchForWorkspaceForks: getOriginalBranchForWorkspaceForks2 } = await Promise.resolve().then(() => (init_git(), exports_git));
+  const branch = getCurrentGitBranch2();
+  const originalBranch = branch ? getOriginalBranchForWorkspaceForks2(branch) : null;
+  if (originalBranch) {
+    const { resolveWorkspace } = await init_context().then(() => exports_context);
+    try {
+      const ws = await resolveWorkspace(_opts);
+      info("Active: " + colors.green.bold(`${activeName || "none"}`) + ` (fork workspace: ${ws.workspaceId})`);
+    } catch {
+      info("Active: " + colors.green.bold(activeName || "none") + " (fork branch)");
+    }
+  } else {
+    info("Active: " + colors.green.bold(activeName || "none"));
+  }
 }
 async function listRemote(_opts) {
+  let remote;
+  if (_opts.baseUrl && _opts.token && !_opts.workspace) {
+    const { setClient: setClient2 } = await Promise.resolve().then(() => (init_client(), exports_client));
+    remote = new URL(_opts.baseUrl).toString();
+    setClient2(_opts.token, remote.replace(/\/$/, ""));
+  } else {
+    const { resolveWorkspace } = await init_context().then(() => exports_context);
+    const workspace = await resolveWorkspace(_opts);
+    await requireLogin(_opts);
+    remote = workspace.remote;
+  }
+  const userWorkspaces = await listUserWorkspaces();
+  const hasForks = userWorkspaces.workspaces.some((x) => x.parent_workspace_id);
+  const headers = hasForks ? ["id", "name", "username", "fork of", "disabled"] : ["id", "name", "username", "disabled"];
+  new Table2().header(headers).padding(2).border(true).body(userWorkspaces.workspaces.map((x) => {
+    const row = [
+      x.id,
+      x.name,
+      x.username
+    ];
+    if (hasForks)
+      row.push(x.parent_workspace_id ?? "-");
+    row.push(x.disabled ? colors.red("true") : "false");
+    return row;
+  })).render();
+  info(`Remote: ${colors.bold(remote)}`);
+  info(`Logged in as: ${colors.green.bold(userWorkspaces.email)}`);
+}
+async function listForks(_opts) {
   const { resolveWorkspace } = await init_context().then(() => exports_context);
   const workspace = await resolveWorkspace(_opts);
   await requireLogin(_opts);
   const userWorkspaces = await listUserWorkspaces();
-  new Table2().header(["id", "name", "username", "disabled"]).padding(2).border(true).body(userWorkspaces.workspaces.map((x) => [
+  const forks = userWorkspaces.workspaces.filter((w) => w.parent_workspace_id);
+  if (forks.length === 0) {
+    info("No forked workspaces found.");
+    return;
+  }
+  new Table2().header(["id", "name", "fork of", "username"]).padding(2).border(true).body(forks.map((x) => [
     x.id,
     x.name,
-    x.username,
-    x.disabled ? colors.red("true") : "false"
+    x.parent_workspace_id ?? "",
+    x.username
   ])).render();
   info(`Remote: ${colors.bold(workspace.remote)}`);
-  info(`Logged in as: ${colors.green.bold(userWorkspaces.email)}`);
 }
 async function getActiveWorkspaceOrFallback(opts) {
   let activeWorkspace = await getActiveWorkspace(opts);
@@ -25663,9 +25808,9 @@ var init_workspace = __esm(async () => {
     init_auth(),
     init_fork()
   ]);
-  command = new Command().alias("profile").description("workspace related commands").action(list).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
+  command = new Command().alias("profile").description("workspace related commands").action(list2).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
     default: "admin"
-  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list).command("list-remote").description("List workspaces on the remote server that you have access to").action(listRemote).command("bind").description("Bind the current Git branch to the active workspace").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, true)).command("unbind").description("Remove workspace binding from the current Git branch").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork);
+  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list2).command("list-remote").description("List workspaces on the remote server that you have access to").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Bind the current Git branch to the active workspace. This adds the branch to gitBranches in wmill.yaml so sync operations use the correct workspace for each branch.").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, true)).command("unbind").description("Remove workspace binding from the current Git branch").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork);
   workspace_default = command;
 });
 
@@ -25864,7 +26009,7 @@ async function tryResolveBranchWorkspace(opts, branchOverride) {
       currentBranch = rawBranch;
     }
   }
-  const config = await readConfigFile();
+  const config = await readConfigFile({ warnIfMissing: false });
   const branchConfig = config.gitBranches?.[currentBranch];
   if (!branchConfig?.baseUrl || !branchConfig?.workspaceId) {
     return;
@@ -25956,10 +26101,10 @@ async function resolveWorkspace(opts, branchOverride) {
   const res = await tryResolveWorkspace(opts);
   if (!res.isError) {
     const workspace = res.value;
-    if (branchOverride || !branch || !branch.startsWith(WM_FORK_PREFIX)) {
+    if (branchOverride || opts.workspace || !branch || !branch.startsWith(WM_FORK_PREFIX)) {
       return workspace;
     } else {
-      info(`Found an active workspace \`${workspace.name}\` but the branch name indicates this is a forked workspace. Ignoring active workspace and trying to resolve the correct workspace from the branch name \`${branch}\``);
+      info(`Found an active workspace \`${workspace.name}\` but the branch name indicates this is a forked workspace. Ignoring active workspace and trying to resolve the correct workspace from the branch name \`${branch}\`. Use --workspace to override.`);
     }
   } else if (opts.workspace) {
     const workspaces = await allWorkspaces(opts.configDir);
@@ -28134,15 +28279,15 @@ var require_constants2 = __commonJS((exports, module) => {
 var require_buffer_util = __commonJS((exports, module) => {
   var { EMPTY_BUFFER } = require_constants2();
   var FastBuffer = Buffer[Symbol.species];
-  function concat(list2, totalLength) {
-    if (list2.length === 0)
+  function concat(list3, totalLength) {
+    if (list3.length === 0)
       return EMPTY_BUFFER;
-    if (list2.length === 1)
-      return list2[0];
+    if (list3.length === 1)
+      return list3[0];
     const target = Buffer.allocUnsafe(totalLength);
     let offset = 0;
-    for (let i = 0;i < list2.length; i++) {
-      const buf = list2[i];
+    for (let i = 0;i < list3.length; i++) {
+      const buf = list3[i];
       target.set(buf, offset);
       offset += buf.length;
     }
@@ -29394,14 +29539,14 @@ var require_sender = __commonJS((exports, module) => {
       this._bufferedBytes += params[3][kByteLength];
       this._queue.push(params);
     }
-    sendFrame(list2, cb) {
-      if (list2.length === 2) {
+    sendFrame(list3, cb) {
+      if (list3.length === 2) {
         this._socket.cork();
-        this._socket.write(list2[0]);
-        this._socket.write(list2[1], cb);
+        this._socket.write(list3[0]);
+        this._socket.write(list3[1], cb);
         this._socket.uncork();
       } else {
-        this._socket.write(list2[0], cb);
+        this._socket.write(list3[0], cb);
       }
     }
   }
@@ -32732,7 +32877,7 @@ var minimatch = (p, pattern, options = {}) => {
     defaults: (options) => orig.defaults(ext(def, options)),
     makeRe: (pattern, options = {}) => orig.makeRe(pattern, ext(def, options)),
     braceExpand: (pattern, options = {}) => orig.braceExpand(pattern, ext(def, options)),
-    match: (list2, pattern, options = {}) => orig.match(list2, pattern, ext(def, options)),
+    match: (list3, pattern, options = {}) => orig.match(list3, pattern, ext(def, options)),
     sep: orig.sep,
     GLOBSTAR
   });
@@ -32742,13 +32887,13 @@ var minimatch = (p, pattern, options = {}) => {
     return [pattern];
   }
   return expand(pattern, { max: options.braceExpandMax });
-}, makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe(), match = (list2, pattern, options = {}) => {
+}, makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe(), match = (list3, pattern, options = {}) => {
   const mm = new Minimatch(pattern, options);
-  list2 = list2.filter((f) => mm.match(f));
-  if (mm.options.nonull && !list2.length) {
-    list2.push(pattern);
+  list3 = list3.filter((f) => mm.match(f));
+  if (mm.options.nonull && !list3.length) {
+    list3.push(pattern);
   }
-  return list2;
+  return list3;
 }, globMagic, regExpEscape2 = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
 var init_esm2 = __esm(() => {
   init_esm();
@@ -34595,20 +34740,20 @@ var require__stream_readable = __commonJS((exports, module) => {
     }
     return ret;
   }
-  function fromListPartial(n, list2, hasStrings) {
+  function fromListPartial(n, list3, hasStrings) {
     var ret;
-    if (n < list2.head.data.length) {
-      ret = list2.head.data.slice(0, n);
-      list2.head.data = list2.head.data.slice(n);
-    } else if (n === list2.head.data.length) {
-      ret = list2.shift();
+    if (n < list3.head.data.length) {
+      ret = list3.head.data.slice(0, n);
+      list3.head.data = list3.head.data.slice(n);
+    } else if (n === list3.head.data.length) {
+      ret = list3.shift();
     } else {
-      ret = hasStrings ? copyFromBufferString(n, list2) : copyFromBuffer(n, list2);
+      ret = hasStrings ? copyFromBufferString(n, list3) : copyFromBuffer(n, list3);
     }
     return ret;
   }
-  function copyFromBufferString(n, list2) {
-    var p = list2.head;
+  function copyFromBufferString(n, list3) {
+    var p = list3.head;
     var c = 1;
     var ret = p.data;
     n -= ret.length;
@@ -34624,23 +34769,23 @@ var require__stream_readable = __commonJS((exports, module) => {
         if (nb === str.length) {
           ++c;
           if (p.next)
-            list2.head = p.next;
+            list3.head = p.next;
           else
-            list2.head = list2.tail = null;
+            list3.head = list3.tail = null;
         } else {
-          list2.head = p;
+          list3.head = p;
           p.data = str.slice(nb);
         }
         break;
       }
       ++c;
     }
-    list2.length -= c;
+    list3.length -= c;
     return ret;
   }
-  function copyFromBuffer(n, list2) {
+  function copyFromBuffer(n, list3) {
     var ret = Buffer4.allocUnsafe(n);
-    var p = list2.head;
+    var p = list3.head;
     var c = 1;
     p.data.copy(ret);
     n -= p.data.length;
@@ -34653,18 +34798,18 @@ var require__stream_readable = __commonJS((exports, module) => {
         if (nb === buf.length) {
           ++c;
           if (p.next)
-            list2.head = p.next;
+            list3.head = p.next;
           else
-            list2.head = list2.tail = null;
+            list3.head = list3.tail = null;
         } else {
-          list2.head = p;
+          list3.head = p;
           p.data = buf.slice(nb);
         }
         break;
       }
       ++c;
     }
-    list2.length -= c;
+    list3.length -= c;
     return ret;
   }
   function endReadable(stream) {
@@ -56161,12 +56306,16 @@ function getBranchSpecificTypes() {
   return {
     variable: ".variable.yaml",
     resource: ".resource.yaml",
+    schedule: ".schedule.yaml",
     ...Object.fromEntries(TRIGGER_TYPES.map((t) => [`${t}_trigger`, `.${t}_trigger.yaml`]))
   };
 }
 function isTriggerFile(path5) {
   return TRIGGER_TYPES.some((type) => path5.endsWith(`.${type}_trigger.yaml`));
 }
+function isScheduleFile(path5) {
+  return path5.endsWith(".schedule.yaml");
+}
 function getFileTypeSuffix(path5) {
   for (const [_, suffix] of Object.entries(getBranchSpecificTypes())) {
     if (path5.endsWith(suffix)) {
@@ -56180,7 +56329,7 @@ function getFileTypeSuffix(path5) {
   return null;
 }
 function buildYamlTypePattern() {
-  const basicTypes = ["variable", "resource"];
+  const basicTypes = ["variable", "resource", "schedule"];
   const triggerTypes = TRIGGER_TYPES.map((t) => `${t}_trigger`);
   return `((${basicTypes.join("|")})|(${triggerTypes.join("|")}))`;
 }
@@ -56212,6 +56361,9 @@ function getSpecificItemsForCurrentBranch(config, branchOverride) {
   if (commonItems?.triggers) {
     merged.triggers = [...commonItems.triggers];
   }
+  if (commonItems?.schedules) {
+    merged.schedules = [...commonItems.schedules];
+  }
   if (commonItems?.folders) {
     merged.folders = [...commonItems.folders];
   }
@@ -56227,6 +56379,9 @@ function getSpecificItemsForCurrentBranch(config, branchOverride) {
   if (branchItems?.triggers) {
     merged.triggers = [...merged.triggers || [], ...branchItems.triggers];
   }
+  if (branchItems?.schedules) {
+    merged.schedules = [...merged.schedules || [], ...branchItems.schedules];
+  }
   if (branchItems?.folders) {
     merged.folders = [...merged.folders || [], ...branchItems.folders];
   }
@@ -56251,6 +56406,9 @@ function isItemTypeConfigured(path5, specificItems) {
   if (isTriggerFile(path5)) {
     return specificItems.triggers !== undefined;
   }
+  if (isScheduleFile(path5)) {
+    return specificItems.schedules !== undefined;
+  }
   if (path5.endsWith("/folder.meta.yaml")) {
     return specificItems.folders !== undefined;
   }
@@ -56275,6 +56433,9 @@ function isSpecificItem(path5, specificItems) {
   if (isTriggerFile(path5)) {
     return specificItems.triggers ? matchesPatterns(path5, specificItems.triggers) : false;
   }
+  if (isScheduleFile(path5)) {
+    return specificItems.schedules ? matchesPatterns(path5, specificItems.schedules) : false;
+  }
   if (path5.endsWith("/folder.meta.yaml")) {
     if (specificItems.folders) {
       const folderPath = path5.slice(0, -"/folder.meta.yaml".length);
@@ -59357,7 +59518,9 @@ function removeExtensionToPath(path6) {
   }
   throw new Error("Invalid extension: " + path6);
 }
-async function list2(opts) {
+async function list3(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -59405,14 +59568,40 @@ async function resolve6(input) {
   }
 }
 async function run2(opts, path6) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const input = opts.data ? await resolve6(opts.data) : {};
-  const id = await runScriptByPath({
-    workspace: workspace.workspaceId,
-    path: path6,
-    requestBody: input
-  });
+  let id;
+  try {
+    id = await runScriptByPath({
+      workspace: workspace.workspaceId,
+      path: path6,
+      requestBody: input
+    });
+  } catch (e) {
+    if (e?.status === 404) {
+      try {
+        const script = await getScriptByPath({
+          workspace: workspace.workspaceId,
+          path: path6
+        });
+        if (script.lock_error_logs) {
+          throw new Error(`Script '${path6}' has a deployment error and cannot be run:
+${script.lock_error_logs}`);
+        }
+      } catch (lookupErr) {
+        if (lookupErr?.message?.includes("deployment error"))
+          throw lookupErr;
+        if (lookupErr?.status && lookupErr.status !== 404)
+          throw lookupErr;
+      }
+      throw new Error(`Script '${path6}' not found. Run 'wmill script list' to see available scripts.`);
+    }
+    throw e;
+  }
   if (!opts.silent) {
     await track_job(workspace.workspaceId, id);
   }
@@ -59423,7 +59612,7 @@ async function run2(opts, path6) {
         id
       })).result ?? {};
       if (opts.silent) {
-        console.log(result);
+        console.log(JSON.stringify(result));
       } else {
         info(JSON.stringify(result, null, 2));
       }
@@ -59541,7 +59730,8 @@ async function bootstrap(opts, scriptPath, language) {
   const resolvedLanguage = languageAliases[language] ?? language;
   const scriptInitialCode = scriptBootstrapCode[resolvedLanguage];
   if (scriptInitialCode === undefined) {
-    throw new Error("Language unknown");
+    const validLanguages = Object.keys(scriptBootstrapCode).sort().join(", ");
+    throw new Error(`Unknown language '${language}'. Valid languages: ${validLanguages}`);
   }
   const config = await readConfigFile();
   const extension = filePathExtensionFromContentType(resolvedLanguage, config.defaultTs);
@@ -59631,6 +59821,9 @@ async function generateMetadata(opts, scriptPath) {
   }
 }
 async function preview(opts, filePath) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
@@ -59786,6 +59979,30 @@ async function preview(opts, filePath) {
     }
   }
 }
+async function history(opts, scriptPath) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const versions = await getScriptHistoryByPath({
+    workspace: workspace.workspaceId,
+    path: scriptPath
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(versions));
+  } else {
+    if (versions.length === 0) {
+      info("No version history found for " + scriptPath);
+      return;
+    }
+    new Table2().header(["#", "Hash", "Deployment Message"]).padding(2).border(true).body(versions.map((v, i) => [
+      String(versions.length - i),
+      v.script_hash,
+      v.deployment_msg ?? "-"
+    ])).render();
+  }
+}
 var import_yaml5, exts, languageAliases, command3, script_default;
 var init_script = __esm(async () => {
   init_colors2();
@@ -59841,7 +60058,7 @@ var init_script = __esm(async () => {
   languageAliases = {
     python: "python3"
   };
-  command3 = new Command().description("script related commands").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list2).command("list", "list all scripts").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list2).command("push", "push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)").arguments("<path:file>").action(push).command("get", "get a script's details").arguments("<path:file>").option("--json", "Output as JSON (for piping to jq)").action(get).command("show", "show a script's content (alias for get)").arguments("<path:file>").action(show).command("run", "run a script by path").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").action(run2).command("preview", "preview a local script without deploying it. Supports both regular and codebase scripts.").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other than the final output. Useful for scripting.").action(preview).command("new", "create a new script").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("bootstrap", "create a new script (alias for new)").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("generate-metadata", "re-generate the metadata file updating the lock and the script schema (for flows, use `wmill flow generate-locks`)").arguments("[script:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--lock-only", "re-generate only the lock").option("--schema-only", "re-generate only script schema").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateMetadata);
+  command3 = new Command().description("script related commands").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list3).command("list", "list all scripts").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list3).command("push", "push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)").arguments("<path:file>").action(push).command("get", "get a script's details").arguments("<path:file>").option("--json", "Output as JSON (for piping to jq)").action(get).command("show", "show a script's content (alias for get)").arguments("<path:file>").action(show).command("run", "run a script by path").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").action(run2).command("preview", "preview a local script without deploying it. Supports both regular and codebase scripts.").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other than the final output. Useful for scripting.").action(preview).command("new", "create a new script").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("bootstrap", "create a new script (alias for new)").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("generate-metadata", "re-generate the metadata file updating the lock and the script schema (for flows, use `wmill flow generate-locks`)").arguments("[script:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--lock-only", "re-generate only the lock").option("--schema-only", "re-generate only script schema").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateMetadata).command("history", "show version history for a script").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history);
   script_default = command3;
 });
 
@@ -60457,7 +60674,9 @@ async function push2(opts, filePath, remotePath) {
   await pushResource(workspace.workspaceId, remotePath, undefined, parseFromFile(filePath), filePath);
   info(colors.bold.underline.green(`Resource ${remotePath} pushed`));
 }
-async function list3(opts) {
+async function list4(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -60536,7 +60755,7 @@ var init_resource = __esm(async () => {
     init_specific_items()
   ]);
   import_yaml7 = __toESM(require_dist(), 1);
-  command5 = new Command().description("resource related commands").option("--json", "Output as JSON (for piping to jq)").action(list3).command("list", "list all resources").option("--json", "Output as JSON (for piping to jq)").action(list3).command("get", "get a resource's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get2).command("new", "create a new resource locally").arguments("<path:string>").action(newResource).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push2);
+  command5 = new Command().description("resource related commands").option("--json", "Output as JSON (for piping to jq)").action(list4).command("list", "list all resources").option("--json", "Output as JSON (for piping to jq)").action(list4).command("get", "get a resource's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get2).command("new", "create a new resource locally").arguments("<path:string>").action(newResource).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push2);
   resource_default = command5;
 });
 
@@ -60557,6 +60776,10 @@ function getLanguageFromExtension(ext2, defaultTs = "bun") {
   }
   return;
 }
+function sanitizeForFilesystem(summary) {
+  const name = summary.toLowerCase().replaceAll(" ", "_").replace(/[/\\:*?"<>|\x00-\x1f\x7f]/g, "").replace(/_+/g, "_").replace(/^[._]+|[._]+$/g, "");
+  return WINDOWS_RESERVED.test(name) ? `_${name}` : name;
+}
 function newPathAssigner(defaultTs, options) {
   const resolvedOptions = typeof defaultTs === "object" ? defaultTs : { defaultTs, skipInlineScriptSuffix: options?.skipInlineScriptSuffix };
   const { defaultTs: tsRuntime, skipInlineScriptSuffix } = resolvedOptions;
@@ -60564,7 +60787,7 @@ function newPathAssigner(defaultTs, options) {
   const seen_names = new Set;
   function assignPath(summary, language) {
     let name;
-    name = summary?.toLowerCase()?.replaceAll(" ", "_") ?? "";
+    name = summary ? sanitizeForFilesystem(summary) : "";
     let original_name = name;
     if (name == "") {
       original_name = INLINE_SCRIPT_PREFIX;
@@ -60586,7 +60809,7 @@ function newRawAppPathAssigner(defaultTs) {
   const seen_names = new Set;
   function assignPath(summary, language) {
     let name;
-    name = summary?.toLowerCase()?.replaceAll(" ", "_") ?? "";
+    name = summary ? sanitizeForFilesystem(summary) : "";
     let original_name = name;
     if (name == "") {
       original_name = "runnable";
@@ -60602,7 +60825,7 @@ function newRawAppPathAssigner(defaultTs) {
   }
   return { assignPath };
 }
-var INLINE_SCRIPT_PREFIX = "inline_script", LANGUAGE_EXTENSIONS, EXTENSION_TO_LANGUAGE;
+var INLINE_SCRIPT_PREFIX = "inline_script", LANGUAGE_EXTENSIONS, EXTENSION_TO_LANGUAGE, WINDOWS_RESERVED;
 var init_path_assigner = __esm(() => {
   LANGUAGE_EXTENSIONS = {
     python3: "py",
@@ -60656,19 +60879,23 @@ var init_path_assigner = __esm(() => {
     rb: "ruby",
     ts: "bun"
   };
+  WINDOWS_RESERVED = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])$/;
 });
 
 // windmill-utils-internal/src/inline-scripts/extractor.ts
 function extractRawscriptInline(id, summary, rawscript, mapping, separator, assigner) {
   const [basePath, ext2] = assigner.assignPath(summary ?? id, rawscript.language);
-  const path7 = mapping[id] ?? basePath + ext2;
+  const mappedPath = mapping[id];
+  const path7 = mappedPath ?? basePath + ext2;
   const language = rawscript.language;
   const content = rawscript.content;
   const r = [{ path: path7, content, language, is_lock: false }];
   rawscript.content = "!inline " + path7.replaceAll(separator, "/");
   const lock = rawscript.lock;
   if (lock && lock != "") {
-    const lockPath = basePath + "lock";
+    const dotIdx = mappedPath ? mappedPath.lastIndexOf(".") : -1;
+    const lockBasePath = mappedPath ? dotIdx > 0 ? mappedPath.substring(0, dotIdx + 1) : mappedPath + "." : basePath;
+    const lockPath = lockBasePath + "lock";
     rawscript.lock = "!inline " + lockPath.replaceAll(separator, "/");
     r.push({ path: lockPath, content: lock, language, is_lock: true });
   }
@@ -60703,6 +60930,43 @@ function extractInlineScripts(modules, mapping = {}, separator = "/", defaultTs,
     }
   });
 }
+function extractCurrentMapping(modules, mapping = {}, failureModule, preprocessorModule) {
+  if (failureModule) {
+    extractCurrentMapping([failureModule], mapping);
+  }
+  if (preprocessorModule) {
+    extractCurrentMapping([preprocessorModule], mapping);
+  }
+  if (!modules || !Array.isArray(modules)) {
+    return mapping;
+  }
+  modules.forEach((m) => {
+    if (!m?.value?.type) {
+      return;
+    }
+    if (m.value.type === "rawscript") {
+      if (m.value.content && m.value.content.startsWith("!inline ")) {
+        mapping[m.id] = m.value.content.trim().split(" ")[1];
+      }
+    } else if (m.value.type === "forloopflow" || m.value.type === "whileloopflow") {
+      extractCurrentMapping(m.value.modules, mapping);
+    } else if (m.value.type === "branchall") {
+      m.value.branches.forEach((b) => extractCurrentMapping(b.modules, mapping));
+    } else if (m.value.type === "branchone") {
+      m.value.branches.forEach((b) => extractCurrentMapping(b.modules, mapping));
+      extractCurrentMapping(m.value.default, mapping);
+    } else if (m.value.type === "aiagent") {
+      (m.value.tools ?? []).forEach((tool) => {
+        const toolValue = tool.value;
+        if (!toolValue || toolValue.tool_type !== "flowmodule" || toolValue.type !== "rawscript" || !toolValue.content || !toolValue.content.startsWith("!inline ")) {
+          return;
+        }
+        mapping[tool.id] = toolValue.content.trim().split(" ")[1];
+      });
+    }
+  });
+  return mapping;
+}
 var init_extractor = __esm(() => {
   init_path_assigner();
 });
@@ -61000,6 +61264,7 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
       info(`Recomputing locks of ${changedScripts.join(", ")} in ${folder}`);
     }
     const fileReader = async (path8) => await readFile7(folder + SEP7 + path8, "utf-8");
+    const currentMapping = extractCurrentMapping(flowValue.value.modules, {}, flowValue.value.failure_module, flowValue.value.preprocessor_module);
     const locksToRemove = tree && !legacyBehaviour ? Object.keys(hashes).filter((k) => {
       if (k === TOP_HASH)
         return false;
@@ -61018,12 +61283,12 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
     const lockAssigner = newPathAssigner(opts.defaultTs ?? "bun", {
       skipInlineScriptSuffix: getNonDottedPaths()
     });
-    const inlineScripts = extractInlineScripts(flowValue.value.modules, {}, SEP7, opts.defaultTs, lockAssigner);
+    const inlineScripts = extractInlineScripts(flowValue.value.modules, currentMapping, SEP7, opts.defaultTs, lockAssigner);
     if (flowValue.value.failure_module) {
-      inlineScripts.push(...extractInlineScripts([flowValue.value.failure_module], {}, SEP7, opts.defaultTs, lockAssigner));
+      inlineScripts.push(...extractInlineScripts([flowValue.value.failure_module], currentMapping, SEP7, opts.defaultTs, lockAssigner));
     }
     if (flowValue.value.preprocessor_module) {
-      inlineScripts.push(...extractInlineScripts([flowValue.value.preprocessor_module], {}, SEP7, opts.defaultTs, lockAssigner));
+      inlineScripts.push(...extractInlineScripts([flowValue.value.preprocessor_module], currentMapping, SEP7, opts.defaultTs, lockAssigner));
     }
     inlineScripts.forEach((s) => {
       writeIfChanged(process.cwd() + SEP7 + folder + SEP7 + s.path, s.content);
@@ -62448,8 +62713,13 @@ async function pushParentScriptForModule(modulePath, workspace, alreadySynced, m
   }
 }
 async function pull(opts) {
+  if (opts.jsonOutput)
+    setSilent(true);
   const originalCliOpts = { ...opts };
   opts = await mergeConfigWithConfigFile(opts);
+  if (originalCliOpts.includeSecrets) {
+    opts.skipSecrets = false;
+  }
   try {
     await validateBranchConfiguration(opts, opts.branch);
   } catch (error2) {
@@ -62682,8 +62952,13 @@ function removeSuffix(str, suffix) {
   return str.slice(0, str.length - suffix.length);
 }
 async function push3(opts) {
+  if (opts.jsonOutput)
+    setSilent(true);
   const originalCliOpts = { ...opts };
   opts = await mergeConfigWithConfigFile(opts);
+  if (originalCliOpts.includeSecrets) {
+    opts.skipSecrets = false;
+  }
   try {
     await validateBranchConfiguration(opts, opts.branch);
   } catch (error2) {
@@ -62751,55 +63026,104 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   const changes = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, opts.branch, false);
   const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
   const tracker = await buildTracker(changes);
+  const autoRegenerate = !!opts.autoMetadata;
   const staleScripts = [];
   const staleFlows = [];
   const staleApps = [];
   for (const change of tracker.scripts) {
-    const stale = await generateScriptMetadataInternal(change, workspace, opts, true, true, rawWorkspaceDependencies, codebases, false);
+    const stale = await generateScriptMetadataInternal(change, workspace, opts, !autoRegenerate, true, rawWorkspaceDependencies, codebases, false);
     if (stale) {
       staleScripts.push(stale);
     }
   }
   if (staleScripts.length > 0) {
     info("");
-    warn("Stale scripts metadata found, you may want to update them using 'wmill script generate-metadata' before pushing:");
+    if (autoRegenerate) {
+      info("Auto-regenerated metadata for stale scripts:");
+    } else {
+      warn("Stale scripts metadata found, you may want to update them using 'wmill script generate-metadata' before pushing:");
+    }
     for (const stale of staleScripts) {
-      warn(stale);
+      if (autoRegenerate) {
+        info(`  ${stale}`);
+      } else {
+        warn(stale);
+      }
     }
     info("");
   }
   for (const change of tracker.flows) {
-    const stale = await generateFlowLockInternal(change, true, workspace, opts, false, true);
+    const stale = await generateFlowLockInternal(change, !autoRegenerate, workspace, opts, false, true);
     if (stale) {
       staleFlows.push(stale);
     }
   }
   if (staleFlows.length > 0) {
-    warn("Stale flows locks found, you may want to update them using 'wmill flow generate-locks' before pushing:");
+    if (autoRegenerate) {
+      info("Auto-regenerated locks for stale flows:");
+    } else {
+      warn("Stale flows locks found, you may want to update them using 'wmill flow generate-locks' before pushing:");
+    }
     for (const stale of staleFlows) {
-      warn(stale);
+      if (autoRegenerate) {
+        info(`  ${stale}`);
+      } else {
+        warn(stale);
+      }
     }
     info("");
   }
   for (const change of tracker.apps) {
-    const stale = await generateAppLocksInternal(change, false, true, workspace, opts, true, true);
+    const stale = await generateAppLocksInternal(change, false, !autoRegenerate, workspace, opts, true, true);
     if (stale) {
       staleApps.push(stale);
     }
   }
   for (const change of tracker.rawApps) {
-    const stale = await generateAppLocksInternal(change, true, true, workspace, opts, true, true);
+    const stale = await generateAppLocksInternal(change, true, !autoRegenerate, workspace, opts, true, true);
     if (stale) {
       staleApps.push(stale);
     }
   }
   if (staleApps.length > 0) {
-    warn("Stale apps locks found, you may want to update them using 'wmill app generate-locks' before pushing:");
+    if (autoRegenerate) {
+      info("Auto-regenerated locks for stale apps:");
+    } else {
+      warn("Stale apps locks found, you may want to update them using 'wmill app generate-locks' before pushing:");
+    }
     for (const stale of staleApps) {
-      warn(stale);
+      if (autoRegenerate) {
+        info(`  ${stale}`);
+      } else {
+        warn(stale);
+      }
     }
     info("");
   }
+  {
+    const skippedWarnings = [];
+    let scheduleCount = 0;
+    let triggerCount = 0;
+    for await (const entry of readDirRecursiveWithIgnore2(() => false, local)) {
+      if (entry.isDirectory)
+        continue;
+      if (!opts.includeSchedules && entry.path.endsWith(".schedule.yaml"))
+        scheduleCount++;
+      if (!opts.includeTriggers && entry.path.endsWith("_trigger.yaml"))
+        triggerCount++;
+    }
+    if (scheduleCount > 0) {
+      skippedWarnings.push(`Skipping ${scheduleCount} schedule file(s). Use --include-schedules or set includeSchedules: true in wmill.yaml`);
+    }
+    if (triggerCount > 0) {
+      skippedWarnings.push(`Skipping ${triggerCount} trigger file(s). Use --include-triggers or set includeTriggers: true in wmill.yaml`);
+    }
+    for (const warning of skippedWarnings) {
+      warn(warning);
+    }
+    if (skippedWarnings.length > 0)
+      info("");
+  }
   await fetchRemoteVersion(workspace);
   info(`remote (${workspace.name}) <- local: ${changes.length} changes to apply`);
   const missingFolders = [];
@@ -63070,16 +63394,60 @@ ${folderList}
                   });
                   break;
                 case "flow":
-                  await deleteFlowByPath({
-                    workspace: workspaceId,
-                    path: removeSuffix(target, getDeleteSuffix("flow", "json"))
-                  });
+                  if (isFlowFolderMetadataFile(target)) {
+                    await deleteFlowByPath({
+                      workspace: workspaceId,
+                      path: removeSuffix(target, getDeleteSuffix("flow", "json"))
+                    });
+                  } else {
+                    const flowFolder = extractFolderPath(target, "flow");
+                    let flowFolderExists = false;
+                    if (flowFolder) {
+                      try {
+                        await stat6(flowFolder);
+                        flowFolderExists = true;
+                      } catch {}
+                    }
+                    if (flowFolderExists) {
+                      await pushObj(workspaceId, target, undefined, undefined, opts.plainSecrets ?? false, alreadySynced, opts.message);
+                    } else {
+                      const remotePath = extractResourceName(target, "flow");
+                      if (remotePath) {
+                        await deleteFlowByPath({
+                          workspace: workspaceId,
+                          path: remotePath
+                        });
+                      }
+                    }
+                  }
                   break;
                 case "app":
-                  await deleteApp({
-                    workspace: workspaceId,
-                    path: removeSuffix(target, getDeleteSuffix("app", "json"))
-                  });
+                  if (isAppFolderMetadataFile(target)) {
+                    await deleteApp({
+                      workspace: workspaceId,
+                      path: removeSuffix(target, getDeleteSuffix("app", "json"))
+                    });
+                  } else {
+                    const appFolder = extractFolderPath(target, "app");
+                    let appFolderExists = false;
+                    if (appFolder) {
+                      try {
+                        await stat6(appFolder);
+                        appFolderExists = true;
+                      } catch {}
+                    }
+                    if (appFolderExists) {
+                      await pushObj(workspaceId, target, undefined, undefined, opts.plainSecrets ?? false, alreadySynced, opts.message);
+                    } else {
+                      const remotePath = extractResourceName(target, "app");
+                      if (remotePath) {
+                        await deleteApp({
+                          workspace: workspaceId,
+                          path: remotePath
+                        });
+                      }
+                    }
+                  }
                   break;
                 case "raw_app":
                   if (isRawAppFolderMetadataFile(target)) {
@@ -63337,7 +63705,7 @@ var init_sync = __esm(async () => {
     aliasDuplicateObjects: false,
     singleQuote: true
   };
-  command6 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").action(push3);
+  command6 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing").action(push3);
   sync_default = command6;
 });
 
@@ -64364,6 +64732,13 @@ var init_metadata = __esm(async () => {
 });
 
 // src/commands/app/raw_apps.ts
+var exports_raw_apps = {};
+__export(exports_raw_apps, {
+  writeRunnableToBackend: () => writeRunnableToBackend,
+  pushRawApp: () => pushRawApp,
+  loadRunnablesFromBackend: () => loadRunnablesFromBackend,
+  generatingPolicy: () => generatingPolicy
+});
 import { sep as SEP10 } from "node:path";
 import path10 from "node:path";
 import { readFile as readFile10, readdir as readdir6 } from "node:fs/promises";
@@ -67066,6 +67441,7 @@ var init_new = __esm(async () => {
 
 // src/commands/app/app.ts
 import { sep as SEP13 } from "node:path";
+import { stat as stat9 } from "node:fs/promises";
 function respecializeFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
     if (typeof v == "object") {
@@ -67195,7 +67571,7 @@ async function generatingPolicy2(app, path16, publicApp) {
     throw e;
   }
 }
-async function list4(opts) {
+async function list5(opts) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -67241,8 +67617,24 @@ async function push4(opts, filePath, remotePath) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  await pushApp(workspace.workspaceId, remotePath, filePath);
-  info(colors.bold.underline.green("App pushed"));
+  const normalizedPath = filePath.endsWith(SEP13) ? filePath.slice(0, -1) : filePath;
+  const isRawApp = normalizedPath.endsWith("__raw_app") || normalizedPath.endsWith(".raw_app");
+  let hasRawAppYaml = false;
+  if (!isRawApp) {
+    try {
+      const rawAppPath = (filePath.endsWith(SEP13) ? filePath : filePath + SEP13) + "raw_app.yaml";
+      await stat9(rawAppPath);
+      hasRawAppYaml = true;
+    } catch {}
+  }
+  if (isRawApp || hasRawAppYaml) {
+    const { pushRawApp: pushRawApp2 } = await init_raw_apps().then(() => exports_raw_apps);
+    await pushRawApp2(workspace.workspaceId, remotePath, filePath);
+    info(colors.bold.underline.green("Raw app pushed"));
+  } else {
+    await pushApp(workspace.workspaceId, remotePath, filePath);
+    info(colors.bold.underline.green("App pushed"));
+  }
 }
 var alreadySynced2, command11, app_default;
 var init_app = __esm(async () => {
@@ -67265,7 +67657,7 @@ var init_app = __esm(async () => {
     init_generate_agents()
   ]);
   alreadySynced2 = [];
-  command11 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list4).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list4).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get3).command("push", "push a local app ").arguments("<file_path:string> <remote_path:string>").action(push4).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", "re-generate the lockfiles for app runnables inline scripts that have changed").arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
+  command11 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list5).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list5).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get3).command("push", "push a local app ").arguments("<file_path:string> <remote_path:string>").action(push4).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", "re-generate the lockfiles for app runnables inline scripts that have changed").arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
     warn(colors.yellow('This command is deprecated. Use "wmill generate-metadata" instead.'));
     const { generateLocksCommand: generateLocksCommand2 } = await init_app_metadata().then(() => exports_app_metadata);
     await generateLocksCommand2(opts, appFolder);
@@ -67274,9 +67666,11 @@ var init_app = __esm(async () => {
 });
 
 // src/commands/folder/folder.ts
-import { stat as stat9, readdir as readdir7, writeFile as writeFile10, mkdir as mkdir7 } from "node:fs/promises";
+import { stat as stat10, readdir as readdir7, writeFile as writeFile10, mkdir as mkdir7 } from "node:fs/promises";
 import { sep as SEP14 } from "node:path";
-async function list5(opts) {
+async function list6(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const folders = await listFolders({
@@ -67296,7 +67690,7 @@ async function newFolder(opts, name) {
   const dirPath = `f${SEP14}${name}`;
   const filePath = `${dirPath}${SEP14}folder.meta.yaml`;
   try {
-    await stat9(filePath);
+    await stat10(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -67384,7 +67778,7 @@ async function push5(opts, name) {
   await requireLogin(opts);
   const metaPath = `f${SEP14}${name}${SEP14}folder.meta.yaml`;
   try {
-    await stat9(metaPath);
+    await stat10(metaPath);
   } catch {
     throw new Error(`Could not find ${metaPath}. Does the folder exist locally?`);
   }
@@ -67395,7 +67789,7 @@ async function push5(opts, name) {
 async function addMissing(opts) {
   const fDir = `f`;
   try {
-    await stat9(fDir);
+    await stat10(fDir);
   } catch {
     info("No 'f/' directory found. Nothing to do.");
     return;
@@ -67407,7 +67801,7 @@ async function addMissing(opts) {
       continue;
     const metaPath = `${fDir}${SEP14}${entry.name}${SEP14}folder.meta.yaml`;
     try {
-      await stat9(metaPath);
+      await stat10(metaPath);
     } catch {
       missing.push(entry.name);
     }
@@ -67446,7 +67840,7 @@ var init_folder = __esm(async () => {
     init_types()
   ]);
   import_yaml23 = __toESM(require_dist(), 1);
-  command12 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list5).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list5).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push5).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing);
+  command12 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push5).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing);
   folder_default = command12;
 });
 
@@ -67487,7 +67881,7 @@ function compileResourceTypeToTsType(schema) {
 
 // src/commands/resource-type/resource-type.ts
 import { writeFileSync as writeFileSync4 } from "node:fs";
-import { stat as stat10, writeFile as writeFile11 } from "node:fs/promises";
+import { stat as stat11, writeFile as writeFile11 } from "node:fs/promises";
 import path16 from "node:path";
 import process16 from "node:process";
 async function pushResourceType(workspace, remotePath, resource, localResource) {
@@ -67521,7 +67915,7 @@ async function pushResourceType(workspace, remotePath, resource, localResource)
   }
 }
 async function push6(opts, filePath, name) {
-  const fstat = await stat10(filePath);
+  const fstat = await stat11(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -67531,7 +67925,9 @@ async function push6(opts, filePath, name) {
   await pushResourceType(workspace.workspaceId, name, undefined, parseFromFile(filePath));
   info(colors.bold.underline.green("Resource pushed"));
 }
-async function list6(opts) {
+async function list7(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const res = await listResourceType({
@@ -67552,7 +67948,7 @@ async function list6(opts) {
 async function newResourceType(opts, name) {
   const filePath = name + ".resource-type.yaml";
   try {
-    await stat10(filePath);
+    await stat11(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -67620,14 +68016,16 @@ var init_resource_type = __esm(async () => {
     init_utils()
   ]);
   import_yaml24 = __toESM(require_dist(), 1);
-  command13 = new Command().description("resource type related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all resource types").option("--schema", "Show schema in the output").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get a resource type's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new resource type locally").arguments("<name:string>").action(newResourceType).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <name:string>").action(push6).command("generate-namespace", "Create a TypeScript definition file with the RT namespace generated from the resource types").action(generateRTNamespace);
+  command13 = new Command().description("resource type related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all resource types").option("--schema", "Show schema in the output").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a resource type's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new resource type locally").arguments("<name:string>").action(newResourceType).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <name:string>").action(push6).command("generate-namespace", "Create a TypeScript definition file with the RT namespace generated from the resource types").action(generateRTNamespace);
   resource_type_default = command13;
 });
 
 // src/commands/variable/variable.ts
-import { stat as stat11, writeFile as writeFile12 } from "node:fs/promises";
+import { stat as stat12, writeFile as writeFile12 } from "node:fs/promises";
 import { sep as SEP15 } from "node:path";
-async function list7(opts) {
+async function list8(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const variables = await listVariable({
@@ -67650,7 +68048,7 @@ async function newVariable(opts, path17) {
   }
   const filePath = path17 + ".variable.yaml";
   try {
-    await stat11(filePath);
+    await stat12(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -67731,7 +68129,7 @@ async function push7(opts, filePath, remotePath) {
   if (!validatePath(remotePath)) {
     return;
   }
-  const fstat = await stat11(filePath);
+  const fstat = await stat12(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -67779,14 +68177,16 @@ var init_variable = __esm(async () => {
     init_confirm()
   ]);
   import_yaml25 = __toESM(require_dist(), 1);
-  command14 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --plain-secrets instead").action(add2);
+  command14 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --plain-secrets instead").action(add2);
   variable_default = command14;
 });
 
 // src/commands/schedule/schedule.ts
-import { stat as stat12, writeFile as writeFile13 } from "node:fs/promises";
+import { stat as stat13, writeFile as writeFile13 } from "node:fs/promises";
 import { sep as SEP16 } from "node:path";
-async function list8(opts) {
+async function list9(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const schedules = await listSchedules({
@@ -67804,14 +68204,14 @@ async function newSchedule(opts, path17) {
   }
   const filePath = path17 + ".schedule.yaml";
   try {
-    await stat12(filePath);
+    await stat13(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
       throw e;
   }
   const template = {
-    schedule: "0 */6 * * *",
+    schedule: "0 0 */6 * * *",
     on_failure: "",
     script_path: "",
     args: {},
@@ -67897,13 +68297,35 @@ async function pushSchedule(workspace, path17, schedule, localSchedule) {
     }
   }
 }
+async function enable(opts, path17) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await setScheduleEnabled({
+    workspace: workspace.workspaceId,
+    path: path17,
+    requestBody: { enabled: true }
+  });
+  info(colors.green(`Schedule ${path17} enabled.`));
+}
+async function disable(opts, path17) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await setScheduleEnabled({
+    workspace: workspace.workspaceId,
+    path: path17,
+    requestBody: { enabled: false }
+  });
+  info(colors.yellow(`Schedule ${path17} disabled.`));
+}
 async function push8(opts, filePath, remotePath) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   if (!validatePath(remotePath)) {
     return;
   }
-  const fstat = await stat12(filePath);
+  const fstat = await stat13(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -67921,10 +68343,11 @@ var init_schedule = __esm(async () => {
   await __promiseAll([
     init_auth(),
     init_context(),
+    init_conf(),
     init_types()
   ]);
   import_yaml26 = __toESM(require_dist(), 1);
-  command15 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8);
+  command15 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list9).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list9).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8).command("enable", "Enable a schedule").arguments("<path:string>").action(enable).command("disable", "Disable a schedule").arguments("<path:string>").action(disable);
   schedule_default = command15;
 });
 
@@ -68553,7 +68976,7 @@ var init_settings = __esm(async () => {
 });
 
 // src/commands/instance/instance.ts
-import { readFile as readFile13, writeFile as writeFile15, readdir as readdir8, mkdir as mkdir8, rm as rm3, stat as stat13 } from "node:fs/promises";
+import { readFile as readFile13, writeFile as writeFile15, readdir as readdir8, mkdir as mkdir8, rm as rm3, stat as stat14 } from "node:fs/promises";
 import { appendFile } from "node:fs/promises";
 import * as path17 from "node:path";
 async function allInstances() {
@@ -68663,6 +69086,21 @@ async function pickInstance(opts, allowNew) {
       prefix: opts.prefix ?? "custom"
     };
   }
+  if (instances.length < 1) {
+    try {
+      const ws = await getActiveWorkspace({});
+      if (ws?.remote && ws?.token) {
+        const remote = ws.remote.endsWith("/") ? ws.remote.slice(0, -1) : ws.remote;
+        setClient(ws.token, remote);
+        return {
+          name: ws.name,
+          remote: ws.remote,
+          token: ws.token,
+          prefix: ws.name
+        };
+      }
+    } catch {}
+  }
   if (!allowNew && instances.length < 1) {
     throw new Error("No instance found, please add one first");
   }
@@ -68949,7 +69387,7 @@ Pushing workspace ` + localWorkspace.id);
 }
 async function getLocalWorkspaces(rootDir, localPrefix, folderPerInstance) {
   const localWorkspaces = [];
-  if (!await stat13(localPrefix).catch(() => null)) {
+  if (!await stat14(localPrefix).catch(() => null)) {
     await mkdir8(localPrefix);
   }
   if (folderPerInstance) {
@@ -69004,6 +69442,21 @@ async function getActiveInstance(opts) {
 async function getConfig2(opts) {
   await pickInstance(opts, false);
   const config = await getInstanceConfig();
+  const hasSecrets = config?.global_settings?.license_key || config?.global_settings?.jwt_secret;
+  let showSecrets = opts.showSecrets ?? false;
+  if (!showSecrets && hasSecrets && process.stdout.isTTY && !opts.outputFile) {
+    warn("Config contains sensitive fields (license_key, jwt_secret). They are masked by default.");
+    warn("Use --show-secrets to include them, or press Y to show them now.");
+    showSecrets = await Confirm.prompt({ message: "Show secrets?", default: false });
+  } else if (!process.stdout.isTTY || opts.outputFile) {
+    showSecrets = true;
+  }
+  if (!showSecrets && config?.global_settings) {
+    if (config.global_settings.license_key)
+      config.global_settings.license_key = "***";
+    if (config.global_settings.jwt_secret)
+      config.global_settings.jwt_secret = "***";
+  }
   const yaml = import_yaml29.stringify(config);
   if (opts.outputFile) {
     await writeFile15(opts.outputFile, yaml, "utf-8");
@@ -69071,7 +69524,7 @@ var init_instance = __esm(async () => {
     });
     await removeInstance(choice);
     info(colors.green.underline(`Removed instance ${choice}`));
-  }).command("switch").complete("instance", async () => (await allInstances()).map((x) => x.name)).arguments("<instance:string:instance>").description("Switch the current instance").action(switchI).command("pull").description("Pull instance settings, users, configs, instance groups and overwrite local").option("--yes", "Pull without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pulling users").option("--skip-settings", "Skip pulling settings").option("--skip-configs", "Skip pulling configs (worker groups and SMTP)").option("--skip-groups", "Skip pulling instance groups").option("--include-workspaces", "Also pull workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to pull from, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePull).command("push").description("Push instance settings, users, configs, group and overwrite remote").option("--yes", "Push without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pushing users").option("--skip-settings", "Skip pushing settings").option("--skip-configs", "Skip pushing configs (worker groups and SMTP)").option("--skip-groups", "Skip pushing instance groups").option("--include-workspaces", "Also push workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to push to, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces folders to push").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePush).command("whoami").description("Display information about the currently logged-in user").action(whoami3).command("get-config").description("Dump the current instance config (global settings + worker configs) as YAML").option("-o, --output-file <file:string>", "Write YAML to a file instead of stdout").option("--instance <instance:string>", "Name of the instance, override the active instance").action(getConfig2);
+  }).command("switch").complete("instance", async () => (await allInstances()).map((x) => x.name)).arguments("<instance:string:instance>").description("Switch the current instance").action(switchI).command("pull").description("Pull instance settings, users, configs, instance groups and overwrite local").option("--yes", "Pull without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pulling users").option("--skip-settings", "Skip pulling settings").option("--skip-configs", "Skip pulling configs (worker groups and SMTP)").option("--skip-groups", "Skip pulling instance groups").option("--include-workspaces", "Also pull workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to pull from, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePull).command("push").description("Push instance settings, users, configs, group and overwrite remote").option("--yes", "Push without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pushing users").option("--skip-settings", "Skip pushing settings").option("--skip-configs", "Skip pushing configs (worker groups and SMTP)").option("--skip-groups", "Skip pushing instance groups").option("--include-workspaces", "Also push workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to push to, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces folders to push").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePush).command("whoami").description("Display information about the currently logged-in user").action(whoami3).command("get-config").description("Dump the current instance config (global settings + worker configs) as YAML").option("-o, --output-file <file:string>", "Write YAML to a file instead of stdout").option("--show-secrets", "Include sensitive fields (license key, JWT secret) without prompting").option("--instance <instance:string>", "Name of the instance, override the active instance").action(getConfig2);
   instance_default = command17;
 });
 
@@ -69087,7 +69540,7 @@ function checkInstanceGroupsPath(opts) {
     instanceGroupsPath = `${opts.prefix}/${INSTANCE_GROUPS_PATH}`;
   }
 }
-async function list9(opts) {
+async function list10(opts) {
   await requireLogin(opts);
   const perPage = 10;
   let page = 0;
@@ -69443,7 +69896,7 @@ var init_user = __esm(async () => {
   import_yaml31 = __toESM(require_dist(), 1);
   instanceUsersPath = INSTANCE_USERS_PATH;
   instanceGroupsPath = INSTANCE_GROUPS_PATH;
-  command18 = new Command().description("user related commands").action(list9).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
+  command18 = new Command().description("user related commands").action(list10).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token", "Create a new API token for the authenticated user").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["password"]
   }).option("--password <password:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["email"]
@@ -69518,7 +69971,7 @@ var init_dependencies = __esm(async () => {
 });
 
 // src/commands/trigger/trigger.ts
-import { stat as stat14, writeFile as writeFile17 } from "node:fs/promises";
+import { stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
 import { sep as SEP17 } from "node:path";
 async function getTrigger(triggerType, workspace, path18) {
   const triggerFunctions = {
@@ -69693,7 +70146,7 @@ async function newTrigger(opts, path18) {
   const kind = opts.kind;
   const filePath = `${path18}.${kind}_trigger.yaml`;
   try {
-    await stat14(filePath);
+    await stat15(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -69742,7 +70195,7 @@ async function get8(opts, path18) {
     } else {
       console.log(colors.bold("Path:") + " " + trigger.path);
       console.log(colors.bold("Kind:") + " " + kind);
-      console.log(colors.bold("Enabled:") + " " + (trigger.enabled ?? "-"));
+      console.log(colors.bold("Enabled:") + " " + (trigger.enabled ?? trigger.mode ?? "-"));
       console.log(colors.bold("Script Path:") + " " + (trigger.script_path ?? ""));
       console.log(colors.bold("Is Flow:") + " " + (trigger.is_flow ? "true" : "false"));
     }
@@ -69761,7 +70214,9 @@ async function listOrEmpty(fn) {
     return [];
   }
 }
-async function list10(opts) {
+async function list11(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const ws = workspace.workspaceId;
@@ -69827,7 +70282,7 @@ async function push10(opts, filePath, remotePath) {
   if (!validatePath(remotePath)) {
     return;
   }
-  const fstat = await stat14(filePath);
+  const fstat = await stat15(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -69861,12 +70316,21 @@ var init_trigger = __esm(async () => {
       route_path: "",
       http_method: "get",
       is_async: false,
-      requires_auth: true
+      requires_auth: true,
+      request_type: "sync",
+      authentication_method: "none",
+      is_static_website: false,
+      workspaced_route: false,
+      wrap_body: false,
+      raw_string: false
     },
     websocket: {
       script_path: "",
       is_flow: false,
       url: "",
+      filters: [],
+      can_return_message: false,
+      can_return_error_result: false,
       enabled: false
     },
     kafka: {
@@ -69875,6 +70339,7 @@ var init_trigger = __esm(async () => {
       kafka_resource_path: "",
       group_id: "",
       topics: [],
+      filters: [],
       enabled: false
     },
     nats: {
@@ -69882,6 +70347,7 @@ var init_trigger = __esm(async () => {
       is_flow: false,
       nats_resource_path: "",
       subjects: [],
+      use_jetstream: false,
       enabled: false
     },
     postgres: {
@@ -69896,23 +70362,25 @@ var init_trigger = __esm(async () => {
       script_path: "",
       is_flow: false,
       mqtt_resource_path: "",
-      topics: [],
-      subscribe_qos: 0,
+      subscribe_topics: [],
       enabled: false
     },
     sqs: {
       script_path: "",
       is_flow: false,
-      sqs_resource_path: "",
       queue_url: "",
+      aws_resource_path: "",
+      aws_auth_resource_type: "credentials",
       enabled: false
     },
     gcp: {
       script_path: "",
       is_flow: false,
       gcp_resource_path: "",
-      subscription_id: "",
       topic_id: "",
+      subscription_id: "",
+      delivery_type: "pull",
+      subscription_mode: "create_update",
       enabled: false
     },
     email: {
@@ -69921,7 +70389,7 @@ var init_trigger = __esm(async () => {
       enabled: false
     }
   };
-  command20 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list10).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list10).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10);
+  command20 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10);
   trigger_default = command20;
 });
 
@@ -69982,9 +70450,15 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   const typeEnding = getTypeStrFromPath(p);
   if (typeEnding === "app") {
     const appName = extractResourceName(p, "app");
+    if (!appName) {
+      throw new Error(`Could not extract app name from path: ${p}`);
+    }
     await pushApp(workspace, appName, buildFolderPath(appName, "app"), message);
   } else if (typeEnding === "raw_app") {
     const rawAppName = extractResourceName(p, "raw_app");
+    if (!rawAppName) {
+      throw new Error(`Could not extract raw app name from path: ${p}`);
+    }
     await pushRawApp(workspace, rawAppName, buildFolderPath(rawAppName, "raw_app"), message);
   } else if (typeEnding === "folder") {
     await pushFolder(workspace, p, befObj, newObj);
@@ -69992,6 +70466,9 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
     await pushVariable(workspace, p, befObj, newObj, plainSecrets);
   } else if (typeEnding === "flow") {
     const flowName = extractResourceName(p, "flow");
+    if (!flowName) {
+      throw new Error(`Could not extract flow name from path: ${p}`);
+    }
     await pushFlow(workspace, flowName, buildFolderPath(flowName, "flow"), message);
   } else if (typeEnding === "resource") {
     if (!alreadySynced3.includes(p)) {
@@ -70092,10 +70569,13 @@ function getTypeStrFromPath(p) {
 }
 function removeType(str, type) {
   const normalizedStr = path18.normalize(str).replaceAll(SEP18, "/");
-  if (!normalizedStr.endsWith("." + type + ".yaml") && !normalizedStr.endsWith("." + type + ".json")) {
-    throw new Error(str + " does not end with ." + type + ".(yaml|json)");
+  if (normalizedStr.endsWith("." + type + ".yaml") || normalizedStr.endsWith("." + type + ".json")) {
+    return normalizedStr.slice(0, normalizedStr.length - type.length - 6);
   }
-  return normalizedStr.slice(0, normalizedStr.length - type.length - 6);
+  if (normalizedStr.includes("." + type)) {
+    debug(`Path '${str}' contains '.${type}' but doesn't end with '.${type}.(yaml|json)' — treating as clean path`);
+  }
+  return normalizedStr;
 }
 function extractNativeTriggerInfo(p) {
   const normalizedPath = path18.normalize(p).replaceAll(SEP18, "/");
@@ -70175,14 +70655,13 @@ function defaultFlowDefinition() {
       order: [],
       properties: {},
       required: []
-    },
-    ws_error_handler_muted: false
+    }
   };
 }
 
 // src/utils/local_path_scripts.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readFile as readFile14, stat as stat15 } from "node:fs/promises";
+import { readFile as readFile14, stat as stat16 } from "node:fs/promises";
 async function readOptionalLock(scriptPath) {
   try {
     return await readFile14(scriptPath + ".script.lock", "utf-8");
@@ -70246,7 +70725,7 @@ async function resolvePreviewLocalScriptState(scriptPath, opts) {
     const filePath = scriptPath + ext2;
     let fileStat;
     try {
-      fileStat = await stat15(filePath);
+      fileStat = await stat16(filePath);
     } catch {
       continue;
     }
@@ -70406,7 +70885,9 @@ async function push11(opts, filePath, remotePath) {
   await pushFlow(workspace.workspaceId, remotePath, filePath);
   info(colors.bold.underline.green("Flow pushed"));
 }
-async function list11(opts) {
+async function list12(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -70447,9 +70928,21 @@ async function get9(opts, path19) {
     console.log(colors.bold("Description:") + " " + (f.description ?? ""));
     console.log(colors.bold("Edited by:") + " " + (f.edited_by ?? ""));
     console.log(colors.bold("Edited at:") + " " + (f.edited_at ?? ""));
+    const modules = f.value?.modules;
+    if (modules && Array.isArray(modules) && modules.length > 0) {
+      console.log(colors.bold("Steps:"));
+      for (const mod of modules) {
+        const type = mod.value?.type ?? "unknown";
+        const detail = mod.value?.language ?? mod.value?.path ?? "";
+        console.log(`  ${mod.id}: ${type}${detail ? " (" + detail + ")" : ""}`);
+      }
+    }
   }
 }
 async function run3(opts, path19) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const input = opts.data ? await resolve6(opts.data) : {};
@@ -70491,9 +70984,16 @@ async function run3(opts, path19) {
     workspace: workspace.workspaceId,
     id
   });
-  info(JSON.stringify(jobInfo.result ?? {}, null, 2));
+  if (opts.silent) {
+    console.log(JSON.stringify(jobInfo.result ?? {}));
+  } else {
+    info(JSON.stringify(jobInfo.result ?? {}, null, 2));
+  }
 }
 async function preview2(opts, flowPath) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   const useLocalPathScripts = !opts.remote;
   if (useLocalPathScripts) {
     opts = await mergeConfigWithConfigFile(opts);
@@ -70501,11 +71001,12 @@ async function preview2(opts, flowPath) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const codebases = useLocalPathScripts ? listSyncCodebases(opts) : [];
-  if (!flowPath.endsWith(".flow") && !flowPath.endsWith(".flow" + SEP19)) {
+  const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP19) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP19);
+  if (!isFlowDir) {
     if (flowPath.endsWith("flow.yaml") || flowPath.endsWith("flow.json")) {
       flowPath = flowPath.substring(0, flowPath.lastIndexOf(SEP19));
     } else {
-      throw new Error("Flow path must be a .flow directory or a flow.yaml file");
+      throw new Error("Flow path must be a .flow/__flow directory or a flow.yaml file");
     }
   }
   if (!flowPath.endsWith(SEP19)) {
@@ -70561,7 +71062,7 @@ async function preview2(opts, flowPath) {
     throw e;
   }
   if (opts.silent) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(result));
   } else {
     info(colors.bold.underline.green("Flow preview completed"));
     info(JSON.stringify(result, null, 2));
@@ -70607,11 +71108,12 @@ async function generateLocks(opts, folder) {
     }
   }
 }
-function bootstrap2(opts, flowPath) {
+async function bootstrap2(opts, flowPath) {
   if (!validatePath(flowPath)) {
     return;
   }
-  const flowDirFullPath = `${flowPath}.flow`;
+  await loadNonDottedPathsSetting();
+  const flowDirFullPath = buildFolderPath(flowPath, "flow");
   mkdirSync4(flowDirFullPath, { recursive: false });
   const newFlowDefinition = defaultFlowDefinition();
   if (opts.summary !== undefined) {
@@ -70621,9 +71123,57 @@ function bootstrap2(opts, flowPath) {
     newFlowDefinition.description = opts.description;
   }
   const newFlowDefinitionYaml = import_yaml36.stringify(newFlowDefinition);
-  const flowYamlPath = `${flowDirFullPath}/flow.yaml`;
+  const metadataFile = getMetadataFileName("flow", "yaml");
+  const flowYamlPath = `${flowDirFullPath}/${metadataFile}`;
   writeFileSync5(flowYamlPath, newFlowDefinitionYaml, { flag: "wx", encoding: "utf-8" });
 }
+async function history2(opts, flowPath) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const versions = await getFlowHistory({
+    workspace: workspace.workspaceId,
+    path: flowPath
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(versions));
+  } else {
+    if (versions.length === 0) {
+      info("No version history found for " + flowPath);
+      return;
+    }
+    new Table2().header(["Version", "Created At", "Deployment Message"]).padding(2).border(true).body(versions.map((v) => [
+      String(v.id),
+      new Date(v.created_at).toISOString().replace("T", " ").substring(0, 19),
+      v.deployment_msg ?? "-"
+    ])).render();
+  }
+}
+async function showVersion(opts, flowPath, version) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const flow = await getFlowVersion({
+    workspace: workspace.workspaceId,
+    path: flowPath,
+    version: parseInt(version, 10)
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(flow));
+  } else {
+    console.log(colors.bold("Path:") + " " + flow.path);
+    console.log(colors.bold("Summary:") + " " + (flow.summary ?? "-"));
+    console.log(colors.bold("Description:") + " " + (flow.description ?? "-"));
+    console.log(colors.bold("Schema:"));
+    console.log(JSON.stringify(flow.schema, null, 2));
+    console.log(colors.bold("Value:"));
+    console.log(JSON.stringify(flow.value, null, 2));
+  }
+}
 var import_yaml36, alreadySynced3, command21, flow_default;
 var init_flow = __esm(async () => {
   init_colors2();
@@ -70632,6 +71182,7 @@ var init_flow = __esm(async () => {
   init_log();
   init_yaml();
   init_services_gen();
+  init_resource_folders();
   await __promiseAll([
     init_types(),
     init_confirm(),
@@ -70647,7 +71198,7 @@ var init_flow = __esm(async () => {
   ]);
   import_yaml36 = __toESM(require_dist(), 1);
   alreadySynced3 = [];
-  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", "re-generate the lock files of all inline scripts of all updated flows").arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2);
+  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", "re-generate the lock files of all inline scripts of all updated flows").arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion);
   flow_default = command21;
 });
 
@@ -71831,22 +72382,22 @@ class DoubleLinkedDependencyTree {
     return this.nodes.has(path19);
   }
   getMismatchedWorkspaceDeps() {
-    const result = {};
+    const result2 = {};
     for (const [path19, node] of this.nodes.entries()) {
       if (node.itemType === "dependencies" && node.contentHash && node.content !== undefined) {
-        result[path19] = node.content;
+        result2[path19] = node.content;
       }
     }
-    return result;
+    return result2;
   }
   getTempScriptRefs(scriptPath) {
-    const result = {};
+    const result2 = {};
     this.traverseTransitive(scriptPath, (_path, node) => {
       if (node.contentHash) {
-        result[_path] = node.contentHash;
+        result2[_path] = node.contentHash;
       }
     });
-    return result;
+    return result2;
   }
   async persistDepsHashes(depsPaths) {
     for (const path19 of depsPaths) {
@@ -73113,8 +73664,8 @@ async function pull2(opts) {
       throw new Error("Couldn't fetch resource types from hub " + hubBaseUrl + ": " + await res1.text());
     }
   }
-  let list12 = await res1.json();
-  if (list12 && list12.length === 0 && hubBaseUrl !== DEFAULT_HUB_BASE_URL) {
+  let list13 = await res1.json();
+  if (list13 && list13.length === 0 && hubBaseUrl !== DEFAULT_HUB_BASE_URL) {
     info("No resource types found in private hub, fetching from public hub");
     delete headers["X-api-secret"];
     const res2 = await fetch(DEFAULT_HUB_BASE_URL + "/resource_types/list", {
@@ -73123,12 +73674,12 @@ async function pull2(opts) {
     if (!res2.ok) {
       throw new Error("Couldn't fetch resource types from public hub: " + await res2.text());
     }
-    list12 = await res2.json();
+    list13 = await res2.json();
   }
   const resourceTypes = await listResourceType({
     workspace: workspace.workspaceId
   });
-  for (const x of list12) {
+  for (const x of list13) {
     try {
       x.schema = JSON.parse(x.schema);
     } catch (e) {
@@ -73320,7 +73871,7 @@ async function dev2(opts) {
   await Promise.all([startApp(), watchChanges()]);
   console.log("Stopped dev mode");
 }
-var command24 = new Command().description("Launch a dev server that will spawn a webserver with HMR").option("--includes <pattern...:string>", "Filter paths givena glob pattern or path").action(dev2);
+var command24 = new Command().description("Launch a dev server that watches for local file changes and auto-pushes them to the remote workspace. Provides live reload for scripts and flows during development.").option("--includes <pattern...:string>", "Filter paths givena glob pattern or path").action(dev2);
 var dev_default2 = command24;
 
 // src/main.ts
@@ -73560,8 +74111,7 @@ await __promiseAll([
   init_workspace(),
   init_resource_type()
 ]);
-var import_yaml40 = __toESM(require_dist(), 1);
-import { stat as stat16, writeFile as writeFile19, rm as rm4, mkdir as mkdir9 } from "node:fs/promises";
+import { stat as stat17, writeFile as writeFile19, rm as rm4, mkdir as mkdir9 } from "node:fs/promises";
 
 // src/guidance/skills.ts
 var SKILLS = [
@@ -78555,6 +79105,23 @@ app related commands
   - \`--dry-run\` - Perform a dry run without making changes
   - \`--default-ts <runtime:string>\` - Default TypeScript runtime (bun or deno)
 
+### audit
+
+View audit logs (requires admin)
+
+**Subcommands:**
+
+- \`audit list\` - List audit log entries
+- \`audit get <id:string>\` - Get a specific audit log entry
+  - \`--json\` - Output as JSON (for piping to jq)
+
+### config
+
+Show all available wmill.yaml configuration options
+
+**Options:**
+- \`--json\` - Output as JSON for programmatic consumption
+
 ### dependencies
 
 workspace dependencies related commands
@@ -78567,14 +79134,14 @@ workspace dependencies related commands
 
 ### dev
 
-Launch a dev server that will spawn a webserver with HMR
+Launch a dev server that watches for local file changes and auto-pushes them to the remote workspace. Provides live reload for scripts and flows during development.
 
 **Options:**
 - \`--includes <pattern...:string>\` - Filter paths givena glob pattern or path
 
 ### docs
 
-Search Windmill documentation. Requires Enterprise Edition.
+Search Windmill documentation.
 
 **Arguments:** \`<query:string>\`
 
@@ -78615,6 +79182,10 @@ flow related commands
 - \`flow bootstrap <flow_path:string>\` - create a new empty flow (alias for new
   - \`--summary <summary:string>\` - flow summary
   - \`--description <description:string>\` - flow description
+- \`flow history <path:string>\` - Show version history for a flow
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`flow show-version <path:string> <version:string>\` - Show a specific version of a flow
+  - \`--json\` - Output as JSON (for piping to jq)
 
 ### folder
 
@@ -78677,6 +79248,25 @@ Manage git-sync settings between local wmill.yaml and Windmill backend
   - \`--yes\` - Skip interactive prompts and use default behavior
   - \`--promotion <branch:string>\` - Use promotionOverrides from the specified branch instead of regular overrides
 
+### group
+
+Manage workspace groups
+
+**Options:**
+- \`--json\` - Output as JSON (for piping to jq)
+
+**Subcommands:**
+
+- \`group list\` - List all groups in the workspace
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`group get <name:string>\` - Get group details and members
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`group create <name:string>\` - Create a new group
+  - \`--summary <summary:string>\` - Group summary/description
+- \`group delete <name:string>\` - Delete a group
+- \`group add-user <name:string> <username:string>\` - Add a user to a group
+- \`group remove-user <name:string> <username:string>\` - Remove a user from a group
+
 ### hub
 
 Hub related commands. EXPERIMENTAL. INTERNAL USE ONLY.
@@ -78732,8 +79322,23 @@ sync local with a remote instance or the opposite (push or pull)
 - \`instance whoami\` - Display information about the currently logged-in user
 - \`instance get-config\` - Dump the current instance config (global settings + worker configs) as YAML
   - \`-o, --output-file <file:string>\` - Write YAML to a file instead of stdout
+  - \`--show-secrets\` - Include sensitive fields (license key, JWT secret) without prompting
   - \`--instance <instance:string>\` - Name of the instance, override the active instance
 
+### job
+
+Manage jobs (list, inspect, cancel)
+
+**Subcommands:**
+
+- \`job list\` - List recent jobs
+- \`job get <id:string>\` - Get job details and result
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`job result <id:string>\` - Get the result of a completed job (machine-friendly
+- \`job logs <id:string>\` - Get job logs
+- \`job cancel <id:string>\` - Cancel a running or queued job
+  - \`--reason <reason:string>\` - Reason for cancellation
+
 ### jobs
 
 Pull completed and queued jobs from workspace
@@ -78820,6 +79425,8 @@ schedule related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`schedule new <path:string>\` - create a new schedule locally
 - \`schedule push <file_path:string> <remote_path:string>\` - push a local schedule spec. This overrides any remote versions.
+- \`schedule enable <path:string>\` - Enable a schedule
+- \`schedule disable <path:string>\` - Disable a schedule
 
 ### script
 
@@ -78857,6 +79464,8 @@ script related commands
   - \`--schema-only\` - re-generate only script schema
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which file to NOT take into account.
+- \`script history <path:string>\` - show version history for a script
+  - \`--json\` - Output as JSON (for piping to jq)
 
 ### sync
 
@@ -78871,6 +79480,7 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--json\` - Use JSON instead of YAML
   - \`--skip-variables\` - Skip syncing variables (including secrets)
   - \`--skip-secrets\` - Skip syncing only secrets variables
+  - \`--include-secrets\` - Include secrets in sync (overrides skipSecrets in wmill.yaml)
   - \`--skip-resources\` - Skip syncing  resources
   - \`--skip-resource-types\` - Skip syncing  resource types
   - \`--skip-scripts\` - Skip syncing scripts
@@ -78900,6 +79510,7 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--json\` - Use JSON instead of YAML
   - \`--skip-variables\` - Skip syncing variables (including secrets)
   - \`--skip-secrets\` - Skip syncing only secrets variables
+  - \`--include-secrets\` - Include secrets in sync (overrides skipSecrets in wmill.yaml)
   - \`--skip-resources\` - Skip syncing  resources
   - \`--skip-resource-types\` - Skip syncing  resource types
   - \`--skip-scripts\` - Skip syncing scripts
@@ -78925,6 +79536,23 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--branch, --env <branch:string>\` - Override the current git branch/environment (works even outside a git repository)
   - \`--lint\` - Run lint validation before pushing
   - \`--locks-required\` - Fail if scripts or flow inline scripts that need locks have no locks
+  - \`--auto-metadata\` - Automatically regenerate stale metadata (locks and schemas) before pushing
+
+### token
+
+Manage API tokens
+
+**Options:**
+- \`--json\` - Output as JSON (for piping to jq)
+
+**Subcommands:**
+
+- \`token list\` - List API tokens
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`token create\` - Create a new API token
+  - \`--label <label:string>\` - Token label
+  - \`--expiration <expiration:string>\` - Token expiration (ISO 8601 timestamp)
+- \`token delete <token_prefix:string>\` - Delete a token by its prefix
 
 ### trigger
 
@@ -78955,7 +79583,7 @@ user related commands
   - \`--company <company:string>\` - Specify to set the company of the new user.
   - \`--name <name:string>\` - Specify to set the name of the new user.
 - \`user remove <email:string>\` - Delete a user
-- \`user create-token\`
+- \`user create-token\` - Create a new API token for the authenticated user
   - \`--email <email:string>\` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.
   - \`--password <password:string>\` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.
 
@@ -79023,7 +79651,8 @@ workspace related commands
 - \`workspace whoami\` - Show the currently active user
 - \`workspace list\` - List local workspace profiles
 - \`workspace list-remote\` - List workspaces on the remote server that you have access to
-- \`workspace bind\` - Bind the current Git branch to the active workspace
+- \`workspace list-forks\` - List forked workspaces on the remote server
+- \`workspace bind\` - Bind the current Git branch to the active workspace. This adds the branch to gitBranches in wmill.yaml so sync operations use the correct workspace for each branch.
   - \`--branch, --env <branch:string>\` - Specify branch/environment (defaults to current)
 - \`workspace unbind\` - Remove workspace binding from the current Git branch
   - \`--branch, --env <branch:string>\` - Specify branch/environment (defaults to current)
@@ -79950,6 +80579,406 @@ ${skillsReference}
 `;
 }
 
+// src/commands/init/template.ts
+var NON_SCHEMA_KEYS = new Set([
+  "name",
+  "default",
+  "section",
+  "sectionNote",
+  "commented",
+  "templateValue",
+  "example",
+  "inlineComment",
+  "groupNote"
+]);
+var SPECIFIC_ITEMS_SCHEMA = {
+  type: "object",
+  description: "Sync only specific items",
+  properties: {
+    variables: { type: "array", items: { type: "string" }, description: "Specific variable paths to sync" },
+    resources: { type: "array", items: { type: "string" }, description: "Specific resource paths to sync" },
+    triggers: { type: "array", items: { type: "string" }, description: "Specific trigger paths to sync" },
+    folders: { type: "array", items: { type: "string" }, description: "Specific folder paths to sync" },
+    settings: { type: "boolean", description: "Whether to sync settings" }
+  },
+  additionalProperties: false
+};
+var BRANCH_CONFIG_SCHEMA = {
+  type: "object",
+  properties: {
+    baseUrl: { type: "string", description: "Windmill instance URL for this branch" },
+    workspaceId: { type: "string", description: "Workspace ID to sync with for this branch" },
+    overrides: { type: "object", description: "Override any top-level sync option for this branch" },
+    promotionOverrides: { type: "object", description: "Overrides applied when using --promotion flag" },
+    specificItems: SPECIFIC_ITEMS_SCHEMA
+  },
+  additionalProperties: false
+};
+var CONFIG_REFERENCE = [
+  { name: "defaultTs", type: "string", enum: ["bun", "deno"], default: "bun", description: "Default TypeScript runtime for new scripts" },
+  {
+    name: "includes",
+    type: "array",
+    items: { type: "string" },
+    default: '["f/**"]',
+    description: "Glob patterns for files to include in sync",
+    templateValue: `
+  - "f/**"`
+  },
+  {
+    name: "extraIncludes",
+    type: "array",
+    items: { type: "string" },
+    default: "[]",
+    description: "Additional glob patterns merged with includes (useful in branch overrides)",
+    commented: true
+  },
+  { name: "excludes", type: "array", items: { type: "string" }, default: "[]", description: "Glob patterns for files to exclude from sync" },
+  {
+    name: "skipVariables",
+    type: "boolean",
+    default: "false",
+    description: "Skip syncing variables",
+    section: "What to sync",
+    sectionNote: '"skip" options default to false (synced), "include" options default to false (not synced)'
+  },
+  { name: "skipResources", type: "boolean", default: "false", description: "Skip syncing resources" },
+  { name: "skipResourceTypes", type: "boolean", default: "false", description: "Skip syncing resource types" },
+  {
+    name: "skipSecrets",
+    type: "boolean",
+    default: "true",
+    description: "Skip syncing secrets (true by default for security)",
+    inlineComment: "true by default — secrets are not synced for security"
+  },
+  { name: "skipScripts", type: "boolean", default: "false", description: "Skip syncing scripts" },
+  { name: "skipFlows", type: "boolean", default: "false", description: "Skip syncing flows" },
+  { name: "skipApps", type: "boolean", default: "false", description: "Skip syncing apps" },
+  { name: "skipFolders", type: "boolean", default: "false", description: "Skip syncing folders" },
+  { name: "skipWorkspaceDependencies", type: "boolean", default: "false", description: "Skip syncing workspace dependencies" },
+  {
+    name: "includeSchedules",
+    type: "boolean",
+    default: "false",
+    description: "Include schedules in sync",
+    commented: true,
+    templateValue: "true",
+    groupNote: "Uncomment to include these (excluded by default):"
+  },
+  {
+    name: "includeTriggers",
+    type: "boolean",
+    default: "false",
+    description: "Include triggers (http, websocket, kafka, etc.) in sync",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "includeUsers",
+    type: "boolean",
+    default: "false",
+    description: "Include workspace users in sync",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "includeGroups",
+    type: "boolean",
+    default: "false",
+    description: "Include workspace groups in sync",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "includeSettings",
+    type: "boolean",
+    default: "false",
+    description: "Include workspace settings in sync",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "includeKey",
+    type: "boolean",
+    default: "false",
+    description: "Include encryption key in sync",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "parallel",
+    type: "integer",
+    default: "(unset)",
+    description: "Number of parallel operations during sync",
+    section: "Sync behavior",
+    commented: true,
+    templateValue: "4"
+  },
+  {
+    name: "locksRequired",
+    type: "boolean",
+    default: "false",
+    description: "Require lock files for all scripts",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "lint",
+    type: "boolean",
+    default: "false",
+    description: "Run linting before push",
+    commented: true,
+    templateValue: "true"
+  },
+  {
+    name: "plainSecrets",
+    type: "boolean",
+    default: "false",
+    description: "Handle secrets as plain text (not recommended)",
+    commented: true
+  },
+  {
+    name: "message",
+    type: "string",
+    default: "(unset)",
+    description: "Default commit message for sync operations",
+    commented: true,
+    templateValue: '"my commit message"'
+  },
+  {
+    name: "promotion",
+    type: "string",
+    default: "(unset)",
+    description: "Branch name to use promotion overrides from during sync",
+    commented: true,
+    templateValue: "staging"
+  },
+  {
+    name: "skipBranchValidation",
+    type: "boolean",
+    default: "false",
+    description: "Skip validation that current git branch matches a configured branch",
+    commented: true
+  },
+  { name: "nonDottedPaths", type: "boolean", default: "true", description: "Use __flow/__app/__raw_app suffixes instead of .flow/.app/.raw_app" },
+  {
+    name: "codebases",
+    type: "array",
+    default: "[]",
+    description: "Codebase bundling configurations for shared libraries",
+    items: {
+      type: "object",
+      properties: {
+        relative_path: { type: "string", description: "Path to the codebase directory" },
+        includes: { type: "array", items: { type: "string" }, description: "Glob patterns for files to include in bundle" },
+        excludes: { type: "array", items: { type: "string" }, description: "Glob patterns for files to exclude from bundle" },
+        format: { type: "string", enum: ["cjs", "esm"], description: "Bundle output format" },
+        external: { type: "array", items: { type: "string" }, description: "Dependencies to leave unbundled (externals)" },
+        assets: { type: "array", items: { type: "object", properties: { from: { type: "string" }, to: { type: "string" } }, required: ["from", "to"] }, description: "Static files to copy into the bundle" },
+        customBundler: { type: "string", description: "Path to a custom bundler script (replaces esbuild)" },
+        inject: { type: "array", items: { type: "string" }, description: "Files to inject into every entry point" },
+        define: { type: "object", additionalProperties: { type: "string" }, description: "Compile-time constant definitions" },
+        banner: { type: "object", additionalProperties: { type: "string" }, description: "Text to prepend to output files by type" },
+        loader: { type: "object", additionalProperties: { type: "string" }, description: "esbuild loader overrides by extension" }
+      },
+      required: ["relative_path"],
+      additionalProperties: false
+    },
+    section: "Codebase bundling (shared libraries)",
+    sectionNote: `Bundle TypeScript/JavaScript codebases that scripts import from.
+Each entry is bundled and uploaded so scripts can import shared code.`,
+    example: [
+      "# codebases:",
+      "#   - relative_path: ./shared          # path to the codebase",
+      '#     includes: ["**/*.ts"]            # files to include in bundle',
+      '#     excludes: ["node_modules/**"]    # files to exclude',
+      '#     format: esm                      # bundle format: "cjs" or "esm"',
+      '#     external: ["pg", "axios"]        # dependencies to leave unbundled',
+      "#     assets:                          # static files to copy into bundle",
+      "#       - from: ./static",
+      "#         to: ./dist",
+      "#     # customBundler: ./build.ts      # custom bundler script (replaces esbuild)",
+      '#     # inject: ["./polyfills.ts"]     # files to inject into every entry point',
+      "#     # define:                        # compile-time constants",
+      `#     #   API_URL: '"https://api.example.com"'`,
+      "#     # banner:                        # text prepended to output files",
+      '#     #   js: "/* bundled by windmill */"',
+      "#     # loader:                        # esbuild loader overrides",
+      '#     #   ".png": "dataurl"'
+    ].join(`
+`)
+  },
+  {
+    name: "gitBranches",
+    type: "object",
+    default: "{}",
+    description: "Map git branches to workspaces and per-branch sync overrides",
+    properties: { commonSpecificItems: SPECIFIC_ITEMS_SCHEMA },
+    additionalProperties: BRANCH_CONFIG_SCHEMA,
+    section: "Git branch / environment bindings",
+    sectionNote: `Map git branches to Windmill workspaces and override settings per branch.
+Use "environments" as an alias if you prefer environment-based terminology.`,
+    templateValue: `
+  {{BRANCH}}:
+    overrides: {}`,
+    example: [
+      "{{BASEURL_LINE}}",
+      "{{WORKSPACE_ID_LINE}}",
+      "    # promotionOverrides:                  # overrides applied during --promotion",
+      "    #   skipSecrets: false",
+      "    # specificItems:                       # only sync these specific items",
+      '    #   variables: ["f/my_folder/my_var"]',
+      '    #   resources: ["f/my_folder/my_res"]',
+      '    #   triggers: ["f/my_folder/my_trigger"]',
+      '    #   folders: ["my_folder"]',
+      "    #   settings: true",
+      "",
+      "  # Example: staging branch bound to a different workspace",
+      "  # staging:",
+      "  #   baseUrl: https://staging.windmill.dev",
+      "  #   workspaceId: staging-workspace",
+      "  #   overrides:",
+      "  #     skipSecrets: false",
+      "  #     includeSchedules: true",
+      "",
+      "  # Items shared across ALL branches",
+      "  # commonSpecificItems:",
+      '  #   variables: ["f/shared/api_key"]',
+      '  #   resources: ["f/shared/db_conn"]',
+      '  #   folders: ["shared"]'
+    ].join(`
+`)
+  },
+  {
+    name: "environments",
+    type: "object",
+    default: "{}",
+    description: "Alias for gitBranches — use if you prefer environment-based terminology",
+    properties: { commonSpecificItems: SPECIFIC_ITEMS_SCHEMA },
+    additionalProperties: BRANCH_CONFIG_SCHEMA,
+    commented: true
+  }
+];
+function yamlKey(s) {
+  if (/^[a-zA-Z0-9_/.@-]+$/.test(s) && !/^(true|false|yes|no|on|off|null|~)$/i.test(s) && !/^\d+(\.\d+)?$/.test(s)) {
+    return s;
+  }
+  return `"${s.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function generateCommentedTemplate(branchName, binding) {
+  const branch = yamlKey(branchName ?? "main");
+  const lines = [
+    "# yaml-language-server: $schema=wmill.schema.json",
+    "# wmill.yaml — Windmill CLI configuration",
+    '# Full reference: run "wmill config"',
+    ""
+  ];
+  for (const opt of CONFIG_REFERENCE) {
+    if (opt.section) {
+      const ruler = "-".repeat(Math.max(0, 65 - opt.section.length));
+      lines.push(`# --- ${opt.section} ${ruler}`);
+      if (opt.sectionNote) {
+        for (const noteLine of opt.sectionNote.split(`
+`)) {
+          lines.push(`# ${noteLine}`);
+        }
+      }
+      lines.push("");
+    }
+    if (opt.groupNote) {
+      lines.push(`# ${opt.groupNote}`);
+    }
+    const value = opt.templateValue ?? opt.default;
+    const resolvedValue = value.replace("{{BRANCH}}", branch);
+    if (opt.commented) {
+      lines.push(`# ${opt.description}`);
+      lines.push(`# ${opt.name}: ${resolvedValue}`);
+    } else {
+      lines.push(`# ${opt.description}`);
+      if (opt.inlineComment) {
+        const base = `${opt.name}: ${resolvedValue}`;
+        const pad = " ".repeat(Math.max(1, 32 - base.length));
+        lines.push(`${base}${pad}# ${opt.inlineComment}`);
+      } else {
+        lines.push(`${opt.name}: ${resolvedValue}`);
+      }
+    }
+    if (opt.example) {
+      let resolvedExample = opt.example.replace(/\{\{BRANCH\}\}/g, branch);
+      if (binding) {
+        resolvedExample = resolvedExample.replace("{{BASEURL_LINE}}", `    baseUrl: ${binding.baseUrl}`).replace("{{WORKSPACE_ID_LINE}}", `    workspaceId: ${binding.workspaceId}`);
+      } else {
+        resolvedExample = resolvedExample.replace("{{BASEURL_LINE}}", "    # baseUrl: https://app.windmill.dev    # Windmill instance URL for this branch").replace("{{WORKSPACE_ID_LINE}}", "    # workspaceId: my-workspace            # workspace to sync with");
+      }
+      for (const exLine of resolvedExample.split(`
+`)) {
+        lines.push(exLine);
+      }
+    }
+    lines.push("");
+  }
+  return lines.join(`
+`);
+}
+function expandSchema(prefix, schema, rows) {
+  if (schema.properties) {
+    for (const [key, prop] of Object.entries(schema.properties)) {
+      const name = prefix ? `${prefix}.${key}` : key;
+      rows.push({ name, description: prop.description ?? "", default: "" });
+      if (prop.properties && prop.type === "object") {
+        expandSchema(name, prop, rows);
+      }
+    }
+  }
+}
+function formatConfigReference() {
+  const nameWidth = 48;
+  const descWidth = 70;
+  const header = [
+    "OPTION".padEnd(nameWidth),
+    "DESCRIPTION".padEnd(descWidth),
+    "DEFAULT"
+  ].join("  ");
+  const separator = "-".repeat(header.length + 10);
+  const allRows = [];
+  for (const opt of CONFIG_REFERENCE) {
+    allRows.push({ name: opt.name, description: opt.description, default: opt.default });
+    if (opt.items?.properties) {
+      expandSchema(`${opt.name}[]`, opt.items, allRows);
+    }
+    if (opt.additionalProperties && typeof opt.additionalProperties === "object" && opt.additionalProperties.properties) {
+      expandSchema(`${opt.name}.<branch>`, opt.additionalProperties, allRows);
+    }
+    if (opt.properties) {
+      expandSchema(opt.name, opt, allRows);
+    }
+  }
+  const rows = allRows.map((r) => [r.name.padEnd(nameWidth), r.description.padEnd(descWidth), r.default].join("  "));
+  return [
+    "wmill.yaml — Configuration Reference",
+    "",
+    "Full documentation: https://www.windmill.dev/docs/advanced/cli",
+    "",
+    separator,
+    header,
+    separator,
+    ...rows,
+    separator,
+    "",
+    'Run "wmill init" to generate a wmill.yaml with commented examples.'
+  ].join(`
+`);
+}
+function formatConfigReferenceJson() {
+  const clean = CONFIG_REFERENCE.map((opt) => ({
+    name: opt.name,
+    type: opt.type,
+    default: opt.default,
+    description: opt.description
+  }));
+  return JSON.stringify(clean, null, 2);
+}
+
 // src/commands/init/init.ts
 function formatSchemaForMarkdown(schemaYaml, schemaName, filePattern) {
   return `## ${schemaName} (\`${filePattern}\`)
@@ -79961,39 +80990,25 @@ ${schemaYaml.trim()}
 \`\`\``;
 }
 async function initAction(opts) {
-  if (await stat16("wmill.yaml").catch(() => null)) {
+  if (await stat17("wmill.yaml").catch(() => null)) {
     error(colors.red("wmill.yaml already exists"));
   } else {
-    const { DEFAULT_SYNC_OPTIONS: DEFAULT_SYNC_OPTIONS2 } = await init_conf().then(() => exports_conf);
-    const initialConfig = { ...DEFAULT_SYNC_OPTIONS2 };
     const { isGitRepository: isGitRepository2, getCurrentGitBranch: getCurrentGitBranch2 } = await Promise.resolve().then(() => (init_git(), exports_git));
+    let branchName;
+    let binding;
     if (isGitRepository2()) {
-      const currentBranch = getCurrentGitBranch2();
-      if (currentBranch) {
-        initialConfig.gitBranches = {
-          [currentBranch]: { overrides: {} }
-        };
-      } else {
-        initialConfig.gitBranches = {};
-      }
-    } else {
-      initialConfig.gitBranches = {};
+      branchName = getCurrentGitBranch2() ?? undefined;
     }
-    initialConfig.nonDottedPaths = true;
-    await writeFile19("wmill.yaml", import_yaml40.stringify(initialConfig), "utf-8");
-    info(colors.green("wmill.yaml created with default settings"));
-    await readLockfile();
-    if (isGitRepository2()) {
+    if (isGitRepository2() && branchName) {
       const activeWorkspace = await getActiveWorkspaceOrFallback(opts);
-      const currentBranch = getCurrentGitBranch2();
-      if (activeWorkspace && currentBranch) {
+      if (activeWorkspace) {
         const shouldBind = opts.bindProfile === true;
         const shouldPrompt = opts.bindProfile === undefined && !!process.stdin.isTTY && !opts.useDefault;
-        const shouldSkip = opts.bindProfile != true && (opts.useDefault || !!!process.stdin.isTTY);
+        const shouldSkip = opts.bindProfile != true && (opts.useDefault || !process.stdin.isTTY);
         if (!shouldSkip) {
           if (shouldBind || shouldPrompt) {
             info(colors.yellow(`
-Current Git branch: ${colors.bold(currentBranch)}`));
+Current Git branch: ${colors.bold(branchName)}`));
             info(colors.yellow(`Active workspace profile: ${colors.bold(activeWorkspace.name)}`));
             info(colors.yellow(`  ${activeWorkspace.workspaceId} on ${activeWorkspace.remote}`));
           }
@@ -80001,22 +81016,21 @@ Current Git branch: ${colors.bold(currentBranch)}`));
             message: "Bind workspace profile to current Git branch?",
             default: true
           })) {
-            const currentConfig = await init_conf().then(() => exports_conf).then((m) => m.readConfigFile());
-            if (!currentConfig.gitBranches) {
-              currentConfig.gitBranches = {};
-            }
-            if (!currentConfig.gitBranches[currentBranch]) {
-              currentConfig.gitBranches[currentBranch] = { overrides: {} };
-            }
-            info(`binding branch ${currentBranch} to workspace ${activeWorkspace.name} on ${activeWorkspace.remote}`);
-            currentConfig.gitBranches[currentBranch].baseUrl = activeWorkspace.remote;
-            currentConfig.gitBranches[currentBranch].workspaceId = activeWorkspace.workspaceId;
-            await writeFile19("wmill.yaml", import_yaml40.stringify(currentConfig), "utf-8");
-            info(colors.green(`✓ Bound branch '${currentBranch}' to workspace '${activeWorkspace.name}'`));
+            info(`binding branch ${branchName} to workspace ${activeWorkspace.name} on ${activeWorkspace.remote}`);
+            binding = {
+              baseUrl: activeWorkspace.remote,
+              workspaceId: activeWorkspace.workspaceId
+            };
           }
         }
       }
     }
+    await writeFile19("wmill.yaml", generateCommentedTemplate(branchName, binding), "utf-8");
+    info(colors.green("wmill.yaml created with default settings"));
+    if (binding) {
+      info(colors.green(`✓ Bound branch '${branchName}' to workspace`));
+    }
+    await readLockfile();
     if (!opts.useDefault) {
       try {
         const { requireLogin: requireLogin2 } = await init_auth().then(() => exports_auth);
@@ -80097,11 +81111,11 @@ Current Git branch: ${colors.bold(currentBranch)}`));
     const skills_base_dir = ".claude/skills";
     const skillsReference = SKILLS.map((s) => `- \`${skills_base_dir}/${s.name}/SKILL.md\` - ${s.description}`).join(`
 `);
-    if (!await stat16("AGENTS.md").catch(() => null)) {
+    if (!await stat17("AGENTS.md").catch(() => null)) {
       await writeFile19("AGENTS.md", generateAgentsMdContent(skillsReference), "utf-8");
       info(colors.green("Created AGENTS.md"));
     }
-    if (!await stat16("CLAUDE.md").catch(() => null)) {
+    if (!await stat17("CLAUDE.md").catch(() => null)) {
       await writeFile19("CLAUDE.md", `Instructions are in @AGENTS.md
 `, "utf-8");
       info(colors.green("Created CLAUDE.md"));
@@ -80328,6 +81342,400 @@ var push12 = new Command().description("Push completed and queued jobs to worksp
 var command28 = new Command().description("Manage jobs (import/export)").command("pull", pull3).command("push", push12);
 var jobs_default = command28;
 
+// src/commands/job/job.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf(),
+  init_utils()
+]);
+function formatDuration(ms) {
+  if (ms < 1000)
+    return `${ms}ms`;
+  const seconds = Math.floor(ms / 1000);
+  if (seconds < 60)
+    return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  const remainingSeconds = seconds % 60;
+  if (minutes < 60)
+    return `${minutes}m${remainingSeconds}s`;
+  const hours = Math.floor(minutes / 60);
+  const remainingMinutes = minutes % 60;
+  return `${hours}h${remainingMinutes}m`;
+}
+function getJobStatus2(job) {
+  if (job.type === "QueuedJob") {
+    if (job.canceled)
+      return colors.red("canceled");
+    if (job.running)
+      return colors.blue("running");
+    return colors.yellow("queued");
+  }
+  if (job.canceled)
+    return colors.red("canceled");
+  if (job.success)
+    return colors.green("success");
+  return colors.red("failure");
+}
+function getJobStatusPlain(job) {
+  if (job.type === "QueuedJob") {
+    if (job.canceled)
+      return "canceled";
+    if (job.running)
+      return "running";
+    return "queued";
+  }
+  if (job.canceled)
+    return "canceled";
+  if (job.success)
+    return "success";
+  return "failure";
+}
+async function list13(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  let successFilter = opts.success;
+  if (opts.failed)
+    successFilter = false;
+  const jobs = await listJobs({
+    workspace: workspace.workspaceId,
+    scriptPathExact: opts.scriptPath,
+    createdBy: opts.createdBy,
+    running: opts.running,
+    success: successFilter,
+    perPage: Math.min(opts.limit ?? 30, 100),
+    jobKinds: opts.jobKinds ?? "script,flow,singlestepflow",
+    label: opts.label,
+    hasNullParent: opts.all ? undefined : true
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(jobs));
+  } else {
+    if (jobs.length === 0) {
+      info("No jobs found.");
+      return;
+    }
+    new Table2().header(["ID", "Status", "Script/Flow", "Created By", "Duration", "Created At"]).padding(2).border(true).body(jobs.map((j) => [
+      j.id.substring(0, 8),
+      getJobStatus2(j),
+      j.script_path ?? j.raw_code?.substring(0, 30) ?? "-",
+      j.created_by ?? j.email ?? "-",
+      j.duration_ms != null ? formatDuration(j.duration_ms) : j.running ? "running" : "-",
+      j.created_at ? formatTimestamp(j.created_at) : "-"
+    ])).render();
+    info(`
+Showing ${jobs.length} job(s). Use --limit to show more.`);
+  }
+}
+async function get10(opts, id) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const job = await getJob({
+    workspace: workspace.workspaceId,
+    id
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(job));
+  } else {
+    const j = job;
+    console.log(colors.bold("ID:") + " " + j.id);
+    console.log(colors.bold("Status:") + " " + getJobStatusPlain(j));
+    console.log(colors.bold("Kind:") + " " + j.job_kind);
+    console.log(colors.bold("Script Path:") + " " + (j.script_path ?? "-"));
+    console.log(colors.bold("Created By:") + " " + (j.created_by ?? "-"));
+    console.log(colors.bold("Created At:") + " " + (j.created_at ? formatTimestamp(j.created_at) : "-"));
+    if (j.started_at) {
+      console.log(colors.bold("Started At:") + " " + formatTimestamp(j.started_at));
+    }
+    if (j.duration_ms != null) {
+      console.log(colors.bold("Duration:") + " " + formatDuration(j.duration_ms));
+    }
+    if (j.schedule_path) {
+      console.log(colors.bold("Schedule:") + " " + j.schedule_path);
+    }
+    if (j.result !== undefined) {
+      console.log(colors.bold("Result:"));
+      console.log(JSON.stringify(j.result, null, 2));
+    }
+  }
+}
+async function result(opts, id) {
+  setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const jobResult = await getCompletedJobResult({
+    workspace: workspace.workspaceId,
+    id
+  });
+  console.log(JSON.stringify(jobResult));
+}
+async function logs(opts, id) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const jobLogs = await getJobLogs({
+    workspace: workspace.workspaceId,
+    id
+  });
+  console.log(jobLogs);
+}
+async function cancel(opts, id) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await cancelQueuedJob({
+    workspace: workspace.workspaceId,
+    id,
+    requestBody: {
+      reason: opts.reason ?? "Canceled via CLI"
+    }
+  });
+  info(colors.green(`Job ${id} canceled.`));
+}
+var listOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--script-path <scriptPath:string>", "Filter by exact script/flow path").option("--created-by <createdBy:string>", "Filter by creator username").option("--running", "Show only running jobs").option("--failed", "Show only failed jobs").option("--success <success:boolean>", "Filter by success status (true/false)").option("--limit <limit:number>", "Number of jobs to return (default 30, max 100)").option("--job-kinds <jobKinds:string>", "Filter by job kinds (default: script,flow,singlestepflow)").option("--label <label:string>", "Filter by job label").option("--all", "Include sub-jobs (flow steps). By default only top-level jobs are shown");
+var command29 = listOptions(new Command().description("Manage jobs (list, inspect, cancel)")).action(list13).command("list", listOptions(new Command().description("List recent jobs"))).action(list13).command("get", "Get job details and result").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get10).command("result", "Get the result of a completed job (machine-friendly)").arguments("<id:string>").action(result).command("logs", "Get job logs").arguments("<id:string>").action(logs).command("cancel", "Cancel a running or queued job").arguments("<id:string>").option("--reason <reason:string>", "Reason for cancellation").action(cancel);
+var job_default = command29;
+
+// src/commands/group/group.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf()
+]);
+async function list14(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const groups = await listGroups({
+    workspace: workspace.workspaceId
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(groups));
+  } else {
+    if (groups.length === 0) {
+      info("No groups found.");
+      return;
+    }
+    new Table2().header(["Name", "Summary", "Members"]).padding(2).border(true).body(groups.map((g) => [
+      g.name,
+      g.summary ?? "-",
+      String(g.members?.length ?? 0)
+    ])).render();
+  }
+}
+async function get11(opts, name) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const group = await getGroup({
+    workspace: workspace.workspaceId,
+    name
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(group));
+  } else {
+    console.log(colors.bold("Name:") + " " + group.name);
+    console.log(colors.bold("Summary:") + " " + (group.summary ?? "-"));
+    console.log(colors.bold("Members:") + " " + (group.members && group.members.length > 0 ? group.members.join(", ") : "(none)"));
+  }
+}
+async function create(opts, name) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await createGroup({
+    workspace: workspace.workspaceId,
+    requestBody: {
+      name,
+      summary: opts.summary
+    }
+  });
+  info(colors.green(`Group '${name}' created.`));
+}
+async function deleteGroup2(opts, name) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await deleteGroup({
+    workspace: workspace.workspaceId,
+    name
+  });
+  info(colors.green(`Group '${name}' deleted.`));
+}
+async function addUser2(opts, name, username) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await addUserToGroup({
+    workspace: workspace.workspaceId,
+    name,
+    requestBody: { username }
+  });
+  info(colors.green(`User '${username}' added to group '${name}'.`));
+}
+async function removeUser(opts, name, username) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await removeUserToGroup({
+    workspace: workspace.workspaceId,
+    name,
+    requestBody: { username }
+  });
+  info(colors.green(`User '${username}' removed from group '${name}'.`));
+}
+var command30 = new Command().description("Manage workspace groups").option("--json", "Output as JSON (for piping to jq)").action(list14).command("list", "List all groups in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list14).command("get", "Get group details and members").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get11).command("create", "Create a new group").arguments("<name:string>").option("--summary <summary:string>", "Group summary/description").action(create).command("delete", "Delete a group").arguments("<name:string>").action(deleteGroup2).command("add-user", "Add a user to a group").arguments("<name:string> <username:string>").action(addUser2).command("remove-user", "Remove a user from a group").arguments("<name:string> <username:string>").action(removeUser);
+var group_default = command30;
+
+// src/commands/audit/audit.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf(),
+  init_utils()
+]);
+async function list15(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const logs2 = await listAuditLogs({
+    workspace: workspace.workspaceId,
+    username: opts.username,
+    operation: opts.operation,
+    actionKind: opts.actionKind,
+    before: opts.before,
+    after: opts.after,
+    perPage: opts.limit ?? 30
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(logs2));
+  } else {
+    if (logs2.length === 0) {
+      info("No audit logs found.");
+      return;
+    }
+    new Table2().header(["ID", "Timestamp", "Username", "Operation", "Action", "Resource"]).padding(2).border(true).body(logs2.map((l) => [
+      String(l.id),
+      formatTimestamp(l.timestamp),
+      l.username,
+      l.operation,
+      l.action_kind,
+      l.resource ?? "-"
+    ])).render();
+  }
+}
+async function get12(opts, id) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const auditLog = await getAuditLog({
+    workspace: workspace.workspaceId,
+    id: parseInt(id, 10)
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(auditLog));
+  } else {
+    console.log(colors.bold("ID:") + " " + auditLog.id);
+    console.log(colors.bold("Timestamp:") + " " + formatTimestamp(auditLog.timestamp));
+    console.log(colors.bold("Username:") + " " + auditLog.username);
+    console.log(colors.bold("Operation:") + " " + auditLog.operation);
+    console.log(colors.bold("Action Kind:") + " " + auditLog.action_kind);
+    console.log(colors.bold("Resource:") + " " + (auditLog.resource ?? "-"));
+    if (auditLog.parameters && Object.keys(auditLog.parameters).length > 0) {
+      console.log(colors.bold("Parameters:"));
+      console.log(JSON.stringify(auditLog.parameters, null, 2));
+    }
+  }
+}
+var auditListOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--username <username:string>", "Filter by username").option("--operation <operation:string>", "Filter by operation (exact or prefix)").option("--action-kind <actionKind:string>", "Filter by action kind (Create, Update, Delete, Execute)").option("--before <before:string>", "Filter events before this timestamp").option("--after <after:string>", "Filter events after this timestamp").option("--limit <limit:number>", "Number of entries to return (default 30, max 100)");
+var command31 = auditListOptions(new Command().description("View audit logs (requires admin)")).action(list15).command("list", auditListOptions(new Command().description("List audit log entries"))).action(list15).command("get", "Get a specific audit log entry").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get12);
+var audit_default = command31;
+
+// src/commands/token/token.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_conf(),
+  init_utils()
+]);
+async function list16(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  await requireLogin(opts);
+  const tokens = await listTokens({
+    excludeEphemeral: true
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(tokens));
+  } else {
+    if (tokens.length === 0) {
+      info("No tokens found.");
+      return;
+    }
+    new Table2().header(["Prefix", "Label", "Created At", "Last Used", "Expiration"]).padding(2).border(true).body(tokens.map((t) => [
+      t.token_prefix,
+      t.label ?? "-",
+      formatTimestamp(t.created_at),
+      formatTimestamp(t.last_used_at),
+      t.expiration ? formatTimestamp(t.expiration) : "never"
+    ])).render();
+  }
+}
+async function create2(opts) {
+  opts = await mergeConfigWithConfigFile(opts);
+  await requireLogin(opts);
+  const token = await createToken({
+    requestBody: {
+      label: opts.label,
+      expiration: opts.expiration
+    }
+  });
+  console.log(token);
+}
+async function deleteToken2(opts, tokenPrefix) {
+  opts = await mergeConfigWithConfigFile(opts);
+  await requireLogin(opts);
+  await deleteToken({ tokenPrefix });
+  info(colors.green(`Token with prefix '${tokenPrefix}' deleted.`));
+}
+var command32 = new Command().description("Manage API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("list", "List API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("create", "Create a new API token").option("--label <label:string>", "Token label").option("--expiration <expiration:string>", "Token expiration (ISO 8601 timestamp)").action(create2).command("delete", "Delete a token by its prefix").arguments("<token_prefix:string>").action(deleteToken2);
+var token_default = command32;
+
 // src/commands/generate-metadata/generate-metadata.ts
 init_mod3();
 init_colors2();
@@ -80515,32 +81923,62 @@ async function generateMetadata2(opts, folder) {
   const formatProgress = (n) => {
     return colors.dim(colors.white(`[${n}/${total}]`.padEnd(maxWidth, " ")));
   };
+  const errors = [];
   for (const item of scripts) {
     current++;
     info(`${formatProgress(current)} script ${item.path}`);
-    await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, false, tree);
+    try {
+      await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, false, tree);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      error(`  Failed: ${msg}`);
+    }
   }
   for (const item of flows) {
     current++;
-    const result = await generateFlowLockInternal(item.folder.replaceAll("/", SEP21), false, workspace, opts, false, true, false, tree);
-    const flowResult = result;
-    const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
-    info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
+    try {
+      const result2 = await generateFlowLockInternal(item.folder.replaceAll("/", SEP21), false, workspace, opts, false, true, false, tree);
+      const flowResult = result2;
+      const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
+      info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      info(`${formatProgress(current)} flow   ${item.path}`);
+      error(`  Failed: ${msg}`);
+    }
   }
   for (const item of apps2) {
     current++;
-    const result = await generateAppLocksInternal(item.folder.replaceAll("/", SEP21), item.isRawApp, false, workspace, opts, false, true, false, tree);
-    const appResult = result;
-    const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
-    info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
+    try {
+      const result2 = await generateAppLocksInternal(item.folder.replaceAll("/", SEP21), item.isRawApp, false, workspace, opts, false, true, false, tree);
+      const appResult = result2;
+      const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
+      info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      info(`${formatProgress(current)} app    ${item.path}`);
+      error(`  Failed: ${msg}`);
+    }
   }
   const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
   await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+  const succeeded = total - errors.length;
   info("");
-  info(`Done. Updated ${colors.bold(String(total))} item(s).`);
+  if (errors.length > 0) {
+    info(`Done. Updated ${colors.bold(String(succeeded))}/${total} item(s). ${colors.red(String(errors.length) + " failed")}:`);
+    for (const { path: path19, error: error2 } of errors) {
+      error(`  ${path19}: ${error2}`);
+    }
+    process.exitCode = 1;
+  } else {
+    info(`Done. Updated ${colors.bold(String(total))} item(s).`);
+  }
 }
-var command29 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2);
-var generate_metadata_default = command29;
+var command33 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2);
+var generate_metadata_default = command33;
 
 // src/commands/docs/docs.ts
 init_mod3();
@@ -80612,13 +82050,26 @@ ${await res.text()}`);
     console.log();
   }
 }
-var command30 = new Command().name("docs").description("Search Windmill documentation. Requires Enterprise Edition.").arguments("<query:string>").option("--json", "Output results as JSON.").action(docs);
-var docs_default = command30;
+var command34 = new Command().name("docs").description("Search Windmill documentation.").arguments("<query:string>").option("--json", "Output results as JSON.").action(docs);
+var docs_default = command34;
+
+// src/commands/config/config.ts
+init_mod3();
+init_log();
+async function configAction(opts) {
+  if (opts.json) {
+    console.log(formatConfigReferenceJson());
+  } else {
+    info(formatConfigReference());
+  }
+}
+var command35 = new Command().name("config").description("Show all available wmill.yaml configuration options").option("--json", "Output as JSON for programmatic consumption").action(configAction);
+var config_default = command35;
 
 // src/main.ts
 await init_context();
-var VERSION = "1.666.0";
-var command31 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).command("init", init_default).command("app", app_default).command("flow", flow_default).command("script", script_default).command("workspace", workspace_default).command("resource", resource_default).command("resource-type", resource_type_default).command("user", user_default).command("variable", variable_default).command("hub", hub_default).command("folder", folder_default).command("schedule", schedule_default).command("trigger", trigger_default).command("dev", dev_default2).command("sync", sync_default).command("lint", lint_default).command("gitsync-settings", gitsync_settings_default).command("instance", instance_default).command("worker-groups", worker_groups_default).command("workers", workers_default).command("queues", queues_default).command("dependencies", dependencies_default).command("jobs", jobs_default).command("generate-metadata", generate_metadata_default).command("docs", docs_default).command("version --version", "Show version information").action(async (opts) => {
+var VERSION = "1.668.0";
+var command36 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).command("init", init_default).command("app", app_default).command("flow", flow_default).command("script", script_default).command("workspace", workspace_default).command("resource", resource_default).command("resource-type", resource_type_default).command("user", user_default).command("variable", variable_default).command("hub", hub_default).command("folder", folder_default).command("schedule", schedule_default).command("trigger", trigger_default).command("dev", dev_default2).command("sync", sync_default).command("lint", lint_default).command("gitsync-settings", gitsync_settings_default).command("instance", instance_default).command("worker-groups", worker_groups_default).command("workers", workers_default).command("queues", queues_default).command("dependencies", dependencies_default).command("jobs", jobs_default).command("job", job_default).command("group", group_default).command("audit", audit_default).command("token", token_default).command("generate-metadata", generate_metadata_default).command("docs", docs_default).command("config", config_default).command("version --version", "Show version information").action(async (opts) => {
   console.log("CLI version: " + VERSION);
   try {
     const provider = new NpmProvider({ package: "windmill-cli" });
@@ -80648,20 +82099,20 @@ var command31 = new Command().name("wmill").action(() => info(`Welcome to Windmi
   error(e);
   info("Try running with sudo and otherwise check the result of the command: npm uninstall windmill-cli && npm install -g windmill-cli");
 })).command("completions", new Command().description("Generate shell completions.").command("bash", new Command().description("Generate bash completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command31, "bash") + `
+  process.stdout.write(generateShellCompletions(command36, "bash") + `
 `);
 })).command("zsh", new Command().description("Generate zsh completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command31, "zsh") + `
+  process.stdout.write(generateShellCompletions(command36, "zsh") + `
 `);
 })).command("fish", new Command().description("Generate fish completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command31, "fish") + `
+  process.stdout.write(generateShellCompletions(command36, "fish") + `
 `);
 })));
 async function main2() {
   try {
     const args = process.argv.slice(2);
     if (args.length === 0) {
-      command31.showHelp();
+      command36.showHelp();
     }
     const LOG_LEVEL = args.includes("--verbose") || args.includes("--debug") ? "DEBUG" : "INFO";
     setShowDiffs(args.includes("--show-diffs"));
@@ -80671,12 +82122,22 @@ async function main2() {
     if (extraHeaders) {
       OpenAPI.HEADERS = extraHeaders;
     }
-    await command31.parse(args);
+    await command36.parse(args);
   } catch (e) {
     if (e && typeof e === "object" && "name" in e && e.name === "ApiError") {
-      console.log("Server failed. " + e.statusText + ": " + e.body);
+      const body = e.body;
+      const bodyStr = typeof body === "object" && body !== null ? JSON.stringify(body) : body;
+      error("Server failed. " + e.statusText + ": " + bodyStr);
+    } else if (e instanceof Error) {
+      error(e.message);
+    } else if (e !== undefined && e !== null) {
+      error(String(e));
+    }
+    const isDebug = process.argv.includes("--verbose") || process.argv.includes("--debug");
+    if (isDebug) {
+      throw e;
     }
-    throw e;
+    process.exitCode = 1;
   }
 }
 function isMain() {
@@ -80696,13 +82157,14 @@ if (isMain()) {
     process.stdin.destroy();
   });
 }
-var main_default = command31;
+var main_default = command36;
 export {
   add as workspaceAdd,
   workspace_default as workspace,
   variable_default as variable,
   user_default as user,
   trigger_default as trigger,
+  token_default as token,
   sync_default as sync,
   script_default as script,
   schedule_default as schedule,
@@ -80711,15 +82173,19 @@ export {
   push3 as push,
   pull,
   lint_default as lint,
+  job_default as job,
   instance_default as instance,
   pull2 as hubPull,
   hub_default as hub,
+  group_default as group,
   gitsync_settings_default as gitsyncSettings,
   folder_default as folder,
   flow_default as flow,
   docs_default as docs,
   dev_default2 as dev,
   main_default as default,
+  config_default as config,
+  audit_default as audit,
   app_default as app,
   WM_FORK_PREFIX,
   VERSION