windmill-cli 1.667.0 → 1.668.0

package/esm/main.js

@@ -4244,6 +4244,7 @@ var exports_log = {};
 __export(exports_log, {
   warn: () => warn,
   setup: () => setup,
+  setSilent: () => setSilent,
   info: () => info,
   error: () => error,
   debug: () => debug
@@ -4251,20 +4252,27 @@ __export(exports_log, {
 function setup(level) {
   logLevel = level;
 }
+function setSilent(silent) {
+  silentMode = silent;
+}
 function debug(msg) {
   if (levels[logLevel] <= levels.DEBUG)
     console.log(`\x1B[90m${String(msg)}\x1B[39m`);
 }
 function info(msg) {
+  if (silentMode)
+    return;
   console.log(`\x1B[34m${String(msg)}\x1B[39m`);
 }
 function warn(msg) {
+  if (silentMode)
+    return;
   console.log(`\x1B[33m${String(msg)}\x1B[39m`);
 }
 function error(msg) {
-  console.log(`\x1B[31m${String(msg)}\x1B[39m`);
+  console.error(`\x1B[31m${String(msg)}\x1B[39m`);
 }
-var logLevel = "INFO", levels;
+var logLevel = "INFO", silentMode = false, levels;
 var init_log = __esm(() => {
   levels = { DEBUG: 0, INFO: 1, WARN: 2, ERROR: 3 };
 });
@@ -11804,7 +11812,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv2("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.667.0",
+    VERSION: "1.668.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -19503,6 +19511,10 @@ var init_gen = __esm(() => {
 });
 
 // src/core/client.ts
+var exports_client = {};
+__export(exports_client, {
+  setClient: () => setClient
+});
 function setClient(token, baseUrl2) {
   if (baseUrl2 === undefined) {
     baseUrl2 = process.env["BASE_INTERNAL_URL"] ?? process.env["BASE_URL"] ?? "http://localhost:8000";
@@ -24762,6 +24774,9 @@ function toCamel(s) {
 function capitalize(str) {
   return str.charAt(0).toUpperCase() + str.slice(1);
 }
+function formatTimestamp(ts) {
+  return new Date(ts).toISOString().replace("T", " ").substring(0, 19);
+}
 var isWin = undefined;
 var init_utils = __esm(async () => {
   init_colors2();
@@ -25030,28 +25045,46 @@ async function createWorkspaceFork2(opts, workspaceName, workspaceId = undefined
   }
   const newBranchName = `${WM_FORK_PREFIX}/${clonedBranchName}/${workspaceId}`;
   info(`Created forked workspace ${trueWorkspaceId}. To start contributing to your fork, create and push edits to the branch \`${newBranchName}\` by using the command:
-    
+
 	` + colors.white(`git checkout -b ${newBranchName}`) + `
-    
-When doing operations on the forked workspace, it will use the remote setup in gitBranches for the branch it was forked from.`);
+
+When doing operations on the forked workspace, it will use the remote setup in gitBranches for the branch it was forked from.
+
+To merge changes back to the parent workspace, you can:
+  - Use the Merge UI from the forked workspace home page
+  - Deploy individual items via the Deploy to staging/prod UI
+  - Use git: ` + colors.white(`git checkout ${clonedBranchName} && git merge ${newBranchName} && wmill sync push`) + `
+  See: https://www.windmill.dev/docs/advanced/workspace_forks`);
 }
 async function deleteWorkspaceFork(opts, name) {
+  let forkWorkspaceId;
+  let token;
+  let remote;
+  let hasLocalProfile = false;
   const orgWorkspaces = await allWorkspaces(opts.configDir);
   const idxOf = orgWorkspaces.findIndex((x) => x.name === name);
-  if (idxOf === -1) {
-    info(colors.red.bold(`! Workspace profile ${name} does not exist locally`));
-    info("available workspace profiles:");
-    await list(opts);
-    return;
-  }
-  const workspace = orgWorkspaces[idxOf];
-  if (!workspace.workspaceId.startsWith(WM_FORK_PREFIX)) {
-    throw new Error(`You can only delete forked workspaces where the workspace id starts with \`${WM_FORK_PREFIX}.\` Failed while attempting to delete \`${workspace.workspaceId}\``);
+  if (idxOf !== -1) {
+    const workspace = orgWorkspaces[idxOf];
+    if (!workspace.workspaceId.startsWith(WM_FORK_PREFIX)) {
+      throw new Error(`You can only delete forked workspaces where the workspace id starts with \`${WM_FORK_PREFIX}.\` Failed while attempting to delete \`${workspace.workspaceId}\``);
+    }
+    forkWorkspaceId = workspace.workspaceId;
+    token = workspace.token;
+    remote = workspace.remote;
+    hasLocalProfile = true;
+  } else {
+    const parentWorkspace = await tryResolveBranchWorkspace(opts);
+    if (!parentWorkspace) {
+      throw new Error("Could not resolve parent workspace. Make sure you are in a git repo with gitBranches configured in wmill.yaml, or create a local workspace profile for the fork.");
+    }
+    forkWorkspaceId = name.startsWith(`${WM_FORK_PREFIX}-`) ? name : `${WM_FORK_PREFIX}-${name}`;
+    token = parentWorkspace.token;
+    remote = parentWorkspace.remote;
   }
   if (!opts.yes) {
     const { Select: Select2 } = await init_select().then(() => exports_select);
     const choice = await Select2.prompt({
-      message: `Are you sure you want to delete the forked workspace with id: \`${workspace.workspaceId}\`? This action will delete the workspace `,
+      message: `Are you sure you want to delete the forked workspace \`${forkWorkspaceId}\`?`,
       options: [
         { name: "Yes", value: "confirm" },
         { name: "No", value: "cancel" }
@@ -25062,14 +25095,15 @@ async function deleteWorkspaceFork(opts, name) {
       return;
     }
   }
-  const remote = workspace.remote;
-  setClient(workspace.token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
+  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
   const result = await deleteWorkspace({
-    workspace: workspace.workspaceId
+    workspace: forkWorkspaceId
   });
-  info(colors.green(`✅ Forked workspace '${workspace.workspaceId}' deleted successfully!
+  info(colors.green(`✅ Forked workspace '${forkWorkspaceId}' deleted successfully!
 ${result}`));
-  await removeWorkspace(name, false, opts);
+  if (hasLocalProfile) {
+    await removeWorkspace(name, false, opts);
+  }
 }
 var init_fork = __esm(async () => {
   init_colors2();
@@ -25148,11 +25182,14 @@ function findWmillYaml() {
 function getWmillYamlPath() {
   return findWmillYaml();
 }
-async function readConfigFile() {
+async function readConfigFile(opts) {
+  const warnIfMissing = opts?.warnIfMissing ?? true;
   try {
     const wmillYamlPath = findWmillYaml();
     if (!wmillYamlPath) {
-      warn("No wmill.yaml found. Use 'wmill init' to bootstrap it.");
+      if (warnIfMissing) {
+        warn("No wmill.yaml found. Use 'wmill init' to bootstrap it.");
+      }
       return {};
     }
     const conf = await yamlParseFile(wmillYamlPath);
@@ -25382,7 +25419,7 @@ var exports_workspace = {};
 __export(exports_workspace, {
   setActiveWorkspace: () => setActiveWorkspace,
   removeWorkspace: () => removeWorkspace,
-  list: () => list,
+  list: () => list2,
   getWorkspaceByName: () => getWorkspaceByName,
   getActiveWorkspaceOrFallback: () => getActiveWorkspaceOrFallback,
   getActiveWorkspace: () => getActiveWorkspace,
@@ -25436,7 +25473,7 @@ async function getWorkspaceByName(workspaceName, configDirOverride) {
   }
   return;
 }
-async function list(opts) {
+async function list2(opts) {
   const workspaces = await allWorkspaces(opts.configDir);
   const activeName = await getActiveWorkspaceName(opts);
   new Table2().header(["name", "remote", "workspace id"]).padding(2).border(true).body(workspaces.map((x) => {
@@ -25539,8 +25576,12 @@ async function add(opts, workspaceName, workspaceId, remote) {
     info(colors.red.bold(`! Workspace at id ${workspaceId} on ${remote} does not exist. Re-run with --create to create it. Aborting.`));
     info("On that instance and with those credentials, the workspaces that you can access are:");
     const workspaces = await listWorkspaces();
-    for (const workspace of workspaces) {
-      info(`- ${workspace.id} (name: ${workspace.name})`);
+    if (workspaces.length === 0) {
+      info("  (none)");
+    } else {
+      for (const workspace of workspaces) {
+        info(`- ${workspace.id} (name: ${workspace.name})`);
+      }
     }
     process10.exit(1);
   }
@@ -25608,7 +25649,7 @@ async function removeWorkspace(name, silent, opts) {
     if (!silent) {
       info(colors.red.bold(`! Workspace profile ${name} does not exist locally`));
       info("available workspace profiles:");
-      await list(opts);
+      await list2(opts);
     }
     return;
   }
@@ -25631,21 +25672,67 @@ async function whoami2(_opts) {
   const whoamiInfo = await globalWhoami();
   info(JSON.stringify(whoamiInfo, null, 2));
   const activeName = await getActiveWorkspaceName(_opts);
-  info("Active: " + colors.green.bold(activeName || "none"));
+  const { getCurrentGitBranch: getCurrentGitBranch2, getOriginalBranchForWorkspaceForks: getOriginalBranchForWorkspaceForks2 } = await Promise.resolve().then(() => (init_git(), exports_git));
+  const branch = getCurrentGitBranch2();
+  const originalBranch = branch ? getOriginalBranchForWorkspaceForks2(branch) : null;
+  if (originalBranch) {
+    const { resolveWorkspace } = await init_context().then(() => exports_context);
+    try {
+      const ws = await resolveWorkspace(_opts);
+      info("Active: " + colors.green.bold(`${activeName || "none"}`) + ` (fork workspace: ${ws.workspaceId})`);
+    } catch {
+      info("Active: " + colors.green.bold(activeName || "none") + " (fork branch)");
+    }
+  } else {
+    info("Active: " + colors.green.bold(activeName || "none"));
+  }
 }
 async function listRemote(_opts) {
+  let remote;
+  if (_opts.baseUrl && _opts.token && !_opts.workspace) {
+    const { setClient: setClient2 } = await Promise.resolve().then(() => (init_client(), exports_client));
+    remote = new URL(_opts.baseUrl).toString();
+    setClient2(_opts.token, remote.replace(/\/$/, ""));
+  } else {
+    const { resolveWorkspace } = await init_context().then(() => exports_context);
+    const workspace = await resolveWorkspace(_opts);
+    await requireLogin(_opts);
+    remote = workspace.remote;
+  }
+  const userWorkspaces = await listUserWorkspaces();
+  const hasForks = userWorkspaces.workspaces.some((x) => x.parent_workspace_id);
+  const headers = hasForks ? ["id", "name", "username", "fork of", "disabled"] : ["id", "name", "username", "disabled"];
+  new Table2().header(headers).padding(2).border(true).body(userWorkspaces.workspaces.map((x) => {
+    const row = [
+      x.id,
+      x.name,
+      x.username
+    ];
+    if (hasForks)
+      row.push(x.parent_workspace_id ?? "-");
+    row.push(x.disabled ? colors.red("true") : "false");
+    return row;
+  })).render();
+  info(`Remote: ${colors.bold(remote)}`);
+  info(`Logged in as: ${colors.green.bold(userWorkspaces.email)}`);
+}
+async function listForks(_opts) {
   const { resolveWorkspace } = await init_context().then(() => exports_context);
   const workspace = await resolveWorkspace(_opts);
   await requireLogin(_opts);
   const userWorkspaces = await listUserWorkspaces();
-  new Table2().header(["id", "name", "username", "disabled"]).padding(2).border(true).body(userWorkspaces.workspaces.map((x) => [
+  const forks = userWorkspaces.workspaces.filter((w) => w.parent_workspace_id);
+  if (forks.length === 0) {
+    info("No forked workspaces found.");
+    return;
+  }
+  new Table2().header(["id", "name", "fork of", "username"]).padding(2).border(true).body(forks.map((x) => [
     x.id,
     x.name,
-    x.username,
-    x.disabled ? colors.red("true") : "false"
+    x.parent_workspace_id ?? "",
+    x.username
   ])).render();
   info(`Remote: ${colors.bold(workspace.remote)}`);
-  info(`Logged in as: ${colors.green.bold(userWorkspaces.email)}`);
 }
 async function getActiveWorkspaceOrFallback(opts) {
   let activeWorkspace = await getActiveWorkspace(opts);
@@ -25721,9 +25808,9 @@ var init_workspace = __esm(async () => {
     init_auth(),
     init_fork()
   ]);
-  command = new Command().alias("profile").description("workspace related commands").action(list).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
+  command = new Command().alias("profile").description("workspace related commands").action(list2).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
     default: "admin"
-  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list).command("list-remote").description("List workspaces on the remote server that you have access to").action(listRemote).command("bind").description("Bind the current Git branch to the active workspace").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, true)).command("unbind").description("Remove workspace binding from the current Git branch").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork);
+  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list2).command("list-remote").description("List workspaces on the remote server that you have access to").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Bind the current Git branch to the active workspace. This adds the branch to gitBranches in wmill.yaml so sync operations use the correct workspace for each branch.").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, true)).command("unbind").description("Remove workspace binding from the current Git branch").option("--branch, --env <branch:string>", "Specify branch/environment (defaults to current)").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork);
   workspace_default = command;
 });
 
@@ -25922,7 +26009,7 @@ async function tryResolveBranchWorkspace(opts, branchOverride) {
       currentBranch = rawBranch;
     }
   }
-  const config = await readConfigFile();
+  const config = await readConfigFile({ warnIfMissing: false });
   const branchConfig = config.gitBranches?.[currentBranch];
   if (!branchConfig?.baseUrl || !branchConfig?.workspaceId) {
     return;
@@ -26014,10 +26101,10 @@ async function resolveWorkspace(opts, branchOverride) {
   const res = await tryResolveWorkspace(opts);
   if (!res.isError) {
     const workspace = res.value;
-    if (branchOverride || !branch || !branch.startsWith(WM_FORK_PREFIX)) {
+    if (branchOverride || opts.workspace || !branch || !branch.startsWith(WM_FORK_PREFIX)) {
       return workspace;
     } else {
-      info(`Found an active workspace \`${workspace.name}\` but the branch name indicates this is a forked workspace. Ignoring active workspace and trying to resolve the correct workspace from the branch name \`${branch}\``);
+      info(`Found an active workspace \`${workspace.name}\` but the branch name indicates this is a forked workspace. Ignoring active workspace and trying to resolve the correct workspace from the branch name \`${branch}\`. Use --workspace to override.`);
     }
   } else if (opts.workspace) {
     const workspaces = await allWorkspaces(opts.configDir);
@@ -28192,15 +28279,15 @@ var require_constants2 = __commonJS((exports, module) => {
 var require_buffer_util = __commonJS((exports, module) => {
   var { EMPTY_BUFFER } = require_constants2();
   var FastBuffer = Buffer[Symbol.species];
-  function concat(list2, totalLength) {
-    if (list2.length === 0)
+  function concat(list3, totalLength) {
+    if (list3.length === 0)
       return EMPTY_BUFFER;
-    if (list2.length === 1)
-      return list2[0];
+    if (list3.length === 1)
+      return list3[0];
     const target = Buffer.allocUnsafe(totalLength);
     let offset = 0;
-    for (let i = 0;i < list2.length; i++) {
-      const buf = list2[i];
+    for (let i = 0;i < list3.length; i++) {
+      const buf = list3[i];
       target.set(buf, offset);
       offset += buf.length;
     }
@@ -29452,14 +29539,14 @@ var require_sender = __commonJS((exports, module) => {
       this._bufferedBytes += params[3][kByteLength];
       this._queue.push(params);
     }
-    sendFrame(list2, cb) {
-      if (list2.length === 2) {
+    sendFrame(list3, cb) {
+      if (list3.length === 2) {
         this._socket.cork();
-        this._socket.write(list2[0]);
-        this._socket.write(list2[1], cb);
+        this._socket.write(list3[0]);
+        this._socket.write(list3[1], cb);
         this._socket.uncork();
       } else {
-        this._socket.write(list2[0], cb);
+        this._socket.write(list3[0], cb);
       }
     }
   }
@@ -32790,7 +32877,7 @@ var minimatch = (p, pattern, options = {}) => {
     defaults: (options) => orig.defaults(ext(def, options)),
     makeRe: (pattern, options = {}) => orig.makeRe(pattern, ext(def, options)),
     braceExpand: (pattern, options = {}) => orig.braceExpand(pattern, ext(def, options)),
-    match: (list2, pattern, options = {}) => orig.match(list2, pattern, ext(def, options)),
+    match: (list3, pattern, options = {}) => orig.match(list3, pattern, ext(def, options)),
     sep: orig.sep,
     GLOBSTAR
   });
@@ -32800,13 +32887,13 @@ var minimatch = (p, pattern, options = {}) => {
     return [pattern];
   }
   return expand(pattern, { max: options.braceExpandMax });
-}, makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe(), match = (list2, pattern, options = {}) => {
+}, makeRe = (pattern, options = {}) => new Minimatch(pattern, options).makeRe(), match = (list3, pattern, options = {}) => {
   const mm = new Minimatch(pattern, options);
-  list2 = list2.filter((f) => mm.match(f));
-  if (mm.options.nonull && !list2.length) {
-    list2.push(pattern);
+  list3 = list3.filter((f) => mm.match(f));
+  if (mm.options.nonull && !list3.length) {
+    list3.push(pattern);
   }
-  return list2;
+  return list3;
 }, globMagic, regExpEscape2 = (s) => s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
 var init_esm2 = __esm(() => {
   init_esm();
@@ -34653,20 +34740,20 @@ var require__stream_readable = __commonJS((exports, module) => {
     }
     return ret;
   }
-  function fromListPartial(n, list2, hasStrings) {
+  function fromListPartial(n, list3, hasStrings) {
     var ret;
-    if (n < list2.head.data.length) {
-      ret = list2.head.data.slice(0, n);
-      list2.head.data = list2.head.data.slice(n);
-    } else if (n === list2.head.data.length) {
-      ret = list2.shift();
+    if (n < list3.head.data.length) {
+      ret = list3.head.data.slice(0, n);
+      list3.head.data = list3.head.data.slice(n);
+    } else if (n === list3.head.data.length) {
+      ret = list3.shift();
     } else {
-      ret = hasStrings ? copyFromBufferString(n, list2) : copyFromBuffer(n, list2);
+      ret = hasStrings ? copyFromBufferString(n, list3) : copyFromBuffer(n, list3);
     }
     return ret;
   }
-  function copyFromBufferString(n, list2) {
-    var p = list2.head;
+  function copyFromBufferString(n, list3) {
+    var p = list3.head;
     var c = 1;
     var ret = p.data;
     n -= ret.length;
@@ -34682,23 +34769,23 @@ var require__stream_readable = __commonJS((exports, module) => {
         if (nb === str.length) {
           ++c;
           if (p.next)
-            list2.head = p.next;
+            list3.head = p.next;
           else
-            list2.head = list2.tail = null;
+            list3.head = list3.tail = null;
         } else {
-          list2.head = p;
+          list3.head = p;
           p.data = str.slice(nb);
         }
         break;
       }
       ++c;
     }
-    list2.length -= c;
+    list3.length -= c;
     return ret;
   }
-  function copyFromBuffer(n, list2) {
+  function copyFromBuffer(n, list3) {
     var ret = Buffer4.allocUnsafe(n);
-    var p = list2.head;
+    var p = list3.head;
     var c = 1;
     p.data.copy(ret);
     n -= p.data.length;
@@ -34711,18 +34798,18 @@ var require__stream_readable = __commonJS((exports, module) => {
         if (nb === buf.length) {
           ++c;
           if (p.next)
-            list2.head = p.next;
+            list3.head = p.next;
           else
-            list2.head = list2.tail = null;
+            list3.head = list3.tail = null;
         } else {
-          list2.head = p;
+          list3.head = p;
           p.data = buf.slice(nb);
         }
         break;
       }
       ++c;
     }
-    list2.length -= c;
+    list3.length -= c;
     return ret;
   }
   function endReadable(stream) {
@@ -59431,7 +59518,9 @@ function removeExtensionToPath(path6) {
   }
   throw new Error("Invalid extension: " + path6);
 }
-async function list2(opts) {
+async function list3(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -59479,14 +59568,40 @@ async function resolve6(input) {
   }
 }
 async function run2(opts, path6) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const input = opts.data ? await resolve6(opts.data) : {};
-  const id = await runScriptByPath({
-    workspace: workspace.workspaceId,
-    path: path6,
-    requestBody: input
-  });
+  let id;
+  try {
+    id = await runScriptByPath({
+      workspace: workspace.workspaceId,
+      path: path6,
+      requestBody: input
+    });
+  } catch (e) {
+    if (e?.status === 404) {
+      try {
+        const script = await getScriptByPath({
+          workspace: workspace.workspaceId,
+          path: path6
+        });
+        if (script.lock_error_logs) {
+          throw new Error(`Script '${path6}' has a deployment error and cannot be run:
+${script.lock_error_logs}`);
+        }
+      } catch (lookupErr) {
+        if (lookupErr?.message?.includes("deployment error"))
+          throw lookupErr;
+        if (lookupErr?.status && lookupErr.status !== 404)
+          throw lookupErr;
+      }
+      throw new Error(`Script '${path6}' not found. Run 'wmill script list' to see available scripts.`);
+    }
+    throw e;
+  }
   if (!opts.silent) {
     await track_job(workspace.workspaceId, id);
   }
@@ -59497,7 +59612,7 @@ async function run2(opts, path6) {
         id
       })).result ?? {};
       if (opts.silent) {
-        console.log(result);
+        console.log(JSON.stringify(result));
       } else {
         info(JSON.stringify(result, null, 2));
       }
@@ -59615,7 +59730,8 @@ async function bootstrap(opts, scriptPath, language) {
   const resolvedLanguage = languageAliases[language] ?? language;
   const scriptInitialCode = scriptBootstrapCode[resolvedLanguage];
   if (scriptInitialCode === undefined) {
-    throw new Error("Language unknown");
+    const validLanguages = Object.keys(scriptBootstrapCode).sort().join(", ");
+    throw new Error(`Unknown language '${language}'. Valid languages: ${validLanguages}`);
   }
   const config = await readConfigFile();
   const extension = filePathExtensionFromContentType(resolvedLanguage, config.defaultTs);
@@ -59705,6 +59821,9 @@ async function generateMetadata(opts, scriptPath) {
   }
 }
 async function preview(opts, filePath) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
@@ -59860,6 +59979,30 @@ async function preview(opts, filePath) {
     }
   }
 }
+async function history(opts, scriptPath) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const versions = await getScriptHistoryByPath({
+    workspace: workspace.workspaceId,
+    path: scriptPath
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(versions));
+  } else {
+    if (versions.length === 0) {
+      info("No version history found for " + scriptPath);
+      return;
+    }
+    new Table2().header(["#", "Hash", "Deployment Message"]).padding(2).border(true).body(versions.map((v, i) => [
+      String(versions.length - i),
+      v.script_hash,
+      v.deployment_msg ?? "-"
+    ])).render();
+  }
+}
 var import_yaml5, exts, languageAliases, command3, script_default;
 var init_script = __esm(async () => {
   init_colors2();
@@ -59915,7 +60058,7 @@ var init_script = __esm(async () => {
   languageAliases = {
     python: "python3"
   };
-  command3 = new Command().description("script related commands").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list2).command("list", "list all scripts").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list2).command("push", "push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)").arguments("<path:file>").action(push).command("get", "get a script's details").arguments("<path:file>").option("--json", "Output as JSON (for piping to jq)").action(get).command("show", "show a script's content (alias for get)").arguments("<path:file>").action(show).command("run", "run a script by path").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").action(run2).command("preview", "preview a local script without deploying it. Supports both regular and codebase scripts.").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other than the final output. Useful for scripting.").action(preview).command("new", "create a new script").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("bootstrap", "create a new script (alias for new)").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("generate-metadata", "re-generate the metadata file updating the lock and the script schema (for flows, use `wmill flow generate-locks`)").arguments("[script:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--lock-only", "re-generate only the lock").option("--schema-only", "re-generate only script schema").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateMetadata);
+  command3 = new Command().description("script related commands").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list3).command("list", "list all scripts").option("--show-archived", "Enable archived scripts in output").option("--json", "Output as JSON (for piping to jq)").action(list3).command("push", "push a local script spec. This overrides any remote versions. Use the script file (.ts, .js, .py, .sh)").arguments("<path:file>").action(push).command("get", "get a script's details").arguments("<path:file>").option("--json", "Output as JSON (for piping to jq)").action(get).command("show", "show a script's content (alias for get)").arguments("<path:file>").action(show).command("run", "run a script by path").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").action(run2).command("preview", "preview a local script without deploying it. Supports both regular and codebase scripts.").arguments("<path:file>").option("-d --data <data:file>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other than the final output. Useful for scripting.").action(preview).command("new", "create a new script").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("bootstrap", "create a new script (alias for new)").arguments("<path:file> <language:string>").option("--summary <summary:string>", "script summary").option("--description <description:string>", "script description").action(bootstrap).command("generate-metadata", "re-generate the metadata file updating the lock and the script schema (for flows, use `wmill flow generate-locks`)").arguments("[script:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--lock-only", "re-generate only the lock").option("--schema-only", "re-generate only script schema").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateMetadata).command("history", "show version history for a script").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history);
   script_default = command3;
 });
 
@@ -60531,7 +60674,9 @@ async function push2(opts, filePath, remotePath) {
   await pushResource(workspace.workspaceId, remotePath, undefined, parseFromFile(filePath), filePath);
   info(colors.bold.underline.green(`Resource ${remotePath} pushed`));
 }
-async function list3(opts) {
+async function list4(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -60610,7 +60755,7 @@ var init_resource = __esm(async () => {
     init_specific_items()
   ]);
   import_yaml7 = __toESM(require_dist(), 1);
-  command5 = new Command().description("resource related commands").option("--json", "Output as JSON (for piping to jq)").action(list3).command("list", "list all resources").option("--json", "Output as JSON (for piping to jq)").action(list3).command("get", "get a resource's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get2).command("new", "create a new resource locally").arguments("<path:string>").action(newResource).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push2);
+  command5 = new Command().description("resource related commands").option("--json", "Output as JSON (for piping to jq)").action(list4).command("list", "list all resources").option("--json", "Output as JSON (for piping to jq)").action(list4).command("get", "get a resource's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get2).command("new", "create a new resource locally").arguments("<path:string>").action(newResource).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push2);
   resource_default = command5;
 });
 
@@ -62568,8 +62713,13 @@ async function pushParentScriptForModule(modulePath, workspace, alreadySynced, m
   }
 }
 async function pull(opts) {
+  if (opts.jsonOutput)
+    setSilent(true);
   const originalCliOpts = { ...opts };
   opts = await mergeConfigWithConfigFile(opts);
+  if (originalCliOpts.includeSecrets) {
+    opts.skipSecrets = false;
+  }
   try {
     await validateBranchConfiguration(opts, opts.branch);
   } catch (error2) {
@@ -62802,8 +62952,13 @@ function removeSuffix(str, suffix) {
   return str.slice(0, str.length - suffix.length);
 }
 async function push3(opts) {
+  if (opts.jsonOutput)
+    setSilent(true);
   const originalCliOpts = { ...opts };
   opts = await mergeConfigWithConfigFile(opts);
+  if (originalCliOpts.includeSecrets) {
+    opts.skipSecrets = false;
+  }
   try {
     await validateBranchConfiguration(opts, opts.branch);
   } catch (error2) {
@@ -62871,55 +63026,104 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   const changes = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, opts.branch, false);
   const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
   const tracker = await buildTracker(changes);
+  const autoRegenerate = !!opts.autoMetadata;
   const staleScripts = [];
   const staleFlows = [];
   const staleApps = [];
   for (const change of tracker.scripts) {
-    const stale = await generateScriptMetadataInternal(change, workspace, opts, true, true, rawWorkspaceDependencies, codebases, false);
+    const stale = await generateScriptMetadataInternal(change, workspace, opts, !autoRegenerate, true, rawWorkspaceDependencies, codebases, false);
     if (stale) {
       staleScripts.push(stale);
     }
   }
   if (staleScripts.length > 0) {
     info("");
-    warn("Stale scripts metadata found, you may want to update them using 'wmill script generate-metadata' before pushing:");
+    if (autoRegenerate) {
+      info("Auto-regenerated metadata for stale scripts:");
+    } else {
+      warn("Stale scripts metadata found, you may want to update them using 'wmill script generate-metadata' before pushing:");
+    }
     for (const stale of staleScripts) {
-      warn(stale);
+      if (autoRegenerate) {
+        info(`  ${stale}`);
+      } else {
+        warn(stale);
+      }
     }
     info("");
   }
   for (const change of tracker.flows) {
-    const stale = await generateFlowLockInternal(change, true, workspace, opts, false, true);
+    const stale = await generateFlowLockInternal(change, !autoRegenerate, workspace, opts, false, true);
     if (stale) {
       staleFlows.push(stale);
     }
   }
   if (staleFlows.length > 0) {
-    warn("Stale flows locks found, you may want to update them using 'wmill flow generate-locks' before pushing:");
+    if (autoRegenerate) {
+      info("Auto-regenerated locks for stale flows:");
+    } else {
+      warn("Stale flows locks found, you may want to update them using 'wmill flow generate-locks' before pushing:");
+    }
     for (const stale of staleFlows) {
-      warn(stale);
+      if (autoRegenerate) {
+        info(`  ${stale}`);
+      } else {
+        warn(stale);
+      }
     }
     info("");
   }
   for (const change of tracker.apps) {
-    const stale = await generateAppLocksInternal(change, false, true, workspace, opts, true, true);
+    const stale = await generateAppLocksInternal(change, false, !autoRegenerate, workspace, opts, true, true);
     if (stale) {
       staleApps.push(stale);
     }
   }
   for (const change of tracker.rawApps) {
-    const stale = await generateAppLocksInternal(change, true, true, workspace, opts, true, true);
+    const stale = await generateAppLocksInternal(change, true, !autoRegenerate, workspace, opts, true, true);
     if (stale) {
       staleApps.push(stale);
     }
   }
   if (staleApps.length > 0) {
-    warn("Stale apps locks found, you may want to update them using 'wmill app generate-locks' before pushing:");
+    if (autoRegenerate) {
+      info("Auto-regenerated locks for stale apps:");
+    } else {
+      warn("Stale apps locks found, you may want to update them using 'wmill app generate-locks' before pushing:");
+    }
     for (const stale of staleApps) {
-      warn(stale);
+      if (autoRegenerate) {
+        info(`  ${stale}`);
+      } else {
+        warn(stale);
+      }
     }
     info("");
   }
+  {
+    const skippedWarnings = [];
+    let scheduleCount = 0;
+    let triggerCount = 0;
+    for await (const entry of readDirRecursiveWithIgnore2(() => false, local)) {
+      if (entry.isDirectory)
+        continue;
+      if (!opts.includeSchedules && entry.path.endsWith(".schedule.yaml"))
+        scheduleCount++;
+      if (!opts.includeTriggers && entry.path.endsWith("_trigger.yaml"))
+        triggerCount++;
+    }
+    if (scheduleCount > 0) {
+      skippedWarnings.push(`Skipping ${scheduleCount} schedule file(s). Use --include-schedules or set includeSchedules: true in wmill.yaml`);
+    }
+    if (triggerCount > 0) {
+      skippedWarnings.push(`Skipping ${triggerCount} trigger file(s). Use --include-triggers or set includeTriggers: true in wmill.yaml`);
+    }
+    for (const warning of skippedWarnings) {
+      warn(warning);
+    }
+    if (skippedWarnings.length > 0)
+      info("");
+  }
   await fetchRemoteVersion(workspace);
   info(`remote (${workspace.name}) <- local: ${changes.length} changes to apply`);
   const missingFolders = [];
@@ -63501,7 +63705,7 @@ var init_sync = __esm(async () => {
     aliasDuplicateObjects: false,
     singleQuote: true
   };
-  command6 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").action(push3);
+  command6 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "Override the current git branch/environment (works even outside a git repository)").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing").action(push3);
   sync_default = command6;
 });
 
@@ -64528,6 +64732,13 @@ var init_metadata = __esm(async () => {
 });
 
 // src/commands/app/raw_apps.ts
+var exports_raw_apps = {};
+__export(exports_raw_apps, {
+  writeRunnableToBackend: () => writeRunnableToBackend,
+  pushRawApp: () => pushRawApp,
+  loadRunnablesFromBackend: () => loadRunnablesFromBackend,
+  generatingPolicy: () => generatingPolicy
+});
 import { sep as SEP10 } from "node:path";
 import path10 from "node:path";
 import { readFile as readFile10, readdir as readdir6 } from "node:fs/promises";
@@ -67230,6 +67441,7 @@ var init_new = __esm(async () => {
 
 // src/commands/app/app.ts
 import { sep as SEP13 } from "node:path";
+import { stat as stat9 } from "node:fs/promises";
 function respecializeFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
     if (typeof v == "object") {
@@ -67359,7 +67571,7 @@ async function generatingPolicy2(app, path16, publicApp) {
     throw e;
   }
 }
-async function list4(opts) {
+async function list5(opts) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -67405,8 +67617,24 @@ async function push4(opts, filePath, remotePath) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  await pushApp(workspace.workspaceId, remotePath, filePath);
-  info(colors.bold.underline.green("App pushed"));
+  const normalizedPath = filePath.endsWith(SEP13) ? filePath.slice(0, -1) : filePath;
+  const isRawApp = normalizedPath.endsWith("__raw_app") || normalizedPath.endsWith(".raw_app");
+  let hasRawAppYaml = false;
+  if (!isRawApp) {
+    try {
+      const rawAppPath = (filePath.endsWith(SEP13) ? filePath : filePath + SEP13) + "raw_app.yaml";
+      await stat9(rawAppPath);
+      hasRawAppYaml = true;
+    } catch {}
+  }
+  if (isRawApp || hasRawAppYaml) {
+    const { pushRawApp: pushRawApp2 } = await init_raw_apps().then(() => exports_raw_apps);
+    await pushRawApp2(workspace.workspaceId, remotePath, filePath);
+    info(colors.bold.underline.green("Raw app pushed"));
+  } else {
+    await pushApp(workspace.workspaceId, remotePath, filePath);
+    info(colors.bold.underline.green("App pushed"));
+  }
 }
 var alreadySynced2, command11, app_default;
 var init_app = __esm(async () => {
@@ -67429,7 +67657,7 @@ var init_app = __esm(async () => {
     init_generate_agents()
   ]);
   alreadySynced2 = [];
-  command11 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list4).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list4).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get3).command("push", "push a local app ").arguments("<file_path:string> <remote_path:string>").action(push4).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", "re-generate the lockfiles for app runnables inline scripts that have changed").arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
+  command11 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list5).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list5).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get3).command("push", "push a local app ").arguments("<file_path:string> <remote_path:string>").action(push4).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", "re-generate the lockfiles for app runnables inline scripts that have changed").arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
     warn(colors.yellow('This command is deprecated. Use "wmill generate-metadata" instead.'));
     const { generateLocksCommand: generateLocksCommand2 } = await init_app_metadata().then(() => exports_app_metadata);
     await generateLocksCommand2(opts, appFolder);
@@ -67438,9 +67666,11 @@ var init_app = __esm(async () => {
 });
 
 // src/commands/folder/folder.ts
-import { stat as stat9, readdir as readdir7, writeFile as writeFile10, mkdir as mkdir7 } from "node:fs/promises";
+import { stat as stat10, readdir as readdir7, writeFile as writeFile10, mkdir as mkdir7 } from "node:fs/promises";
 import { sep as SEP14 } from "node:path";
-async function list5(opts) {
+async function list6(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const folders = await listFolders({
@@ -67460,7 +67690,7 @@ async function newFolder(opts, name) {
   const dirPath = `f${SEP14}${name}`;
   const filePath = `${dirPath}${SEP14}folder.meta.yaml`;
   try {
-    await stat9(filePath);
+    await stat10(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -67548,7 +67778,7 @@ async function push5(opts, name) {
   await requireLogin(opts);
   const metaPath = `f${SEP14}${name}${SEP14}folder.meta.yaml`;
   try {
-    await stat9(metaPath);
+    await stat10(metaPath);
   } catch {
     throw new Error(`Could not find ${metaPath}. Does the folder exist locally?`);
   }
@@ -67559,7 +67789,7 @@ async function push5(opts, name) {
 async function addMissing(opts) {
   const fDir = `f`;
   try {
-    await stat9(fDir);
+    await stat10(fDir);
   } catch {
     info("No 'f/' directory found. Nothing to do.");
     return;
@@ -67571,7 +67801,7 @@ async function addMissing(opts) {
       continue;
     const metaPath = `${fDir}${SEP14}${entry.name}${SEP14}folder.meta.yaml`;
     try {
-      await stat9(metaPath);
+      await stat10(metaPath);
     } catch {
       missing.push(entry.name);
     }
@@ -67610,7 +67840,7 @@ var init_folder = __esm(async () => {
     init_types()
   ]);
   import_yaml23 = __toESM(require_dist(), 1);
-  command12 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list5).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list5).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push5).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing);
+  command12 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push5).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing);
   folder_default = command12;
 });
 
@@ -67651,7 +67881,7 @@ function compileResourceTypeToTsType(schema) {
 
 // src/commands/resource-type/resource-type.ts
 import { writeFileSync as writeFileSync4 } from "node:fs";
-import { stat as stat10, writeFile as writeFile11 } from "node:fs/promises";
+import { stat as stat11, writeFile as writeFile11 } from "node:fs/promises";
 import path16 from "node:path";
 import process16 from "node:process";
 async function pushResourceType(workspace, remotePath, resource, localResource) {
@@ -67685,7 +67915,7 @@ async function pushResourceType(workspace, remotePath, resource, localResource)
   }
 }
 async function push6(opts, filePath, name) {
-  const fstat = await stat10(filePath);
+  const fstat = await stat11(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -67695,7 +67925,9 @@ async function push6(opts, filePath, name) {
   await pushResourceType(workspace.workspaceId, name, undefined, parseFromFile(filePath));
   info(colors.bold.underline.green("Resource pushed"));
 }
-async function list6(opts) {
+async function list7(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const res = await listResourceType({
@@ -67716,7 +67948,7 @@ async function list6(opts) {
 async function newResourceType(opts, name) {
   const filePath = name + ".resource-type.yaml";
   try {
-    await stat10(filePath);
+    await stat11(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -67784,14 +68016,16 @@ var init_resource_type = __esm(async () => {
     init_utils()
   ]);
   import_yaml24 = __toESM(require_dist(), 1);
-  command13 = new Command().description("resource type related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all resource types").option("--schema", "Show schema in the output").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get a resource type's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new resource type locally").arguments("<name:string>").action(newResourceType).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <name:string>").action(push6).command("generate-namespace", "Create a TypeScript definition file with the RT namespace generated from the resource types").action(generateRTNamespace);
+  command13 = new Command().description("resource type related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all resource types").option("--schema", "Show schema in the output").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a resource type's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new resource type locally").arguments("<name:string>").action(newResourceType).command("push", "push a local resource spec. This overrides any remote versions.").arguments("<file_path:string> <name:string>").action(push6).command("generate-namespace", "Create a TypeScript definition file with the RT namespace generated from the resource types").action(generateRTNamespace);
   resource_type_default = command13;
 });
 
 // src/commands/variable/variable.ts
-import { stat as stat11, writeFile as writeFile12 } from "node:fs/promises";
+import { stat as stat12, writeFile as writeFile12 } from "node:fs/promises";
 import { sep as SEP15 } from "node:path";
-async function list7(opts) {
+async function list8(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const variables = await listVariable({
@@ -67814,7 +68048,7 @@ async function newVariable(opts, path17) {
   }
   const filePath = path17 + ".variable.yaml";
   try {
-    await stat11(filePath);
+    await stat12(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -67895,7 +68129,7 @@ async function push7(opts, filePath, remotePath) {
   if (!validatePath(remotePath)) {
     return;
   }
-  const fstat = await stat11(filePath);
+  const fstat = await stat12(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -67943,14 +68177,16 @@ var init_variable = __esm(async () => {
     init_confirm()
   ]);
   import_yaml25 = __toESM(require_dist(), 1);
-  command14 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --plain-secrets instead").action(add2);
+  command14 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --plain-secrets instead").action(add2);
   variable_default = command14;
 });
 
 // src/commands/schedule/schedule.ts
-import { stat as stat12, writeFile as writeFile13 } from "node:fs/promises";
+import { stat as stat13, writeFile as writeFile13 } from "node:fs/promises";
 import { sep as SEP16 } from "node:path";
-async function list8(opts) {
+async function list9(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const schedules = await listSchedules({
@@ -67968,14 +68204,14 @@ async function newSchedule(opts, path17) {
   }
   const filePath = path17 + ".schedule.yaml";
   try {
-    await stat12(filePath);
+    await stat13(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
       throw e;
   }
   const template = {
-    schedule: "0 */6 * * *",
+    schedule: "0 0 */6 * * *",
     on_failure: "",
     script_path: "",
     args: {},
@@ -68061,13 +68297,35 @@ async function pushSchedule(workspace, path17, schedule, localSchedule) {
     }
   }
 }
+async function enable(opts, path17) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await setScheduleEnabled({
+    workspace: workspace.workspaceId,
+    path: path17,
+    requestBody: { enabled: true }
+  });
+  info(colors.green(`Schedule ${path17} enabled.`));
+}
+async function disable(opts, path17) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await setScheduleEnabled({
+    workspace: workspace.workspaceId,
+    path: path17,
+    requestBody: { enabled: false }
+  });
+  info(colors.yellow(`Schedule ${path17} disabled.`));
+}
 async function push8(opts, filePath, remotePath) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   if (!validatePath(remotePath)) {
     return;
   }
-  const fstat = await stat12(filePath);
+  const fstat = await stat13(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -68085,10 +68343,11 @@ var init_schedule = __esm(async () => {
   await __promiseAll([
     init_auth(),
     init_context(),
+    init_conf(),
     init_types()
   ]);
   import_yaml26 = __toESM(require_dist(), 1);
-  command15 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8);
+  command15 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list9).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list9).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8).command("enable", "Enable a schedule").arguments("<path:string>").action(enable).command("disable", "Disable a schedule").arguments("<path:string>").action(disable);
   schedule_default = command15;
 });
 
@@ -68717,7 +68976,7 @@ var init_settings = __esm(async () => {
 });
 
 // src/commands/instance/instance.ts
-import { readFile as readFile13, writeFile as writeFile15, readdir as readdir8, mkdir as mkdir8, rm as rm3, stat as stat13 } from "node:fs/promises";
+import { readFile as readFile13, writeFile as writeFile15, readdir as readdir8, mkdir as mkdir8, rm as rm3, stat as stat14 } from "node:fs/promises";
 import { appendFile } from "node:fs/promises";
 import * as path17 from "node:path";
 async function allInstances() {
@@ -68827,6 +69086,21 @@ async function pickInstance(opts, allowNew) {
       prefix: opts.prefix ?? "custom"
     };
   }
+  if (instances.length < 1) {
+    try {
+      const ws = await getActiveWorkspace({});
+      if (ws?.remote && ws?.token) {
+        const remote = ws.remote.endsWith("/") ? ws.remote.slice(0, -1) : ws.remote;
+        setClient(ws.token, remote);
+        return {
+          name: ws.name,
+          remote: ws.remote,
+          token: ws.token,
+          prefix: ws.name
+        };
+      }
+    } catch {}
+  }
   if (!allowNew && instances.length < 1) {
     throw new Error("No instance found, please add one first");
   }
@@ -69113,7 +69387,7 @@ Pushing workspace ` + localWorkspace.id);
 }
 async function getLocalWorkspaces(rootDir, localPrefix, folderPerInstance) {
   const localWorkspaces = [];
-  if (!await stat13(localPrefix).catch(() => null)) {
+  if (!await stat14(localPrefix).catch(() => null)) {
     await mkdir8(localPrefix);
   }
   if (folderPerInstance) {
@@ -69168,6 +69442,21 @@ async function getActiveInstance(opts) {
 async function getConfig2(opts) {
   await pickInstance(opts, false);
   const config = await getInstanceConfig();
+  const hasSecrets = config?.global_settings?.license_key || config?.global_settings?.jwt_secret;
+  let showSecrets = opts.showSecrets ?? false;
+  if (!showSecrets && hasSecrets && process.stdout.isTTY && !opts.outputFile) {
+    warn("Config contains sensitive fields (license_key, jwt_secret). They are masked by default.");
+    warn("Use --show-secrets to include them, or press Y to show them now.");
+    showSecrets = await Confirm.prompt({ message: "Show secrets?", default: false });
+  } else if (!process.stdout.isTTY || opts.outputFile) {
+    showSecrets = true;
+  }
+  if (!showSecrets && config?.global_settings) {
+    if (config.global_settings.license_key)
+      config.global_settings.license_key = "***";
+    if (config.global_settings.jwt_secret)
+      config.global_settings.jwt_secret = "***";
+  }
   const yaml = import_yaml29.stringify(config);
   if (opts.outputFile) {
     await writeFile15(opts.outputFile, yaml, "utf-8");
@@ -69235,7 +69524,7 @@ var init_instance = __esm(async () => {
     });
     await removeInstance(choice);
     info(colors.green.underline(`Removed instance ${choice}`));
-  }).command("switch").complete("instance", async () => (await allInstances()).map((x) => x.name)).arguments("<instance:string:instance>").description("Switch the current instance").action(switchI).command("pull").description("Pull instance settings, users, configs, instance groups and overwrite local").option("--yes", "Pull without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pulling users").option("--skip-settings", "Skip pulling settings").option("--skip-configs", "Skip pulling configs (worker groups and SMTP)").option("--skip-groups", "Skip pulling instance groups").option("--include-workspaces", "Also pull workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to pull from, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePull).command("push").description("Push instance settings, users, configs, group and overwrite remote").option("--yes", "Push without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pushing users").option("--skip-settings", "Skip pushing settings").option("--skip-configs", "Skip pushing configs (worker groups and SMTP)").option("--skip-groups", "Skip pushing instance groups").option("--include-workspaces", "Also push workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to push to, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces folders to push").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePush).command("whoami").description("Display information about the currently logged-in user").action(whoami3).command("get-config").description("Dump the current instance config (global settings + worker configs) as YAML").option("-o, --output-file <file:string>", "Write YAML to a file instead of stdout").option("--instance <instance:string>", "Name of the instance, override the active instance").action(getConfig2);
+  }).command("switch").complete("instance", async () => (await allInstances()).map((x) => x.name)).arguments("<instance:string:instance>").description("Switch the current instance").action(switchI).command("pull").description("Pull instance settings, users, configs, instance groups and overwrite local").option("--yes", "Pull without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pulling users").option("--skip-settings", "Skip pulling settings").option("--skip-configs", "Skip pulling configs (worker groups and SMTP)").option("--skip-groups", "Skip pulling instance groups").option("--include-workspaces", "Also pull workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to pull from, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePull).command("push").description("Push instance settings, users, configs, group and overwrite remote").option("--yes", "Push without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pushing users").option("--skip-settings", "Skip pushing settings").option("--skip-configs", "Skip pushing configs (worker groups and SMTP)").option("--skip-groups", "Skip pushing instance groups").option("--include-workspaces", "Also push workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to push to, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces folders to push").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePush).command("whoami").description("Display information about the currently logged-in user").action(whoami3).command("get-config").description("Dump the current instance config (global settings + worker configs) as YAML").option("-o, --output-file <file:string>", "Write YAML to a file instead of stdout").option("--show-secrets", "Include sensitive fields (license key, JWT secret) without prompting").option("--instance <instance:string>", "Name of the instance, override the active instance").action(getConfig2);
   instance_default = command17;
 });
 
@@ -69251,7 +69540,7 @@ function checkInstanceGroupsPath(opts) {
     instanceGroupsPath = `${opts.prefix}/${INSTANCE_GROUPS_PATH}`;
   }
 }
-async function list9(opts) {
+async function list10(opts) {
   await requireLogin(opts);
   const perPage = 10;
   let page = 0;
@@ -69607,7 +69896,7 @@ var init_user = __esm(async () => {
   import_yaml31 = __toESM(require_dist(), 1);
   instanceUsersPath = INSTANCE_USERS_PATH;
   instanceGroupsPath = INSTANCE_GROUPS_PATH;
-  command18 = new Command().description("user related commands").action(list9).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
+  command18 = new Command().description("user related commands").action(list10).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token", "Create a new API token for the authenticated user").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["password"]
   }).option("--password <password:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["email"]
@@ -69682,7 +69971,7 @@ var init_dependencies = __esm(async () => {
 });
 
 // src/commands/trigger/trigger.ts
-import { stat as stat14, writeFile as writeFile17 } from "node:fs/promises";
+import { stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
 import { sep as SEP17 } from "node:path";
 async function getTrigger(triggerType, workspace, path18) {
   const triggerFunctions = {
@@ -69857,7 +70146,7 @@ async function newTrigger(opts, path18) {
   const kind = opts.kind;
   const filePath = `${path18}.${kind}_trigger.yaml`;
   try {
-    await stat14(filePath);
+    await stat15(filePath);
     throw new Error("File already exists: " + filePath);
   } catch (e) {
     if (e.message?.startsWith("File already exists"))
@@ -69906,7 +70195,7 @@ async function get8(opts, path18) {
     } else {
       console.log(colors.bold("Path:") + " " + trigger.path);
       console.log(colors.bold("Kind:") + " " + kind);
-      console.log(colors.bold("Enabled:") + " " + (trigger.enabled ?? "-"));
+      console.log(colors.bold("Enabled:") + " " + (trigger.enabled ?? trigger.mode ?? "-"));
       console.log(colors.bold("Script Path:") + " " + (trigger.script_path ?? ""));
       console.log(colors.bold("Is Flow:") + " " + (trigger.is_flow ? "true" : "false"));
     }
@@ -69925,7 +70214,9 @@ async function listOrEmpty(fn) {
     return [];
   }
 }
-async function list10(opts) {
+async function list11(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const ws = workspace.workspaceId;
@@ -69991,7 +70282,7 @@ async function push10(opts, filePath, remotePath) {
   if (!validatePath(remotePath)) {
     return;
   }
-  const fstat = await stat14(filePath);
+  const fstat = await stat15(filePath);
   if (!fstat.isFile()) {
     throw new Error("file path must refer to a file.");
   }
@@ -70025,12 +70316,21 @@ var init_trigger = __esm(async () => {
       route_path: "",
       http_method: "get",
       is_async: false,
-      requires_auth: true
+      requires_auth: true,
+      request_type: "sync",
+      authentication_method: "none",
+      is_static_website: false,
+      workspaced_route: false,
+      wrap_body: false,
+      raw_string: false
     },
     websocket: {
       script_path: "",
       is_flow: false,
       url: "",
+      filters: [],
+      can_return_message: false,
+      can_return_error_result: false,
       enabled: false
     },
     kafka: {
@@ -70039,6 +70339,7 @@ var init_trigger = __esm(async () => {
       kafka_resource_path: "",
       group_id: "",
       topics: [],
+      filters: [],
       enabled: false
     },
     nats: {
@@ -70046,6 +70347,7 @@ var init_trigger = __esm(async () => {
       is_flow: false,
       nats_resource_path: "",
       subjects: [],
+      use_jetstream: false,
       enabled: false
     },
     postgres: {
@@ -70060,23 +70362,25 @@ var init_trigger = __esm(async () => {
       script_path: "",
       is_flow: false,
       mqtt_resource_path: "",
-      topics: [],
-      subscribe_qos: 0,
+      subscribe_topics: [],
       enabled: false
     },
     sqs: {
       script_path: "",
       is_flow: false,
-      sqs_resource_path: "",
       queue_url: "",
+      aws_resource_path: "",
+      aws_auth_resource_type: "credentials",
       enabled: false
     },
     gcp: {
       script_path: "",
       is_flow: false,
       gcp_resource_path: "",
-      subscription_id: "",
       topic_id: "",
+      subscription_id: "",
+      delivery_type: "pull",
+      subscription_mode: "create_update",
       enabled: false
     },
     email: {
@@ -70085,7 +70389,7 @@ var init_trigger = __esm(async () => {
       enabled: false
     }
   };
-  command20 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list10).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list10).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10);
+  command20 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10);
   trigger_default = command20;
 });
 
@@ -70265,10 +70569,13 @@ function getTypeStrFromPath(p) {
 }
 function removeType(str, type) {
   const normalizedStr = path18.normalize(str).replaceAll(SEP18, "/");
-  if (!normalizedStr.endsWith("." + type + ".yaml") && !normalizedStr.endsWith("." + type + ".json")) {
-    throw new Error(str + " does not end with ." + type + ".(yaml|json)");
+  if (normalizedStr.endsWith("." + type + ".yaml") || normalizedStr.endsWith("." + type + ".json")) {
+    return normalizedStr.slice(0, normalizedStr.length - type.length - 6);
   }
-  return normalizedStr.slice(0, normalizedStr.length - type.length - 6);
+  if (normalizedStr.includes("." + type)) {
+    debug(`Path '${str}' contains '.${type}' but doesn't end with '.${type}.(yaml|json)' — treating as clean path`);
+  }
+  return normalizedStr;
 }
 function extractNativeTriggerInfo(p) {
   const normalizedPath = path18.normalize(p).replaceAll(SEP18, "/");
@@ -70348,14 +70655,13 @@ function defaultFlowDefinition() {
       order: [],
       properties: {},
       required: []
-    },
-    ws_error_handler_muted: false
+    }
   };
 }
 
 // src/utils/local_path_scripts.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { readFile as readFile14, stat as stat15 } from "node:fs/promises";
+import { readFile as readFile14, stat as stat16 } from "node:fs/promises";
 async function readOptionalLock(scriptPath) {
   try {
     return await readFile14(scriptPath + ".script.lock", "utf-8");
@@ -70419,7 +70725,7 @@ async function resolvePreviewLocalScriptState(scriptPath, opts) {
     const filePath = scriptPath + ext2;
     let fileStat;
     try {
-      fileStat = await stat15(filePath);
+      fileStat = await stat16(filePath);
     } catch {
       continue;
     }
@@ -70579,7 +70885,9 @@ async function push11(opts, filePath, remotePath) {
   await pushFlow(workspace.workspaceId, remotePath, filePath);
   info(colors.bold.underline.green("Flow pushed"));
 }
-async function list11(opts) {
+async function list12(opts) {
+  if (opts.json)
+    setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   let page = 0;
@@ -70620,9 +70928,21 @@ async function get9(opts, path19) {
     console.log(colors.bold("Description:") + " " + (f.description ?? ""));
     console.log(colors.bold("Edited by:") + " " + (f.edited_by ?? ""));
     console.log(colors.bold("Edited at:") + " " + (f.edited_at ?? ""));
+    const modules = f.value?.modules;
+    if (modules && Array.isArray(modules) && modules.length > 0) {
+      console.log(colors.bold("Steps:"));
+      for (const mod of modules) {
+        const type = mod.value?.type ?? "unknown";
+        const detail = mod.value?.language ?? mod.value?.path ?? "";
+        console.log(`  ${mod.id}: ${type}${detail ? " (" + detail + ")" : ""}`);
+      }
+    }
   }
 }
 async function run3(opts, path19) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const input = opts.data ? await resolve6(opts.data) : {};
@@ -70664,9 +70984,16 @@ async function run3(opts, path19) {
     workspace: workspace.workspaceId,
     id
   });
-  info(JSON.stringify(jobInfo.result ?? {}, null, 2));
+  if (opts.silent) {
+    console.log(JSON.stringify(jobInfo.result ?? {}));
+  } else {
+    info(JSON.stringify(jobInfo.result ?? {}, null, 2));
+  }
 }
 async function preview2(opts, flowPath) {
+  if (opts.silent) {
+    setSilent(true);
+  }
   const useLocalPathScripts = !opts.remote;
   if (useLocalPathScripts) {
     opts = await mergeConfigWithConfigFile(opts);
@@ -70674,11 +71001,12 @@ async function preview2(opts, flowPath) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const codebases = useLocalPathScripts ? listSyncCodebases(opts) : [];
-  if (!flowPath.endsWith(".flow") && !flowPath.endsWith(".flow" + SEP19)) {
+  const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP19) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP19);
+  if (!isFlowDir) {
     if (flowPath.endsWith("flow.yaml") || flowPath.endsWith("flow.json")) {
       flowPath = flowPath.substring(0, flowPath.lastIndexOf(SEP19));
     } else {
-      throw new Error("Flow path must be a .flow directory or a flow.yaml file");
+      throw new Error("Flow path must be a .flow/__flow directory or a flow.yaml file");
     }
   }
   if (!flowPath.endsWith(SEP19)) {
@@ -70734,7 +71062,7 @@ async function preview2(opts, flowPath) {
     throw e;
   }
   if (opts.silent) {
-    console.log(JSON.stringify(result, null, 2));
+    console.log(JSON.stringify(result));
   } else {
     info(colors.bold.underline.green("Flow preview completed"));
     info(JSON.stringify(result, null, 2));
@@ -70799,6 +71127,53 @@ async function bootstrap2(opts, flowPath) {
   const flowYamlPath = `${flowDirFullPath}/${metadataFile}`;
   writeFileSync5(flowYamlPath, newFlowDefinitionYaml, { flag: "wx", encoding: "utf-8" });
 }
+async function history2(opts, flowPath) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const versions = await getFlowHistory({
+    workspace: workspace.workspaceId,
+    path: flowPath
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(versions));
+  } else {
+    if (versions.length === 0) {
+      info("No version history found for " + flowPath);
+      return;
+    }
+    new Table2().header(["Version", "Created At", "Deployment Message"]).padding(2).border(true).body(versions.map((v) => [
+      String(v.id),
+      new Date(v.created_at).toISOString().replace("T", " ").substring(0, 19),
+      v.deployment_msg ?? "-"
+    ])).render();
+  }
+}
+async function showVersion(opts, flowPath, version) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const flow = await getFlowVersion({
+    workspace: workspace.workspaceId,
+    path: flowPath,
+    version: parseInt(version, 10)
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(flow));
+  } else {
+    console.log(colors.bold("Path:") + " " + flow.path);
+    console.log(colors.bold("Summary:") + " " + (flow.summary ?? "-"));
+    console.log(colors.bold("Description:") + " " + (flow.description ?? "-"));
+    console.log(colors.bold("Schema:"));
+    console.log(JSON.stringify(flow.schema, null, 2));
+    console.log(colors.bold("Value:"));
+    console.log(JSON.stringify(flow.value, null, 2));
+  }
+}
 var import_yaml36, alreadySynced3, command21, flow_default;
 var init_flow = __esm(async () => {
   init_colors2();
@@ -70823,7 +71198,7 @@ var init_flow = __esm(async () => {
   ]);
   import_yaml36 = __toESM(require_dist(), 1);
   alreadySynced3 = [];
-  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", "re-generate the lock files of all inline scripts of all updated flows").arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2);
+  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", "re-generate the lock files of all inline scripts of all updated flows").arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion);
   flow_default = command21;
 });
 
@@ -72007,22 +72382,22 @@ class DoubleLinkedDependencyTree {
     return this.nodes.has(path19);
   }
   getMismatchedWorkspaceDeps() {
-    const result = {};
+    const result2 = {};
     for (const [path19, node] of this.nodes.entries()) {
       if (node.itemType === "dependencies" && node.contentHash && node.content !== undefined) {
-        result[path19] = node.content;
+        result2[path19] = node.content;
       }
     }
-    return result;
+    return result2;
   }
   getTempScriptRefs(scriptPath) {
-    const result = {};
+    const result2 = {};
     this.traverseTransitive(scriptPath, (_path, node) => {
       if (node.contentHash) {
-        result[_path] = node.contentHash;
+        result2[_path] = node.contentHash;
       }
     });
-    return result;
+    return result2;
   }
   async persistDepsHashes(depsPaths) {
     for (const path19 of depsPaths) {
@@ -73289,8 +73664,8 @@ async function pull2(opts) {
       throw new Error("Couldn't fetch resource types from hub " + hubBaseUrl + ": " + await res1.text());
     }
   }
-  let list12 = await res1.json();
-  if (list12 && list12.length === 0 && hubBaseUrl !== DEFAULT_HUB_BASE_URL) {
+  let list13 = await res1.json();
+  if (list13 && list13.length === 0 && hubBaseUrl !== DEFAULT_HUB_BASE_URL) {
     info("No resource types found in private hub, fetching from public hub");
     delete headers["X-api-secret"];
     const res2 = await fetch(DEFAULT_HUB_BASE_URL + "/resource_types/list", {
@@ -73299,12 +73674,12 @@ async function pull2(opts) {
     if (!res2.ok) {
       throw new Error("Couldn't fetch resource types from public hub: " + await res2.text());
     }
-    list12 = await res2.json();
+    list13 = await res2.json();
   }
   const resourceTypes = await listResourceType({
     workspace: workspace.workspaceId
   });
-  for (const x of list12) {
+  for (const x of list13) {
     try {
       x.schema = JSON.parse(x.schema);
     } catch (e) {
@@ -73496,7 +73871,7 @@ async function dev2(opts) {
   await Promise.all([startApp(), watchChanges()]);
   console.log("Stopped dev mode");
 }
-var command24 = new Command().description("Launch a dev server that will spawn a webserver with HMR").option("--includes <pattern...:string>", "Filter paths givena glob pattern or path").action(dev2);
+var command24 = new Command().description("Launch a dev server that watches for local file changes and auto-pushes them to the remote workspace. Provides live reload for scripts and flows during development.").option("--includes <pattern...:string>", "Filter paths givena glob pattern or path").action(dev2);
 var dev_default2 = command24;
 
 // src/main.ts
@@ -73736,7 +74111,7 @@ await __promiseAll([
   init_workspace(),
   init_resource_type()
 ]);
-import { stat as stat16, writeFile as writeFile19, rm as rm4, mkdir as mkdir9 } from "node:fs/promises";
+import { stat as stat17, writeFile as writeFile19, rm as rm4, mkdir as mkdir9 } from "node:fs/promises";
 
 // src/guidance/skills.ts
 var SKILLS = [
@@ -78730,6 +79105,16 @@ app related commands
   - \`--dry-run\` - Perform a dry run without making changes
   - \`--default-ts <runtime:string>\` - Default TypeScript runtime (bun or deno)
 
+### audit
+
+View audit logs (requires admin)
+
+**Subcommands:**
+
+- \`audit list\` - List audit log entries
+- \`audit get <id:string>\` - Get a specific audit log entry
+  - \`--json\` - Output as JSON (for piping to jq)
+
 ### config
 
 Show all available wmill.yaml configuration options
@@ -78749,14 +79134,14 @@ workspace dependencies related commands
 
 ### dev
 
-Launch a dev server that will spawn a webserver with HMR
+Launch a dev server that watches for local file changes and auto-pushes them to the remote workspace. Provides live reload for scripts and flows during development.
 
 **Options:**
 - \`--includes <pattern...:string>\` - Filter paths givena glob pattern or path
 
 ### docs
 
-Search Windmill documentation. Requires Enterprise Edition.
+Search Windmill documentation.
 
 **Arguments:** \`<query:string>\`
 
@@ -78797,6 +79182,10 @@ flow related commands
 - \`flow bootstrap <flow_path:string>\` - create a new empty flow (alias for new
   - \`--summary <summary:string>\` - flow summary
   - \`--description <description:string>\` - flow description
+- \`flow history <path:string>\` - Show version history for a flow
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`flow show-version <path:string> <version:string>\` - Show a specific version of a flow
+  - \`--json\` - Output as JSON (for piping to jq)
 
 ### folder
 
@@ -78859,6 +79248,25 @@ Manage git-sync settings between local wmill.yaml and Windmill backend
   - \`--yes\` - Skip interactive prompts and use default behavior
   - \`--promotion <branch:string>\` - Use promotionOverrides from the specified branch instead of regular overrides
 
+### group
+
+Manage workspace groups
+
+**Options:**
+- \`--json\` - Output as JSON (for piping to jq)
+
+**Subcommands:**
+
+- \`group list\` - List all groups in the workspace
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`group get <name:string>\` - Get group details and members
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`group create <name:string>\` - Create a new group
+  - \`--summary <summary:string>\` - Group summary/description
+- \`group delete <name:string>\` - Delete a group
+- \`group add-user <name:string> <username:string>\` - Add a user to a group
+- \`group remove-user <name:string> <username:string>\` - Remove a user from a group
+
 ### hub
 
 Hub related commands. EXPERIMENTAL. INTERNAL USE ONLY.
@@ -78914,8 +79322,23 @@ sync local with a remote instance or the opposite (push or pull)
 - \`instance whoami\` - Display information about the currently logged-in user
 - \`instance get-config\` - Dump the current instance config (global settings + worker configs) as YAML
   - \`-o, --output-file <file:string>\` - Write YAML to a file instead of stdout
+  - \`--show-secrets\` - Include sensitive fields (license key, JWT secret) without prompting
   - \`--instance <instance:string>\` - Name of the instance, override the active instance
 
+### job
+
+Manage jobs (list, inspect, cancel)
+
+**Subcommands:**
+
+- \`job list\` - List recent jobs
+- \`job get <id:string>\` - Get job details and result
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`job result <id:string>\` - Get the result of a completed job (machine-friendly
+- \`job logs <id:string>\` - Get job logs
+- \`job cancel <id:string>\` - Cancel a running or queued job
+  - \`--reason <reason:string>\` - Reason for cancellation
+
 ### jobs
 
 Pull completed and queued jobs from workspace
@@ -79002,6 +79425,8 @@ schedule related commands
   - \`--json\` - Output as JSON (for piping to jq)
 - \`schedule new <path:string>\` - create a new schedule locally
 - \`schedule push <file_path:string> <remote_path:string>\` - push a local schedule spec. This overrides any remote versions.
+- \`schedule enable <path:string>\` - Enable a schedule
+- \`schedule disable <path:string>\` - Disable a schedule
 
 ### script
 
@@ -79039,6 +79464,8 @@ script related commands
   - \`--schema-only\` - re-generate only script schema
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which file to NOT take into account.
+- \`script history <path:string>\` - show version history for a script
+  - \`--json\` - Output as JSON (for piping to jq)
 
 ### sync
 
@@ -79053,6 +79480,7 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--json\` - Use JSON instead of YAML
   - \`--skip-variables\` - Skip syncing variables (including secrets)
   - \`--skip-secrets\` - Skip syncing only secrets variables
+  - \`--include-secrets\` - Include secrets in sync (overrides skipSecrets in wmill.yaml)
   - \`--skip-resources\` - Skip syncing  resources
   - \`--skip-resource-types\` - Skip syncing  resource types
   - \`--skip-scripts\` - Skip syncing scripts
@@ -79082,6 +79510,7 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--json\` - Use JSON instead of YAML
   - \`--skip-variables\` - Skip syncing variables (including secrets)
   - \`--skip-secrets\` - Skip syncing only secrets variables
+  - \`--include-secrets\` - Include secrets in sync (overrides skipSecrets in wmill.yaml)
   - \`--skip-resources\` - Skip syncing  resources
   - \`--skip-resource-types\` - Skip syncing  resource types
   - \`--skip-scripts\` - Skip syncing scripts
@@ -79107,6 +79536,23 @@ sync local with a remote workspaces or the opposite (push or pull)
   - \`--branch, --env <branch:string>\` - Override the current git branch/environment (works even outside a git repository)
   - \`--lint\` - Run lint validation before pushing
   - \`--locks-required\` - Fail if scripts or flow inline scripts that need locks have no locks
+  - \`--auto-metadata\` - Automatically regenerate stale metadata (locks and schemas) before pushing
+
+### token
+
+Manage API tokens
+
+**Options:**
+- \`--json\` - Output as JSON (for piping to jq)
+
+**Subcommands:**
+
+- \`token list\` - List API tokens
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`token create\` - Create a new API token
+  - \`--label <label:string>\` - Token label
+  - \`--expiration <expiration:string>\` - Token expiration (ISO 8601 timestamp)
+- \`token delete <token_prefix:string>\` - Delete a token by its prefix
 
 ### trigger
 
@@ -79137,7 +79583,7 @@ user related commands
   - \`--company <company:string>\` - Specify to set the company of the new user.
   - \`--name <name:string>\` - Specify to set the name of the new user.
 - \`user remove <email:string>\` - Delete a user
-- \`user create-token\`
+- \`user create-token\` - Create a new API token for the authenticated user
   - \`--email <email:string>\` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.
   - \`--password <password:string>\` - Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.
 
@@ -79205,7 +79651,8 @@ workspace related commands
 - \`workspace whoami\` - Show the currently active user
 - \`workspace list\` - List local workspace profiles
 - \`workspace list-remote\` - List workspaces on the remote server that you have access to
-- \`workspace bind\` - Bind the current Git branch to the active workspace
+- \`workspace list-forks\` - List forked workspaces on the remote server
+- \`workspace bind\` - Bind the current Git branch to the active workspace. This adds the branch to gitBranches in wmill.yaml so sync operations use the correct workspace for each branch.
   - \`--branch, --env <branch:string>\` - Specify branch/environment (defaults to current)
 - \`workspace unbind\` - Remove workspace binding from the current Git branch
   - \`--branch, --env <branch:string>\` - Specify branch/environment (defaults to current)
@@ -80543,7 +80990,7 @@ ${schemaYaml.trim()}
 \`\`\``;
 }
 async function initAction(opts) {
-  if (await stat16("wmill.yaml").catch(() => null)) {
+  if (await stat17("wmill.yaml").catch(() => null)) {
     error(colors.red("wmill.yaml already exists"));
   } else {
     const { isGitRepository: isGitRepository2, getCurrentGitBranch: getCurrentGitBranch2 } = await Promise.resolve().then(() => (init_git(), exports_git));
@@ -80664,11 +81111,11 @@ Current Git branch: ${colors.bold(branchName)}`));
     const skills_base_dir = ".claude/skills";
     const skillsReference = SKILLS.map((s) => `- \`${skills_base_dir}/${s.name}/SKILL.md\` - ${s.description}`).join(`
 `);
-    if (!await stat16("AGENTS.md").catch(() => null)) {
+    if (!await stat17("AGENTS.md").catch(() => null)) {
       await writeFile19("AGENTS.md", generateAgentsMdContent(skillsReference), "utf-8");
       info(colors.green("Created AGENTS.md"));
     }
-    if (!await stat16("CLAUDE.md").catch(() => null)) {
+    if (!await stat17("CLAUDE.md").catch(() => null)) {
       await writeFile19("CLAUDE.md", `Instructions are in @AGENTS.md
 `, "utf-8");
       info(colors.green("Created CLAUDE.md"));
@@ -80895,6 +81342,400 @@ var push12 = new Command().description("Push completed and queued jobs to worksp
 var command28 = new Command().description("Manage jobs (import/export)").command("pull", pull3).command("push", push12);
 var jobs_default = command28;
 
+// src/commands/job/job.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf(),
+  init_utils()
+]);
+function formatDuration(ms) {
+  if (ms < 1000)
+    return `${ms}ms`;
+  const seconds = Math.floor(ms / 1000);
+  if (seconds < 60)
+    return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  const remainingSeconds = seconds % 60;
+  if (minutes < 60)
+    return `${minutes}m${remainingSeconds}s`;
+  const hours = Math.floor(minutes / 60);
+  const remainingMinutes = minutes % 60;
+  return `${hours}h${remainingMinutes}m`;
+}
+function getJobStatus2(job) {
+  if (job.type === "QueuedJob") {
+    if (job.canceled)
+      return colors.red("canceled");
+    if (job.running)
+      return colors.blue("running");
+    return colors.yellow("queued");
+  }
+  if (job.canceled)
+    return colors.red("canceled");
+  if (job.success)
+    return colors.green("success");
+  return colors.red("failure");
+}
+function getJobStatusPlain(job) {
+  if (job.type === "QueuedJob") {
+    if (job.canceled)
+      return "canceled";
+    if (job.running)
+      return "running";
+    return "queued";
+  }
+  if (job.canceled)
+    return "canceled";
+  if (job.success)
+    return "success";
+  return "failure";
+}
+async function list13(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  let successFilter = opts.success;
+  if (opts.failed)
+    successFilter = false;
+  const jobs = await listJobs({
+    workspace: workspace.workspaceId,
+    scriptPathExact: opts.scriptPath,
+    createdBy: opts.createdBy,
+    running: opts.running,
+    success: successFilter,
+    perPage: Math.min(opts.limit ?? 30, 100),
+    jobKinds: opts.jobKinds ?? "script,flow,singlestepflow",
+    label: opts.label,
+    hasNullParent: opts.all ? undefined : true
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(jobs));
+  } else {
+    if (jobs.length === 0) {
+      info("No jobs found.");
+      return;
+    }
+    new Table2().header(["ID", "Status", "Script/Flow", "Created By", "Duration", "Created At"]).padding(2).border(true).body(jobs.map((j) => [
+      j.id.substring(0, 8),
+      getJobStatus2(j),
+      j.script_path ?? j.raw_code?.substring(0, 30) ?? "-",
+      j.created_by ?? j.email ?? "-",
+      j.duration_ms != null ? formatDuration(j.duration_ms) : j.running ? "running" : "-",
+      j.created_at ? formatTimestamp(j.created_at) : "-"
+    ])).render();
+    info(`
+Showing ${jobs.length} job(s). Use --limit to show more.`);
+  }
+}
+async function get10(opts, id) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const job = await getJob({
+    workspace: workspace.workspaceId,
+    id
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(job));
+  } else {
+    const j = job;
+    console.log(colors.bold("ID:") + " " + j.id);
+    console.log(colors.bold("Status:") + " " + getJobStatusPlain(j));
+    console.log(colors.bold("Kind:") + " " + j.job_kind);
+    console.log(colors.bold("Script Path:") + " " + (j.script_path ?? "-"));
+    console.log(colors.bold("Created By:") + " " + (j.created_by ?? "-"));
+    console.log(colors.bold("Created At:") + " " + (j.created_at ? formatTimestamp(j.created_at) : "-"));
+    if (j.started_at) {
+      console.log(colors.bold("Started At:") + " " + formatTimestamp(j.started_at));
+    }
+    if (j.duration_ms != null) {
+      console.log(colors.bold("Duration:") + " " + formatDuration(j.duration_ms));
+    }
+    if (j.schedule_path) {
+      console.log(colors.bold("Schedule:") + " " + j.schedule_path);
+    }
+    if (j.result !== undefined) {
+      console.log(colors.bold("Result:"));
+      console.log(JSON.stringify(j.result, null, 2));
+    }
+  }
+}
+async function result(opts, id) {
+  setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const jobResult = await getCompletedJobResult({
+    workspace: workspace.workspaceId,
+    id
+  });
+  console.log(JSON.stringify(jobResult));
+}
+async function logs(opts, id) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const jobLogs = await getJobLogs({
+    workspace: workspace.workspaceId,
+    id
+  });
+  console.log(jobLogs);
+}
+async function cancel(opts, id) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await cancelQueuedJob({
+    workspace: workspace.workspaceId,
+    id,
+    requestBody: {
+      reason: opts.reason ?? "Canceled via CLI"
+    }
+  });
+  info(colors.green(`Job ${id} canceled.`));
+}
+var listOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--script-path <scriptPath:string>", "Filter by exact script/flow path").option("--created-by <createdBy:string>", "Filter by creator username").option("--running", "Show only running jobs").option("--failed", "Show only failed jobs").option("--success <success:boolean>", "Filter by success status (true/false)").option("--limit <limit:number>", "Number of jobs to return (default 30, max 100)").option("--job-kinds <jobKinds:string>", "Filter by job kinds (default: script,flow,singlestepflow)").option("--label <label:string>", "Filter by job label").option("--all", "Include sub-jobs (flow steps). By default only top-level jobs are shown");
+var command29 = listOptions(new Command().description("Manage jobs (list, inspect, cancel)")).action(list13).command("list", listOptions(new Command().description("List recent jobs"))).action(list13).command("get", "Get job details and result").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get10).command("result", "Get the result of a completed job (machine-friendly)").arguments("<id:string>").action(result).command("logs", "Get job logs").arguments("<id:string>").action(logs).command("cancel", "Cancel a running or queued job").arguments("<id:string>").option("--reason <reason:string>", "Reason for cancellation").action(cancel);
+var job_default = command29;
+
+// src/commands/group/group.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf()
+]);
+async function list14(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const groups = await listGroups({
+    workspace: workspace.workspaceId
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(groups));
+  } else {
+    if (groups.length === 0) {
+      info("No groups found.");
+      return;
+    }
+    new Table2().header(["Name", "Summary", "Members"]).padding(2).border(true).body(groups.map((g) => [
+      g.name,
+      g.summary ?? "-",
+      String(g.members?.length ?? 0)
+    ])).render();
+  }
+}
+async function get11(opts, name) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const group = await getGroup({
+    workspace: workspace.workspaceId,
+    name
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(group));
+  } else {
+    console.log(colors.bold("Name:") + " " + group.name);
+    console.log(colors.bold("Summary:") + " " + (group.summary ?? "-"));
+    console.log(colors.bold("Members:") + " " + (group.members && group.members.length > 0 ? group.members.join(", ") : "(none)"));
+  }
+}
+async function create(opts, name) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await createGroup({
+    workspace: workspace.workspaceId,
+    requestBody: {
+      name,
+      summary: opts.summary
+    }
+  });
+  info(colors.green(`Group '${name}' created.`));
+}
+async function deleteGroup2(opts, name) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await deleteGroup({
+    workspace: workspace.workspaceId,
+    name
+  });
+  info(colors.green(`Group '${name}' deleted.`));
+}
+async function addUser2(opts, name, username) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await addUserToGroup({
+    workspace: workspace.workspaceId,
+    name,
+    requestBody: { username }
+  });
+  info(colors.green(`User '${username}' added to group '${name}'.`));
+}
+async function removeUser(opts, name, username) {
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await removeUserToGroup({
+    workspace: workspace.workspaceId,
+    name,
+    requestBody: { username }
+  });
+  info(colors.green(`User '${username}' removed from group '${name}'.`));
+}
+var command30 = new Command().description("Manage workspace groups").option("--json", "Output as JSON (for piping to jq)").action(list14).command("list", "List all groups in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list14).command("get", "Get group details and members").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get11).command("create", "Create a new group").arguments("<name:string>").option("--summary <summary:string>", "Group summary/description").action(create).command("delete", "Delete a group").arguments("<name:string>").action(deleteGroup2).command("add-user", "Add a user to a group").arguments("<name:string> <username:string>").action(addUser2).command("remove-user", "Remove a user from a group").arguments("<name:string> <username:string>").action(removeUser);
+var group_default = command30;
+
+// src/commands/audit/audit.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf(),
+  init_utils()
+]);
+async function list15(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const logs2 = await listAuditLogs({
+    workspace: workspace.workspaceId,
+    username: opts.username,
+    operation: opts.operation,
+    actionKind: opts.actionKind,
+    before: opts.before,
+    after: opts.after,
+    perPage: opts.limit ?? 30
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(logs2));
+  } else {
+    if (logs2.length === 0) {
+      info("No audit logs found.");
+      return;
+    }
+    new Table2().header(["ID", "Timestamp", "Username", "Operation", "Action", "Resource"]).padding(2).border(true).body(logs2.map((l) => [
+      String(l.id),
+      formatTimestamp(l.timestamp),
+      l.username,
+      l.operation,
+      l.action_kind,
+      l.resource ?? "-"
+    ])).render();
+  }
+}
+async function get12(opts, id) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const auditLog = await getAuditLog({
+    workspace: workspace.workspaceId,
+    id: parseInt(id, 10)
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(auditLog));
+  } else {
+    console.log(colors.bold("ID:") + " " + auditLog.id);
+    console.log(colors.bold("Timestamp:") + " " + formatTimestamp(auditLog.timestamp));
+    console.log(colors.bold("Username:") + " " + auditLog.username);
+    console.log(colors.bold("Operation:") + " " + auditLog.operation);
+    console.log(colors.bold("Action Kind:") + " " + auditLog.action_kind);
+    console.log(colors.bold("Resource:") + " " + (auditLog.resource ?? "-"));
+    if (auditLog.parameters && Object.keys(auditLog.parameters).length > 0) {
+      console.log(colors.bold("Parameters:"));
+      console.log(JSON.stringify(auditLog.parameters, null, 2));
+    }
+  }
+}
+var auditListOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--username <username:string>", "Filter by username").option("--operation <operation:string>", "Filter by operation (exact or prefix)").option("--action-kind <actionKind:string>", "Filter by action kind (Create, Update, Delete, Execute)").option("--before <before:string>", "Filter events before this timestamp").option("--after <after:string>", "Filter events after this timestamp").option("--limit <limit:number>", "Number of entries to return (default 30, max 100)");
+var command31 = auditListOptions(new Command().description("View audit logs (requires admin)")).action(list15).command("list", auditListOptions(new Command().description("List audit log entries"))).action(list15).command("get", "Get a specific audit log entry").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get12);
+var audit_default = command31;
+
+// src/commands/token/token.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_conf(),
+  init_utils()
+]);
+async function list16(opts) {
+  if (opts.json)
+    setSilent(true);
+  opts = await mergeConfigWithConfigFile(opts);
+  await requireLogin(opts);
+  const tokens = await listTokens({
+    excludeEphemeral: true
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(tokens));
+  } else {
+    if (tokens.length === 0) {
+      info("No tokens found.");
+      return;
+    }
+    new Table2().header(["Prefix", "Label", "Created At", "Last Used", "Expiration"]).padding(2).border(true).body(tokens.map((t) => [
+      t.token_prefix,
+      t.label ?? "-",
+      formatTimestamp(t.created_at),
+      formatTimestamp(t.last_used_at),
+      t.expiration ? formatTimestamp(t.expiration) : "never"
+    ])).render();
+  }
+}
+async function create2(opts) {
+  opts = await mergeConfigWithConfigFile(opts);
+  await requireLogin(opts);
+  const token = await createToken({
+    requestBody: {
+      label: opts.label,
+      expiration: opts.expiration
+    }
+  });
+  console.log(token);
+}
+async function deleteToken2(opts, tokenPrefix) {
+  opts = await mergeConfigWithConfigFile(opts);
+  await requireLogin(opts);
+  await deleteToken({ tokenPrefix });
+  info(colors.green(`Token with prefix '${tokenPrefix}' deleted.`));
+}
+var command32 = new Command().description("Manage API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("list", "List API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("create", "Create a new API token").option("--label <label:string>", "Token label").option("--expiration <expiration:string>", "Token expiration (ISO 8601 timestamp)").action(create2).command("delete", "Delete a token by its prefix").arguments("<token_prefix:string>").action(deleteToken2);
+var token_default = command32;
+
 // src/commands/generate-metadata/generate-metadata.ts
 init_mod3();
 init_colors2();
@@ -81082,32 +81923,62 @@ async function generateMetadata2(opts, folder) {
   const formatProgress = (n) => {
     return colors.dim(colors.white(`[${n}/${total}]`.padEnd(maxWidth, " ")));
   };
+  const errors = [];
   for (const item of scripts) {
     current++;
     info(`${formatProgress(current)} script ${item.path}`);
-    await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, false, tree);
+    try {
+      await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, false, tree);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      error(`  Failed: ${msg}`);
+    }
   }
   for (const item of flows) {
     current++;
-    const result = await generateFlowLockInternal(item.folder.replaceAll("/", SEP21), false, workspace, opts, false, true, false, tree);
-    const flowResult = result;
-    const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
-    info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
+    try {
+      const result2 = await generateFlowLockInternal(item.folder.replaceAll("/", SEP21), false, workspace, opts, false, true, false, tree);
+      const flowResult = result2;
+      const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
+      info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      info(`${formatProgress(current)} flow   ${item.path}`);
+      error(`  Failed: ${msg}`);
+    }
   }
   for (const item of apps2) {
     current++;
-    const result = await generateAppLocksInternal(item.folder.replaceAll("/", SEP21), item.isRawApp, false, workspace, opts, false, true, false, tree);
-    const appResult = result;
-    const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
-    info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
+    try {
+      const result2 = await generateAppLocksInternal(item.folder.replaceAll("/", SEP21), item.isRawApp, false, workspace, opts, false, true, false, tree);
+      const appResult = result2;
+      const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
+      info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      info(`${formatProgress(current)} app    ${item.path}`);
+      error(`  Failed: ${msg}`);
+    }
   }
   const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
   await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+  const succeeded = total - errors.length;
   info("");
-  info(`Done. Updated ${colors.bold(String(total))} item(s).`);
+  if (errors.length > 0) {
+    info(`Done. Updated ${colors.bold(String(succeeded))}/${total} item(s). ${colors.red(String(errors.length) + " failed")}:`);
+    for (const { path: path19, error: error2 } of errors) {
+      error(`  ${path19}: ${error2}`);
+    }
+    process.exitCode = 1;
+  } else {
+    info(`Done. Updated ${colors.bold(String(total))} item(s).`);
+  }
 }
-var command29 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2);
-var generate_metadata_default = command29;
+var command33 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2);
+var generate_metadata_default = command33;
 
 // src/commands/docs/docs.ts
 init_mod3();
@@ -81179,8 +82050,8 @@ ${await res.text()}`);
     console.log();
   }
 }
-var command30 = new Command().name("docs").description("Search Windmill documentation. Requires Enterprise Edition.").arguments("<query:string>").option("--json", "Output results as JSON.").action(docs);
-var docs_default = command30;
+var command34 = new Command().name("docs").description("Search Windmill documentation.").arguments("<query:string>").option("--json", "Output results as JSON.").action(docs);
+var docs_default = command34;
 
 // src/commands/config/config.ts
 init_mod3();
@@ -81192,13 +82063,13 @@ async function configAction(opts) {
     info(formatConfigReference());
   }
 }
-var command31 = new Command().name("config").description("Show all available wmill.yaml configuration options").option("--json", "Output as JSON for programmatic consumption").action(configAction);
-var config_default = command31;
+var command35 = new Command().name("config").description("Show all available wmill.yaml configuration options").option("--json", "Output as JSON for programmatic consumption").action(configAction);
+var config_default = command35;
 
 // src/main.ts
 await init_context();
-var VERSION = "1.667.0";
-var command32 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).command("init", init_default).command("app", app_default).command("flow", flow_default).command("script", script_default).command("workspace", workspace_default).command("resource", resource_default).command("resource-type", resource_type_default).command("user", user_default).command("variable", variable_default).command("hub", hub_default).command("folder", folder_default).command("schedule", schedule_default).command("trigger", trigger_default).command("dev", dev_default2).command("sync", sync_default).command("lint", lint_default).command("gitsync-settings", gitsync_settings_default).command("instance", instance_default).command("worker-groups", worker_groups_default).command("workers", workers_default).command("queues", queues_default).command("dependencies", dependencies_default).command("jobs", jobs_default).command("generate-metadata", generate_metadata_default).command("docs", docs_default).command("config", config_default).command("version --version", "Show version information").action(async (opts) => {
+var VERSION = "1.668.0";
+var command36 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).command("init", init_default).command("app", app_default).command("flow", flow_default).command("script", script_default).command("workspace", workspace_default).command("resource", resource_default).command("resource-type", resource_type_default).command("user", user_default).command("variable", variable_default).command("hub", hub_default).command("folder", folder_default).command("schedule", schedule_default).command("trigger", trigger_default).command("dev", dev_default2).command("sync", sync_default).command("lint", lint_default).command("gitsync-settings", gitsync_settings_default).command("instance", instance_default).command("worker-groups", worker_groups_default).command("workers", workers_default).command("queues", queues_default).command("dependencies", dependencies_default).command("jobs", jobs_default).command("job", job_default).command("group", group_default).command("audit", audit_default).command("token", token_default).command("generate-metadata", generate_metadata_default).command("docs", docs_default).command("config", config_default).command("version --version", "Show version information").action(async (opts) => {
   console.log("CLI version: " + VERSION);
   try {
     const provider = new NpmProvider({ package: "windmill-cli" });
@@ -81228,20 +82099,20 @@ var command32 = new Command().name("wmill").action(() => info(`Welcome to Windmi
   error(e);
   info("Try running with sudo and otherwise check the result of the command: npm uninstall windmill-cli && npm install -g windmill-cli");
 })).command("completions", new Command().description("Generate shell completions.").command("bash", new Command().description("Generate bash completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command32, "bash") + `
+  process.stdout.write(generateShellCompletions(command36, "bash") + `
 `);
 })).command("zsh", new Command().description("Generate zsh completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command32, "zsh") + `
+  process.stdout.write(generateShellCompletions(command36, "zsh") + `
 `);
 })).command("fish", new Command().description("Generate fish completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command32, "fish") + `
+  process.stdout.write(generateShellCompletions(command36, "fish") + `
 `);
 })));
 async function main2() {
   try {
     const args = process.argv.slice(2);
     if (args.length === 0) {
-      command32.showHelp();
+      command36.showHelp();
     }
     const LOG_LEVEL = args.includes("--verbose") || args.includes("--debug") ? "DEBUG" : "INFO";
     setShowDiffs(args.includes("--show-diffs"));
@@ -81251,12 +82122,22 @@ async function main2() {
     if (extraHeaders) {
       OpenAPI.HEADERS = extraHeaders;
     }
-    await command32.parse(args);
+    await command36.parse(args);
   } catch (e) {
     if (e && typeof e === "object" && "name" in e && e.name === "ApiError") {
-      console.log("Server failed. " + e.statusText + ": " + e.body);
+      const body = e.body;
+      const bodyStr = typeof body === "object" && body !== null ? JSON.stringify(body) : body;
+      error("Server failed. " + e.statusText + ": " + bodyStr);
+    } else if (e instanceof Error) {
+      error(e.message);
+    } else if (e !== undefined && e !== null) {
+      error(String(e));
+    }
+    const isDebug = process.argv.includes("--verbose") || process.argv.includes("--debug");
+    if (isDebug) {
+      throw e;
     }
-    throw e;
+    process.exitCode = 1;
   }
 }
 function isMain() {
@@ -81276,13 +82157,14 @@ if (isMain()) {
     process.stdin.destroy();
   });
 }
-var main_default = command32;
+var main_default = command36;
 export {
   add as workspaceAdd,
   workspace_default as workspace,
   variable_default as variable,
   user_default as user,
   trigger_default as trigger,
+  token_default as token,
   sync_default as sync,
   script_default as script,
   schedule_default as schedule,
@@ -81291,9 +82173,11 @@ export {
   push3 as push,
   pull,
   lint_default as lint,
+  job_default as job,
   instance_default as instance,
   pull2 as hubPull,
   hub_default as hub,
+  group_default as group,
   gitsync_settings_default as gitsyncSettings,
   folder_default as folder,
   flow_default as flow,
@@ -81301,6 +82185,7 @@ export {
   dev_default2 as dev,
   main_default as default,
   config_default as config,
+  audit_default as audit,
   app_default as app,
   WM_FORK_PREFIX,
   VERSION