windmill-cli 1.693.4 → 1.693.5

package/esm/main.js

@@ -5,43 +5,25 @@ var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
 var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
   for (let key of __getOwnPropNames(mod))
     if (!__hasOwnProp.call(to, key))
       __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
+        get: () => mod[key],
         enumerable: true
       });
-  if (canCache)
-    cache.set(mod, to);
   return to;
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, {
       get: all[name],
       enumerable: true,
       configurable: true,
-      set: __exportSetter.bind(all, name)
+      set: (newValue) => all[name] = () => newValue
     });
 };
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
@@ -13203,7 +13185,7 @@ function sameValueZero(a, b) {
 }
 function equal(a, b) {
   const seen = new Map;
-  return function compare3(a2, b2) {
+  return function compare(a2, b2) {
     if (sameValueZero(a2, b2))
       return true;
     if (isPrimitive(a2) || isPrimitive(b2))
@@ -13228,7 +13210,7 @@ function equal(a, b) {
         throw new TypeError("Cannot compare WeakSet instances");
       }
       if (a2 instanceof WeakRef) {
-        return compare3(a2.deref(), b2.deref());
+        return compare(a2.deref(), b2.deref());
       }
       if (seen.get(a2) === b2) {
         return true;
@@ -13250,7 +13232,7 @@ function equal(a, b) {
             return a2.symmetricDifference(b2).size === 0;
           }
           for (const key of aKeys) {
-            if (!b2.has(key) || !compare3(a2.get(key), b2.get(key))) {
+            if (!b2.has(key) || !compare(a2.get(key), b2.get(key))) {
               return false;
             }
           }
@@ -13259,9 +13241,9 @@ function equal(a, b) {
         let unmatchedEntries = a2.size;
         for (const [aKey, aValue] of a2.entries()) {
           for (const [bKey, bValue] of b2.entries()) {
-            if (!compare3(aKey, bKey))
+            if (!compare(aKey, bKey))
               continue;
-            if (aKey === aValue && bKey === bValue || compare3(aValue, bValue)) {
+            if (aKey === aValue && bKey === bValue || compare(aValue, bValue)) {
               unmatchedEntries--;
               break;
             }
@@ -13281,7 +13263,7 @@ function equal(a, b) {
         keys = getKeysDeep(a2).union(getKeysDeep(b2));
       }
       for (const key of keys) {
-        if (!compare3(a2[key], b2[key])) {
+        if (!compare(a2[key], b2[key])) {
           return false;
         }
         if (key in a2 && !(key in b2) || key in b2 && !(key in a2)) {
@@ -26462,6 +26444,9 @@ function getScriptBasePathFromModulePath(p) {
     return;
   return norm.slice(0, idx);
 }
+function scriptPathToRemotePath(p) {
+  return (isModuleEntryPoint(p) ? getScriptBasePathFromModulePath(p) : p.substring(0, p.indexOf("."))).replaceAll(SEP2, "/");
+}
 function getDeleteSuffix(type, format6) {
   return getFolderSuffixes()[type] + "/" + METADATA_FILES[type][format6];
 }
@@ -30420,7 +30405,7 @@ var require_stream = __commonJS((exports, module) => {
       if (!duplex.push(data3))
         ws.pause();
     });
-    ws.once("error", function error2(err) {
+    ws.once("error", function error(err) {
       if (duplex.destroyed)
         return;
       terminateOnDestroy = false;
@@ -30438,7 +30423,7 @@ var require_stream = __commonJS((exports, module) => {
         return;
       }
       let called = false;
-      ws.once("error", function error2(err2) {
+      ws.once("error", function error(err2) {
         called = true;
         callback(err2);
       });
@@ -30452,7 +30437,7 @@ var require_stream = __commonJS((exports, module) => {
     };
     duplex._final = function(callback) {
       if (ws.readyState === ws.CONNECTING) {
-        ws.once("open", function open2() {
+        ws.once("open", function open() {
           duplex._final(callback);
         });
         return;
@@ -30476,7 +30461,7 @@ var require_stream = __commonJS((exports, module) => {
     };
     duplex._write = function(chunk, encoding, callback) {
       if (ws.readyState === ws.CONNECTING) {
-        ws.once("open", function open2() {
+        ws.once("open", function open() {
           duplex._write(chunk, encoding, callback);
         });
         return;
@@ -35527,7 +35512,7 @@ var require_BufferList = __commonJS((exports, module) => {
       this.tail = null;
       this.length = 0;
     }
-    BufferList.prototype.push = function push2(v) {
+    BufferList.prototype.push = function push(v) {
       var entry = { data: v, next: null };
       if (this.length > 0)
         this.tail.next = entry;
@@ -35558,7 +35543,7 @@ var require_BufferList = __commonJS((exports, module) => {
       this.head = this.tail = null;
       this.length = 0;
     };
-    BufferList.prototype.join = function join9(s) {
+    BufferList.prototype.join = function join(s) {
       if (this.length === 0)
         return "";
       var p = this.head;
@@ -37493,7 +37478,7 @@ var require_nodejsUtils = __commonJS((exports, module) => {
 
 // node_modules/set-immediate-shim/index.js
 var require_set_immediate_shim = __commonJS((exports, module) => {
-  module.exports = typeof setImmediate === "function" ? setImmediate : function setImmediate2() {
+  module.exports = typeof setImmediate === "function" ? setImmediate : function setImmediate() {
     var args = [].slice.apply(arguments);
     args.splice(1, 0, 0);
     setTimeout.apply(null, args);
@@ -45848,7 +45833,7 @@ var require_headers = __commonJS((exports) => {
     }
     return result;
   };
-  exports.encode = function encode2(opts) {
+  exports.encode = function encode(opts) {
     const buf = b4a.alloc(512);
     let name = opts.name;
     let prefix = "";
@@ -45889,7 +45874,7 @@ var require_headers = __commonJS((exports) => {
     b4a.write(buf, encodeOct(cksum(buf), 6), 148);
     return buf;
   };
-  exports.decode = function decode2(buf, filenameEncoding, allowUnknownFormat) {
+  exports.decode = function decode(buf, filenameEncoding, allowUnknownFormat) {
     let typeflag = buf[156] === 0 ? 0 : buf[156] - ZERO_OFFSET;
     let name = decodeStr(buf, 0, 100, filenameEncoding);
     const mode = decodeOct(buf, 100, 8);
@@ -48800,7 +48785,7 @@ var require_subschema = __commonJS((exports) => {
 
 // node_modules/fast-deep-equal/index.js
 var require_fast_deep_equal = __commonJS((exports, module) => {
-  module.exports = function equal2(a, b) {
+  module.exports = function equal(a, b) {
     if (a === b)
       return true;
     if (a && b && typeof a == "object" && typeof b == "object") {
@@ -48812,7 +48797,7 @@ var require_fast_deep_equal = __commonJS((exports, module) => {
         if (length != b.length)
           return false;
         for (i = length;i-- !== 0; )
-          if (!equal2(a[i], b[i]))
+          if (!equal(a[i], b[i]))
             return false;
         return true;
       }
@@ -48831,7 +48816,7 @@ var require_fast_deep_equal = __commonJS((exports, module) => {
           return false;
       for (i = length;i-- !== 0; ) {
         var key = keys[i];
-        if (!equal2(a[key], b[key]))
+        if (!equal(a[key], b[key]))
           return false;
       }
       return true;
@@ -61660,7 +61645,7 @@ async function handleFile(path8, workspace, alreadySynced, message, opts, rawWor
     }
     debug(`Processing local script ${path8}`);
     alreadySynced.push(path8);
-    const remotePath = moduleEntryPoint ? getScriptBasePathFromModulePath(path8).replaceAll(SEP4, "/") : path8.substring(0, path8.indexOf(".")).replaceAll(SEP4, "/");
+    const remotePath = scriptPathToRemotePath(path8);
     const language = inferContentTypeFromFilePath(path8, opts?.defaultTs);
     const codebase = language == "bun" ? findCodebase(path8, codebases) : undefined;
     let bundleContent = undefined;
@@ -63593,8 +63578,11 @@ function getLanguageFromExtension(ext2, defaultTs = "bun") {
   }
   return;
 }
-function sanitizeForFilesystem(summary) {
-  const name = summary.replaceAll(" ", "_").replace(/[/\\:*?"<>|\x00-\x1f\x7f]/g, "").replace(/_+/g, "_").replace(/^[._]+|[._]+$/g, "");
+function sanitizeForFilesystem(summary, options) {
+  let name = summary.replaceAll(" ", "_").replace(/[/\\:*?"<>|\x00-\x1f\x7f]/g, "").replace(/_+/g, "_").replace(/^[._]+|[._]+$/g, "");
+  if (!options?.preserveCase) {
+    name = name.toLowerCase();
+  }
   return WINDOWS_RESERVED.test(name.toLowerCase()) ? `_${name}` : name;
 }
 function newPathAssigner(defaultTs, options) {
@@ -63626,7 +63614,7 @@ function newRawAppPathAssigner(defaultTs) {
   const seen_names = new Set;
   function assignPath(summary, language) {
     let name;
-    name = summary ? sanitizeForFilesystem(summary) : "";
+    name = summary ? sanitizeForFilesystem(summary, { preserveCase: true }) : "";
     let original_name = name;
     if (name == "") {
       original_name = "runnable";
@@ -63995,6 +63983,19 @@ var init_relative_imports = __esm(async () => {
 // src/commands/flow/flow_metadata.ts
 import * as path10 from "node:path";
 import { sep as SEP7 } from "node:path";
+async function isFlowDirectlyStale(folder, hashes, conf) {
+  if (await checkifMetadataUptodate(folder, hashes[TOP_HASH], conf, TOP_HASH)) {
+    return false;
+  }
+  const fileEntries = Object.entries(hashes).filter(([k]) => k !== TOP_HASH);
+  if (fileEntries.length === 0)
+    return true;
+  for (const [k, h] of fileEntries) {
+    if (!await checkifMetadataUptodate(folder, h, conf, k))
+      return true;
+  }
+  return false;
+}
 async function generateFlowHash(rawWorkspaceDependencies, folder, defaultTs) {
   const elems = await FSFSElement(path10.join(process.cwd(), folder), [], true);
   const hashes = {};
@@ -64014,6 +64015,14 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
   if (folder.endsWith(SEP7)) {
     folder = folder.substring(0, folder.length - 1);
   }
+  if (opts.rehashOnly) {
+    const hashes = await generateFlowHash({}, folder, opts.defaultTs);
+    await clearGlobalLock(folder);
+    for (const [k, v] of Object.entries(hashes)) {
+      await updateMetadataGlobalLock(folder, v, k);
+    }
+    return;
+  }
   const remote_path = extractNameFromFolder(folder.replaceAll(SEP7, "/"), "flow");
   if (!justUpdateMetadataLock && !noStaleMessage) {
     info(`Generating lock for flow ${folder} at ${remote_path}`);
@@ -64043,7 +64052,7 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
         inlineScriptPaths.push(treePath);
       }
       const hashes = await generateFlowHash({}, folder, opts.defaultTs);
-      const isDirectlyStale = !await checkifMetadataUptodate(folder, hashes[TOP_HASH], conf, TOP_HASH);
+      const isDirectlyStale = await isFlowDirectlyStale(folder, hashes, conf);
       await tree.addNode(folderNormalized, "", "bun", "", inlineScriptPaths, "flow", folderNormalized, folder, isDirectlyStale);
       return;
     }
@@ -64052,7 +64061,7 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
     const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
     filteredDeps = await filterWorkspaceDependenciesForFlow(flowValue.value, rawWorkspaceDependencies, folder);
     const hashes = await generateFlowHash(filteredDeps, folder, opts.defaultTs);
-    const isDirectlyStale = !await checkifMetadataUptodate(folder, hashes[TOP_HASH], conf, TOP_HASH);
+    const isDirectlyStale = await isFlowDirectlyStale(folder, hashes, conf);
     if (!isDirectlyStale) {
       if (!noStaleMessage) {
         info(colors.green(`Flow ${remote_path} metadata is up-to-date, skipping`));
@@ -64227,6 +64236,662 @@ var init_flow_metadata = __esm(async () => {
   import_yaml9 = __toESM(require_dist(), 1);
 });
 
+// src/utils/dependency_tree.ts
+async function uploadScripts(tree, workspace) {
+  const scriptHashes = {};
+  const workspaceDeps = [];
+  for (const path11 of tree.allPaths()) {
+    const content = tree.getContent(path11);
+    const itemType = tree.getItemType(path11);
+    if (itemType === "dependencies") {
+      if (content === undefined)
+        continue;
+      const info2 = workspaceDependenciesPathToLanguageAndFilename(path11);
+      if (info2) {
+        const hash2 = await generateHash(content);
+        workspaceDeps.push({ path: path11, language: info2.language, name: info2.name, hash: hash2 });
+      }
+    } else if (itemType === "script") {
+      if (!content)
+        continue;
+      const hash2 = await generateHash(content);
+      scriptHashes[path11] = hash2;
+    }
+  }
+  if (Object.keys(scriptHashes).length === 0 && workspaceDeps.length === 0)
+    return;
+  const mismatched = await diffRawScriptsWithDeployed({
+    workspace: workspace.workspaceId,
+    requestBody: {
+      scripts: scriptHashes,
+      workspace_deps: workspaceDeps
+    }
+  });
+  for (const path11 of mismatched) {
+    const content = tree.getContent(path11);
+    const itemType = tree.getItemType(path11);
+    if (itemType === "dependencies") {
+      if (content !== undefined) {
+        tree.setContentHash(path11, "mismatched");
+      }
+    } else if (content) {
+      const hash2 = await storeRawScriptTemp({
+        workspace: workspace.workspaceId,
+        requestBody: content
+      });
+      tree.setContentHash(path11, hash2);
+    }
+  }
+}
+
+class DoubleLinkedDependencyTree {
+  nodes = new Map;
+  workspaceDeps = {};
+  setWorkspaceDeps(deps) {
+    this.workspaceDeps = deps;
+  }
+  async addNode(path11, content, language, metadata, imports, itemType, folder, originalPath, isDirectlyStale, isRawApp) {
+    const hasWorkspaceDeps = itemType === "script" || itemType === "inline_script";
+    const filteredDeps = hasWorkspaceDeps ? filterWorkspaceDependencies(this.workspaceDeps, content, language) : {};
+    const stalenessHash = await generateScriptHash({}, content, metadata);
+    if (!this.nodes.has(path11)) {
+      this.nodes.set(path11, {
+        content: "",
+        stalenessHash: "",
+        language: "deno",
+        metadata: "",
+        imports: new Set,
+        importedBy: new Set,
+        itemType: "script",
+        folder: "",
+        originalPath: "",
+        isDirectlyStale: false
+      });
+    }
+    const node = this.nodes.get(path11);
+    node.content = content;
+    node.stalenessHash = stalenessHash;
+    node.language = language;
+    node.metadata = metadata;
+    node.itemType = itemType;
+    node.folder = folder;
+    node.originalPath = originalPath;
+    node.isDirectlyStale = isDirectlyStale;
+    node.isRawApp = isRawApp;
+    const filteredDepsPaths = Object.keys(filteredDeps);
+    for (const depsPath of filteredDepsPaths) {
+      if (!this.nodes.has(depsPath)) {
+        const depsInfo = workspaceDependenciesPathToLanguageAndFilename(depsPath);
+        const contentHash = await generateHash(filteredDeps[depsPath] + depsPath);
+        const isUpToDate = await checkifMetadataUptodate(depsPath, contentHash, undefined);
+        this.nodes.set(depsPath, {
+          content: filteredDeps[depsPath],
+          stalenessHash: "",
+          language: depsInfo?.language ?? "deno",
+          metadata: "",
+          imports: new Set,
+          importedBy: new Set,
+          itemType: "dependencies",
+          folder: "",
+          originalPath: depsPath,
+          isDirectlyStale: !isUpToDate
+        });
+      }
+    }
+    const allImports = [...imports, ...filteredDepsPaths];
+    for (const importPath of allImports) {
+      node.imports.add(importPath);
+      if (!this.nodes.has(importPath)) {
+        this.nodes.set(importPath, {
+          content: "",
+          stalenessHash: "",
+          language: "deno",
+          metadata: "",
+          imports: new Set,
+          importedBy: new Set,
+          itemType: "script",
+          folder: "",
+          originalPath: "",
+          isDirectlyStale: false
+        });
+      }
+      this.nodes.get(importPath).importedBy.add(path11);
+    }
+  }
+  getContent(path11) {
+    return this.nodes.get(path11)?.content;
+  }
+  getStalenessHash(path11) {
+    return this.nodes.get(path11)?.stalenessHash;
+  }
+  getContentHash(path11) {
+    return this.nodes.get(path11)?.contentHash;
+  }
+  setContentHash(path11, hash2) {
+    const node = this.nodes.get(path11);
+    if (node) {
+      node.contentHash = hash2;
+    }
+  }
+  getLanguage(path11) {
+    return this.nodes.get(path11)?.language;
+  }
+  getMetadata(path11) {
+    return this.nodes.get(path11)?.metadata;
+  }
+  getStaleReason(path11) {
+    return this.nodes.get(path11)?.staleReason;
+  }
+  getItemType(path11) {
+    return this.nodes.get(path11)?.itemType;
+  }
+  getFolder(path11) {
+    return this.nodes.get(path11)?.folder;
+  }
+  getIsRawApp(path11) {
+    return this.nodes.get(path11)?.isRawApp;
+  }
+  getIsDirectlyStale(path11) {
+    return this.nodes.get(path11)?.isDirectlyStale ?? false;
+  }
+  getOriginalPath(path11) {
+    return this.nodes.get(path11)?.originalPath;
+  }
+  getImports(path11) {
+    return this.nodes.get(path11)?.imports;
+  }
+  isStale(path11) {
+    return this.nodes.get(path11)?.staleReason !== undefined;
+  }
+  propagateStaleness() {
+    const directlyStale = new Set;
+    for (const [path11, node] of this.nodes.entries()) {
+      if (node.isDirectlyStale) {
+        directlyStale.add(path11);
+        node.staleReason = "content changed";
+      }
+    }
+    const allStale = new Set(directlyStale);
+    const queue = [...directlyStale];
+    const visited = new Set;
+    while (queue.length > 0) {
+      const scriptPath = queue.shift();
+      if (visited.has(scriptPath))
+        continue;
+      visited.add(scriptPath);
+      const node = this.nodes.get(scriptPath);
+      if (!node)
+        continue;
+      for (const importer of node.importedBy) {
+        if (!allStale.has(importer)) {
+          allStale.add(importer);
+          queue.push(importer);
+          const importerNode = this.nodes.get(importer);
+          if (importerNode)
+            importerNode.staleReason = `depends on ${scriptPath}`;
+        }
+      }
+    }
+  }
+  traverseTransitive(scriptPath, callback) {
+    const queue = [scriptPath];
+    const visited = new Set;
+    while (queue.length > 0) {
+      const current = queue.shift();
+      if (visited.has(current))
+        continue;
+      visited.add(current);
+      const node = this.nodes.get(current);
+      if (!node)
+        continue;
+      for (const importPath of node.imports) {
+        const importNode = this.nodes.get(importPath);
+        if (importNode) {
+          const stop = callback(importPath, importNode);
+          if (!stop) {
+            queue.push(importPath);
+          }
+        }
+      }
+    }
+  }
+  allPaths() {
+    return this.nodes.keys();
+  }
+  *stalePaths() {
+    for (const [path11, node] of this.nodes.entries()) {
+      if (node.staleReason) {
+        yield path11;
+      }
+    }
+  }
+  has(path11) {
+    return this.nodes.has(path11);
+  }
+  getMismatchedWorkspaceDeps() {
+    const result = {};
+    for (const [path11, node] of this.nodes.entries()) {
+      if (node.itemType === "dependencies" && node.contentHash && node.content !== undefined) {
+        result[path11] = node.content;
+      }
+    }
+    return result;
+  }
+  getTempScriptRefs(scriptPath) {
+    const result = {};
+    this.traverseTransitive(scriptPath, (_path, node) => {
+      if (node.contentHash) {
+        result[_path] = node.contentHash;
+      }
+    });
+    return result;
+  }
+  async persistDepsHashes(depsPaths) {
+    for (const path11 of depsPaths) {
+      const node = this.nodes.get(path11);
+      if (node?.itemType === "dependencies" && node.content !== undefined) {
+        const hash2 = await generateHash(node.content + path11);
+        await updateMetadataGlobalLock(path11, hash2);
+      }
+    }
+  }
+  get size() {
+    return this.nodes.size;
+  }
+}
+var init_dependency_tree = __esm(async () => {
+  init_services_gen();
+  await __promiseAll([
+    init_metadata(),
+    init_utils()
+  ]);
+});
+
+// src/commands/generate-metadata/generate-metadata.ts
+var exports_generate_metadata = {};
+__export(exports_generate_metadata, {
+  rehashOnly: () => rehashOnly,
+  default: () => generate_metadata_default
+});
+import { sep as SEP8 } from "node:path";
+async function walkLocalScripts(codebases, ignore) {
+  const elems = await elementsToMap(await FSFSElement(process.cwd(), codebases, false), (p, isD) => !isD && !exts.some((ext2) => p.endsWith(ext2)) || ignore(p, isD) || isFolderResourcePathAnyFormat(p) || isScriptModulePath(p) && !isModuleEntryPoint(p), false, {});
+  return Object.keys(elems);
+}
+async function walkLocalFlowFolders(ignore) {
+  const elems = await elementsToMap(await FSFSElement(process.cwd(), [], true), (p, isD) => ignore(p, isD) || !isD && !p.endsWith(SEP8 + "flow.yaml") && !p.endsWith(SEP8 + "flow.json"), false, {});
+  return Object.keys(elems).map((x) => x.substring(0, x.lastIndexOf(SEP8)));
+}
+async function walkLocalAppItems(ignore) {
+  const elems = await elementsToMap(await FSFSElement(process.cwd(), [], true), (p, isD) => ignore(p, isD) || !isD && !p.endsWith(SEP8 + "raw_app.yaml") && !p.endsWith(SEP8 + "app.yaml"), false, {});
+  return Object.keys(elems).map((p) => ({
+    folder: p.substring(0, p.lastIndexOf(SEP8)),
+    rawApp: p.endsWith(SEP8 + "raw_app.yaml")
+  }));
+}
+function categorizeLocalFiles(paths) {
+  const scripts = [];
+  const flowFolderSet = new Set;
+  const appPaths = [];
+  for (const p of paths) {
+    if (p.endsWith(SEP8 + "flow.yaml") || p.endsWith(SEP8 + "flow.json")) {
+      flowFolderSet.add(p.substring(0, p.lastIndexOf(SEP8)));
+    } else if (p.endsWith(SEP8 + "raw_app.yaml") || p.endsWith(SEP8 + "app.yaml")) {
+      appPaths.push(p);
+    } else if (exts.some((ext2) => p.endsWith(ext2)) && !isFolderResourcePathAnyFormat(p) && !(isScriptModulePath(p) && !isModuleEntryPoint(p))) {
+      scripts.push(p);
+    }
+  }
+  return { scripts, flowFolders: [...flowFolderSet], appPaths };
+}
+async function rehashOnly(opts, folder, rehashFilter) {
+  const codebases = await listSyncCodebases(opts);
+  const ignore = await ignoreF(opts);
+  const counts = { scripts: 0, flows: 0, apps: 0 };
+  const folderFilter = folder?.replaceAll("\\", "/").replace(/^\.\//, "").replace(/\/$/, "");
+  const inFilter = (p) => {
+    if (!folderFilter)
+      return true;
+    const n = p.replaceAll("\\", "/");
+    return n === folderFilter || n.startsWith(folderFilter + "/");
+  };
+  const conf = rehashFilter?.missingOnly ? await readLockfile() : undefined;
+  const isFlatKeyed = conf?.version === "v2";
+  const hasEntry = (key, subpath) => {
+    if (!conf?.locks)
+      return false;
+    if (isFlatKeyed) {
+      const fullKey = subpath ? `${key}+${subpath}` : key;
+      return conf.locks[fullKey] !== undefined || conf.locks["./" + fullKey] !== undefined;
+    }
+    for (const p of [key, "./" + key]) {
+      const obj = conf.locks[p];
+      if (obj === undefined)
+        continue;
+      if (!subpath)
+        return true;
+      if (typeof obj === "object" && obj?.[subpath] !== undefined)
+        return true;
+    }
+    return false;
+  };
+  const skipIfExisting = (remotePath, subpath) => !!rehashFilter?.missingOnly && hasEntry(remotePath, subpath);
+  let scriptPaths;
+  let flowFolders;
+  let appPaths;
+  if (rehashFilter?.localFiles) {
+    const cat = categorizeLocalFiles(rehashFilter.localFiles);
+    scriptPaths = cat.scripts;
+    flowFolders = cat.flowFolders;
+    appPaths = cat.appPaths.map((p) => ({
+      folder: p.substring(0, p.lastIndexOf(SEP8)),
+      rawApp: p.endsWith(SEP8 + "raw_app.yaml")
+    }));
+  } else {
+    scriptPaths = await walkLocalScripts(codebases, ignore);
+    flowFolders = await walkLocalFlowFolders(ignore);
+    appPaths = await walkLocalAppItems(ignore);
+  }
+  const stubWorkspace = {};
+  const rehashOpts = { ...opts, rehashOnly: true };
+  if (!rehashFilter?.skipScripts) {
+    for (const e of scriptPaths) {
+      const remotePath = scriptPathToRemotePath(e);
+      if (!inFilter(remotePath))
+        continue;
+      if (rehashFilter?.missingOnly) {
+        if (skipIfExisting(remotePath) || skipIfExisting(remotePath, "__script_hash"))
+          continue;
+      }
+      try {
+        await generateScriptMetadataInternal(e, stubWorkspace, rehashOpts, false, true, {}, codebases, false);
+        counts.scripts++;
+      } catch (err) {
+        warn(`Skipping ${e}: ${err instanceof Error ? err.message : err}`);
+      }
+    }
+  }
+  if (!rehashFilter?.skipFlows) {
+    for (const f of flowFolders) {
+      if (!inFilter(f))
+        continue;
+      if (rehashFilter?.missingOnly) {
+        const folderNormalized = f.replaceAll(SEP8, "/");
+        if (skipIfExisting(folderNormalized, "__flow_hash"))
+          continue;
+      }
+      try {
+        await generateFlowLockInternal(f, false, stubWorkspace, rehashOpts, false, true);
+        counts.flows++;
+      } catch (err) {
+        warn(`Skipping ${f}: ${err instanceof Error ? err.message : err}`);
+      }
+    }
+  }
+  if (!rehashFilter?.skipApps) {
+    for (const { folder: appFolder, rawApp } of appPaths) {
+      if (!inFilter(appFolder))
+        continue;
+      if (rehashFilter?.missingOnly) {
+        const folderNormalized = appFolder.replaceAll(SEP8, "/");
+        if (skipIfExisting(folderNormalized, "__app_hash"))
+          continue;
+      }
+      try {
+        await generateAppLocksInternal(appFolder, rawApp, false, stubWorkspace, rehashOpts, false, true);
+        counts.apps++;
+      } catch (err) {
+        warn(`Skipping ${appFolder}: ${err instanceof Error ? err.message : err}`);
+      }
+    }
+  }
+  if (counts.scripts + counts.flows + counts.apps > 0 || !rehashFilter?.missingOnly) {
+    info(`Rehashed ${colors.bold(String(counts.scripts))} script(s), ` + `${colors.bold(String(counts.flows))} flow(s), ` + `${colors.bold(String(counts.apps))} app(s) from disk.`);
+  }
+  return counts;
+}
+async function generateMetadata2(opts, folder) {
+  if (folder === "") {
+    folder = undefined;
+  }
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  opts = await mergeConfigWithConfigFile(opts);
+  const rawWorkspaceDependencies = await getRawWorkspaceDependencies(false);
+  const codebases = await listSyncCodebases(opts);
+  const ignore = await ignoreF(opts);
+  const skipScripts = opts.skipScripts ?? false;
+  const skipFlows = opts.skipFlows ?? opts.schemaOnly ?? false;
+  const skipApps = opts.skipApps ?? opts.schemaOnly ?? false;
+  const checking = [];
+  if (!skipScripts)
+    checking.push("scripts");
+  if (!skipFlows)
+    checking.push("flows");
+  if (!skipApps)
+    checking.push("apps");
+  if (checking.length === 0) {
+    info(colors.yellow("Nothing to check (all types skipped)"));
+    return;
+  }
+  info(`Checking ${checking.join(", ")}...`);
+  const tree = new DoubleLinkedDependencyTree;
+  tree.setWorkspaceDeps(rawWorkspaceDependencies);
+  if (!skipScripts) {
+    for (const e of await walkLocalScripts(codebases, ignore)) {
+      await generateScriptMetadataInternal(e, workspace, opts, true, true, rawWorkspaceDependencies, codebases, false, tree);
+    }
+  }
+  if (!skipFlows) {
+    for (const flowFolder of await walkLocalFlowFolders(ignore)) {
+      await generateFlowLockInternal(flowFolder, true, workspace, opts, false, true, tree);
+    }
+  }
+  if (!skipApps) {
+    for (const { folder: appFolder, rawApp } of await walkLocalAppItems(ignore)) {
+      await generateAppLocksInternal(appFolder, rawApp, true, workspace, opts, false, true, tree);
+    }
+  }
+  tree.propagateStaleness();
+  try {
+    await uploadScripts(tree, workspace);
+  } catch (e) {
+    warn(colors.yellow(`Failed to upload scripts to temp storage (backend may be too old): ${e}. ` + `Locks will be generated using deployed script versions only — locally modified ` + `relative imports may not be reflected.`));
+  }
+  const staleItems = [];
+  const seenFolders = new Set;
+  for (const p of tree.allPaths()) {
+    const staleReason = tree.getStaleReason(p);
+    if (!staleReason)
+      continue;
+    const itemType = tree.getItemType(p);
+    const itemFolder = tree.getFolder(p);
+    if (itemType === "dependencies") {
+      staleItems.push({ type: itemType, path: p, folder: itemFolder, staleReason });
+    } else if (itemType === "inline_script") {
+      continue;
+    } else if (itemType === "script") {
+      const originalPath = tree.getOriginalPath(p);
+      staleItems.push({ type: itemType, path: originalPath, folder: itemFolder, staleReason });
+    } else if (!seenFolders.has(itemFolder)) {
+      seenFolders.add(itemFolder);
+      const originalPath = tree.getOriginalPath(p);
+      staleItems.push({ type: itemType, path: originalPath, folder: itemFolder, isRawApp: tree.getIsRawApp(p), staleReason });
+    }
+  }
+  let filteredItems = staleItems;
+  if (folder) {
+    folder = folder.replaceAll("\\", "/");
+    if (folder.endsWith("/")) {
+      folder = folder.substring(0, folder.length - 1);
+    }
+    const folderNoExt = folder.replace(/\.[^/.]+$/, "");
+    const isInsideFolder = (item) => {
+      const normalizedFolder = item.folder.replaceAll("\\", "/");
+      const normalizedPath = item.path.replaceAll("\\", "/");
+      return normalizedFolder === folder || normalizedFolder.startsWith(folder + "/") || normalizedPath === folder || normalizedPath === folderNoExt;
+    };
+    const isPathInFolder = (p) => p.startsWith(folder + "/") || p === folder || p === folderNoExt;
+    const touchesFolder = (treePath) => {
+      if (isPathInFolder(treePath))
+        return true;
+      let found = false;
+      tree.traverseTransitive(treePath, (importPath) => {
+        if (isPathInFolder(importPath)) {
+          found = true;
+          return true;
+        }
+      });
+      return found;
+    };
+    const isRelevant = (item) => {
+      if (isInsideFolder(item))
+        return true;
+      if (item.type === "dependencies")
+        return true;
+      const treePath = (item.type === "script" ? item.path.replace(/\.[^/.]+$/, "") : item.folder).replaceAll("\\", "/");
+      return touchesFolder(treePath);
+    };
+    if (opts.strictFolderBoundaries) {
+      filteredItems = staleItems.filter(isInsideFolder);
+      const excludedStale = staleItems.filter((item) => !isInsideFolder(item) && isRelevant(item) && item.type !== "dependencies");
+      for (const item of excludedStale) {
+        const normalizedPath = item.path.replaceAll("\\", "/");
+        warn(colors.yellow(`Warning: ${normalizedPath} depends on something inside "${folder}" but is outside it — skipped due to --strict-folder-boundaries. Next generate-metadata will not detect it as stale.`));
+      }
+    } else {
+      filteredItems = staleItems.filter(isRelevant);
+    }
+  }
+  if (filteredItems.length === 0) {
+    info(colors.green("All metadata up-to-date"));
+    return;
+  }
+  const scripts = filteredItems.filter((i) => i.type === "script");
+  const flows = filteredItems.filter((i) => i.type === "flow");
+  const apps2 = filteredItems.filter((i) => i.type === "app");
+  const deps = filteredItems.filter((i) => i.type === "dependencies");
+  info("");
+  info(`Found ${colors.bold(String(filteredItems.length))} item(s) with stale metadata:`);
+  const printItems = (label, items) => {
+    if (items.length === 0)
+      return;
+    info(`  ${label} (${items.length}):`);
+    for (const item of items) {
+      const reason = item.staleReason ? colors.dim(colors.white(` — ${item.staleReason}`)) : "";
+      info(`    ~ ${item.path}` + reason);
+    }
+  };
+  printItems("Workspace dependencies", deps);
+  printItems("Scripts", scripts);
+  printItems("Flows", flows);
+  printItems("Apps", apps2);
+  if (opts.dryRun) {
+    return;
+  }
+  info("");
+  const isInteractive = process.stdin.isTTY ?? false;
+  if (!opts.yes && isInteractive && !await Confirm.prompt({
+    message: "Update metadata?",
+    default: true
+  })) {
+    return;
+  }
+  info("");
+  const mismatchedWorkspaceDeps = tree.getMismatchedWorkspaceDeps();
+  const total = filteredItems.length - deps.length;
+  const maxWidth = `[${total}/${total}]`.length;
+  let current = 0;
+  const formatProgress = (n) => {
+    return colors.dim(colors.white(`[${n}/${total}]`.padEnd(maxWidth, " ")));
+  };
+  const errors = [];
+  for (const item of scripts) {
+    current++;
+    info(`${formatProgress(current)} script ${item.path}`);
+    try {
+      await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, tree);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      error(`  Failed: ${msg}`);
+    }
+  }
+  for (const item of flows) {
+    current++;
+    try {
+      const result = await generateFlowLockInternal(item.folder.replaceAll("/", SEP8), false, workspace, opts, false, true, tree);
+      const flowResult = result;
+      const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
+      info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      info(`${formatProgress(current)} flow   ${item.path}`);
+      error(`  Failed: ${msg}`);
+    }
+  }
+  for (const item of apps2) {
+    current++;
+    try {
+      const result = await generateAppLocksInternal(item.folder.replaceAll("/", SEP8), item.isRawApp, false, workspace, opts, false, true, tree);
+      const appResult = result;
+      const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
+      info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
+    } catch (e) {
+      const msg = e instanceof Error ? e.message : String(e);
+      errors.push({ path: item.path, error: msg });
+      info(`${formatProgress(current)} app    ${item.path}`);
+      error(`  Failed: ${msg}`);
+    }
+  }
+  const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
+  await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+  const succeeded = total - errors.length;
+  info("");
+  if (errors.length > 0) {
+    info(`Done. Updated ${colors.bold(String(succeeded))}/${total} item(s). ${colors.red(String(errors.length) + " failed")}:`);
+    for (const { path: path11, error: error2 } of errors) {
+      error(`  ${path11}: ${error2}`);
+    }
+    process.exitCode = 1;
+  } else {
+    info(`Done. Updated ${colors.bold(String(total))} item(s).`);
+  }
+}
+async function rehashCommand(opts, folder) {
+  if (folder === "")
+    folder = undefined;
+  opts = await mergeConfigWithConfigFile(opts);
+  await rehashOnly(opts, folder, {
+    skipScripts: opts.skipScripts,
+    skipFlows: opts.skipFlows,
+    skipApps: opts.skipApps
+  });
+}
+var command7, generate_metadata_default;
+var init_generate_metadata = __esm(async () => {
+  init_mod3();
+  init_colors2();
+  init_log();
+  await __promiseAll([
+    init_confirm(),
+    init_conf(),
+    init_context(),
+    init_auth(),
+    init_metadata(),
+    init_flow_metadata(),
+    init_app_metadata(),
+    init_sync(),
+    init_script(),
+    init_resource_folders(),
+    init_codebase(),
+    init_dependency_tree()
+  ]);
+  command7 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2).command("rehash", new Command().description("Trust on-disk content; rewrite wmill-lock.yaml hashes without backend " + "trips or yaml/lock rewrites. Useful for bootstrapping missing lockfile " + "entries or recovering from older-CLI hash drift.").arguments("[folder:string]").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(rehashCommand));
+  generate_metadata_default = command7;
+});
+
 // src/commands/sync/sync.ts
 var exports_sync = {};
 __export(exports_sync, {
@@ -64248,7 +64913,7 @@ __export(exports_sync, {
 });
 import { writeFile as writeFile7, readdir as readdir4, stat as stat7, rm, copyFile, mkdir as mkdir5 } from "node:fs/promises";
 import * as path11 from "node:path";
-import { sep as SEP8 } from "node:path";
+import { sep as SEP9 } from "node:path";
 function resolveWsNameFromBranch(opts, branchName) {
   const match2 = findWorkspaceByGitBranch(opts.workspaces, branchName);
   return match2 ? match2[0] : branchName;
@@ -64578,11 +65243,11 @@ function extractInlineScriptsForApps(key, rec, pathAssigner, toId, removeSchema)
         const o = v;
         const name = toId(key ?? "", rec);
         const [basePathO, ext2] = pathAssigner.assignPath(name, o["language"]);
-        const basePath = basePathO.replaceAll(SEP8, "/");
+        const basePath = basePathO.replaceAll(SEP9, "/");
         const r = [];
         if (o["content"]) {
           const content = o["content"];
-          o["content"] = "!inline " + basePath.replaceAll(SEP8, "/") + ext2;
+          o["content"] = "!inline " + basePath.replaceAll(SEP9, "/") + ext2;
           r.push({
             path: basePath + ext2,
             content
@@ -64590,7 +65255,7 @@ function extractInlineScriptsForApps(key, rec, pathAssigner, toId, removeSchema)
         }
         if (o["lock"] && o["lock"] != "") {
           const lock = o["lock"];
-          o["lock"] = "!inline " + basePath.replaceAll(SEP8, "/") + "lock";
+          o["lock"] = "!inline " + basePath.replaceAll(SEP9, "/") + "lock";
           r.push({
             path: basePath + "lock",
             content: lock
@@ -64624,7 +65289,7 @@ function parseFileResourceTypeMap(raw) {
   return { formatExtMap, filesetMap };
 }
 async function findFilesetResourceFile(changePath) {
-  const filesetIdx = changePath.indexOf(".fileset" + SEP8);
+  const filesetIdx = changePath.indexOf(".fileset" + SEP9);
   if (filesetIdx === -1) {
     throw new Error(`Not a fileset resource path: ${changePath}`);
   }
@@ -64724,12 +65389,12 @@ function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, re
             try {
               const assigner = newPathAssigner(defaultTs, { skipInlineScriptSuffix: getNonDottedPaths() });
               const inlineMapping = extractCurrentMapping(flow.value.modules, {}, flow.value.failure_module, flow.value.preprocessor_module);
-              inlineScripts = extractInlineScripts(flow.value.modules, inlineMapping, SEP8, defaultTs, assigner, { skipInlineScriptSuffix: getNonDottedPaths() });
+              inlineScripts = extractInlineScripts(flow.value.modules, inlineMapping, SEP9, defaultTs, assigner, { skipInlineScriptSuffix: getNonDottedPaths() });
               if (flow.value.failure_module) {
-                inlineScripts.push(...extractInlineScripts([flow.value.failure_module], inlineMapping, SEP8, defaultTs, assigner, { skipInlineScriptSuffix: getNonDottedPaths() }));
+                inlineScripts.push(...extractInlineScripts([flow.value.failure_module], inlineMapping, SEP9, defaultTs, assigner, { skipInlineScriptSuffix: getNonDottedPaths() }));
               }
               if (flow.value.preprocessor_module) {
-                inlineScripts.push(...extractInlineScripts([flow.value.preprocessor_module], inlineMapping, SEP8, defaultTs, assigner, { skipInlineScriptSuffix: getNonDottedPaths() }));
+                inlineScripts.push(...extractInlineScripts([flow.value.preprocessor_module], inlineMapping, SEP9, defaultTs, assigner, { skipInlineScriptSuffix: getNonDottedPaths() }));
               }
             } catch (error2) {
               error(`Failed to extract inline scripts for flow at path: ${p}`);
@@ -64939,10 +65604,10 @@ function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, re
             const hasModules = parsed["modules"] && Object.keys(parsed["modules"]).length > 0;
             if (parsed["lock"] && parsed["lock"] != "" && parsed["codebase"] == undefined) {
               if (hasModules) {
-                const scriptBase = removeSuffix(removeSuffix(p.replaceAll(SEP8, "/"), ".json"), ".script");
+                const scriptBase = removeSuffix(removeSuffix(p.replaceAll(SEP9, "/"), ".json"), ".script");
                 parsed["lock"] = "!inline " + scriptBase + getModuleFolderSuffix() + "/script.lock";
               } else {
-                parsed["lock"] = "!inline " + removeSuffix(p.replaceAll(SEP8, "/"), ".json") + ".lock";
+                parsed["lock"] = "!inline " + removeSuffix(p.replaceAll(SEP9, "/"), ".json") + ".lock";
               }
             } else if (parsed["lock"] == "") {
               parsed["lock"] = "";
@@ -64972,9 +65637,9 @@ function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, re
             const formatExtension = resourceTypeToFormatExtension[resourceType];
             const isFileset = resourceTypeToIsFileset[resourceType] ?? false;
             if (isFileset) {
-              parsed["value"] = "!inline_fileset " + removeSuffix(p.replaceAll(SEP8, "/"), ".resource.json") + ".fileset";
+              parsed["value"] = "!inline_fileset " + removeSuffix(p.replaceAll(SEP9, "/"), ".resource.json") + ".fileset";
             } else if (formatExtension) {
-              parsed["value"]["content"] = "!inline " + removeSuffix(p.replaceAll(SEP8, "/"), ".resource.json") + ".resource.file." + formatExtension;
+              parsed["value"]["content"] = "!inline " + removeSuffix(p.replaceAll(SEP9, "/"), ".resource.json") + ".resource.file." + formatExtension;
             }
             return useYaml ? import_yaml11.stringify(parsed, yamlOptions) : JSON.stringify(parsed, null, 2);
           }
@@ -65141,7 +65806,7 @@ function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, re
       }
     };
   }
-  return _internal_folder("." + SEP8, zip);
+  return _internal_folder("." + SEP9, zip);
 }
 async function* readDirRecursiveWithIgnore2(ignore, root) {
   const stack = [
@@ -65160,7 +65825,7 @@ async function* readDirRecursiveWithIgnore2(ignore, root) {
     yield e;
     for await (const e2 of e.c()) {
       if (e2.isDirectory) {
-        const dirName = e2.path.split(SEP8).pop();
+        const dirName = e2.path.split(SEP9).pop();
         if (dirName == "node_modules" || dirName == ".claude" || dirName?.startsWith(".")) {
           continue;
         }
@@ -65183,7 +65848,7 @@ async function elementsToMap(els, ignore, json, skips, specificItems, branchOver
   for await (const entry of readDirRecursiveWithIgnore2(ignore, els)) {
     if (entry.isDirectory) {
       if (!isRemote) {
-        const dirName = entry.path.split(SEP8).pop() ?? "";
+        const dirName = entry.path.split(SEP9).pop() ?? "";
         if (hasWrongFormatSuffix(dirName)) {
           wrongFormatPaths.push(entry.path);
         }
@@ -65228,7 +65893,7 @@ async function elementsToMap(els, ignore, json, skips, specificItems, branchOver
       }
     }
     if (isRawAppFile(path12)) {
-      const suffix = path12.split(getFolderSuffix("raw_app") + SEP8).pop();
+      const suffix = path12.split(getFolderSuffix("raw_app") + SEP9).pop();
       if (suffix?.startsWith("dist/") || suffix == "wmill.d.ts" || suffix == "package-lock.json" || suffix == "DATATABLES.md") {
         continue;
       }
@@ -65499,7 +66164,8 @@ async function compareDynFSElement(els1, els2, ignore, json, skips, ignoreMetada
     }
     return a.path.localeCompare(b.path);
   });
-  return changes;
+  const localMap = isEls1Remote ? m2 : m1;
+  return { changes, localMap };
 }
 function getOrderFromPath(p) {
   const typ = getTypeStrFromPath(p);
@@ -65728,7 +66394,7 @@ async function pull(opts) {
   const zipFile = await downloadZip(workspace, opts.plainSecrets, opts.skipVariables, opts.skipResources, opts.skipResourceTypes, opts.skipSecrets, opts.includeSchedules, opts.includeTriggers, opts.includeUsers, opts.includeGroups, opts.includeSettings, opts.includeKey, opts.skipWorkspaceDependencies, opts.defaultTs);
   const remote = ZipFSElement(zipFile, !opts.json, opts.defaultTs ?? "bun", resourceTypeToFormatExtension, resourceTypeToIsFileset, true, parseSyncBehavior(opts.syncBehavior) >= 1);
   const local = !opts.stateful ? await FSFSElement(process.cwd(), codebases, true) : await FSFSElement(path11.join(process.cwd(), ".wmill"), [], true);
-  const changes = await compareDynFSElement(remote, local, await ignoreF(opts), opts.json ?? false, opts, false, codebases, true, specificItems, wsNameForFiles, true);
+  const { changes, localMap } = await compareDynFSElement(remote, local, await ignoreF(opts), opts.json ?? false, opts, false, codebases, true, specificItems, wsNameForFiles, true);
   info(`remote (${workspace.name}) -> local: ${changes.length} changes to apply`);
   if (opts.dryRun && opts.jsonOutput) {
     const result = {
@@ -65892,6 +66558,31 @@ Done! All ${changes.length} changes applied locally and wmill-lock.yaml updated.
   } else if (opts.jsonOutput) {
     console.log(JSON.stringify({ success: true, message: "No changes to apply", total: 0 }, null, 2));
   }
+  if (!opts.jsonOutput && !opts.dryRun) {
+    try {
+      const { rehashOnly: rehashOnly2 } = await init_generate_metadata().then(() => exports_generate_metadata);
+      const postPullPaths = new Set(Object.keys(localMap));
+      for (const change of changes) {
+        if (change.name === "added")
+          postPullPaths.add(change.path);
+        else if (change.name === "deleted")
+          postPullPaths.delete(change.path);
+      }
+      const filled = await rehashOnly2(opts, undefined, {
+        missingOnly: true,
+        localFiles: postPullPaths
+      });
+      const total = filled.scripts + filled.flows + filled.apps;
+      if (total > 0) {
+        info(colors.gray(`Auto-filled ${total} missing lockfile entr${total === 1 ? "y" : "ies"} (${filled.scripts} script, ${filled.flows} flow, ${filled.apps} app) from disk.`));
+      }
+    } catch (e) {
+      if (e instanceof UnknownLockVersionError || e instanceof MalformedLockfileError) {
+        throw e;
+      }
+      warn(colors.yellow(`Could not auto-fill missing lockfile entries: ${e instanceof Error ? e.message : e}`));
+    }
+  }
   try {
     await pullSharedUi(workspace.workspaceId);
   } catch (e) {
@@ -66020,7 +66711,7 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   } catch {}
   const remote = ZipFSElement(await downloadZip(workspace, opts.plainSecrets, opts.skipVariables, opts.skipResources, opts.skipResourceTypes, opts.skipSecrets, opts.includeSchedules, opts.includeTriggers, opts.includeUsers, opts.includeGroups, opts.includeSettings, opts.includeKey, opts.skipWorkspaceDependencies, opts.defaultTs), !opts.json, opts.defaultTs ?? "bun", resourceTypeToFormatExtension, resourceTypeToIsFileset, false, parseSyncBehavior(opts.syncBehavior) >= 1);
   const local = await FSFSElement(path11.join(process.cwd(), ""), codebases, false);
-  const changes = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, wsNameForFiles, false);
+  const { changes } = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, wsNameForFiles, false);
   const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
   const tracker = await buildTracker(changes);
   const autoRegenerate = !!opts.autoMetadata;
@@ -66127,7 +66818,7 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   if (changes.length > 0) {
     const folderNames = new Set;
     for (const change of changes) {
-      const parts = change.path.split(SEP8);
+      const parts = change.path.split(SEP9);
       if (parts.length >= 3 && parts[0] === "f" && change.name !== "deleted") {
         folderNames.add(parts[1]);
       }
@@ -66160,7 +66851,7 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
     const userIsAdmin = user.is_admin;
     const msg = `${userIsAdmin ? "Warning: " : ""}Missing folder.meta.yaml for:
 ${folderList}
-` + `Run 'wmill folder add-missing' to create them locally, then push again.`;
+Run 'wmill folder add-missing' to create them locally, then push again.`;
     if (!userIsAdmin) {
       if (opts.jsonOutput) {
         console.log(JSON.stringify({ success: false, error: "missing_folders", missing_folders: missingFolders, message: msg }, null, 2));
@@ -66242,7 +66933,7 @@ ${folderList}
       };
       await preCheckPermissionedAs(changes, user.email, userIsAdminOrDeployer, opts.acceptOverridingPermissionedAsWithSelf ?? false, !!process.stdin.isTTY);
     } else if (folderDefaultAnnotations && folderDefaultAnnotations.size > 0) {
-      warn(colors.yellow(`This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, ` + `but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`));
+      warn(colors.yellow(`This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`));
     }
     if (!opts.yes && !await Confirm.prompt({
       message: `Do you want to apply these ${changes.length} changes to the remote?`,
@@ -66273,7 +66964,7 @@ ${folderList}
       parallelizationFactor = 1;
     }
     const allGrouped = Array.from(groupedChanges.entries());
-    const isFolderMetaGroup = ([basePath]) => basePath.endsWith(`${SEP8}folder`) || basePath === "folder";
+    const isFolderMetaGroup = ([basePath]) => basePath.endsWith(`${SEP9}folder`) || basePath === "folder";
     const folderMetaGroups = allGrouped.filter(isFolderMetaGroup);
     const groupedChangesArray = allGrouped.filter((g) => !isFolderMetaGroup(g));
     info(`found changes for ${allGrouped.length} items with a total of ${allGrouped.reduce((acc, [_, changes2]) => acc + changes2.length, 0)} files to process`);
@@ -66289,7 +66980,7 @@ ${folderList}
       while (pool.size < effectiveParallelism() && queue.length > 0) {
         const [groupBasePath, initialChanges] = queue.shift();
         let changes2 = initialChanges;
-        const isFolderGroup = groupBasePath.endsWith(`${SEP8}folder`) || groupBasePath === "folder";
+        const isFolderGroup = groupBasePath.endsWith(`${SEP9}folder`) || groupBasePath === "folder";
         const promise = (async () => {
           const alreadySynced = [];
           const deletedVarsResPaths = [];
@@ -66421,7 +67112,7 @@ ${folderList}
                 info(`Deleting ${typ} ${change.path}`);
               }
               const workspaceId = workspace.workspaceId;
-              const target = change.path.replaceAll(SEP8, "/");
+              const target = change.path.replaceAll(SEP9, "/");
               switch (typ) {
                 case "script": {
                   await archiveScriptByPath({
@@ -66433,7 +67124,7 @@ ${folderList}
                 case "folder":
                   await deleteFolder({
                     workspace: workspaceId,
-                    name: change.path.split(SEP8)[1]
+                    name: change.path.split(SEP9)[1]
                   });
                   break;
                 case "resource": {
@@ -66732,14 +67423,14 @@ Done! All ${changes.length} changes pushed to the remote workspace ${workspace.w
   }
 }
 var import_yaml11, branchDeprecationWarned = false, yamlOptions, isNotWmillFile = (p, isDirectory2) => {
-  if (p.endsWith(SEP8)) {
+  if (p.endsWith(SEP9)) {
     return false;
   }
-  if (p.startsWith("ui" + SEP8)) {
+  if (p.startsWith("ui" + SEP9)) {
     return true;
   }
   if (isDirectory2) {
-    return !p.startsWith("u" + SEP8) && !p.startsWith("f" + SEP8) && !p.startsWith("g" + SEP8) && !p.startsWith("users" + SEP8) && !p.startsWith("groups" + SEP8) && !p.startsWith("dependencies" + SEP8);
+    return !p.startsWith("u" + SEP9) && !p.startsWith("f" + SEP9) && !p.startsWith("g" + SEP9) && !p.startsWith("users" + SEP9) && !p.startsWith("groups" + SEP9) && !p.startsWith("dependencies" + SEP9);
   }
   if (isScriptModulePath(p)) {
     return false;
@@ -66747,16 +67438,16 @@ var import_yaml11, branchDeprecationWarned = false, yamlOptions, isNotWmillFile
   try {
     const typ = getTypeStrFromPath(p);
     if (typ == "resource-type" || typ == "settings" || typ == "encryption_key") {
-      return p.includes(SEP8);
+      return p.includes(SEP9);
     } else {
-      return !p.startsWith("u" + SEP8) && !p.startsWith("f" + SEP8) && !p.startsWith("g" + SEP8) && !p.startsWith("users" + SEP8) && !p.startsWith("groups" + SEP8) && !p.startsWith("dependencies" + SEP8);
+      return !p.startsWith("u" + SEP9) && !p.startsWith("f" + SEP9) && !p.startsWith("g" + SEP9) && !p.startsWith("users" + SEP9) && !p.startsWith("groups" + SEP9) && !p.startsWith("dependencies" + SEP9);
     }
   } catch {
     return true;
   }
 }, isWhitelisted = (p) => {
-  return p == "." + SEP8 || p == "" || p == "u" || p == "f" || p == "g" || p == "ui" || p == "users" || p == "groups" || p == "dependencies";
-}, command7, sync_default;
+  return p == "." + SEP9 || p == "" || p == "u" || p == "f" || p == "g" || p == "ui" || p == "users" || p == "groups" || p == "dependencies";
+}, command8, sync_default;
 var init_sync = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -66798,8 +67489,8 @@ var init_sync = __esm(async () => {
     aliasDuplicateObjects: false,
     singleQuote: true
   };
-  command7 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing").option("--accept-overriding-permissioned-as-with-self", "Accept that items with a different permissioned_as will be updated with your own user").action(push4);
-  sync_default = command7;
+  command8 = new Command().description("sync local with a remote workspaces or the opposite (push or pull)").action(() => info("2 actions available, pull and push. Use -h to display help.")).command("pull").description("Pull any remote changes and apply them locally.").option("--yes", "Pull without needing confirmation").option("--dry-run", "Show changes that would be pulled without actually pushing").option("--plain-secrets", "Pull secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing  schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Overrides wmill.yaml includes").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account. Overrides wmill.yaml excludes").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").action(pull).command("push").description("Push any local changes and apply them remotely.").option("--yes", "Push without needing confirmation").option("--dry-run", "Show changes that would be pushed without actually pushing").option("--plain-secrets", "Push secrets as plain text").option("--json", "Use JSON instead of YAML").option("--skip-variables", "Skip syncing variables (including secrets)").option("--skip-secrets", "Skip syncing only secrets variables").option("--include-secrets", "Include secrets in sync (overrides skipSecrets in wmill.yaml)").option("--skip-resources", "Skip syncing  resources").option("--skip-resource-types", "Skip syncing  resource types").option("--skip-scripts", "Skip syncing scripts").option("--skip-flows", "Skip syncing flows").option("--skip-apps", "Skip syncing apps").option("--skip-folders", "Skip syncing folders").option("--skip-workspace-dependencies", "Skip syncing workspace dependencies").option("--include-schedules", "Include syncing schedules").option("--include-triggers", "Include syncing triggers").option("--include-users", "Include syncing users").option("--include-groups", "Include syncing groups").option("--include-settings", "Include syncing workspace settings").option("--include-key", "Include workspace encryption key").option("--skip-branch-validation", "Skip git branch validation and prompts").option("--json-output", "Output results in JSON format").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").option("--extra-includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string). Useful to still take wmill.yaml into account and act as a second pattern to satisfy").option("--message <message:string>", "Include a message that will be added to all scripts/flows/apps updated during this push").option("--parallel <number>", "Number of changes to process in parallel").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when multiple repositories exist").option("--branch, --env <branch:string>", "[Deprecated: use --workspace] Override the current git branch/environment").option("--lint", "Run lint validation before pushing").option("--locks-required", "Fail if scripts or flow inline scripts that need locks have no locks").option("--auto-metadata", "Automatically regenerate stale metadata (locks and schemas) before pushing").option("--accept-overriding-permissioned-as-with-self", "Accept that items with a different permissioned_as will be updated with your own user").action(push4);
+  sync_default = command8;
 });
 
 // windmill-utils-internal/src/parse/parse-schema.ts
@@ -67004,7 +67695,7 @@ var init_parse_schema = __esm(() => {
 });
 
 // src/utils/metadata.ts
-import { sep as SEP9 } from "node:path";
+import { sep as SEP10 } from "node:path";
 import { writeFile as writeFile8, stat as stat8, rm as rm2, readdir as readdir5 } from "node:fs/promises";
 import { readFileSync as readFileSync2, existsSync as existsSync6, readdirSync, statSync, writeFileSync as writeFileSync5 } from "node:fs";
 import * as path12 from "node:path";
@@ -67098,7 +67789,7 @@ async function blueColor() {
 }
 async function generateScriptMetadataInternal(scriptPath, workspace, opts, dryRun, noStaleMessage, rawWorkspaceDependencies, codebases, justUpdateMetadataLock, tree) {
   const isFolderLayout = isModuleEntryPoint(scriptPath);
-  const remotePath = isFolderLayout ? getScriptBasePathFromModulePath(scriptPath).replaceAll(SEP9, "/") : scriptPath.substring(0, scriptPath.indexOf(".")).replaceAll(SEP9, "/");
+  const remotePath = scriptPathToRemotePath(scriptPath);
   const language = inferContentTypeFromFilePath(scriptPath, opts.defaultTs);
   const metadataWithType = await parseMetadataFile(remotePath, undefined);
   const scriptContent = await readTextFile(scriptPath);
@@ -67113,6 +67804,22 @@ async function generateScriptMetadataInternal(scriptPath, workspace, opts, dryRu
     moduleHashes = await computeModuleHashes(moduleFolderPath, opts.defaultTs, tree ? {} : rawWorkspaceDependencies, isFolderLayout);
   }
   const hasModuleHashes = Object.keys(moduleHashes).length > 0;
+  if (opts.rehashOnly) {
+    if (hasModuleHashes) {
+      const sortedEntries = Object.entries(moduleHashes).sort(([a], [b]) => a.localeCompare(b));
+      const metaHash = await generateHash(hash2 + JSON.stringify(sortedEntries));
+      await clearGlobalLock(remotePath);
+      await updateMetadataGlobalLock(remotePath, metaHash, SCRIPT_TOP_HASH);
+      for (const [modulePath, moduleHash] of Object.entries(moduleHashes)) {
+        await updateMetadataGlobalLock(remotePath, moduleHash, modulePath);
+      }
+    } else {
+      await clearGlobalLock(remotePath);
+      await updateMetadataGlobalLock(remotePath, hash2);
+    }
+    return;
+  }
+  const conf = await readLockfile();
   let checkHash = hash2;
   let checkSubpath;
   if (hasModuleHashes) {
@@ -67120,7 +67827,6 @@ async function generateScriptMetadataInternal(scriptPath, workspace, opts, dryRu
     checkHash = await generateHash(hash2 + JSON.stringify(sortedEntries));
     checkSubpath = SCRIPT_TOP_HASH;
   }
-  const conf = await readLockfile();
   const isDirectlyStale = !await checkifMetadataUptodate(remotePath, checkHash, conf, checkSubpath);
   if (tree) {
     if (dryRun) {
@@ -67183,9 +67889,9 @@ async function generateScriptMetadataInternal(scriptPath, workspace, opts, dryRu
     }
   } else {
     if (isFolderLayout) {
-      metadataParsedContent.lock = "!inline " + remotePath.replaceAll(SEP9, "/") + getModuleFolderSuffix() + "/script.lock";
+      metadataParsedContent.lock = "!inline " + remotePath.replaceAll(SEP10, "/") + getModuleFolderSuffix() + "/script.lock";
     } else {
-      metadataParsedContent.lock = "!inline " + remotePath.replaceAll(SEP9, "/") + ".script.lock";
+      metadataParsedContent.lock = "!inline " + remotePath.replaceAll(SEP10, "/") + ".script.lock";
     }
   }
   let metaPath;
@@ -67372,7 +68078,7 @@ async function updateScriptLock(workspace, scriptContent, language, remotePath,
   const lockPath = lockPathOverride ?? remotePath + ".script.lock";
   if (lock != "") {
     await writeFile8(lockPath, lock, "utf-8");
-    metadataContent.lock = "!inline " + lockPath.replaceAll(SEP9, "/");
+    metadataContent.lock = "!inline " + lockPath.replaceAll(SEP10, "/");
   } else {
     try {
       if (await stat8(lockPath)) {
@@ -67686,22 +68392,29 @@ async function parseMetadataFile(scriptPath, generateMetadataIfMissing) {
   };
 }
 function normalizeLockPath(p) {
-  return p.replace(/\\/g, "/");
+  let n = p.replace(/\\/g, "/");
+  if (n.startsWith("./"))
+    n = n.slice(2);
+  return n;
 }
 async function readLockfile() {
+  let parsed;
   try {
-    const read2 = await yamlParseFile(WMILL_LOCKFILE);
-    if (typeof read2 == "object" && read2 != null) {
-      return read2;
-    } else {
-      throw new Error("Invalid lockfile");
-    }
+    parsed = await yamlParseFile(WMILL_LOCKFILE);
   } catch {
-    const lock = { locks: {}, version: "v2" };
+    const lock = { locks: {}, version: CURRENT_LOCK_VERSION };
     await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(lock, yamlOptions), "utf-8");
     info(colors.green("wmill-lock.yaml created"));
     return lock;
   }
+  if (typeof parsed != "object" || parsed == null) {
+    throw new MalformedLockfileError("wmill-lock.yaml is malformed (expected an object). Refusing to operate to avoid corrupting the lockfile.");
+  }
+  const conf = parsed;
+  if (conf.version != null && !KNOWN_LOCK_VERSIONS.includes(conf.version)) {
+    throw new UnknownLockVersionError(`wmill-lock.yaml is at unknown version "${conf.version}". This was written by a newer wmill CLI; please upgrade with \`wmill upgrade\`. Refusing to operate to avoid corrupting the lockfile.`);
+  }
+  return conf;
 }
 function v2LockPath(path13, subpath) {
   const normalizedPath = normalizeLockPath(path13);
@@ -67718,15 +68431,18 @@ async function checkifMetadataUptodate(path13, hash2, conf, subpath) {
   if (!conf.locks) {
     return false;
   }
-  const isV2 = conf?.version == "v2";
-  if (isV2) {
-    const current = conf.locks?.[v2LockPath(path13, subpath)];
-    return current == hash2;
-  } else {
-    const obj = conf.locks?.[path13];
-    const current = subpath && typeof obj == "object" ? obj?.[subpath] : obj;
-    return current == hash2;
+  const isFlatKeyed = conf?.version === "v2";
+  if (isFlatKeyed) {
+    const key = v2LockPath(path13, subpath);
+    return conf.locks?.[key] === hash2 || conf.locks?.["./" + key] === hash2;
+  }
+  for (const p of [path13, "./" + path13]) {
+    const obj = conf.locks?.[p];
+    const v = subpath && typeof obj == "object" ? obj?.[subpath] : obj;
+    if (v === hash2)
+      return true;
   }
+  return false;
 }
 async function generateScriptHash(rawWorkspaceDependencies, scriptContent, newMetadataContent) {
   return await generateHash(JSON.stringify(rawWorkspaceDependencies) + scriptContent + newMetadataContent);
@@ -67761,15 +68477,16 @@ async function clearGlobalLock(path13) {
   if (!conf?.locks) {
     conf.locks = {};
   }
-  const isV2 = conf?.version == "v2";
-  if (isV2) {
+  const isFlatKeyed = conf?.version === "v2";
+  if (isFlatKeyed) {
     const key = v2LockPath(path13);
+    const legacyKey = "./" + key;
     if (conf.locks) {
       Object.keys(conf.locks).forEach((k) => {
-        if (conf.locks) {
-          if (k.startsWith(key)) {
-            delete conf.locks[k];
-          }
+        if (!conf.locks)
+          return;
+        if (k === key || k.startsWith(key + "+") || k === legacyKey || k.startsWith(legacyKey + "+")) {
+          delete conf.locks[k];
         }
       });
     }
@@ -67781,8 +68498,8 @@ async function updateMetadataGlobalLock(path13, hash2, subpath) {
   if (!conf?.locks) {
     conf.locks = {};
   }
-  const isV2 = conf?.version == "v2";
-  if (isV2) {
+  const isFlatKeyed = conf?.version === "v2";
+  if (isFlatKeyed) {
     conf.locks[v2LockPath(path13, subpath)] = hash2;
   } else {
     if (subpath) {
@@ -67798,7 +68515,7 @@ async function updateMetadataGlobalLock(path13, hash2, subpath) {
   }
   await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(conf, yamlOptions), "utf-8");
 }
-var import_yaml13, _require, _parserCache, LockfileGenerationError, LANG_ANNOTATION_CONFIG, lockCache, WMILL_LOCKFILE = "wmill-lock.yaml", SCRIPT_TOP_HASH = "__script_hash";
+var import_yaml13, _require, _parserCache, LockfileGenerationError, UnknownLockVersionError, MalformedLockfileError, LANG_ANNOTATION_CONFIG, lockCache, WMILL_LOCKFILE = "wmill-lock.yaml", CURRENT_LOCK_VERSION = "v2", KNOWN_LOCK_VERSIONS, SCRIPT_TOP_HASH = "__script_hash";
 var init_metadata = __esm(async () => {
   init_colors2();
   init_log();
@@ -67824,6 +68541,18 @@ var init_metadata = __esm(async () => {
       this.name = "LockfileGenerationError";
     }
   };
+  UnknownLockVersionError = class UnknownLockVersionError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "UnknownLockVersionError";
+    }
+  };
+  MalformedLockfileError = class MalformedLockfileError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "MalformedLockfileError";
+    }
+  };
   LANG_ANNOTATION_CONFIG = {
     python3: { comment: "#", keyword: "requirements", validityRe: /^#\s?(\S+)\s*$/ },
     bun: { comment: "//", keyword: "package_json" },
@@ -67833,6 +68562,7 @@ var init_metadata = __esm(async () => {
     powershell: { comment: "#", keyword: "modules_json" }
   };
   lockCache = new Map;
+  KNOWN_LOCK_VERSIONS = ["v1", "v2"];
 });
 
 // src/commands/app/raw_apps.ts
@@ -67843,7 +68573,7 @@ __export(exports_raw_apps, {
   loadRunnablesFromBackend: () => loadRunnablesFromBackend,
   generatingPolicy: () => generatingPolicy
 });
-import { sep as SEP10 } from "node:path";
+import { sep as SEP11 } from "node:path";
 import path13 from "node:path";
 import { readdir as readdir6 } from "node:fs/promises";
 async function readSiblingLock(backendPath, runnableId, allFiles) {
@@ -67981,7 +68711,7 @@ async function collectAppFiles(localPath) {
         if (entry.name === APP_BACKEND_FOLDER || entry.name === "node_modules" || entry.name === "dist" || entry.name === ".claude" || entry.name === "sql_to_apply") {
           continue;
         }
-        await readDirRecursive2(fullPath + SEP10, relativePath + "/");
+        await readDirRecursive2(fullPath + SEP11, relativePath + "/");
       } else if (entry.isFile()) {
         if (entry.name === "raw_app.yaml" || entry.name === "package-lock.json" || entry.name === "DATATABLES.md" || entry.name === "AGENTS.md" || entry.name === "wmill.d.ts") {
           continue;
@@ -67999,7 +68729,7 @@ async function pushRawApp(workspace, remotePath, localPath, message) {
     return;
   }
   alreadySynced.push(localPath);
-  remotePath = remotePath.replaceAll(SEP10, "/");
+  remotePath = remotePath.replaceAll(SEP11, "/");
   let app = undefined;
   try {
     app = await getAppByPath({
@@ -68013,8 +68743,8 @@ async function pushRawApp(workspace, remotePath, localPath, message) {
   if (app) {
     app.policy = undefined;
   }
-  if (!localPath.endsWith(SEP10)) {
-    localPath += SEP10;
+  if (!localPath.endsWith(SEP11)) {
+    localPath += SEP11;
   }
   const appFilePath = localPath + "raw_app.yaml";
   const localApp = await yamlParseFile(appFilePath);
@@ -68030,7 +68760,7 @@ async function pushRawApp(workspace, remotePath, localPath, message) {
   } else {
     runnables = {};
   }
-  replaceInlineScripts2(runnables, backendPath + SEP10, true);
+  replaceInlineScripts2(runnables, backendPath + SEP11, true);
   repopulateFields(runnables);
   const appForPolicy = { ...localApp, runnables };
   await generatingPolicy(appForPolicy, remotePath, localApp?.["public"] ?? false);
@@ -68142,7 +68872,20 @@ __export(exports_app_metadata, {
 });
 import path14 from "node:path";
 import { mkdir as mkdir6, readdir as readdir7 } from "node:fs/promises";
-import { sep as SEP11 } from "node:path";
+import { sep as SEP12 } from "node:path";
+async function isAppDirectlyStale(appFolder, hashes, conf) {
+  if (await checkifMetadataUptodate(appFolder, hashes[TOP_HASH2], conf, TOP_HASH2)) {
+    return false;
+  }
+  const fileEntries = Object.entries(hashes).filter(([k]) => k !== TOP_HASH2);
+  if (fileEntries.length === 0)
+    return true;
+  for (const [k, h] of fileEntries) {
+    if (!await checkifMetadataUptodate(appFolder, h, conf, k))
+      return true;
+  }
+  return false;
+}
 async function generateAppHash(rawReqs, folder, rawApp, defaultTs) {
   const runnablesFolder = rawApp ? path14.join(folder, APP_BACKEND_FOLDER) : folder;
   const hashes = {};
@@ -68156,7 +68899,7 @@ async function generateAppHash(rawReqs, folder, rawApp, defaultTs) {
         }
       }
       if (exts.some((e) => f.path.endsWith(e))) {
-        const relativePath = normalizeLockPath(f.path.replace(runnablesFolder + SEP11, ""));
+        const relativePath = normalizeLockPath(f.path.replace(runnablesFolder + SEP12, ""));
         hashes[relativePath] = await generateHash(await f.getContentText() + JSON.stringify(rawReqs));
       }
     }
@@ -68172,23 +68915,31 @@ async function generateAppHash(rawReqs, folder, rawApp, defaultTs) {
   return { ...sortedHashes, [TOP_HASH2]: await generateHash(JSON.stringify(sortedHashes)) };
 }
 async function generateAppLocksInternal(appFolder, rawApp, dryRun, workspace, opts, justUpdateMetadataLock, noStaleMessage, tree) {
-  if (appFolder.endsWith(SEP11)) {
+  if (appFolder.endsWith(SEP12)) {
     appFolder = appFolder.substring(0, appFolder.length - 1);
   }
-  const remote_path = appFolder.replaceAll(SEP11, "/");
+  if (opts.rehashOnly) {
+    const hashes = await generateAppHash({}, appFolder, rawApp, opts.defaultTs);
+    await clearGlobalLock(appFolder);
+    for (const [k, v] of Object.entries(hashes)) {
+      await updateMetadataGlobalLock(appFolder, v, k);
+    }
+    return;
+  }
+  const remote_path = appFolder.replaceAll(SEP12, "/");
   if (!justUpdateMetadataLock && !noStaleMessage) {
     info(`Generating locks for app ${appFolder} at ${remote_path}`);
   }
   const appFilePath = path14.join(appFolder, rawApp ? "raw_app.yaml" : "app.yaml");
   const appFile = await yamlParseFile(appFilePath);
   const appValue = rawApp ? appFile.runnables : appFile.value;
-  const folderNormalized = appFolder.replaceAll(SEP11, "/");
+  const folderNormalized = appFolder.replaceAll(SEP12, "/");
   let filteredDeps = {};
   const conf = await readLockfile();
   if (tree) {
     if (dryRun) {
       const hashes = await generateAppHash({}, appFolder, rawApp, opts.defaultTs);
-      const isDirectlyStale = !await checkifMetadataUptodate(appFolder, hashes[TOP_HASH2], conf, TOP_HASH2);
+      const isDirectlyStale = await isAppDirectlyStale(appFolder, hashes, conf);
       let treeAppValue = structuredClone(appValue);
       if (rawApp) {
         const runnablesPath = path14.join(appFolder, APP_BACKEND_FOLDER);
@@ -68204,7 +68955,7 @@ async function generateAppLocksInternal(appFolder, rawApp, dryRun, workspace, op
         }
         let content = inlineScript.content;
         if (typeof content === "string" && content.startsWith("!inline ")) {
-          const filePath = appFolder + SEP11 + content.replace("!inline ", "");
+          const filePath = appFolder + SEP12 + content.replace("!inline ", "");
           try {
             content = await readTextFile(filePath);
           } catch {
@@ -68226,7 +68977,7 @@ async function generateAppLocksInternal(appFolder, rawApp, dryRun, workspace, op
     const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
     filteredDeps = await filterWorkspaceDependenciesForApp(appValue, rawWorkspaceDependencies, appFolder);
     const hashes = await generateAppHash(filteredDeps, appFolder, rawApp, opts.defaultTs);
-    const isDirectlyStale = !await checkifMetadataUptodate(appFolder, hashes[TOP_HASH2], conf, TOP_HASH2);
+    const isDirectlyStale = await isAppDirectlyStale(appFolder, hashes, conf);
     if (!isDirectlyStale) {
       if (!noStaleMessage) {
         info(colors.green(`App ${remote_path} metadata is up-to-date, skipping`));
@@ -68263,11 +69014,11 @@ async function generateAppLocksInternal(appFolder, rawApp, dryRun, workspace, op
         if (Object.keys(runnables).length === 0 && rawAppFile.runnables) {
           runnables = rawAppFile.runnables;
         }
-        replaceInlineScripts2(runnables, runnablesPath + SEP11, false);
+        replaceInlineScripts2(runnables, runnablesPath + SEP12, false);
         updatedScripts = await updateRawAppRunnables(workspace, runnables, remote_path, appFolder, filteredDeps, opts.defaultTs, noStaleMessage, tempScriptRefs);
       } else {
         const normalAppFile = appFile;
-        replaceInlineScripts2(normalAppFile.value, appFolder + SEP11, false);
+        replaceInlineScripts2(normalAppFile.value, appFolder + SEP12, false);
         const result = await updateAppInlineScripts(workspace, normalAppFile.value, remote_path, appFolder, filteredDeps, opts.defaultTs, noStaleMessage, tempScriptRefs);
         normalAppFile.value = result.value;
         updatedScripts = result.updatedScripts;
@@ -68299,7 +69050,7 @@ async function filterWorkspaceDependenciesForApp(appValue, rawWorkspaceDependenc
     }
     return inlineScript;
   });
-  return await filterWorkspaceDependenciesForScripts(scripts, rawWorkspaceDependencies, folder, SEP11);
+  return await filterWorkspaceDependenciesForScripts(scripts, rawWorkspaceDependencies, folder, SEP12);
 }
 async function traverseAndProcessInlineScripts(obj, processor, currentPath = []) {
   if (!obj || typeof obj !== "object") {
@@ -68354,7 +69105,7 @@ async function updateRawAppRunnables(workspace, runnables, remotePath, appFolder
     }
     if (language === "frontend") {
       const [basePathO, ext2] = pathAssigner.assignPath(runnableId, language);
-      const basePath = basePathO.replaceAll(SEP11, "/");
+      const basePath = basePathO.replaceAll(SEP12, "/");
       const contentPath = path14.join(runnablesFolder, `${basePath}${ext2}`);
       writeIfChanged(contentPath, content);
       const simplifiedRunnable = { type: "inline" };
@@ -68372,7 +69123,7 @@ async function updateRawAppRunnables(workspace, runnables, remotePath, appFolder
     try {
       const lock = await generateInlineScriptLock(workspace, content, language, `${remotePath}/${runnableId}`, rawDeps, tempScriptRefs);
       const [basePathO, ext2] = pathAssigner.assignPath(runnableId, language);
-      const basePath = basePathO.replaceAll(SEP11, "/");
+      const basePath = basePathO.replaceAll(SEP12, "/");
       const contentPath = path14.join(runnablesFolder, `${basePath}${ext2}`);
       const lockPath = path14.join(runnablesFolder, `${basePath}lock`);
       writeIfChanged(contentPath, content);
@@ -68421,7 +69172,7 @@ async function updateAppInlineScripts(workspace, appValue, remotePath, appFolder
         lock = await generateInlineScriptLock(workspace, content, language, scriptPath, rawDeps, tempScriptRefs);
       }
       const [basePathO, ext2] = pathAssigner.assignPath(scriptName, language);
-      const basePath = basePathO.replaceAll(SEP11, "/");
+      const basePath = basePathO.replaceAll(SEP12, "/");
       const contentPath = path14.join(appFolder, `${basePath}${ext2}`);
       const lockPath = path14.join(appFolder, `${basePath}lock`);
       writeIfChanged(contentPath, content);
@@ -68550,7 +69301,7 @@ async function inferRunnableSchemaFromFile(appFolder, runnableFilePath, defaultT
     warn(colors.yellow(`Could not read file: ${fullFilePath}`));
     return;
   }
-  const remotePath = appFolder.replaceAll(SEP11, "/");
+  const remotePath = appFolder.replaceAll(SEP12, "/");
   try {
     const schemaResult = await inferSchema(language, content, currentSchema, `${remotePath}/${runnableId}`);
     info(colors.green(`  Inferred schema for ${runnableId}`));
@@ -68586,7 +69337,7 @@ async function inferAllInlineSchemas(appFolder, defaultTs = "bun") {
   return schemas;
 }
 function getAppFolders(elems, extension) {
-  return Object.keys(elems).filter((p) => p.endsWith(SEP11 + extension)).map((p) => p.substring(0, p.length - (SEP11 + extension).length));
+  return Object.keys(elems).filter((p) => p.endsWith(SEP12 + extension)).map((p) => p.substring(0, p.length - (SEP12 + extension).length));
 }
 async function generateLocksCommand(opts, appPath) {
   const { generateAppLocksInternal: generateAppLocksInternal2 } = await init_app_metadata().then(() => exports_app_metadata);
@@ -68604,7 +69355,7 @@ async function generateLocksCommand(opts, appPath) {
   } else {
     const ignore = await ignoreF2(opts);
     const elems = await elementsToMap2(await FSFSElement2(process.cwd(), [], true), (p, isD) => {
-      return ignore(p, isD) || !isD && !p.endsWith(SEP11 + "raw_app.yaml") && !p.endsWith(SEP11 + "app.yaml");
+      return ignore(p, isD) || !isD && !p.endsWith(SEP12 + "raw_app.yaml") && !p.endsWith(SEP12 + "app.yaml");
     }, false, {});
     const rawAppFolders = getAppFolders(elems, "raw_app.yaml");
     const appFolders = getAppFolders(elems, "app.yaml");
@@ -68846,7 +69597,7 @@ async function generateAgents(opts, appFolder) {
   await requireLogin(opts);
   await regenerateAgentDocs(workspace.workspaceId, targetDir);
 }
-var command8, generate_agents_default;
+var command9, generate_agents_default;
 var init_generate_agents = __esm(async () => {
   init_mod3();
   init_colors2();
@@ -68859,12 +69610,12 @@ var init_generate_agents = __esm(async () => {
     init_sync(),
     init_resource_folders()
   ]);
-  command8 = new Command().description("regenerate AGENTS.md and DATATABLES.md from remote workspace").arguments("[app_folder:string]").action(generateAgents);
-  generate_agents_default = command8;
+  command9 = new Command().description("regenerate AGENTS.md and DATATABLES.md from remote workspace").arguments("[app_folder:string]").action(generateAgents);
+  generate_agents_default = command9;
 });
 
 // src/commands/app/dev.ts
-import { sep as SEP12 } from "node:path";
+import { sep as SEP13 } from "node:path";
 import * as http2 from "node:http";
 import * as fs11 from "node:fs";
 import * as path16 from "node:path";
@@ -69555,7 +70306,7 @@ async function loadRunnables() {
       runnables = rawApp?.runnables ?? {};
     }
     convertRunnablesToApiFormat(runnables);
-    replaceInlineScripts2(runnables, backendPath + SEP12, true);
+    replaceInlineScripts2(runnables, backendPath + SEP13, true);
     repopulateFields(runnables);
     return runnables;
   } catch (error2) {
@@ -70007,7 +70758,7 @@ var DEFAULT_PORT = 4000, DEFAULT_HOST = "localhost", createHTML = (jsPath, cssPa
   </script>
 </body>
 </html>
-`, command9, dev_default, ITERATIONS_BEFORE_SLOW_REFRESH = 10, ITERATIONS_BEFORE_SUPER_SLOW_REFRESH = 100, QUEUE_LOG_INTERVAL_MS2 = 5000;
+`, command10, dev_default, ITERATIONS_BEFORE_SLOW_REFRESH = 10, ITERATIONS_BEFORE_SUPER_SLOW_REFRESH = 100, QUEUE_LOG_INTERVAL_MS2 = 5000;
 var init_dev = __esm(async () => {
   init_mod3();
   init_colors2();
@@ -70032,10 +70783,10 @@ var init_dev = __esm(async () => {
     init_generate_agents(),
     init_resource_folders()
   ]);
-  command9 = new Command().description("Start a development server for building apps with live reload and hot module replacement").arguments("[app_folder:string]").option("--port <port:number>", "Port to run the dev server on (will find next available port if occupied)").option("--host <host:string>", "Host to bind the dev server to", {
+  command10 = new Command().description("Start a development server for building apps with live reload and hot module replacement").arguments("[app_folder:string]").option("--port <port:number>", "Port to run the dev server on (will find next available port if occupied)").option("--host <host:string>", "Host to bind the dev server to", {
     default: DEFAULT_HOST
   }).option("--entry <entry:string>", "Entry point file (default: index.ts for Svelte/Vue, index.tsx otherwise)").option("--no-open", "Don't automatically open the browser").action(dev);
-  dev_default = command9;
+  dev_default = command10;
 });
 
 // src/commands/app/lint.ts
@@ -70164,7 +70915,7 @@ async function lint2(opts, appFolder) {
 ✅ All checks passed
 `));
 }
-var command10, lint_default2;
+var command11, lint_default2;
 var init_lint2 = __esm(async () => {
   init_mod3();
   init_colors2();
@@ -70176,8 +70927,8 @@ var init_lint2 = __esm(async () => {
     init_raw_apps(),
     init_resource_folders()
   ]);
-  command10 = new Command().description("Lint a raw app folder to validate structure and buildability").arguments("[app_folder:string]").option("--fix", "Attempt to fix common issues (not implemented yet)").action(lint2);
-  lint_default2 = command10;
+  command11 = new Command().description("Lint a raw app folder to validate structure and buildability").arguments("[app_folder:string]").option("--fix", "Attempt to fix common issues (not implemented yet)").action(lint2);
+  lint_default2 = command11;
 });
 
 // src/commands/app/new.ts
@@ -70713,7 +71464,7 @@ createApp(App).mount('#root')`, indexCss = `body {
 .myclass {
     border: 1px solid gray;
     padding: 2px;
-}`, templates, command11, new_default;
+}`, templates, command12, new_default;
 var init_new = __esm(async () => {
   init_mod3();
   init_colors2();
@@ -70798,12 +71549,12 @@ var init_new = __esm(async () => {
       }
     }
   };
-  command11 = new Command().description("create a new raw app from a template").option("--summary <summary:string>", "App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.").option("--path <path:string>", "App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.").option("--framework <framework:string>", "Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.").option("--datatable <datatable:string>", "Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.").option("--schema <schema:string>", "Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.").option("--overwrite", "Overwrite the target directory if it already exists, without prompting.").option("--no-open-in-desktop", "Do not prompt to open the new app in Claude Desktop.").action(newApp);
-  new_default = command11;
+  command12 = new Command().description("create a new raw app from a template").option("--summary <summary:string>", "App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.").option("--path <path:string>", "App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.").option("--framework <framework:string>", "Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.").option("--datatable <datatable:string>", "Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.").option("--schema <schema:string>", "Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.").option("--overwrite", "Overwrite the target directory if it already exists, without prompting.").option("--no-open-in-desktop", "Do not prompt to open the new app in Claude Desktop.").action(newApp);
+  new_default = command12;
 });
 
 // src/commands/app/app.ts
-import { sep as SEP13 } from "node:path";
+import { sep as SEP14 } from "node:path";
 import { stat as stat10 } from "node:fs/promises";
 function respecializeFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
@@ -70877,7 +71628,7 @@ async function pushApp(workspace, remotePath, localPath, message, permissionedAs
     return;
   }
   alreadySynced2.push(localPath);
-  remotePath = remotePath.replaceAll(SEP13, "/");
+  remotePath = remotePath.replaceAll(SEP14, "/");
   let app = undefined;
   try {
     app = await getAppByPath({
@@ -70897,8 +71648,8 @@ async function pushApp(workspace, remotePath, localPath, message, permissionedAs
   if (app) {
     app.policy = undefined;
   }
-  if (!localPath.endsWith(SEP13)) {
-    localPath += SEP13;
+  if (!localPath.endsWith(SEP14)) {
+    localPath += SEP14;
   }
   const path19 = localPath + "app.yaml";
   const localApp = await yamlParseFile(path19);
@@ -70999,12 +71750,12 @@ async function push5(opts, filePath, remotePath) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const normalizedPath = filePath.endsWith(SEP13) ? filePath.slice(0, -1) : filePath;
+  const normalizedPath = filePath.endsWith(SEP14) ? filePath.slice(0, -1) : filePath;
   const isRawApp = normalizedPath.endsWith("__raw_app") || normalizedPath.endsWith(".raw_app");
   let hasRawAppYaml = false;
   if (!isRawApp) {
     try {
-      const rawAppPath = (filePath.endsWith(SEP13) ? filePath : filePath + SEP13) + "raw_app.yaml";
+      const rawAppPath = (filePath.endsWith(SEP14) ? filePath : filePath + SEP14) + "raw_app.yaml";
       await stat10(rawAppPath);
       hasRawAppYaml = true;
     } catch {}
@@ -71018,7 +71769,7 @@ async function push5(opts, filePath, remotePath) {
     info(colors.bold.underline.green("App pushed"));
   }
 }
-var alreadySynced2, command12, app_default;
+var alreadySynced2, command13, app_default;
 var init_app = __esm(async () => {
   init_mod3();
   init_mod6();
@@ -71039,7 +71790,7 @@ var init_app = __esm(async () => {
     init_generate_agents()
   ]);
   alreadySynced2 = [];
-  command12 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("push", "push a local app ").arguments("<file_path:string> <remote_path:string>").action(push5).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", 'DEPRECATED: re-generate app lockfiles. Use "wmill generate-metadata" instead.').arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
+  command13 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("push", "push a local app ").arguments("<file_path:string> <remote_path:string>").action(push5).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", 'DEPRECATED: re-generate app lockfiles. Use "wmill generate-metadata" instead.').arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
     warn(colors.yellow('This command is deprecated. Use "wmill generate-metadata" instead.'));
     const { generateLocksCommand: generateLocksCommand2 } = await init_app_metadata().then(() => exports_app_metadata);
     await generateLocksCommand2(opts, appFolder);
@@ -71069,12 +71820,12 @@ var init_app = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for app ${appPath} to ${email}`));
   });
-  app_default = command12;
+  app_default = command13;
 });
 
 // src/commands/folder/folder.ts
 import { stat as stat11, readdir as readdir8, writeFile as writeFile11, mkdir as mkdir8 } from "node:fs/promises";
-import { sep as SEP14 } from "node:path";
+import { sep as SEP15 } from "node:path";
 async function list7(opts) {
   if (opts.json)
     setSilent(true);
@@ -71094,8 +71845,8 @@ async function list7(opts) {
   }
 }
 async function newFolder(opts, name) {
-  const dirPath = `f${SEP14}${name}`;
-  const filePath = `${dirPath}${SEP14}folder.meta.yaml`;
+  const dirPath = `f${SEP15}${name}`;
+  const filePath = `${dirPath}${SEP15}folder.meta.yaml`;
   try {
     await stat11(filePath);
     throw new Error("File already exists: " + filePath);
@@ -71133,13 +71884,13 @@ async function get5(opts, name) {
   }
 }
 async function pushFolder(workspace, name, folder, localFolder) {
-  if (name.startsWith(SEP14)) {
+  if (name.startsWith(SEP15)) {
     name = name.substring(1);
   }
-  if (name.startsWith("f" + SEP14)) {
+  if (name.startsWith("f" + SEP15)) {
     name = name.substring(2);
   }
-  name = name.split(SEP14)[0];
+  name = name.split(SEP15)[0];
   debug(`Processing local folder ${name}`);
   try {
     folder = await getFolder({ workspace, name });
@@ -71183,7 +71934,7 @@ async function pushFolder(workspace, name, folder, localFolder) {
 async function push6(opts, name) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const metaPath = `f${SEP14}${name}${SEP14}folder.meta.yaml`;
+  const metaPath = `f${SEP15}${name}${SEP15}folder.meta.yaml`;
   try {
     await stat11(metaPath);
   } catch {
@@ -71206,7 +71957,7 @@ async function addMissing(opts) {
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const metaPath = `${fDir}${SEP14}${entry.name}${SEP14}folder.meta.yaml`;
+    const metaPath = `${fDir}${SEP15}${entry.name}${SEP15}folder.meta.yaml`;
     try {
       await stat11(metaPath);
     } catch {
@@ -71233,7 +71984,7 @@ async function addMissing(opts) {
   info(`
 Created ${missing.length} folder.meta.yaml file(s). You can now run 'wmill sync push' to push them.`);
 }
-var import_yaml24, command13, folder_default;
+var import_yaml24, command14, folder_default;
 var init_folder = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -71247,7 +71998,7 @@ var init_folder = __esm(async () => {
     init_types()
   ]);
   import_yaml24 = __toESM(require_dist(), 1);
-  command13 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push6).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing).command("show-rules", "Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.").arguments("<name:string>").option("--test-path <path:string>", "Test which rule matches this item path (e.g. f/prod/jobs/my_script)").option("--json", "Output as JSON").action(async (opts, folderName2) => {
+  command14 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push6).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing).command("show-rules", "Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.").arguments("<name:string>").option("--test-path <path:string>", "Test which rule matches this item path (e.g. f/prod/jobs/my_script)").option("--json", "Output as JSON").action(async (opts, folderName2) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const folder = await getFolder({
@@ -71295,13 +72046,13 @@ var init_folder = __esm(async () => {
       info(colors.yellow(`No rule matches path '${testPath}' (relative: '${relative7}')`));
     }
   });
-  folder_default = command13;
+  folder_default = command14;
 });
 
 // src/commands/variable/variable.ts
 import { mkdir as mkdir9, stat as stat12, writeFile as writeFile12 } from "node:fs/promises";
 import { dirname as dirname14 } from "node:path";
-import { sep as SEP15 } from "node:path";
+import { sep as SEP16 } from "node:path";
 async function list8(opts) {
   if (opts.json)
     setSilent(true);
@@ -71370,7 +72121,7 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
   try {
     variable = await getVariable({
       workspace,
-      path: remotePath.replaceAll(SEP15, "/"),
+      path: remotePath.replaceAll(SEP16, "/"),
       decryptSecret: plainSecrets,
       includeEncrypted: true
     });
@@ -71386,7 +72137,7 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
     debug(`Variable ${remotePath} is not up-to-date, updating`);
     await updateVariable({
       workspace,
-      path: remotePath.replaceAll(SEP15, "/"),
+      path: remotePath.replaceAll(SEP16, "/"),
       alreadyEncrypted: !plainSecrets,
       requestBody: {
         ...localVariable,
@@ -71399,7 +72150,7 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
       workspace,
       alreadyEncrypted: !plainSecrets,
       requestBody: {
-        path: remotePath.replaceAll(SEP15, "/"),
+        path: remotePath.replaceAll(SEP16, "/"),
         ...localVariable
       }
     });
@@ -71445,7 +72196,7 @@ async function add2(opts, value, remotePath) {
   }, true);
   info(colors.bold.underline.green(`Variable ${remotePath} pushed`));
 }
-var import_yaml25, command14, variable_default;
+var import_yaml25, command15, variable_default;
 var init_variable = __esm(async () => {
   init_mod3();
   init_mod6();
@@ -71459,14 +72210,14 @@ var init_variable = __esm(async () => {
     init_confirm()
   ]);
   import_yaml25 = __toESM(require_dist(), 1);
-  command14 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --plain-secrets instead").action(add2);
-  variable_default = command14;
+  command15 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --plain-secrets instead").action(add2);
+  variable_default = command15;
 });
 
 // src/commands/schedule/schedule.ts
 import { mkdir as mkdir10, stat as stat13, writeFile as writeFile13 } from "node:fs/promises";
 import { dirname as dirname15 } from "node:path";
-import { sep as SEP16 } from "node:path";
+import { sep as SEP17 } from "node:path";
 async function list9(opts) {
   if (opts.json)
     setSilent(true);
@@ -71530,7 +72281,7 @@ async function get7(opts, path19) {
   }
 }
 async function pushSchedule(workspace, path19, schedule, localSchedule, permissionedAsContext) {
-  path19 = removeType(path19, "schedule").replaceAll(SEP16, "/");
+  path19 = removeType(path19, "schedule").replaceAll(SEP17, "/");
   debug(`Processing local schedule ${path19}`);
   try {
     schedule = await getSchedule({ workspace, path: path19 });
@@ -71632,7 +72383,7 @@ async function push8(opts, filePath, remotePath) {
   await pushSchedule(workspace.workspaceId, remotePath, undefined, parseFromFile(filePath));
   console.log(colors.bold.underline.green("Schedule pushed"));
 }
-var import_yaml26, command15, schedule_default;
+var import_yaml26, command16, schedule_default;
 var init_schedule = __esm(async () => {
   init_mod3();
   init_mod6();
@@ -71647,7 +72398,7 @@ var init_schedule = __esm(async () => {
     init_types()
   ]);
   import_yaml26 = __toESM(require_dist(), 1);
-  command15 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list9).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list9).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8).command("enable", "Enable a schedule").arguments("<path:string>").action(enable).command("disable", "Disable a schedule").arguments("<path:string>").action(disable).command("set-permissioned-as", "Set the email (run-as user) for a schedule (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, schedulePath, email) => {
+  command16 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list9).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list9).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8).command("enable", "Enable a schedule").arguments("<path:string>").action(enable).command("disable", "Disable a schedule").arguments("<path:string>").action(disable).command("set-permissioned-as", "Set the email (run-as user) for a schedule (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, schedulePath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const cache3 = new Map;
@@ -71669,7 +72420,7 @@ var init_schedule = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for schedule ${schedulePath} to ${email} (username: ${username})`));
   });
-  schedule_default = command15;
+  schedule_default = command16;
 });
 
 // src/commands/instance/slack.ts
@@ -72763,7 +73514,7 @@ async function whoami3(opts) {
     error(colors.red(`Failed to retrieve whoami information: ${error2.message}`));
   }
 }
-var import_yaml29, command16, instance_default;
+var import_yaml29, command17, instance_default;
 var init_instance = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -72788,7 +73539,7 @@ var init_instance = __esm(async () => {
     init_workspace()
   ]);
   import_yaml29 = __toESM(require_dist(), 1);
-  command16 = new Command().description("sync local with a remote instance or the opposite (push or pull)").action(async () => {
+  command17 = new Command().description("sync local with a remote instance or the opposite (push or pull)").action(async () => {
     info("4 actions available, add, remove, switch, pull and push. Use -h to display help.");
     const activeInstance = await getActiveInstance({});
     new Table2().header(["name", "remote", "token"]).padding(2).border(true).body((await allInstances()).map((x) => [
@@ -72814,7 +73565,7 @@ var init_instance = __esm(async () => {
     await removeInstance(choice);
     info(colors.green.underline(`Removed instance ${choice}`));
   }).command("switch").complete("instance", async () => (await allInstances()).map((x) => x.name)).arguments("<instance:string:instance>").description("Switch the current instance").action(switchI).command("pull").description("Pull instance settings, users, configs, instance groups and overwrite local").option("--yes", "Pull without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pulling users").option("--skip-settings", "Skip pulling settings").option("--skip-configs", "Skip pulling configs (worker groups)").option("--skip-groups", "Skip pulling instance groups").option("--include-workspaces", "Also pull workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to pull from, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePull).command("push").description("Push instance settings, users, configs, group and overwrite remote").option("--yes", "Push without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pushing users").option("--skip-settings", "Skip pushing settings").option("--skip-configs", "Skip pushing configs (worker groups)").option("--skip-groups", "Skip pushing instance groups").option("--include-workspaces", "Also push workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to push to, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces folders to push").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePush).command("whoami").description("Display information about the currently logged-in user").action(whoami3).command("get-config").description("Dump the current instance config (global settings + worker configs) as YAML").option("-o, --output-file <file:string>", "Write YAML to a file instead of stdout").option("--show-secrets", "Include sensitive fields (license key, JWT secret) without prompting").option("--instance <instance:string>", "Name of the instance, override the active instance").action(getConfig2).command("connect-slack").description("Non-interactively connect Slack at the instance level using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: global_settings 'slack' row + encrypted f/slack_bot/global_bot_token variable and resource in the admins workspace.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).option("--instance <instance:string>", "Instance profile to connect against (defaults to the active instance)").action((opts) => connectSlackInstance2(opts));
-  instance_default = command16;
+  instance_default = command17;
 });
 
 // src/commands/user/user.ts
@@ -73169,7 +73920,7 @@ async function pushInstanceGroups(opts, preview2 = false) {
     info(colors.green("Groups pushed to the instance"));
   }
 }
-var import_yaml31, INSTANCE_USERS_PATH = "instance_users.yaml", instanceUsersPath, INSTANCE_GROUPS_PATH = "instance_groups.yaml", instanceGroupsPath, command17, user_default;
+var import_yaml31, INSTANCE_USERS_PATH = "instance_users.yaml", instanceUsersPath, INSTANCE_GROUPS_PATH = "instance_groups.yaml", instanceGroupsPath, command18, user_default;
 var init_user = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -73185,12 +73936,12 @@ var init_user = __esm(async () => {
   import_yaml31 = __toESM(require_dist(), 1);
   instanceUsersPath = INSTANCE_USERS_PATH;
   instanceGroupsPath = INSTANCE_GROUPS_PATH;
-  command17 = new Command().description("user related commands").action(list10).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token", "Create a new API token for the authenticated user").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
+  command18 = new Command().description("user related commands").action(list10).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token", "Create a new API token for the authenticated user").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["password"]
   }).option("--password <password:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["email"]
   }).action(createToken2);
-  user_default = command17;
+  user_default = command18;
 });
 
 // src/commands/dependencies/dependencies.ts
@@ -73239,7 +73990,7 @@ async function pushWorkspaceDependencies(workspace, path20, _befObj, newDependen
   });
   info(colors.green(`Successfully pushed ${displayName} for ${language}`));
 }
-var command18, dependencies_default;
+var command19, dependencies_default;
 var init_dependencies = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -73251,14 +74002,14 @@ var init_dependencies = __esm(async () => {
     init_metadata(),
     init_utils()
   ]);
-  command18 = new Command().alias("deps").description("workspace dependencies related commands").command("push", "Push workspace dependencies from a local file").arguments("<file_path:string>").action(push9);
-  dependencies_default = command18;
+  command19 = new Command().alias("deps").description("workspace dependencies related commands").command("push", "Push workspace dependencies from a local file").arguments("<file_path:string>").action(push9);
+  dependencies_default = command19;
 });
 
 // src/commands/trigger/trigger.ts
 import { mkdir as mkdir12, stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
 import { dirname as dirname16 } from "node:path";
-import { sep as SEP17 } from "node:path";
+import { sep as SEP18 } from "node:path";
 async function getTrigger(triggerType, workspace, path20) {
   const triggerFunctions = {
     http: getHttpTrigger,
@@ -73309,7 +74060,7 @@ async function createTrigger(triggerType, workspace, path20, trigger) {
   await triggerFunction({ workspace, path: path20, requestBody: trigger });
 }
 async function pushTrigger(triggerType, workspace, path20, trigger, localTrigger, permissionedAsContext) {
-  path20 = removeType(path20, triggerType + "_trigger").replaceAll(SEP17, "/");
+  path20 = removeType(path20, triggerType + "_trigger").replaceAll(SEP18, "/");
   debug(`Processing local ${triggerType} trigger ${path20}`);
   try {
     trigger = await getTrigger(triggerType, workspace, path20);
@@ -73615,7 +74366,7 @@ async function push10(opts, filePath, remotePath) {
   await pushTrigger(triggerKind, workspace.workspaceId, remotePath, undefined, parseFromFile(filePath));
   console.log(colors.bold.underline.green("Trigger pushed"));
 }
-var import_yaml33, triggerTemplates, TRIGGER_SKIP_FIELDS, command19, trigger_default;
+var import_yaml33, triggerTemplates, TRIGGER_SKIP_FIELDS, command20, trigger_default;
 var init_trigger = __esm(async () => {
   init_services_gen();
   init_mod3();
@@ -73721,7 +74472,7 @@ var init_trigger = __esm(async () => {
     }
   };
   TRIGGER_SKIP_FIELDS = new Set(["workspace_id", "extra_perms", "edited_by", "edited_at"]);
-  command19 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10).command("set-permissioned-as", "Set the email (run-as user) for a trigger (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)").action(async (opts, triggerPath, email) => {
+  command20 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10).command("set-permissioned-as", "Set the email (run-as user) for a trigger (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, sqs, gcp, azure, email)").action(async (opts, triggerPath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     if (!opts.kind) {
@@ -73744,12 +74495,12 @@ var init_trigger = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for ${opts.kind} trigger ${triggerPath} to ${email} (username: ${username})`));
   });
-  trigger_default = command19;
+  trigger_default = command20;
 });
 
 // src/types.ts
 import * as path20 from "node:path";
-import { sep as SEP18 } from "node:path";
+import { sep as SEP19 } from "node:path";
 function isSuperset(subset, superset) {
   return Object.keys(subset).every((key) => {
     const eq = deepEqual(subset[key], superset[key]);
@@ -73893,7 +74644,7 @@ function getTypeStrFromPath(p) {
   if (isRawAppPath(p)) {
     return "raw_app";
   }
-  if (p.startsWith("dependencies" + SEP18)) {
+  if (p.startsWith("dependencies" + SEP19)) {
     return "workspace_dependencies";
   }
   if (isFileResource(p) || isFilesetResource(p)) {
@@ -73923,7 +74674,7 @@ function getTypeStrFromPath(p) {
   }
 }
 function removeType(str, type) {
-  const normalizedStr = path20.normalize(str).replaceAll(SEP18, "/");
+  const normalizedStr = path20.normalize(str).replaceAll(SEP19, "/");
   if (normalizedStr.endsWith("." + type + ".yaml") || normalizedStr.endsWith("." + type + ".json")) {
     return normalizedStr.slice(0, normalizedStr.length - type.length - 6);
   }
@@ -73933,7 +74684,7 @@ function removeType(str, type) {
   return normalizedStr;
 }
 function extractNativeTriggerInfo(p) {
-  const normalizedPath = path20.normalize(p).replaceAll(SEP18, "/");
+  const normalizedPath = path20.normalize(p).replaceAll(SEP19, "/");
   const withoutExt = normalizedPath.replace(/\.(json|yaml)$/, "");
   const match2 = withoutExt.match(/^(.+)\.(flow|script)\.([^.]+)\.(\w+)_native_trigger$/);
   if (!match2) {
@@ -73947,8 +74698,8 @@ function extractNativeTriggerInfo(p) {
   };
 }
 function removePathPrefix(str, prefix) {
-  const normalizedStr = path20.normalize(str).replaceAll(SEP18, "/");
-  const normalizedPrefix = path20.normalize(prefix).replaceAll(SEP18, "/");
+  const normalizedStr = path20.normalize(str).replaceAll(SEP19, "/");
+  const normalizedPrefix = path20.normalize(prefix).replaceAll(SEP19, "/");
   if (normalizedStr === normalizedPrefix) {
     return "";
   }
@@ -74120,7 +74871,7 @@ var init_local_path_scripts = __esm(async () => {
 });
 
 // src/commands/flow/flow.ts
-import { sep as SEP19 } from "node:path";
+import { sep as SEP20 } from "node:path";
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync7 } from "node:fs";
 function normalizeOptionalString(value) {
   return typeof value === "string" && value.trim() === "" ? undefined : value ?? undefined;
@@ -74181,7 +74932,7 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
     return;
   }
   alreadySynced3.push(localPath);
-  remotePath = remotePath.replaceAll(SEP19, "/");
+  remotePath = remotePath.replaceAll(SEP20, "/");
   let flow = undefined;
   try {
     flow = await getFlowByPath({
@@ -74189,18 +74940,18 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
       path: remotePath
     });
   } catch {}
-  if (!localPath.endsWith(SEP19)) {
-    localPath += SEP19;
+  if (!localPath.endsWith(SEP20)) {
+    localPath += SEP20;
   }
   const localFlow = await yamlParseFile(localPath + "flow.yaml");
   const fileReader = async (path21) => await readTextFile(localPath + path21);
   const missingFiles = [];
-  await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, localPath, SEP19, undefined, missingFiles);
+  await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, localPath, SEP20, undefined, missingFiles);
   if (localFlow.value.failure_module) {
-    await replaceInlineScripts([localFlow.value.failure_module], fileReader, exports_log, localPath, SEP19, undefined, missingFiles);
+    await replaceInlineScripts([localFlow.value.failure_module], fileReader, exports_log, localPath, SEP20, undefined, missingFiles);
   }
   if (localFlow.value.preprocessor_module) {
-    await replaceInlineScripts([localFlow.value.preprocessor_module], fileReader, exports_log, localPath, SEP19, undefined, missingFiles);
+    await replaceInlineScripts([localFlow.value.preprocessor_module], fileReader, exports_log, localPath, SEP20, undefined, missingFiles);
   }
   if (missingFiles.length > 0) {
     warn(colors.yellow(`Warning: missing inline script file(s): ${missingFiles.join(", ")}. ` + `The flow will be pushed with unresolved !inline references.`));
@@ -74223,9 +74974,9 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
     info(colors.bold.yellow(`Updating flow ${remotePath}...`));
     await updateFlow({
       workspace,
-      path: remotePath.replaceAll(SEP19, "/"),
+      path: remotePath.replaceAll(SEP20, "/"),
       requestBody: {
-        path: remotePath.replaceAll(SEP19, "/"),
+        path: remotePath.replaceAll(SEP20, "/"),
         deployment_message: message,
         ...localFlow,
         ...preserveFields
@@ -74237,7 +74988,7 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
       await createFlow({
         workspace,
         requestBody: {
-          path: remotePath.replaceAll(SEP19, "/"),
+          path: remotePath.replaceAll(SEP20, "/"),
           deployment_message: message,
           ...localFlow,
           ...preserveFields
@@ -74486,25 +75237,25 @@ async function preview2(opts, flowPath) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const codebases = useLocalPathScripts ? listSyncCodebases(opts) : [];
-  const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP19) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP19);
+  const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP20) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP20);
   if (!isFlowDir) {
     if (flowPath.endsWith("flow.yaml") || flowPath.endsWith("flow.json")) {
-      flowPath = flowPath.substring(0, flowPath.lastIndexOf(SEP19));
+      flowPath = flowPath.substring(0, flowPath.lastIndexOf(SEP20));
     } else {
       throw new Error("Flow path must be a .flow/__flow directory or a flow.yaml file");
     }
   }
-  if (!flowPath.endsWith(SEP19)) {
-    flowPath += SEP19;
+  if (!flowPath.endsWith(SEP20)) {
+    flowPath += SEP20;
   }
   const localFlow = await yamlParseFile(flowPath + "flow.yaml");
   const fileReader = async (path21) => await readTextFile(flowPath + path21);
-  await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, flowPath, SEP19);
+  await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, flowPath, SEP20);
   if (localFlow.value.failure_module) {
-    await replaceInlineScripts([localFlow.value.failure_module], fileReader, exports_log, flowPath, SEP19);
+    await replaceInlineScripts([localFlow.value.failure_module], fileReader, exports_log, flowPath, SEP20);
   }
   if (localFlow.value.preprocessor_module) {
-    await replaceInlineScripts([localFlow.value.preprocessor_module], fileReader, exports_log, flowPath, SEP19);
+    await replaceInlineScripts([localFlow.value.preprocessor_module], fileReader, exports_log, flowPath, SEP20);
   }
   if (useLocalPathScripts) {
     const scriptPaths = collectPathScriptPaths(localFlow.value);
@@ -74534,7 +75285,7 @@ async function preview2(opts, flowPath) {
     workspace: workspace.workspaceId,
     requestBody: {
       value: localFlow.value,
-      path: flowPath.substring(0, flowPath.indexOf(".flow")).replaceAll(SEP19, "/"),
+      path: flowPath.substring(0, flowPath.indexOf(".flow")).replaceAll(SEP20, "/"),
       args: input
     }
   });
@@ -74566,8 +75317,8 @@ async function generateLocks(opts, folder) {
   } else {
     const ignore = await ignoreF(opts);
     const elems = Object.keys(await elementsToMap(await FSFSElement(process.cwd(), [], true), (p, isD) => {
-      return ignore(p, isD) || !isD && !p.endsWith(SEP19 + "flow.yaml") && !p.endsWith(SEP19 + "flow.json");
-    }, false, {})).map((x) => x.substring(0, x.lastIndexOf(SEP19)));
+      return ignore(p, isD) || !isD && !p.endsWith(SEP20 + "flow.yaml") && !p.endsWith(SEP20 + "flow.json");
+    }, false, {})).map((x) => x.substring(0, x.lastIndexOf(SEP20)));
     let hasAny = false;
     for (const folder2 of elems) {
       const candidate = await generateFlowLockInternal(folder2, true, workspace, opts);
@@ -74666,7 +75417,7 @@ async function showVersion(opts, flowPath, version) {
     console.log(JSON.stringify(flow.value, null, 2));
   }
 }
-var import_yaml36, alreadySynced3, command20, flow_default;
+var import_yaml36, alreadySynced3, command21, flow_default;
 var init_flow = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -74691,7 +75442,7 @@ var init_flow = __esm(async () => {
   ]);
   import_yaml36 = __toESM(require_dist(), 1);
   alreadySynced3 = [];
-  command20 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--message <message:string>", "Deployment message").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", 'DEPRECATED: re-generate flow lock files. Use "wmill generate-metadata" instead.').arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion).command("set-permissioned-as", "Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, flowPath, email) => {
+  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--message <message:string>", "Deployment message").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", 'DEPRECATED: re-generate flow lock files. Use "wmill generate-metadata" instead.').arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion).command("set-permissioned-as", "Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, flowPath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const remote = await getFlowByPath({
@@ -74712,7 +75463,7 @@ var init_flow = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for flow ${flowPath} to ${email}`));
   });
-  flow_default = command20;
+  flow_default = command21;
 });
 
 // src/commands/gitsync-settings/converter.ts
@@ -75651,286 +76402,15 @@ __export(exports_gitsync_settings, {
   pullGitSyncSettings: () => pullGitSyncSettings,
   default: () => gitsync_settings_default
 });
-var command22, gitsync_settings_default;
+var command23, gitsync_settings_default;
 var init_gitsync_settings = __esm(async () => {
   init_mod3();
   await __promiseAll([
     init_pull2(),
     init_push()
   ]);
-  command22 = new Command().description("Manage git-sync settings between local wmill.yaml and Windmill backend").command("pull").description("Pull git-sync settings from Windmill backend to local wmill.yaml").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--default", "Write settings to top-level defaults instead of overrides").option("--replace", "Replace existing settings (non-interactive mode)").option("--override", "Add branch-specific override (non-interactive mode)").option("--diff", "Show differences without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pullGitSyncSettings).command("push").description("Push git-sync settings from local wmill.yaml to Windmill backend").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--diff", "Show what would be pushed without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pushGitSyncSettings);
-  gitsync_settings_default = command22;
-});
-
-// src/utils/dependency_tree.ts
-async function uploadScripts(tree, workspace) {
-  const scriptHashes = {};
-  const workspaceDeps = [];
-  for (const path22 of tree.allPaths()) {
-    const content = tree.getContent(path22);
-    const itemType = tree.getItemType(path22);
-    if (itemType === "dependencies") {
-      if (content === undefined)
-        continue;
-      const info2 = workspaceDependenciesPathToLanguageAndFilename(path22);
-      if (info2) {
-        const hash2 = await generateHash(content);
-        workspaceDeps.push({ path: path22, language: info2.language, name: info2.name, hash: hash2 });
-      }
-    } else if (itemType === "script") {
-      if (!content)
-        continue;
-      const hash2 = await generateHash(content);
-      scriptHashes[path22] = hash2;
-    }
-  }
-  if (Object.keys(scriptHashes).length === 0 && workspaceDeps.length === 0)
-    return;
-  const mismatched = await diffRawScriptsWithDeployed({
-    workspace: workspace.workspaceId,
-    requestBody: {
-      scripts: scriptHashes,
-      workspace_deps: workspaceDeps
-    }
-  });
-  for (const path22 of mismatched) {
-    const content = tree.getContent(path22);
-    const itemType = tree.getItemType(path22);
-    if (itemType === "dependencies") {
-      if (content !== undefined) {
-        tree.setContentHash(path22, "mismatched");
-      }
-    } else if (content) {
-      const hash2 = await storeRawScriptTemp({
-        workspace: workspace.workspaceId,
-        requestBody: content
-      });
-      tree.setContentHash(path22, hash2);
-    }
-  }
-}
-
-class DoubleLinkedDependencyTree {
-  nodes = new Map;
-  workspaceDeps = {};
-  setWorkspaceDeps(deps) {
-    this.workspaceDeps = deps;
-  }
-  async addNode(path22, content, language, metadata, imports, itemType, folder, originalPath, isDirectlyStale, isRawApp) {
-    const hasWorkspaceDeps = itemType === "script" || itemType === "inline_script";
-    const filteredDeps = hasWorkspaceDeps ? filterWorkspaceDependencies(this.workspaceDeps, content, language) : {};
-    const stalenessHash = await generateScriptHash({}, content, metadata);
-    if (!this.nodes.has(path22)) {
-      this.nodes.set(path22, {
-        content: "",
-        stalenessHash: "",
-        language: "deno",
-        metadata: "",
-        imports: new Set,
-        importedBy: new Set,
-        itemType: "script",
-        folder: "",
-        originalPath: "",
-        isDirectlyStale: false
-      });
-    }
-    const node = this.nodes.get(path22);
-    node.content = content;
-    node.stalenessHash = stalenessHash;
-    node.language = language;
-    node.metadata = metadata;
-    node.itemType = itemType;
-    node.folder = folder;
-    node.originalPath = originalPath;
-    node.isDirectlyStale = isDirectlyStale;
-    node.isRawApp = isRawApp;
-    const filteredDepsPaths = Object.keys(filteredDeps);
-    for (const depsPath of filteredDepsPaths) {
-      if (!this.nodes.has(depsPath)) {
-        const depsInfo = workspaceDependenciesPathToLanguageAndFilename(depsPath);
-        const contentHash = await generateHash(filteredDeps[depsPath] + depsPath);
-        const isUpToDate = await checkifMetadataUptodate(depsPath, contentHash, undefined);
-        this.nodes.set(depsPath, {
-          content: filteredDeps[depsPath],
-          stalenessHash: "",
-          language: depsInfo?.language ?? "deno",
-          metadata: "",
-          imports: new Set,
-          importedBy: new Set,
-          itemType: "dependencies",
-          folder: "",
-          originalPath: depsPath,
-          isDirectlyStale: !isUpToDate
-        });
-      }
-    }
-    const allImports = [...imports, ...filteredDepsPaths];
-    for (const importPath of allImports) {
-      node.imports.add(importPath);
-      if (!this.nodes.has(importPath)) {
-        this.nodes.set(importPath, {
-          content: "",
-          stalenessHash: "",
-          language: "deno",
-          metadata: "",
-          imports: new Set,
-          importedBy: new Set,
-          itemType: "script",
-          folder: "",
-          originalPath: "",
-          isDirectlyStale: false
-        });
-      }
-      this.nodes.get(importPath).importedBy.add(path22);
-    }
-  }
-  getContent(path22) {
-    return this.nodes.get(path22)?.content;
-  }
-  getStalenessHash(path22) {
-    return this.nodes.get(path22)?.stalenessHash;
-  }
-  getContentHash(path22) {
-    return this.nodes.get(path22)?.contentHash;
-  }
-  setContentHash(path22, hash2) {
-    const node = this.nodes.get(path22);
-    if (node) {
-      node.contentHash = hash2;
-    }
-  }
-  getLanguage(path22) {
-    return this.nodes.get(path22)?.language;
-  }
-  getMetadata(path22) {
-    return this.nodes.get(path22)?.metadata;
-  }
-  getStaleReason(path22) {
-    return this.nodes.get(path22)?.staleReason;
-  }
-  getItemType(path22) {
-    return this.nodes.get(path22)?.itemType;
-  }
-  getFolder(path22) {
-    return this.nodes.get(path22)?.folder;
-  }
-  getIsRawApp(path22) {
-    return this.nodes.get(path22)?.isRawApp;
-  }
-  getIsDirectlyStale(path22) {
-    return this.nodes.get(path22)?.isDirectlyStale ?? false;
-  }
-  getOriginalPath(path22) {
-    return this.nodes.get(path22)?.originalPath;
-  }
-  getImports(path22) {
-    return this.nodes.get(path22)?.imports;
-  }
-  isStale(path22) {
-    return this.nodes.get(path22)?.staleReason !== undefined;
-  }
-  propagateStaleness() {
-    const directlyStale = new Set;
-    for (const [path22, node] of this.nodes.entries()) {
-      if (node.isDirectlyStale) {
-        directlyStale.add(path22);
-        node.staleReason = "content changed";
-      }
-    }
-    const allStale = new Set(directlyStale);
-    const queue = [...directlyStale];
-    const visited = new Set;
-    while (queue.length > 0) {
-      const scriptPath = queue.shift();
-      if (visited.has(scriptPath))
-        continue;
-      visited.add(scriptPath);
-      const node = this.nodes.get(scriptPath);
-      if (!node)
-        continue;
-      for (const importer of node.importedBy) {
-        if (!allStale.has(importer)) {
-          allStale.add(importer);
-          queue.push(importer);
-          const importerNode = this.nodes.get(importer);
-          if (importerNode)
-            importerNode.staleReason = `depends on ${scriptPath}`;
-        }
-      }
-    }
-  }
-  traverseTransitive(scriptPath, callback) {
-    const queue = [scriptPath];
-    const visited = new Set;
-    while (queue.length > 0) {
-      const current = queue.shift();
-      if (visited.has(current))
-        continue;
-      visited.add(current);
-      const node = this.nodes.get(current);
-      if (!node)
-        continue;
-      for (const importPath of node.imports) {
-        const importNode = this.nodes.get(importPath);
-        if (importNode) {
-          const stop = callback(importPath, importNode);
-          if (!stop) {
-            queue.push(importPath);
-          }
-        }
-      }
-    }
-  }
-  allPaths() {
-    return this.nodes.keys();
-  }
-  *stalePaths() {
-    for (const [path22, node] of this.nodes.entries()) {
-      if (node.staleReason) {
-        yield path22;
-      }
-    }
-  }
-  has(path22) {
-    return this.nodes.has(path22);
-  }
-  getMismatchedWorkspaceDeps() {
-    const result2 = {};
-    for (const [path22, node] of this.nodes.entries()) {
-      if (node.itemType === "dependencies" && node.contentHash && node.content !== undefined) {
-        result2[path22] = node.content;
-      }
-    }
-    return result2;
-  }
-  getTempScriptRefs(scriptPath) {
-    const result2 = {};
-    this.traverseTransitive(scriptPath, (_path, node) => {
-      if (node.contentHash) {
-        result2[_path] = node.contentHash;
-      }
-    });
-    return result2;
-  }
-  async persistDepsHashes(depsPaths) {
-    for (const path22 of depsPaths) {
-      const node = this.nodes.get(path22);
-      if (node?.itemType === "dependencies" && node.content !== undefined) {
-        const hash2 = await generateHash(node.content + path22);
-        await updateMetadataGlobalLock(path22, hash2);
-      }
-    }
-  }
-  get size() {
-    return this.nodes.size;
-  }
-}
-var init_dependency_tree = __esm(async () => {
-  init_services_gen();
-  await __promiseAll([
-    init_metadata(),
-    init_utils()
-  ]);
+  command23 = new Command().description("Manage git-sync settings between local wmill.yaml and Windmill backend").command("pull").description("Pull git-sync settings from Windmill backend to local wmill.yaml").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--default", "Write settings to top-level defaults instead of overrides").option("--replace", "Replace existing settings (non-interactive mode)").option("--override", "Add branch-specific override (non-interactive mode)").option("--diff", "Show differences without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pullGitSyncSettings).command("push").description("Push git-sync settings from local wmill.yaml to Windmill backend").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--diff", "Show what would be pushed without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pushGitSyncSettings);
+  gitsync_settings_default = command23;
 });
 
 // src/main.ts
@@ -77207,8 +77687,8 @@ async function pull2(opts) {
     await pushResourceType(workspace.workspaceId, x.name + ".resource-type.json", undefined, x);
   }
 }
-var command21 = new Command().name("hub").description("Hub related commands. EXPERIMENTAL. INTERNAL USE ONLY.").command("pull").description("pull any supported definitions. EXPERIMENTAL.").action(pull2);
-var hub_default = command21;
+var command22 = new Command().name("hub").description("Hub related commands. EXPERIMENTAL. INTERNAL USE ONLY.").command("pull").description("pull any supported definitions. EXPERIMENTAL.").action(pull2);
+var hub_default = command22;
 
 // src/main.ts
 await __promiseAll([
@@ -77299,8 +77779,8 @@ async function pushWorkerGroups(opts) {
     await pushInstanceConfigs(opts, false);
   }
 }
-var command23 = new Command().description("display worker groups, pull and push worker groups configs").action(displayWorkerGroups).command("pull").description("Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)").option("--instance", "Name of the instance to push to, override the active instance").option("--base-url", "Base url to be passed to the instance settings instead of the local one").option("--yes", "Pull without needing confirmation").action(pullWorkerGroups).command("push").description("Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").option("--yes", "Push without needing confirmation").action(pushWorkerGroups);
-var worker_groups_default = command23;
+var command24 = new Command().description("display worker groups, pull and push worker groups configs").action(displayWorkerGroups).command("pull").description("Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)").option("--instance", "Name of the instance to push to, override the active instance").option("--base-url", "Base url to be passed to the instance settings instead of the local one").option("--yes", "Pull without needing confirmation").action(pullWorkerGroups).command("push").description("Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").option("--yes", "Push without needing confirmation").action(pushWorkerGroups);
+var worker_groups_default = command24;
 
 // src/main.ts
 await init_lint();
@@ -77329,7 +77809,7 @@ await __promiseAll([
   init_local_path_scripts()
 ]);
 var import_yaml40 = __toESM(require_dist(), 1);
-import { sep as SEP20 } from "node:path";
+import { sep as SEP21 } from "node:path";
 import * as http3 from "node:http";
 import * as https from "node:https";
 import { access, readdir as readdir10, realpath, stat as stat17, unlink, writeFile as writeFile19 } from "node:fs/promises";
@@ -77582,7 +78062,7 @@ async function dev2(opts) {
     if (paths.length == 0) {
       return;
     }
-    const nativePath = (await realpath(paths[0])).replace(base + SEP20, "");
+    const nativePath = (await realpath(paths[0])).replace(base + SEP21, "");
     const cpath = nativePath.replaceAll("\\", "/");
     const insideFlow = isInsideFlowFolder(cpath);
     if (insideFlow || !ignore(nativePath, false)) {
@@ -77599,7 +78079,7 @@ async function dev2(opts) {
           return;
         const wmFlowPath = stripFolderSuffix(localPath.replace(/\/$/, ""), FLOW_SUFFIXES);
         const localFlow = await yamlParseFile(localPath + "flow.yaml");
-        await replaceInlineScripts(localFlow.value.modules, async (path22) => await readTextFile(localPath + path22), exports_log, localPath, SEP20, undefined);
+        await replaceInlineScripts(localFlow.value.modules, async (path22) => await readTextFile(localPath + path22), exports_log, localPath, SEP21, undefined);
         snapshotPathScripts(localFlow.value);
         const localScriptReader = createPreviewLocalScriptReader({
           exts,
@@ -77652,7 +78132,7 @@ async function dev2(opts) {
       if (!flowDir || !flowYaml)
         throw new Error("not a flow");
       const localFlow = await yamlParseFile(flowYaml);
-      await replaceInlineScripts(localFlow.value.modules, async (p) => await readTextFile(flowDir + p), exports_log, flowDir, SEP20, undefined);
+      await replaceInlineScripts(localFlow.value.modules, async (p) => await readTextFile(flowDir + p), exports_log, flowDir, SEP21, undefined);
       snapshotPathScripts(localFlow.value);
       const localScriptReader = createPreviewLocalScriptReader({
         exts,
@@ -77999,8 +78479,8 @@ async function dev2(opts) {
   await Promise.all([startServer(), watchChanges()]);
   console.log("Stopped dev mode");
 }
-var command24 = new Command().description("Watch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace — use wmill sync push for that.").option("--includes <pattern...:string>", "Filter paths given a glob pattern or path").option("--proxy-port <port:number>", "Port for a localhost reverse proxy to the remote Windmill server").option("--path <path:string>", "Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)").option("--no-open", "Do not open the browser automatically").action(dev2);
-var dev_default2 = command24;
+var command25 = new Command().description("Watch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace — use wmill sync push for that.").option("--includes <pattern...:string>", "Filter paths given a glob pattern or path").option("--proxy-port <port:number>", "Port for a localhost reverse proxy to the remote Windmill server").option("--path <path:string>", "Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)").option("--no-open", "Do not open the browser automatically").action(dev2);
+var dev_default2 = command25;
 
 // src/main.ts
 init_gen();
@@ -78114,8 +78594,8 @@ Worker Group: ${group.groupName} (${group.workers.length} workers)`);
     info("Use 'wmill instance add' to add a new instance");
   }
 }
-var command25 = new Command().description("List all workers grouped by worker groups").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayWorkers);
-var workers_default = command25;
+var command26 = new Command().description("List all workers grouped by worker groups").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayWorkers);
+var workers_default = command26;
 
 // src/commands/queues/queues.ts
 init_mod3();
@@ -78223,8 +78703,8 @@ async function displayQueues(opts, workspace) {
     info("Use 'wmill instance add' to add a new instance");
   }
 }
-var command26 = new Command().description("List all queues with their metrics").arguments("[workspace:string] the optional workspace to filter by (default to all workspaces)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayQueues);
-var queues_default = command26;
+var command27 = new Command().description("List all queues with their metrics").arguments("[workspace:string] the optional workspace to filter by (default to all workspaces)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayQueues);
+var queues_default = command27;
 
 // src/main.ts
 await init_dependencies();
@@ -78276,7 +78756,7 @@ When a new app needs to be created, YOU run \`wmill app new\` yourself with \`--
 
 ## Triggers
 
-You MUST use the \`triggers\` skill to configure HTTP routes, WebSocket, Kafka, NATS, SQS, MQTT, GCP, or Postgres CDC triggers.
+You MUST use the \`triggers\` skill to configure HTTP routes, WebSocket, Kafka, NATS, SQS, MQTT, GCP, Azure, Email, or Postgres CDC triggers.
 
 ## Schedules
 
@@ -83871,6 +84351,49 @@ Examples:
 - \`u/user/webhook.http_trigger.yaml\`
 - \`f/data/kafka_consumer.kafka_trigger.yaml\`
 - \`f/sync/postgres_cdc.postgres_trigger.yaml\`
+- \`f/inbound/orders.email_trigger.yaml\`
+
+## Email Triggers
+
+An email trigger routes incoming emails to a script or flow. Each trigger reserves a local-part: emails sent to \`<local_part>@<windmill_email_domain>\` are delivered to the configured runnable. Set \`workspaced_local_part: true\` to namespace it per workspace (the actual recipient becomes \`<workspace_id>-<local_part>@…\`); on Windmill Cloud this is required.
+
+Senders may append URL-style extras to the local-part with \`+\`: \`mytrigger+foo=bar+baz=qux@…\`. They flow through to the script as \`email_extra_args\` (see below).
+
+### Payload
+
+The runnable receives:
+
+- \`parsed_email\` — \`{ headers, text_body, html_body, attachments[] }\`. Each \`attachment\` has \`{ headers, body }\`.
+- \`raw_email\` — the raw RFC 822 message as a string, **or** an S3 object (\`{ s3: "windmill_emails/<job_id>/raw.eml" }\`) if the message exceeds 1 MiB.
+- \`email_extra_args\` (optional, only when sender appended \`+key=value\` extras) — a flat object of the parsed extras.
+
+With a preprocessor, all of the above are nested under \`event\` along with \`event.kind = "email"\` and \`event.trigger_path\` (the trigger's path). Without a preprocessor, \`trigger_path\` is **not** exposed — add a preprocessor if you need it.
+
+### Attachments are S3 objects
+
+Binary attachments are uploaded to the workspace S3 bucket and surface in \`parsed_email.attachments[i].body\` as:
+
+\`\`\`json
+{ "s3": "windmill_emails/<job_id>/attachments/<filename>" }
+\`\`\`
+
+To read the bytes inside a script, use the wmill SDK:
+
+\`\`\`ts
+// TypeScript
+import * as wmill from "windmill-client"
+const file = await wmill.loadS3File(parsed_email.attachments[0].body)
+\`\`\`
+
+\`\`\`python
+# Python
+import wmill
+data = wmill.load_s3_file(parsed_email["attachments"][0]["body"])
+\`\`\`
+
+If the workspace has no S3 resource configured (Workspace Settings → Object storage), \`body\` falls back to the string \`"configure s3 in the workspace settings to handle attachments"\`. The same applies to large \`raw_email\` bodies. Email attachment storage requires the server to be built with the \`parquet\` feature.
+
+Text/HTML/inline parts are placed inline in \`body\` as strings.
 
 ## CLI Commands
 
@@ -84804,6 +85327,15 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
 - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
+**Subcommands:**
+
+- \`generate-metadata rehash [folder:string]\`
+  - \`--skip-scripts\` - Skip processing scripts
+  - \`--skip-flows\` - Skip processing flows
+  - \`--skip-apps\` - Skip processing apps
+  - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
+  - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
+
 ### gitsync-settings
 
 Manage git-sync settings between local wmill.yaml and Windmill backend
@@ -85477,6 +86009,71 @@ required:
 - azure_mode
 - scope_resource_id
 - subscription_name
+`,
+  email_trigger: `type: object
+properties:
+  script_path:
+    type: string
+    description: Path to the script or flow to execute when triggered
+  permissioned_as:
+    type: string
+    description: The user or group this trigger runs as (permissioned_as)
+  is_flow:
+    type: boolean
+    description: True if script_path points to a flow, false if it points to a script
+  labels:
+    type: array
+    items:
+      type: string
+  local_part:
+    type: string
+  workspaced_local_part:
+    type: boolean
+  error_handler_path:
+    type: string
+  error_handler_args:
+    type: object
+    description: The arguments to pass to the script or flow
+  retry:
+    type: object
+    properties:
+      constant:
+        type: object
+        description: Retry with constant delay between attempts
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          seconds:
+            type: integer
+            description: Seconds to wait between retries
+      exponential:
+        type: object
+        description: Retry with exponential backoff (delay doubles each time)
+        properties:
+          attempts:
+            type: integer
+            description: Number of retry attempts
+          multiplier:
+            type: integer
+            description: Multiplier for exponential backoff
+          seconds:
+            type: integer
+            minimum: 1
+            description: Initial delay in seconds
+          random_factor:
+            type: integer
+            minimum: 0
+            maximum: 100
+            description: Random jitter percentage (0-100) to avoid thundering herd
+      retry_if:
+        $ref: '#/components/schemas/RetryIf'
+    description: Retry configuration for failed module executions
+required:
+- script_path
+- permissioned_as
+- is_flow
+- local_part
 `,
   gcp_trigger: `type: object
 properties:
@@ -86404,7 +87001,8 @@ var SCHEMA_MAPPINGS = {
     { name: "MqttTrigger", schemaKey: "mqtt_trigger", filePattern: "*.mqtt_trigger.yaml" },
     { name: "SqsTrigger", schemaKey: "sqs_trigger", filePattern: "*.sqs_trigger.yaml" },
     { name: "GcpTrigger", schemaKey: "gcp_trigger", filePattern: "*.gcp_trigger.yaml" },
-    { name: "AzureTrigger", schemaKey: "azure_trigger", filePattern: "*.azure_trigger.yaml" }
+    { name: "AzureTrigger", schemaKey: "azure_trigger", filePattern: "*.azure_trigger.yaml" },
+    { name: "EmailTrigger", schemaKey: "email_trigger", filePattern: "*.email_trigger.yaml" }
   ],
   schedules: [
     { name: "Schedule", schemaKey: "schedule", filePattern: "*.schedule.yaml" }
@@ -87225,8 +87823,8 @@ async function initAction(opts) {
     info(colors.gray("Skipped resource type namespace generation (no workspace bound). Run 'wmill workspace bind' then 'wmill init' to generate it."));
   }
 }
-var command27 = new Command().description("Bootstrap a windmill project with a wmill.yaml file").option("--use-default", "Use default settings without checking backend").option("--use-backend", "Use backend git-sync settings if available").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when using backend settings").option("--bind-profile", "Automatically bind active workspace profile to current Git branch").option("--no-bind-profile", "Skip workspace profile binding prompt").action(initAction);
-var init_default = command27;
+var command28 = new Command().description("Bootstrap a windmill project with a wmill.yaml file").option("--use-default", "Use default settings without checking backend").option("--use-backend", "Use backend git-sync settings if available").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when using backend settings").option("--bind-profile", "Automatically bind active workspace profile to current Git branch").option("--no-bind-profile", "Skip workspace profile binding prompt").action(initAction);
+var init_default = command28;
 
 // src/commands/jobs/jobs.ts
 init_mod3();
@@ -87392,8 +87990,8 @@ Warning: Found ${workers.length} active worker(s) on the instance.`));
 }
 var pull3 = new Command().description("Pull completed and queued jobs from workspace").option("-c, --completed-output <file:string>", "Completed jobs output file (default: completed_jobs.json)").option("-q, --queued-output <file:string>", "Queued jobs output file (default: queued_jobs.json)").option("--skip-worker-check", "Skip checking for active workers before export").arguments("[workspace:string]").action(pullJobs);
 var push12 = new Command().description("Push completed and queued jobs to workspace").option("-c, --completed-file <file:string>", "Completed jobs input file (default: completed_jobs.json)").option("-q, --queued-file <file:string>", "Queued jobs input file (default: queued_jobs.json)").option("--skip-worker-check", "Skip checking for active workers before import").arguments("[workspace:string]").action(pushJobs);
-var command28 = new Command().description("Manage jobs (import/export)").command("pull", pull3).command("push", push12);
-var jobs_default = command28;
+var command29 = new Command().description("Manage jobs (import/export)").command("pull", pull3).command("push", push12);
+var jobs_default = command29;
 
 // src/commands/job/job.ts
 init_mod3();
@@ -87707,8 +88305,8 @@ async function cancel(opts, id) {
   info(colors.green(`Job ${id} canceled.`));
 }
 var listOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--script-path <scriptPath:string>", "Filter by exact script/flow path").option("--created-by <createdBy:string>", "Filter by creator username").option("--running", "Show only running jobs").option("--failed", "Show only failed jobs").option("--success <success:boolean>", "Filter by success status (true/false)").option("--limit <limit:number>", "Number of jobs to return (default 30, max 100)").option("--job-kinds <jobKinds:string>", "Filter by job kinds (default: script,flow,singlestepflow)").option("--label <label:string>", "Filter by job label").option("--all", "Include sub-jobs (flow steps). By default only top-level jobs are shown").option("--parent <parent:string>", "Filter by parent job ID (show sub-jobs of a specific flow)").option("--is-flow-step", "Show only flow step jobs");
-var command29 = listOptions(new Command().description("Manage jobs (list, inspect, cancel)")).action(list13).command("list", listOptions(new Command().description("List recent jobs"))).action(list13).command("get", "Get job details. For flows: shows step tree with sub-job IDs").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get10).command("result", "Get the result of a completed job (machine-friendly)").arguments("<id:string>").action(result).command("logs", "Get job logs. For flows: aggregates all step logs").arguments("<id:string>").action(logs).command("cancel", "Cancel a running or queued job").arguments("<id:string>").option("--reason <reason:string>", "Reason for cancellation").action(cancel);
-var job_default = command29;
+var command30 = listOptions(new Command().description("Manage jobs (list, inspect, cancel)")).action(list13).command("list", listOptions(new Command().description("List recent jobs"))).action(list13).command("get", "Get job details. For flows: shows step tree with sub-job IDs").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get10).command("result", "Get the result of a completed job (machine-friendly)").arguments("<id:string>").action(result).command("logs", "Get job logs. For flows: aggregates all step logs").arguments("<id:string>").action(logs).command("cancel", "Cancel a running or queued job").arguments("<id:string>").option("--reason <reason:string>", "Reason for cancellation").action(cancel);
+var job_default = command30;
 
 // src/commands/group/group.ts
 init_mod3();
@@ -87807,8 +88405,8 @@ async function removeUser(opts, name, username) {
   });
   info(colors.green(`User '${username}' removed from group '${name}'.`));
 }
-var command30 = new Command().description("Manage workspace groups").option("--json", "Output as JSON (for piping to jq)").action(list14).command("list", "List all groups in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list14).command("get", "Get group details and members").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get11).command("create", "Create a new group").arguments("<name:string>").option("--summary <summary:string>", "Group summary/description").action(create).command("delete", "Delete a group").arguments("<name:string>").action(deleteGroup2).command("add-user", "Add a user to a group").arguments("<name:string> <username:string>").action(addUser2).command("remove-user", "Remove a user from a group").arguments("<name:string> <username:string>").action(removeUser);
-var group_default = command30;
+var command31 = new Command().description("Manage workspace groups").option("--json", "Output as JSON (for piping to jq)").action(list14).command("list", "List all groups in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list14).command("get", "Get group details and members").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get11).command("create", "Create a new group").arguments("<name:string>").option("--summary <summary:string>", "Group summary/description").action(create).command("delete", "Delete a group").arguments("<name:string>").action(deleteGroup2).command("add-user", "Add a user to a group").arguments("<name:string> <username:string>").action(addUser2).command("remove-user", "Remove a user from a group").arguments("<name:string> <username:string>").action(removeUser);
+var group_default = command31;
 
 // src/commands/audit/audit.ts
 init_mod3();
@@ -87885,8 +88483,8 @@ async function get12(opts, id) {
   }
 }
 var auditListOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--username <username:string>", "Filter by username").option("--operation <operation:string>", "Filter by operation (exact or prefix)").option("--action-kind <actionKind:string>", "Filter by action kind (Create, Update, Delete, Execute)").option("--before <before:string>", "Filter events before this timestamp").option("--after <after:string>", "Filter events after this timestamp").option("--limit <limit:number>", "Number of entries to return (default 30, max 100)");
-var command31 = auditListOptions(new Command().description("View audit logs (requires admin)")).action(list15).command("list", auditListOptions(new Command().description("List audit log entries"))).action(list15).command("get", "Get a specific audit log entry").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get12);
-var audit_default = command31;
+var command32 = auditListOptions(new Command().description("View audit logs (requires admin)")).action(list15).command("list", auditListOptions(new Command().description("List audit log entries"))).action(list15).command("get", "Get a specific audit log entry").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get12);
+var audit_default = command32;
 
 // src/commands/token/token.ts
 init_mod3();
@@ -87940,253 +88538,11 @@ async function deleteToken2(opts, tokenPrefix) {
   await deleteToken({ tokenPrefix });
   info(colors.green(`Token with prefix '${tokenPrefix}' deleted.`));
 }
-var command32 = new Command().description("Manage API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("list", "List API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("create", "Create a new API token").option("--label <label:string>", "Token label").option("--expiration <expiration:string>", "Token expiration (ISO 8601 timestamp)").action(create2).command("delete", "Delete a token by its prefix").arguments("<token_prefix:string>").action(deleteToken2);
-var token_default = command32;
+var command33 = new Command().description("Manage API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("list", "List API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("create", "Create a new API token").option("--label <label:string>", "Token label").option("--expiration <expiration:string>", "Token expiration (ISO 8601 timestamp)").action(create2).command("delete", "Delete a token by its prefix").arguments("<token_prefix:string>").action(deleteToken2);
+var token_default = command33;
 
-// src/commands/generate-metadata/generate-metadata.ts
-init_mod3();
-init_colors2();
-init_log();
-await __promiseAll([
-  init_confirm(),
-  init_conf(),
-  init_context(),
-  init_auth(),
-  init_metadata(),
-  init_flow_metadata(),
-  init_app_metadata(),
-  init_sync(),
-  init_script(),
-  init_resource_folders(),
-  init_codebase(),
-  init_dependency_tree()
-]);
-import { sep as SEP21 } from "node:path";
-async function generateMetadata2(opts, folder) {
-  if (folder === "") {
-    folder = undefined;
-  }
-  const workspace = await resolveWorkspace(opts);
-  await requireLogin(opts);
-  opts = await mergeConfigWithConfigFile(opts);
-  const rawWorkspaceDependencies = await getRawWorkspaceDependencies(false);
-  const codebases = await listSyncCodebases(opts);
-  const ignore = await ignoreF(opts);
-  const skipScripts = opts.skipScripts ?? false;
-  const skipFlows = opts.skipFlows ?? opts.schemaOnly ?? false;
-  const skipApps = opts.skipApps ?? opts.schemaOnly ?? false;
-  const checking = [];
-  if (!skipScripts)
-    checking.push("scripts");
-  if (!skipFlows)
-    checking.push("flows");
-  if (!skipApps)
-    checking.push("apps");
-  if (checking.length === 0) {
-    info(colors.yellow("Nothing to check (all types skipped)"));
-    return;
-  }
-  info(`Checking ${checking.join(", ")}...`);
-  const tree = new DoubleLinkedDependencyTree;
-  tree.setWorkspaceDeps(rawWorkspaceDependencies);
-  if (!skipScripts) {
-    const scriptElems = await elementsToMap(await FSFSElement(process.cwd(), codebases, false), (p, isD) => {
-      return !isD && !exts.some((ext2) => p.endsWith(ext2)) || ignore(p, isD) || isFolderResourcePathAnyFormat(p) || isScriptModulePath(p) && !isModuleEntryPoint(p);
-    }, false, {});
-    for (const e of Object.keys(scriptElems)) {
-      await generateScriptMetadataInternal(e, workspace, opts, true, true, rawWorkspaceDependencies, codebases, false, tree);
-    }
-  }
-  if (!skipFlows) {
-    const flowElems = Object.keys(await elementsToMap(await FSFSElement(process.cwd(), [], true), (p, isD) => {
-      return ignore(p, isD) || !isD && !p.endsWith(SEP21 + "flow.yaml") && !p.endsWith(SEP21 + "flow.json");
-    }, false, {})).map((x) => x.substring(0, x.lastIndexOf(SEP21)));
-    for (const flowFolder of flowElems) {
-      await generateFlowLockInternal(flowFolder, true, workspace, opts, false, true, tree);
-    }
-  }
-  if (!skipApps) {
-    const elems = await elementsToMap(await FSFSElement(process.cwd(), [], true), (p, isD) => {
-      return ignore(p, isD) || !isD && !p.endsWith(SEP21 + "raw_app.yaml") && !p.endsWith(SEP21 + "app.yaml");
-    }, false, {});
-    const rawAppFolders = getAppFolders(elems, "raw_app.yaml");
-    const appFolders = getAppFolders(elems, "app.yaml");
-    for (const appFolder of rawAppFolders) {
-      await generateAppLocksInternal(appFolder, true, true, workspace, opts, false, true, tree);
-    }
-    for (const appFolder of appFolders) {
-      await generateAppLocksInternal(appFolder, false, true, workspace, opts, false, true, tree);
-    }
-  }
-  tree.propagateStaleness();
-  try {
-    await uploadScripts(tree, workspace);
-  } catch (e) {
-    warn(colors.yellow(`Failed to upload scripts to temp storage (backend may be too old): ${e}. ` + `Locks will be generated using deployed script versions only — locally modified ` + `relative imports may not be reflected.`));
-  }
-  const staleItems = [];
-  const seenFolders = new Set;
-  for (const p of tree.allPaths()) {
-    const staleReason = tree.getStaleReason(p);
-    if (!staleReason)
-      continue;
-    const itemType = tree.getItemType(p);
-    const itemFolder = tree.getFolder(p);
-    if (itemType === "dependencies") {
-      staleItems.push({ type: itemType, path: p, folder: itemFolder, staleReason });
-    } else if (itemType === "inline_script") {
-      continue;
-    } else if (itemType === "script") {
-      const originalPath = tree.getOriginalPath(p);
-      staleItems.push({ type: itemType, path: originalPath, folder: itemFolder, staleReason });
-    } else if (!seenFolders.has(itemFolder)) {
-      seenFolders.add(itemFolder);
-      const originalPath = tree.getOriginalPath(p);
-      staleItems.push({ type: itemType, path: originalPath, folder: itemFolder, isRawApp: tree.getIsRawApp(p), staleReason });
-    }
-  }
-  let filteredItems = staleItems;
-  if (folder) {
-    folder = folder.replaceAll("\\", "/");
-    if (folder.endsWith("/")) {
-      folder = folder.substring(0, folder.length - 1);
-    }
-    const folderNoExt = folder.replace(/\.[^/.]+$/, "");
-    const isInsideFolder = (item) => {
-      const normalizedFolder = item.folder.replaceAll("\\", "/");
-      const normalizedPath = item.path.replaceAll("\\", "/");
-      return normalizedFolder === folder || normalizedFolder.startsWith(folder + "/") || normalizedPath === folder || normalizedPath === folderNoExt;
-    };
-    const isPathInFolder = (p) => p.startsWith(folder + "/") || p === folder || p === folderNoExt;
-    const touchesFolder = (treePath) => {
-      if (isPathInFolder(treePath))
-        return true;
-      let found = false;
-      tree.traverseTransitive(treePath, (importPath) => {
-        if (isPathInFolder(importPath)) {
-          found = true;
-          return true;
-        }
-      });
-      return found;
-    };
-    const isRelevant = (item) => {
-      if (isInsideFolder(item))
-        return true;
-      if (item.type === "dependencies")
-        return true;
-      const treePath = (item.type === "script" ? item.path.replace(/\.[^/.]+$/, "") : item.folder).replaceAll("\\", "/");
-      return touchesFolder(treePath);
-    };
-    if (opts.strictFolderBoundaries) {
-      filteredItems = staleItems.filter(isInsideFolder);
-      const excludedStale = staleItems.filter((item) => !isInsideFolder(item) && isRelevant(item) && item.type !== "dependencies");
-      for (const item of excludedStale) {
-        const normalizedPath = item.path.replaceAll("\\", "/");
-        warn(colors.yellow(`Warning: ${normalizedPath} depends on something inside "${folder}" but is outside it — skipped due to --strict-folder-boundaries. Next generate-metadata will not detect it as stale.`));
-      }
-    } else {
-      filteredItems = staleItems.filter(isRelevant);
-    }
-  }
-  if (filteredItems.length === 0) {
-    info(colors.green("All metadata up-to-date"));
-    return;
-  }
-  const scripts = filteredItems.filter((i) => i.type === "script");
-  const flows = filteredItems.filter((i) => i.type === "flow");
-  const apps2 = filteredItems.filter((i) => i.type === "app");
-  const deps = filteredItems.filter((i) => i.type === "dependencies");
-  info("");
-  info(`Found ${colors.bold(String(filteredItems.length))} item(s) with stale metadata:`);
-  const printItems = (label, items) => {
-    if (items.length === 0)
-      return;
-    info(`  ${label} (${items.length}):`);
-    for (const item of items) {
-      const reason = item.staleReason ? colors.dim(colors.white(` — ${item.staleReason}`)) : "";
-      info(`    ~ ${item.path}` + reason);
-    }
-  };
-  printItems("Workspace dependencies", deps);
-  printItems("Scripts", scripts);
-  printItems("Flows", flows);
-  printItems("Apps", apps2);
-  if (opts.dryRun) {
-    return;
-  }
-  info("");
-  const isInteractive = process.stdin.isTTY ?? false;
-  if (!opts.yes && isInteractive && !await Confirm.prompt({
-    message: "Update metadata?",
-    default: true
-  })) {
-    return;
-  }
-  info("");
-  const mismatchedWorkspaceDeps = tree.getMismatchedWorkspaceDeps();
-  const total = filteredItems.length - deps.length;
-  const maxWidth = `[${total}/${total}]`.length;
-  let current = 0;
-  const formatProgress = (n) => {
-    return colors.dim(colors.white(`[${n}/${total}]`.padEnd(maxWidth, " ")));
-  };
-  const errors = [];
-  for (const item of scripts) {
-    current++;
-    info(`${formatProgress(current)} script ${item.path}`);
-    try {
-      await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, tree);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      error(`  Failed: ${msg}`);
-    }
-  }
-  for (const item of flows) {
-    current++;
-    try {
-      const result2 = await generateFlowLockInternal(item.folder.replaceAll("/", SEP21), false, workspace, opts, false, true, tree);
-      const flowResult = result2;
-      const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
-      info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      info(`${formatProgress(current)} flow   ${item.path}`);
-      error(`  Failed: ${msg}`);
-    }
-  }
-  for (const item of apps2) {
-    current++;
-    try {
-      const result2 = await generateAppLocksInternal(item.folder.replaceAll("/", SEP21), item.isRawApp, false, workspace, opts, false, true, tree);
-      const appResult = result2;
-      const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
-      info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      info(`${formatProgress(current)} app    ${item.path}`);
-      error(`  Failed: ${msg}`);
-    }
-  }
-  const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
-  await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
-  const succeeded = total - errors.length;
-  info("");
-  if (errors.length > 0) {
-    info(`Done. Updated ${colors.bold(String(succeeded))}/${total} item(s). ${colors.red(String(errors.length) + " failed")}:`);
-    for (const { path: path22, error: error2 } of errors) {
-      error(`  ${path22}: ${error2}`);
-    }
-    process.exitCode = 1;
-  } else {
-    info(`Done. Updated ${colors.bold(String(total))} item(s).`);
-  }
-}
-var command33 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2);
-var generate_metadata_default = command33;
+// src/main.ts
+await init_generate_metadata();
 
 // src/commands/docs/docs.ts
 init_mod3();