windmill-cli 1.694.0 → 1.696.0

package/esm/main.js

@@ -16710,7 +16710,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.694.0",
+    VERSION: "1.696.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -27428,6 +27428,29 @@ async function listRemote(_opts) {
     await requireLogin(_opts);
     remote = workspace.remote;
   }
+  if (_opts.asSuperadmin) {
+    const perPage = 100;
+    let page = 1;
+    const all = [];
+    while (true) {
+      const batch = await listWorkspacesAsSuperAdmin({ page, perPage });
+      all.push(...batch);
+      if (batch.length < perPage)
+        break;
+      page++;
+    }
+    const hasForks2 = all.some((x) => x.parent_workspace_id);
+    const headers2 = hasForks2 ? ["id", "name", "owner", "fork of"] : ["id", "name", "owner"];
+    new Table2().header(headers2).padding(2).border(true).body(all.map((x) => {
+      const row = [x.id, x.name, x.owner];
+      if (hasForks2)
+        row.push(x.parent_workspace_id ?? "-");
+      return row;
+    })).render();
+    info(`Remote: ${colors.bold(remote)}`);
+    info(`Total workspaces: ${colors.green.bold(all.length.toString())} (superadmin)`);
+    return;
+  }
   const userWorkspaces = await listUserWorkspaces();
   const hasForks = userWorkspaces.workspaces.some((x) => x.parent_workspace_id);
   const headers = hasForks ? ["id", "name", "username", "fork of", "disabled"] : ["id", "name", "username", "disabled"];
@@ -27638,7 +27661,7 @@ var init_workspace = __esm(async () => {
   ]);
   command2 = new Command().alias("profile").description("workspace related commands").action(list3).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
     default: "admin"
-  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list3).command("list-remote").description("List workspaces on the remote server that you have access to").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Create or update a workspace entry in wmill.yaml from the active profile").option("--workspace <name:string>", "Workspace name (default: current branch or workspaceId)").option("--branch <branch:string>", "Git branch to associate (default: workspace name)").action((opts) => bind(opts, true)).command("unbind").description("Remove baseUrl and workspaceId from a workspace entry").option("--workspace <name:string>", "Workspace to unbind").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--color <color:string>", "Workspace color (hex code, e.g. #ff0000)").option("--datatable-behavior <behavior:string>", "How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)").option("-y --yes", "Skip interactive prompts (defaults datatable behavior to 'skip')").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork).command("merge").description("Compare and deploy changes between a fork and its parent workspace").option("--direction <direction:string>", "Deploy direction: to-parent or to-fork").option("--all", "Deploy all changed items including conflicts").option("--skip-conflicts", "Skip items modified in both workspaces").option("--include <items:string>", "Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)").option("--exclude <items:string>", "Comma-separated kind:path items to exclude").option("--preserve-on-behalf-of", "Preserve original on_behalf_of/permissioned_as values").option("-y --yes", "Non-interactive mode (deploy without prompts)").action(mergeWorkspaces).command("connect-slack").description("Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).action(connectSlack2).command("disconnect-slack").description("Clear slack_team_id / slack_name on the active workspace (marks the workspace as disconnected). Does NOT remove the bot token variable/resource/folder/group — delete those from the local sync folder and run 'wmill sync push' to tear them down. Does NOT remove the workspace-level OAuth override — set slack_oauth_client_id/_secret to '' in settings.yaml and push.").action(disconnectSlack2);
+  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list3).command("list-remote").description("List workspaces on the remote server that you have access to").option("--as-superadmin", "List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Create or update a workspace entry in wmill.yaml from the active profile").option("--workspace <name:string>", "Workspace name (default: current branch or workspaceId)").option("--branch <branch:string>", "Git branch to associate (default: workspace name)").action((opts) => bind(opts, true)).command("unbind").description("Remove baseUrl and workspaceId from a workspace entry").option("--workspace <name:string>", "Workspace to unbind").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--color <color:string>", "Workspace color (hex code, e.g. #ff0000)").option("--datatable-behavior <behavior:string>", "How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)").option("-y --yes", "Skip interactive prompts (defaults datatable behavior to 'skip')").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork).command("merge").description("Compare and deploy changes between a fork and its parent workspace").option("--direction <direction:string>", "Deploy direction: to-parent or to-fork").option("--all", "Deploy all changed items including conflicts").option("--skip-conflicts", "Skip items modified in both workspaces").option("--include <items:string>", "Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)").option("--exclude <items:string>", "Comma-separated kind:path items to exclude").option("--preserve-on-behalf-of", "Preserve original on_behalf_of/permissioned_as values").option("-y --yes", "Non-interactive mode (deploy without prompts)").action(mergeWorkspaces).command("connect-slack").description("Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).action(connectSlack2).command("disconnect-slack").description("Clear slack_team_id / slack_name on the active workspace (marks the workspace as disconnected). Does NOT remove the bot token variable/resource/folder/group — delete those from the local sync folder and run 'wmill sync push' to tear them down. Does NOT remove the workspace-level OAuth override — set slack_oauth_client_id/_secret to '' in settings.yaml and push.").action(disconnectSlack2);
   workspace_default = command2;
 });
 
@@ -61583,6 +61606,282 @@ var init_tar = __esm(() => {
   init_tar_stream();
 });
 
+// src/utils/dependency_tree.ts
+var exports_dependency_tree = {};
+__export(exports_dependency_tree, {
+  uploadScripts: () => uploadScripts,
+  DoubleLinkedDependencyTree: () => DoubleLinkedDependencyTree
+});
+async function uploadScripts(tree, workspace) {
+  const scriptHashes = {};
+  const workspaceDeps = [];
+  for (const path7 of tree.allPaths()) {
+    const content = tree.getContent(path7);
+    const itemType = tree.getItemType(path7);
+    if (itemType === "dependencies") {
+      if (content === undefined)
+        continue;
+      const info2 = workspaceDependenciesPathToLanguageAndFilename(path7);
+      if (info2) {
+        const hash2 = await generateHash(content);
+        workspaceDeps.push({ path: path7, language: info2.language, name: info2.name, hash: hash2 });
+      }
+    } else if (itemType === "script") {
+      if (!content)
+        continue;
+      const hash2 = await generateHash(content);
+      scriptHashes[path7] = hash2;
+    }
+  }
+  if (Object.keys(scriptHashes).length === 0 && workspaceDeps.length === 0)
+    return;
+  const mismatched = await diffRawScriptsWithDeployed({
+    workspace: workspace.workspaceId,
+    requestBody: {
+      scripts: scriptHashes,
+      workspace_deps: workspaceDeps
+    }
+  });
+  for (const path7 of mismatched) {
+    const content = tree.getContent(path7);
+    const itemType = tree.getItemType(path7);
+    if (itemType === "dependencies") {
+      if (content !== undefined) {
+        tree.setContentHash(path7, "mismatched");
+      }
+    } else if (content) {
+      const hash2 = await storeRawScriptTemp({
+        workspace: workspace.workspaceId,
+        requestBody: content
+      });
+      tree.setContentHash(path7, hash2);
+    }
+  }
+}
+
+class DoubleLinkedDependencyTree {
+  nodes = new Map;
+  workspaceDeps = {};
+  setWorkspaceDeps(deps) {
+    this.workspaceDeps = deps;
+  }
+  async addNode(path7, content, language, metadata, imports, itemType, folder, originalPath, isDirectlyStale, isRawApp) {
+    const hasWorkspaceDeps = itemType === "script" || itemType === "inline_script";
+    const filteredDeps = hasWorkspaceDeps ? filterWorkspaceDependencies(this.workspaceDeps, content, language) : {};
+    const stalenessHash = await generateScriptHash({}, content, metadata);
+    if (!this.nodes.has(path7)) {
+      this.nodes.set(path7, {
+        content: "",
+        stalenessHash: "",
+        language: "deno",
+        metadata: "",
+        imports: new Set,
+        importedBy: new Set,
+        itemType: "script",
+        folder: "",
+        originalPath: "",
+        isDirectlyStale: false
+      });
+    }
+    const node = this.nodes.get(path7);
+    node.content = content;
+    node.stalenessHash = stalenessHash;
+    node.language = language;
+    node.metadata = metadata;
+    node.itemType = itemType;
+    node.folder = folder;
+    node.originalPath = originalPath;
+    node.isDirectlyStale = isDirectlyStale;
+    node.isRawApp = isRawApp;
+    const filteredDepsPaths = Object.keys(filteredDeps);
+    for (const depsPath of filteredDepsPaths) {
+      if (!this.nodes.has(depsPath)) {
+        const depsInfo = workspaceDependenciesPathToLanguageAndFilename(depsPath);
+        const contentHash = await generateHash(filteredDeps[depsPath] + depsPath);
+        const isUpToDate = await checkifMetadataUptodate(depsPath, contentHash, undefined);
+        this.nodes.set(depsPath, {
+          content: filteredDeps[depsPath],
+          stalenessHash: "",
+          language: depsInfo?.language ?? "deno",
+          metadata: "",
+          imports: new Set,
+          importedBy: new Set,
+          itemType: "dependencies",
+          folder: "",
+          originalPath: depsPath,
+          isDirectlyStale: !isUpToDate
+        });
+      }
+    }
+    const allImports = [...imports, ...filteredDepsPaths];
+    for (const importPath of allImports) {
+      node.imports.add(importPath);
+      if (!this.nodes.has(importPath)) {
+        this.nodes.set(importPath, {
+          content: "",
+          stalenessHash: "",
+          language: "deno",
+          metadata: "",
+          imports: new Set,
+          importedBy: new Set,
+          itemType: "script",
+          folder: "",
+          originalPath: "",
+          isDirectlyStale: false
+        });
+      }
+      this.nodes.get(importPath).importedBy.add(path7);
+    }
+  }
+  getContent(path7) {
+    return this.nodes.get(path7)?.content;
+  }
+  getStalenessHash(path7) {
+    return this.nodes.get(path7)?.stalenessHash;
+  }
+  getContentHash(path7) {
+    return this.nodes.get(path7)?.contentHash;
+  }
+  setContentHash(path7, hash2) {
+    const node = this.nodes.get(path7);
+    if (node) {
+      node.contentHash = hash2;
+    }
+  }
+  getLanguage(path7) {
+    return this.nodes.get(path7)?.language;
+  }
+  getMetadata(path7) {
+    return this.nodes.get(path7)?.metadata;
+  }
+  getStaleReason(path7) {
+    return this.nodes.get(path7)?.staleReason;
+  }
+  getItemType(path7) {
+    return this.nodes.get(path7)?.itemType;
+  }
+  getFolder(path7) {
+    return this.nodes.get(path7)?.folder;
+  }
+  getIsRawApp(path7) {
+    return this.nodes.get(path7)?.isRawApp;
+  }
+  getIsDirectlyStale(path7) {
+    return this.nodes.get(path7)?.isDirectlyStale ?? false;
+  }
+  getOriginalPath(path7) {
+    return this.nodes.get(path7)?.originalPath;
+  }
+  getImports(path7) {
+    return this.nodes.get(path7)?.imports;
+  }
+  isStale(path7) {
+    return this.nodes.get(path7)?.staleReason !== undefined;
+  }
+  propagateStaleness() {
+    const directlyStale = new Set;
+    for (const [path7, node] of this.nodes.entries()) {
+      if (node.isDirectlyStale) {
+        directlyStale.add(path7);
+        node.staleReason = "content changed";
+      }
+    }
+    const allStale = new Set(directlyStale);
+    const queue = [...directlyStale];
+    const visited = new Set;
+    while (queue.length > 0) {
+      const scriptPath = queue.shift();
+      if (visited.has(scriptPath))
+        continue;
+      visited.add(scriptPath);
+      const node = this.nodes.get(scriptPath);
+      if (!node)
+        continue;
+      for (const importer of node.importedBy) {
+        if (!allStale.has(importer)) {
+          allStale.add(importer);
+          queue.push(importer);
+          const importerNode = this.nodes.get(importer);
+          if (importerNode)
+            importerNode.staleReason = `depends on ${scriptPath}`;
+        }
+      }
+    }
+  }
+  traverseTransitive(scriptPath, callback) {
+    const queue = [scriptPath];
+    const visited = new Set;
+    while (queue.length > 0) {
+      const current = queue.shift();
+      if (visited.has(current))
+        continue;
+      visited.add(current);
+      const node = this.nodes.get(current);
+      if (!node)
+        continue;
+      for (const importPath of node.imports) {
+        const importNode = this.nodes.get(importPath);
+        if (importNode) {
+          const stop = callback(importPath, importNode);
+          if (!stop) {
+            queue.push(importPath);
+          }
+        }
+      }
+    }
+  }
+  allPaths() {
+    return this.nodes.keys();
+  }
+  *stalePaths() {
+    for (const [path7, node] of this.nodes.entries()) {
+      if (node.staleReason) {
+        yield path7;
+      }
+    }
+  }
+  has(path7) {
+    return this.nodes.has(path7);
+  }
+  getMismatchedWorkspaceDeps() {
+    const result = {};
+    for (const [path7, node] of this.nodes.entries()) {
+      if (node.itemType === "dependencies" && node.contentHash && node.content !== undefined) {
+        result[path7] = node.content;
+      }
+    }
+    return result;
+  }
+  getTempScriptRefs(scriptPath) {
+    const result = {};
+    this.traverseTransitive(scriptPath, (_path, node) => {
+      if (node.contentHash) {
+        result[_path] = node.contentHash;
+      }
+    });
+    return result;
+  }
+  async persistDepsHashes(depsPaths) {
+    for (const path7 of depsPaths) {
+      const node = this.nodes.get(path7);
+      if (node?.itemType === "dependencies" && node.content !== undefined) {
+        const hash2 = await generateHash(node.content + path7);
+        await updateMetadataGlobalLock(path7, hash2);
+      }
+    }
+  }
+  get size() {
+    return this.nodes.size;
+  }
+}
+var init_dependency_tree = __esm(async () => {
+  init_services_gen();
+  await __promiseAll([
+    init_metadata(),
+    init_utils()
+  ]);
+});
+
 // src/commands/script/script.ts
 import { writeFile as writeFile5, stat as stat4, mkdir as mkdir3 } from "node:fs/promises";
 import { Buffer as Buffer4 } from "node:buffer";
@@ -62346,8 +62645,20 @@ async function generateMetadata(opts, scriptPath) {
       info(colors.green.bold("No metadata to update"));
       return;
     }
+    const { DoubleLinkedDependencyTree: DoubleLinkedDependencyTree2, uploadScripts: uploadScripts2 } = await init_dependency_tree().then(() => exports_dependency_tree);
+    const tree = new DoubleLinkedDependencyTree2;
+    tree.setWorkspaceDeps(rawWorkspaceDependencies);
+    for (const e of Object.keys(elems)) {
+      await generateScriptMetadataInternal(e, workspace, opts, true, true, rawWorkspaceDependencies, codebases, false, tree);
+    }
+    tree.propagateStaleness();
+    try {
+      await uploadScripts2(tree, workspace);
+    } catch (e) {
+      warn(colors.yellow(`Failed to upload scripts to temp storage (backend may be too old): ${e}. ` + `Locks will be generated using deployed script versions only — locally modified ` + `relative imports may not be reflected.`));
+    }
     for (const e of Object.keys(elems)) {
-      await generateScriptMetadataInternal(e, workspace, opts, false, true, rawWorkspaceDependencies, codebases, false);
+      await generateScriptMetadataInternal(e, workspace, opts, false, true, rawWorkspaceDependencies, codebases, false, tree);
     }
   }
 }
@@ -64272,281 +64583,11 @@ var init_flow_metadata = __esm(async () => {
   import_yaml9 = __toESM(require_dist(), 1);
 });
 
-// src/utils/dependency_tree.ts
-async function uploadScripts(tree, workspace) {
-  const scriptHashes = {};
-  const workspaceDeps = [];
-  for (const path11 of tree.allPaths()) {
-    const content = tree.getContent(path11);
-    const itemType = tree.getItemType(path11);
-    if (itemType === "dependencies") {
-      if (content === undefined)
-        continue;
-      const info2 = workspaceDependenciesPathToLanguageAndFilename(path11);
-      if (info2) {
-        const hash2 = await generateHash(content);
-        workspaceDeps.push({ path: path11, language: info2.language, name: info2.name, hash: hash2 });
-      }
-    } else if (itemType === "script") {
-      if (!content)
-        continue;
-      const hash2 = await generateHash(content);
-      scriptHashes[path11] = hash2;
-    }
-  }
-  if (Object.keys(scriptHashes).length === 0 && workspaceDeps.length === 0)
-    return;
-  const mismatched = await diffRawScriptsWithDeployed({
-    workspace: workspace.workspaceId,
-    requestBody: {
-      scripts: scriptHashes,
-      workspace_deps: workspaceDeps
-    }
-  });
-  for (const path11 of mismatched) {
-    const content = tree.getContent(path11);
-    const itemType = tree.getItemType(path11);
-    if (itemType === "dependencies") {
-      if (content !== undefined) {
-        tree.setContentHash(path11, "mismatched");
-      }
-    } else if (content) {
-      const hash2 = await storeRawScriptTemp({
-        workspace: workspace.workspaceId,
-        requestBody: content
-      });
-      tree.setContentHash(path11, hash2);
-    }
-  }
-}
-
-class DoubleLinkedDependencyTree {
-  nodes = new Map;
-  workspaceDeps = {};
-  setWorkspaceDeps(deps) {
-    this.workspaceDeps = deps;
-  }
-  async addNode(path11, content, language, metadata, imports, itemType, folder, originalPath, isDirectlyStale, isRawApp) {
-    const hasWorkspaceDeps = itemType === "script" || itemType === "inline_script";
-    const filteredDeps = hasWorkspaceDeps ? filterWorkspaceDependencies(this.workspaceDeps, content, language) : {};
-    const stalenessHash = await generateScriptHash({}, content, metadata);
-    if (!this.nodes.has(path11)) {
-      this.nodes.set(path11, {
-        content: "",
-        stalenessHash: "",
-        language: "deno",
-        metadata: "",
-        imports: new Set,
-        importedBy: new Set,
-        itemType: "script",
-        folder: "",
-        originalPath: "",
-        isDirectlyStale: false
-      });
-    }
-    const node = this.nodes.get(path11);
-    node.content = content;
-    node.stalenessHash = stalenessHash;
-    node.language = language;
-    node.metadata = metadata;
-    node.itemType = itemType;
-    node.folder = folder;
-    node.originalPath = originalPath;
-    node.isDirectlyStale = isDirectlyStale;
-    node.isRawApp = isRawApp;
-    const filteredDepsPaths = Object.keys(filteredDeps);
-    for (const depsPath of filteredDepsPaths) {
-      if (!this.nodes.has(depsPath)) {
-        const depsInfo = workspaceDependenciesPathToLanguageAndFilename(depsPath);
-        const contentHash = await generateHash(filteredDeps[depsPath] + depsPath);
-        const isUpToDate = await checkifMetadataUptodate(depsPath, contentHash, undefined);
-        this.nodes.set(depsPath, {
-          content: filteredDeps[depsPath],
-          stalenessHash: "",
-          language: depsInfo?.language ?? "deno",
-          metadata: "",
-          imports: new Set,
-          importedBy: new Set,
-          itemType: "dependencies",
-          folder: "",
-          originalPath: depsPath,
-          isDirectlyStale: !isUpToDate
-        });
-      }
-    }
-    const allImports = [...imports, ...filteredDepsPaths];
-    for (const importPath of allImports) {
-      node.imports.add(importPath);
-      if (!this.nodes.has(importPath)) {
-        this.nodes.set(importPath, {
-          content: "",
-          stalenessHash: "",
-          language: "deno",
-          metadata: "",
-          imports: new Set,
-          importedBy: new Set,
-          itemType: "script",
-          folder: "",
-          originalPath: "",
-          isDirectlyStale: false
-        });
-      }
-      this.nodes.get(importPath).importedBy.add(path11);
-    }
-  }
-  getContent(path11) {
-    return this.nodes.get(path11)?.content;
-  }
-  getStalenessHash(path11) {
-    return this.nodes.get(path11)?.stalenessHash;
-  }
-  getContentHash(path11) {
-    return this.nodes.get(path11)?.contentHash;
-  }
-  setContentHash(path11, hash2) {
-    const node = this.nodes.get(path11);
-    if (node) {
-      node.contentHash = hash2;
-    }
-  }
-  getLanguage(path11) {
-    return this.nodes.get(path11)?.language;
-  }
-  getMetadata(path11) {
-    return this.nodes.get(path11)?.metadata;
-  }
-  getStaleReason(path11) {
-    return this.nodes.get(path11)?.staleReason;
-  }
-  getItemType(path11) {
-    return this.nodes.get(path11)?.itemType;
-  }
-  getFolder(path11) {
-    return this.nodes.get(path11)?.folder;
-  }
-  getIsRawApp(path11) {
-    return this.nodes.get(path11)?.isRawApp;
-  }
-  getIsDirectlyStale(path11) {
-    return this.nodes.get(path11)?.isDirectlyStale ?? false;
-  }
-  getOriginalPath(path11) {
-    return this.nodes.get(path11)?.originalPath;
-  }
-  getImports(path11) {
-    return this.nodes.get(path11)?.imports;
-  }
-  isStale(path11) {
-    return this.nodes.get(path11)?.staleReason !== undefined;
-  }
-  propagateStaleness() {
-    const directlyStale = new Set;
-    for (const [path11, node] of this.nodes.entries()) {
-      if (node.isDirectlyStale) {
-        directlyStale.add(path11);
-        node.staleReason = "content changed";
-      }
-    }
-    const allStale = new Set(directlyStale);
-    const queue = [...directlyStale];
-    const visited = new Set;
-    while (queue.length > 0) {
-      const scriptPath = queue.shift();
-      if (visited.has(scriptPath))
-        continue;
-      visited.add(scriptPath);
-      const node = this.nodes.get(scriptPath);
-      if (!node)
-        continue;
-      for (const importer of node.importedBy) {
-        if (!allStale.has(importer)) {
-          allStale.add(importer);
-          queue.push(importer);
-          const importerNode = this.nodes.get(importer);
-          if (importerNode)
-            importerNode.staleReason = `depends on ${scriptPath}`;
-        }
-      }
-    }
-  }
-  traverseTransitive(scriptPath, callback) {
-    const queue = [scriptPath];
-    const visited = new Set;
-    while (queue.length > 0) {
-      const current = queue.shift();
-      if (visited.has(current))
-        continue;
-      visited.add(current);
-      const node = this.nodes.get(current);
-      if (!node)
-        continue;
-      for (const importPath of node.imports) {
-        const importNode = this.nodes.get(importPath);
-        if (importNode) {
-          const stop = callback(importPath, importNode);
-          if (!stop) {
-            queue.push(importPath);
-          }
-        }
-      }
-    }
-  }
-  allPaths() {
-    return this.nodes.keys();
-  }
-  *stalePaths() {
-    for (const [path11, node] of this.nodes.entries()) {
-      if (node.staleReason) {
-        yield path11;
-      }
-    }
-  }
-  has(path11) {
-    return this.nodes.has(path11);
-  }
-  getMismatchedWorkspaceDeps() {
-    const result = {};
-    for (const [path11, node] of this.nodes.entries()) {
-      if (node.itemType === "dependencies" && node.contentHash && node.content !== undefined) {
-        result[path11] = node.content;
-      }
-    }
-    return result;
-  }
-  getTempScriptRefs(scriptPath) {
-    const result = {};
-    this.traverseTransitive(scriptPath, (_path, node) => {
-      if (node.contentHash) {
-        result[_path] = node.contentHash;
-      }
-    });
-    return result;
-  }
-  async persistDepsHashes(depsPaths) {
-    for (const path11 of depsPaths) {
-      const node = this.nodes.get(path11);
-      if (node?.itemType === "dependencies" && node.content !== undefined) {
-        const hash2 = await generateHash(node.content + path11);
-        await updateMetadataGlobalLock(path11, hash2);
-      }
-    }
-  }
-  get size() {
-    return this.nodes.size;
-  }
-}
-var init_dependency_tree = __esm(async () => {
-  init_services_gen();
-  await __promiseAll([
-    init_metadata(),
-    init_utils()
-  ]);
-});
-
 // src/commands/generate-metadata/generate-metadata.ts
 var exports_generate_metadata = {};
 __export(exports_generate_metadata, {
   rehashOnly: () => rehashOnly,
+  generateMetadata: () => generateMetadata2,
   default: () => generate_metadata_default
 });
 import { sep as SEP8 } from "node:path";
@@ -66754,12 +66795,65 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   const staleScripts = [];
   const staleFlows = [];
   const staleApps = [];
+  const tree = autoRegenerate ? new DoubleLinkedDependencyTree : undefined;
+  if (tree)
+    tree.setWorkspaceDeps(rawWorkspaceDependencies);
   for (const change of tracker.scripts) {
-    const stale = await generateScriptMetadataInternal(change, workspace, opts, !autoRegenerate, true, rawWorkspaceDependencies, codebases, false);
-    if (stale) {
+    const stale = await generateScriptMetadataInternal(change, workspace, opts, true, true, rawWorkspaceDependencies, codebases, false, tree);
+    if (!autoRegenerate && stale) {
       staleScripts.push(stale);
     }
   }
+  for (const change of tracker.flows) {
+    const stale = await generateFlowLockInternal(change, true, workspace, opts, false, true, tree);
+    if (!autoRegenerate && stale) {
+      staleFlows.push(stale);
+    }
+  }
+  for (const change of tracker.apps) {
+    const stale = await generateAppLocksInternal(change, false, true, workspace, opts, true, true, tree);
+    if (!autoRegenerate && stale) {
+      staleApps.push(stale);
+    }
+  }
+  for (const change of tracker.rawApps) {
+    const stale = await generateAppLocksInternal(change, true, true, workspace, opts, true, true, tree);
+    if (!autoRegenerate && stale) {
+      staleApps.push(stale);
+    }
+  }
+  if (autoRegenerate && tree) {
+    tree.propagateStaleness();
+    try {
+      await uploadScripts(tree, workspace);
+    } catch (e) {
+      warn(colors.yellow(`Failed to upload scripts to temp storage (backend may be too old): ${e}. ` + `Locks will be generated using deployed script versions only — locally modified ` + `relative imports may not be reflected.`));
+    }
+    for (const change of tracker.scripts) {
+      const generated = await generateScriptMetadataInternal(change, workspace, opts, false, true, rawWorkspaceDependencies, codebases, false, tree);
+      if (generated) {
+        staleScripts.push(generated);
+      }
+    }
+    for (const change of tracker.flows) {
+      const generated = await generateFlowLockInternal(change, false, workspace, opts, false, true, tree);
+      if (generated) {
+        staleFlows.push(generated);
+      }
+    }
+    for (const change of tracker.apps) {
+      const generated = await generateAppLocksInternal(change, false, false, workspace, opts, true, true, tree);
+      if (generated) {
+        staleApps.push(generated);
+      }
+    }
+    for (const change of tracker.rawApps) {
+      const generated = await generateAppLocksInternal(change, true, false, workspace, opts, true, true, tree);
+      if (generated) {
+        staleApps.push(generated);
+      }
+    }
+  }
   if (staleScripts.length > 0) {
     info("");
     if (autoRegenerate) {
@@ -66776,12 +66870,6 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
     }
     info("");
   }
-  for (const change of tracker.flows) {
-    const stale = await generateFlowLockInternal(change, !autoRegenerate, workspace, opts, false, true);
-    if (stale) {
-      staleFlows.push(stale);
-    }
-  }
   if (staleFlows.length > 0) {
     if (autoRegenerate) {
       info("Auto-regenerated locks for stale flows:");
@@ -66797,18 +66885,6 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
     }
     info("");
   }
-  for (const change of tracker.apps) {
-    const stale = await generateAppLocksInternal(change, false, !autoRegenerate, workspace, opts, true, true);
-    if (stale) {
-      staleApps.push(stale);
-    }
-  }
-  for (const change of tracker.rawApps) {
-    const stale = await generateAppLocksInternal(change, true, !autoRegenerate, workspace, opts, true, true);
-    if (stale) {
-      staleApps.push(stale);
-    }
-  }
   if (staleApps.length > 0) {
     if (autoRegenerate) {
       info("Auto-regenerated locks for stale apps:");
@@ -67511,6 +67587,7 @@ var init_sync = __esm(async () => {
     init_types(),
     init_codebase(),
     init_metadata(),
+    init_dependency_tree(),
     init_resource(),
     init_flow_metadata(),
     init_app(),
@@ -79022,6 +79099,37 @@ Name the parameters by adding comments before the statement:
 -- @name2 (int64) = 0
 SELECT * FROM users WHERE name = @name1 AND age > @name2;
 \`\`\`
+
+## Receiving an S3Object as a script parameter
+
+Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
+it, downloads the file, and binds it as a \`STRING\` JSON parameter — Parquet/CSV
+files are decoded server-side into a JSON array of records, JSON/JSONL pass
+through. Consume with \`JSON_EXTRACT_ARRAY\` / \`JSON_VALUE\`:
+
+\`\`\`sql
+-- @file (s3object)
+SELECT
+  CAST(JSON_VALUE(row, '$.id') AS INT64) AS id,
+  JSON_VALUE(row, '$.name') AS name
+FROM UNNEST(JSON_EXTRACT_ARRAY(@file)) AS row;
+\`\`\`
+
+## Streaming query results to S3
+
+Add a \`-- s3\` directive at the top of the script to stream the result set to S3
+instead of returning rows. Windmill writes the file and returns its \`S3Object\`
+as the script result.
+
+\`\`\`sql
+-- s3 prefix=exports/users format=parquet
+SELECT id, name FROM users;
+\`\`\`
+
+All keys are optional: \`prefix\` (object key prefix), \`storage\` (named storage —
+omit to use the workspace default), \`format\` (\`json\` (default), \`parquet\`, or
+\`csv\`). Use this for large result sets — rows stream directly to S3 instead of
+being buffered, bypassing the 10000-row return cap.
 `,
   "write-script-bun": `---
 name: write-script-bun
@@ -79145,19 +79253,20 @@ export async function preprocessor(event: Event) {
 
 ## S3 Object Operations
 
-Windmill provides built-in support for S3-compatible storage operations.
-
-### S3Object Type
+Windmill provides built-in support for S3-compatible storage operations. The \`wmill.S3Object\` type covers both the \`s3://storage/key\` URI form (\`s3:///key\` for the workspace default storage) and the \`{ s3, storage? }\` record form — always use it instead of redefining your own.
 
-The S3Object type represents a file in S3 storage:
+### Receiving an S3Object as a script parameter
 
 \`\`\`typescript
-type S3Object = {
-  s3: string; // Path within the bucket
-};
+import * as wmill from "windmill-client";
+
+export async function main(file: wmill.S3Object) {
+  const content = await wmill.loadS3File(file);
+  // ...
+}
 \`\`\`
 
-## TypeScript Operations
+### S3 operations
 
 \`\`\`typescript
 import * as wmill from "windmill-client";
@@ -79169,7 +79278,7 @@ const content: Uint8Array = await wmill.loadS3File(s3object);
 const blob: Blob = await wmill.loadS3FileStream(s3object);
 
 // Write file to S3
-const result: S3Object = await wmill.writeS3File(
+const result: wmill.S3Object = await wmill.writeS3File(
   s3object, // Target path (or undefined to auto-generate)
   fileContent, // string or Blob
   s3ResourcePath // Optional: specific S3 resource to use
@@ -79835,19 +79944,20 @@ export async function preprocessor(event: Event) {
 
 ## S3 Object Operations
 
-Windmill provides built-in support for S3-compatible storage operations.
+Windmill provides built-in support for S3-compatible storage operations. The \`wmill.S3Object\` type covers both the \`s3://storage/key\` URI form (\`s3:///key\` for the workspace default storage) and the \`{ s3, storage? }\` record form — always use it instead of redefining your own.
 
-### S3Object Type
-
-The S3Object type represents a file in S3 storage:
+### Receiving an S3Object as a script parameter
 
 \`\`\`typescript
-type S3Object = {
-  s3: string; // Path within the bucket
-};
+import * as wmill from "windmill-client";
+
+export async function main(file: wmill.S3Object) {
+  const content = await wmill.loadS3File(file);
+  // ...
+}
 \`\`\`
 
-## TypeScript Operations
+### S3 operations
 
 \`\`\`typescript
 import * as wmill from "windmill-client";
@@ -79859,7 +79969,7 @@ const content: Uint8Array = await wmill.loadS3File(s3object);
 const blob: Blob = await wmill.loadS3FileStream(s3object);
 
 // Write file to S3
-const result: S3Object = await wmill.writeS3File(
+const result: wmill.S3Object = await wmill.writeS3File(
   s3object, // Target path (or undefined to auto-generate)
   fileContent, // string or Blob
   s3ResourcePath // Optional: specific S3 resource to use
@@ -80613,19 +80723,20 @@ export async function preprocessor(event: Event) {
 
 ## S3 Object Operations
 
-Windmill provides built-in support for S3-compatible storage operations.
-
-### S3Object Type
+Windmill provides built-in support for S3-compatible storage operations. The \`wmill.S3Object\` type covers both the \`s3://storage/key\` URI form (\`s3:///key\` for the workspace default storage) and the \`{ s3, storage? }\` record form — always use it instead of redefining your own.
 
-The S3Object type represents a file in S3 storage:
+### Receiving an S3Object as a script parameter
 
 \`\`\`typescript
-type S3Object = {
-  s3: string; // Path within the bucket
-};
+import * as wmill from "windmill-client";
+
+export async function main(file: wmill.S3Object) {
+  const content = await wmill.loadS3File(file);
+  // ...
+}
 \`\`\`
 
-## TypeScript Operations
+### S3 operations
 
 \`\`\`typescript
 import * as wmill from "windmill-client";
@@ -80637,7 +80748,7 @@ const content: Uint8Array = await wmill.loadS3File(s3object);
 const blob: Blob = await wmill.loadS3FileStream(s3object);
 
 // Write file to S3
-const result: S3Object = await wmill.writeS3File(
+const result: wmill.S3Object = await wmill.writeS3File(
   s3object, // Target path (or undefined to auto-generate)
   fileContent, // string or Blob
   s3ResourcePath // Optional: specific S3 resource to use
@@ -81274,6 +81385,30 @@ SELECT * FROM read_parquet('s3:///path/to/file.parquet');
 -- JSON files
 SELECT * FROM read_json('s3:///path/to/file.json');
 \`\`\`
+
+### Receiving an S3Object as a script parameter
+
+Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for it
+and binds the arg as the bare \`s3://storage/key\` URI, which DuckDB's reader
+functions consume directly:
+
+\`\`\`sql
+-- $file (s3object)
+SELECT * FROM read_parquet($file);
+\`\`\`
+
+Works with any DuckDB reader: \`read_csv($file)\`, \`read_json($file)\`, etc.
+
+### Writing query results to S3
+
+DuckDB writes to S3 natively via \`COPY ... TO\`:
+
+\`\`\`sql
+COPY (SELECT * FROM users) TO 's3:///exports/users.parquet' (FORMAT PARQUET);
+\`\`\`
+
+Use this instead of the \`-- s3\` streaming directive supported by the other SQL
+dialects — that directive is not available in DuckDB.
 `,
   "write-script-go": `---
 name: write-script-go
@@ -81590,6 +81725,36 @@ Name the parameters by adding comments before the statement:
 -- @P2 name2 (int) = 0
 SELECT * FROM users WHERE name = @P1 AND age > @P2;
 \`\`\`
+
+## Receiving an S3Object as a script parameter
+
+Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
+it, downloads the file, and binds it as \`nvarchar(max)\` JSON text — Parquet/CSV
+files are decoded server-side into a JSON array of records, JSON/JSONL pass
+through. Consume with \`OPENJSON\`:
+
+\`\`\`sql
+-- @P1 file (s3object)
+SELECT id, name
+FROM OPENJSON(@P1)
+WITH (id INT, name NVARCHAR(200));
+\`\`\`
+
+## Streaming query results to S3
+
+Add a \`-- s3\` directive at the top of the script to stream the result set to S3
+instead of returning rows. Windmill writes the file and returns its \`S3Object\`
+as the script result.
+
+\`\`\`sql
+-- s3 prefix=exports/users format=parquet
+SELECT id, name FROM users;
+\`\`\`
+
+All keys are optional: \`prefix\` (object key prefix), \`storage\` (named storage —
+omit to use the workspace default), \`format\` (\`json\` (default), \`parquet\`, or
+\`csv\`). Use this for large result sets — rows stream directly to S3 instead of
+being buffered as the script return value.
 `,
   "write-script-mysql": `---
 name: write-script-mysql
@@ -81642,6 +81807,37 @@ Name the parameters by adding comments before the statement:
 -- ? name2 (int) = 0
 SELECT * FROM users WHERE name = ? AND age > ?;
 \`\`\`
+
+## Receiving an S3Object as a script parameter
+
+Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
+it, downloads the file, and binds it as JSON text — Parquet/CSV files are
+decoded server-side into a JSON array of records, JSON/JSONL pass through.
+Consume with \`JSON_TABLE\`:
+
+\`\`\`sql
+-- ? file (s3object)
+SELECT id, name
+FROM JSON_TABLE(?, '$[*]'
+  COLUMNS (id INT PATH '$.id', name VARCHAR(200) PATH '$.name')
+) AS r;
+\`\`\`
+
+## Streaming query results to S3
+
+Add a \`-- s3\` directive at the top of the script to stream the result set to S3
+instead of returning rows. Windmill writes the file and returns its \`S3Object\`
+as the script result.
+
+\`\`\`sql
+-- s3 prefix=exports/users format=parquet
+SELECT id, name FROM users;
+\`\`\`
+
+All keys are optional: \`prefix\` (object key prefix), \`storage\` (named storage —
+omit to use the workspace default), \`format\` (\`json\` (default), \`parquet\`, or
+\`csv\`). Use this for large result sets — rows stream directly to S3 instead of
+being buffered as the script return value.
 `,
   "write-script-nativets": `---
 name: write-script-nativets
@@ -82449,6 +82645,35 @@ Name the parameters by adding comments at the beginning of the script (without s
 -- $2 name2 = default_value
 SELECT * FROM users WHERE name = $1::TEXT AND age > $2::INT;
 \`\`\`
+
+## Receiving an S3Object as a script parameter
+
+Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
+it, downloads the file, and binds it as a \`jsonb\` parameter — Parquet/CSV files
+are decoded server-side into a JSON array of records, JSON/JSONL pass through.
+Consume with \`jsonb_to_recordset\` (or any \`jsonb\` API):
+
+\`\`\`sql
+-- $1 file (s3object)
+SELECT *
+FROM jsonb_to_recordset($1::jsonb) AS r(id INT, name TEXT);
+\`\`\`
+
+## Streaming query results to S3
+
+Add a \`-- s3\` directive at the top of the script to stream the result set to S3
+instead of returning rows. Windmill writes the file and returns its \`S3Object\`
+as the script result.
+
+\`\`\`sql
+-- s3 prefix=exports/users format=parquet
+SELECT id, name FROM users;
+\`\`\`
+
+All keys are optional: \`prefix\` (object key prefix), \`storage\` (named storage —
+omit to use the workspace default), \`format\` (\`json\` (default), \`parquet\`, or
+\`csv\`). Use this for large result sets — rows stream directly to S3 instead of
+being buffered as the script return value.
 `,
   "write-script-powershell": `---
 name: write-script-powershell
@@ -82686,6 +82911,21 @@ def preprocessor(event: Event):
 
 Windmill provides built-in support for S3-compatible storage operations.
 
+### Receiving an S3Object as a script parameter
+
+To accept a file from S3 as input to a script, type the parameter with \`S3Object\` (imported from \`wmill\`):
+
+\`\`\`python
+import wmill
+from wmill import S3Object
+
+def main(file: S3Object):
+    content = wmill.load_s3_file(file)
+    # ...
+\`\`\`
+
+### S3 operations
+
 \`\`\`python
 import wmill
 
@@ -83690,6 +83930,37 @@ Name the parameters by adding comments before the statement:
 -- ? name2 (number) = 0
 SELECT * FROM users WHERE name = ? AND age > ?;
 \`\`\`
+
+## Receiving an S3Object as a script parameter
+
+Declare the arg with type \`(s3object)\`. Windmill renders an S3 file picker for
+it, downloads the file, and binds it as JSON text — Parquet/CSV files are
+decoded server-side into a JSON array of records, JSON/JSONL pass through.
+Wrap the bind with \`PARSE_JSON(?)\` and walk it with \`LATERAL FLATTEN\`:
+
+\`\`\`sql
+-- ? file (s3object)
+SELECT
+  v.value:id::NUMBER AS id,
+  v.value:name::STRING AS name
+FROM LATERAL FLATTEN(input => PARSE_JSON(?)) v;
+\`\`\`
+
+## Streaming query results to S3
+
+Add a \`-- s3\` directive at the top of the script to stream the result set to S3
+instead of returning rows. Windmill writes the file and returns its \`S3Object\`
+as the script result.
+
+\`\`\`sql
+-- s3 prefix=exports/users format=parquet
+SELECT id, name FROM users;
+\`\`\`
+
+All keys are optional: \`prefix\` (object key prefix), \`storage\` (named storage —
+omit to use the workspace default), \`format\` (\`json\` (default), \`parquet\`, or
+\`csv\`). Use this for large result sets — rows stream directly to S3 instead of
+being buffered, bypassing the 10000-row return cap.
 `,
   "write-flow": `---
 name: write-flow
@@ -84813,12 +85084,12 @@ Use this guide when writing or modifying Windmill Workflow-as-Code (WAC) scripts
 WAC is authored as a Windmill script and deployed with the normal script workflow. It is not an OpenFlow YAML flow.
 
 Supported WAC authoring targets:
-- TypeScript scripts that import from \`windmill-client\`
+- Bun TypeScript scripts that import from \`windmill-client\`
 - Python 3 scripts that import from \`wmill\`
 
 ## File Shape
 
-TypeScript:
+Bun TypeScript:
 
 \`\`\`typescript
 import {
@@ -84860,7 +85131,7 @@ async def main(x: str):
 
 Rules:
 - Do not call \`main\`.
-- TypeScript should export the workflow entrypoint, preferably \`export const main = workflow(async (...) => { ... })\`.
+- Bun TypeScript should export the workflow entrypoint, preferably \`export const main = workflow(async (...) => { ... })\`.
 - Python must use \`@workflow\` on an async top-level function, usually \`main\`.
 - Define task functions and \`taskScript\`/\`task_script\` or \`taskFlow\`/\`task_flow\` assignments at module top level with stable names.
 - Use the exact SDK names. Do not alias \`workflow\`, \`task\`, \`taskScript\`, \`taskFlow\`, \`step\`, \`sleep\`, \`waitForApproval\`, \`task_script\`, \`task_flow\`, or \`wait_for_approval\`; the WAC parser recognizes these names directly.
@@ -85823,6 +86094,7 @@ workspace related commands
 - \`workspace whoami\` - Show the currently active user
 - \`workspace list\` - List local workspace profiles
 - \`workspace list-remote\` - List workspaces on the remote server that you have access to
+  - \`--as-superadmin\` - List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)
 - \`workspace list-forks\` - List forked workspaces on the remote server
 - \`workspace bind\` - Create or update a workspace entry in wmill.yaml from the active profile
   - \`--workspace <name:string>\` - Workspace name (default: current branch or workspaceId)
@@ -88745,7 +89017,7 @@ var config_default = command35;
 
 // src/main.ts
 await init_context();
-var VERSION = "1.694.0";
+var VERSION = "1.696.0";
 async function checkVersionSafe(cmd) {
   const mainCommand = cmd.getMainCommand();
   const upgradeCommand = mainCommand.getCommand("upgrade");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.694.0",
+  "version": "1.696.0",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",
@@ -18,7 +18,7 @@
   "dependencies": {
     "esbuild": "0.28.0",
     "windmill-parser-wasm-py": "1.693.1",
-    "windmill-parser-wasm-ts": "1.693.1",
+    "windmill-parser-wasm-ts": "1.695.0",
     "windmill-parser-wasm-regex": "1.692.0",
     "windmill-parser-wasm-go": "1.510.1",
     "windmill-parser-wasm-php": "1.647.1",