windmill-cli 1.696.1 → 1.697.0

package/esm/main.js

@@ -16440,6 +16440,48 @@ var init_login = __esm(async () => {
   ]);
 });
 
+// src/utils/http_guards.ts
+async function detectAuthGatewayChallenge(response, url) {
+  const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+  const cfMitigated = response.headers.get("cf-mitigated") ?? undefined;
+  const looksHtml = contentType.includes("text/html");
+  if (!looksHtml && cfMitigated !== "challenge")
+    return;
+  let snippet = "";
+  try {
+    snippet = (await response.clone().text()).slice(0, 256);
+  } catch {}
+  const isChallenge = cfMitigated === "challenge" || ACCESS_TITLE.test(snippet) || looksHtml && HTML_DOCTYPE.test(snippet);
+  if (!isChallenge)
+    return;
+  throw new AuthGatewayChallengeError(url || response.url || "(unknown)", response.headers.get("cf-ray") ?? undefined, cfMitigated, response.status, snippet);
+}
+var ACCESS_TITLE, HTML_DOCTYPE, AuthGatewayChallengeError;
+var init_http_guards = __esm(() => {
+  ACCESS_TITLE = /<title>\s*Sign in[^<]*Cloudflare Access\s*<\/title>/i;
+  HTML_DOCTYPE = /^\s*<(!doctype|html)/i;
+  AuthGatewayChallengeError = class AuthGatewayChallengeError extends Error {
+    url;
+    cfRay;
+    cfMitigated;
+    status;
+    bodySnippet;
+    name = "AuthGatewayChallengeError";
+    constructor(url, cfRay, cfMitigated, status, bodySnippet) {
+      const cfPart = [
+        cfRay ? `cf-ray=${cfRay}` : null,
+        cfMitigated ? `cf-mitigated=${cfMitigated}` : null
+      ].filter(Boolean).join(", ");
+      super(`Got an HTML response from ${url} (status ${status}${cfPart ? `, ${cfPart}` : ""}). ` + `The request was intercepted by an upstream auth gateway (likely Cloudflare Access) ` + `before reaching Windmill. Verify the runner is on the right network or pass service-token headers via the HEADERS env var ` + `(e.g. HEADERS="CF-Access-Client-Id: <id>, CF-Access-Client-Secret: <secret>"). ` + `Body starts with: ${JSON.stringify(bodySnippet.slice(0, 120))}`);
+      this.url = url;
+      this.cfRay = cfRay;
+      this.cfMitigated = cfMitigated;
+      this.status = status;
+      this.bodySnippet = bodySnippet;
+    }
+  };
+});
+
 // windmill-utils-internal/src/config/config.ts
 import { stat as stat2, mkdir } from "node:fs/promises";
 function getEnv2(key) {
@@ -16710,7 +16752,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.696.1",
+    VERSION: "1.697.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17174,6 +17216,8 @@ __export(exports_services_gen, {
   loadFilePreview: () => loadFilePreview,
   loadFileMetadata: () => loadFileMetadata,
   loadCsvPreview: () => loadCsvPreview,
+  listWsSpecificVersions: () => listWsSpecificVersions,
+  listWsSpecific: () => listWsSpecific,
   listWorkspacesAsSuperAdmin: () => listWorkspacesAsSuperAdmin,
   listWorkspaces: () => listWorkspaces,
   listWorkspaceInvites: () => listWorkspaceInvites,
@@ -19625,6 +19669,26 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, listWsSpecific = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/workspaces/list_ws_specific",
+    path: {
+      workspace: data3.workspace
+    }
+  });
+}, listWsSpecificVersions = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/workspaces/list_ws_specific_versions",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      kind: data3.kind,
+      path: data3.path
+    }
+  });
 }, setPublicAppRateLimit = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -25331,7 +25395,7 @@ Found ${datatables.length} datatable(s):`);
       workspace: workspace.workspaceId,
       requestBody: {
         id: trueWorkspaceId,
-        name: opts.createWorkspaceName ?? trueWorkspaceId,
+        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
         color: forkColor
       }
     });
@@ -25347,7 +25411,7 @@ Found ${datatables.length} datatable(s):`);
       workspace: workspace.workspaceId,
       requestBody: {
         id: trueWorkspaceId,
-        name: opts.createWorkspaceName ?? trueWorkspaceId,
+        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
         color: forkColor,
         forked_datatables: forkedDatatables
       }
@@ -25433,9 +25497,21 @@ var init_fork = __esm(async () => {
 });
 
 // windmill-utils-internal/src/deploy.ts
+function isTriggerKind(kind) {
+  return TRIGGER_KINDS.includes(kind);
+}
+function isTriggerOrScheduleKind(kind) {
+  return kind === "schedule" || isTriggerKind(kind);
+}
 function folderName(path2) {
   return path2.replace(/^f\//, "");
 }
+function stripOperationalStateOnUpdate(payload, alreadyExists) {
+  if (!alreadyExists)
+    return payload;
+  const { mode: _mode, enabled: _enabled, ...rest } = payload;
+  return rest;
+}
 function getSubModules(flowModule) {
   const type = flowModule?.value?.type;
   if (type === "forloopflow" || type === "whileloopflow") {
@@ -25489,6 +25565,10 @@ async function checkItemExists(provider, kind, path2, workspace) {
     return provider.existsResourceType({ workspace, path: path2 });
   } else if (kind === "folder") {
     return provider.existsFolder({ workspace, name: folderName(path2) });
+  } else if (kind === "schedule") {
+    return provider.existsSchedule({ workspace, path: path2 });
+  } else if (isTriggerKind(kind)) {
+    return provider.existsTriggerByKind(kind, { workspace, path: path2 });
   }
   throw new Error(`Unknown kind: ${kind}`);
 }
@@ -25725,6 +25805,48 @@ async function deployItem(provider, kind, path2, workspaceFrom, workspaceTo, onB
           }
         });
       }
+    } else if (kind === "schedule") {
+      const schedule = await provider.getSchedule({
+        workspace: workspaceFrom,
+        path: path2
+      });
+      const baseBody = stripOperationalStateOnUpdate(schedule, alreadyExists);
+      const requestBody = {
+        ...baseBody,
+        permissioned_as: onBehalfOf,
+        preserve_permissioned_as: preserveOnBehalfOf
+      };
+      if (alreadyExists) {
+        await provider.updateSchedule({
+          workspace: workspaceTo,
+          path: path2,
+          requestBody
+        });
+      } else {
+        await provider.createSchedule({
+          workspace: workspaceTo,
+          requestBody
+        });
+      }
+    } else if (isTriggerKind(kind)) {
+      const triggerBody = await provider.getTriggerForDeploy(kind, {
+        workspace: workspaceFrom,
+        path: path2,
+        onBehalfOf
+      });
+      const requestBody = stripOperationalStateOnUpdate(triggerBody, alreadyExists);
+      if (alreadyExists) {
+        await provider.updateTriggerByKind(kind, {
+          workspace: workspaceTo,
+          path: path2,
+          requestBody
+        });
+      } else {
+        await provider.createTriggerByKind(kind, {
+          workspace: workspaceTo,
+          requestBody
+        });
+      }
     } else {
       throw new Error(`Unknown kind: ${kind}`);
     }
@@ -25753,6 +25875,10 @@ async function deleteItemInWorkspace(provider, kind, path2, workspace) {
       await provider.deleteResourceType({ workspace, path: path2 });
     } else if (kind === "folder") {
       await provider.deleteFolder({ workspace, name: folderName(path2) });
+    } else if (kind === "schedule") {
+      await provider.deleteSchedule({ workspace, path: path2 });
+    } else if (isTriggerKind(kind)) {
+      await provider.deleteTriggerByKind(kind, { workspace, path: path2 });
     } else {
       throw new Error(`Deletion not supported for kind: ${kind}`);
     }
@@ -25772,10 +25898,30 @@ async function getOnBehalfOf(provider, kind, path2, workspace) {
     } else if (kind === "app" || kind === "raw_app") {
       const app = await provider.getAppByPath({ workspace, path: path2 });
       return app.policy?.on_behalf_of_email;
+    } else if (kind === "schedule") {
+      const schedule = await provider.getSchedule({ workspace, path: path2 });
+      return schedule.permissioned_as;
+    } else if (isTriggerKind(kind)) {
+      return await provider.getTriggerPermissionedAs(kind, { workspace, path: path2 });
     }
   } catch {}
   return;
 }
+var TRIGGER_KINDS;
+var init_deploy = __esm(() => {
+  TRIGGER_KINDS = [
+    "http_trigger",
+    "websocket_trigger",
+    "kafka_trigger",
+    "nats_trigger",
+    "postgres_trigger",
+    "mqtt_trigger",
+    "sqs_trigger",
+    "gcp_trigger",
+    "azure_trigger",
+    "email_trigger"
+  ];
+});
 
 // node_modules/@cliffy/prompt/checkbox.js
 var exports_checkbox = {};
@@ -25999,6 +26145,111 @@ var init_checkbox = __esm(async () => {
 });
 
 // src/commands/workspace/merge.ts
+function triggerService(kind) {
+  switch (kind) {
+    case "http_trigger":
+      return {
+        exists: existsHttpTrigger,
+        get: getHttpTrigger,
+        create: createHttpTrigger,
+        update: updateHttpTrigger,
+        delete: deleteHttpTrigger
+      };
+    case "websocket_trigger":
+      return {
+        exists: existsWebsocketTrigger,
+        get: getWebsocketTrigger,
+        create: createWebsocketTrigger,
+        update: updateWebsocketTrigger,
+        delete: deleteWebsocketTrigger
+      };
+    case "kafka_trigger":
+      return {
+        exists: existsKafkaTrigger,
+        get: getKafkaTrigger,
+        create: createKafkaTrigger,
+        update: updateKafkaTrigger,
+        delete: deleteKafkaTrigger
+      };
+    case "nats_trigger":
+      return {
+        exists: existsNatsTrigger,
+        get: getNatsTrigger,
+        create: createNatsTrigger,
+        update: updateNatsTrigger,
+        delete: deleteNatsTrigger
+      };
+    case "postgres_trigger":
+      return {
+        exists: existsPostgresTrigger,
+        get: getPostgresTrigger,
+        create: createPostgresTrigger,
+        update: updatePostgresTrigger,
+        delete: deletePostgresTrigger
+      };
+    case "mqtt_trigger":
+      return {
+        exists: existsMqttTrigger,
+        get: getMqttTrigger,
+        create: createMqttTrigger,
+        update: updateMqttTrigger,
+        delete: deleteMqttTrigger
+      };
+    case "sqs_trigger":
+      return {
+        exists: existsSqsTrigger,
+        get: getSqsTrigger,
+        create: createSqsTrigger,
+        update: updateSqsTrigger,
+        delete: deleteSqsTrigger
+      };
+    case "gcp_trigger":
+      return {
+        exists: existsGcpTrigger,
+        get: getGcpTrigger,
+        create: createGcpTrigger,
+        update: updateGcpTrigger,
+        delete: deleteGcpTrigger
+      };
+    case "azure_trigger":
+      return {
+        exists: existsAzureTrigger,
+        get: getAzureTrigger,
+        create: createAzureTrigger,
+        update: updateAzureTrigger,
+        delete: deleteAzureTrigger
+      };
+    case "email_trigger":
+      return {
+        exists: existsEmailTrigger,
+        get: getEmailTrigger,
+        create: createEmailTrigger,
+        update: updateEmailTrigger,
+        delete: deleteEmailTrigger
+      };
+  }
+}
+function preparePayload(kind, trigger, onBehalfOf) {
+  const preserve = onBehalfOf !== undefined;
+  const base = {
+    ...trigger,
+    permissioned_as: onBehalfOf,
+    preserve_permissioned_as: preserve
+  };
+  if (kind === "gcp_trigger") {
+    base.subscription_id = "";
+    base.subscription_mode = "create_update";
+    if (base.delivery_config) {
+      base.delivery_config = { ...base.delivery_config, audience: "" };
+    }
+    if (base.delivery_type === "push") {
+      base.base_endpoint = OpenAPI.BASE.replace(/\/api\/?$/, "");
+    } else {
+      base.base_endpoint = undefined;
+    }
+  }
+  return base;
+}
 async function mergeWorkspaces(opts) {
   const workspace = await tryResolveBranchWorkspace(opts);
   if (!workspace) {
@@ -26049,6 +26300,10 @@ async function mergeWorkspaces(opts) {
     summaryRows.push(["Resource Types", String(summary.resource_types_changed)]);
   if (summary.folders_changed > 0)
     summaryRows.push(["Folders", String(summary.folders_changed)]);
+  if (summary.schedules_changed > 0)
+    summaryRows.push(["Schedules", String(summary.schedules_changed)]);
+  if (summary.triggers_changed > 0)
+    summaryRows.push(["Triggers", String(summary.triggers_changed)]);
   summaryRows.push(["Total", String(summary.total_diffs)]);
   if (summary.conflicts > 0)
     summaryRows.push([
@@ -26114,11 +26369,9 @@ Direction: ${colors.bold(direction === "to-parent" ? `Fork → Parent (${parentW
   if (opts.all) {
     selectedDiffs = selectableDiffs;
   } else if (opts.skipConflicts) {
-    selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0));
+    selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0) && (!!opts.include || !isTriggerOrScheduleKind(d.kind)));
   } else if (opts.yes && !opts.include && !opts.exclude) {
-    if (direction === "to-fork") {
-      selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0));
-    }
+    selectedDiffs = selectableDiffs.filter((d) => !isTriggerOrScheduleKind(d.kind) && (direction !== "to-fork" || !(d.ahead > 0 && d.behind > 0)));
   } else if (!opts.yes) {
     const { Checkbox: Checkbox2 } = await init_checkbox().then(() => exports_checkbox);
     const defaultForToFork = direction === "to-fork";
@@ -26126,11 +26379,12 @@ Direction: ${colors.bold(direction === "to-parent" ? `Fork → Parent (${parentW
       message: `Select items to deploy (${selectableDiffs.length} available):`,
       options: selectableDiffs.map((d) => {
         const isConflict = d.ahead > 0 && d.behind > 0;
+        const isTriggerOrSchedule = isTriggerOrScheduleKind(d.kind);
         const label = `${d.kind}:${d.path}${isConflict ? colors.red(" [CONFLICT]") : ""}`;
         return {
           name: label,
           value: `${d.kind}:${d.path}`,
-          checked: defaultForToFork ? !isConflict : true
+          checked: !isTriggerOrSchedule && (defaultForToFork ? !isConflict : true)
         };
       })
     });
@@ -26219,6 +26473,8 @@ var init_merge = __esm(async () => {
   init_log();
   init_client();
   init_services_gen();
+  init_OpenAPI();
+  init_deploy();
   await init_context();
   provider = {
     existsFlowByPath,
@@ -26258,7 +26514,28 @@ var init_merge = __esm(async () => {
     getFolder,
     createFolder,
     updateFolder,
-    deleteFolder
+    deleteFolder,
+    existsTriggerByKind: (kind, p) => triggerService(kind).exists(p),
+    getTriggerForDeploy: async (kind, p) => {
+      const trigger = await triggerService(kind).get({
+        workspace: p.workspace,
+        path: p.path
+      });
+      return preparePayload(kind, trigger, p.onBehalfOf);
+    },
+    createTriggerByKind: (kind, p) => triggerService(kind).create(p),
+    updateTriggerByKind: (kind, p) => triggerService(kind).update(p),
+    deleteTriggerByKind: (kind, p) => triggerService(kind).delete(p),
+    getTriggerValue: (kind, p) => triggerService(kind).get(p),
+    getTriggerPermissionedAs: async (kind, p) => {
+      const trigger = await triggerService(kind).get(p);
+      return trigger?.permissioned_as;
+    },
+    existsSchedule,
+    getSchedule,
+    createSchedule,
+    updateSchedule,
+    deleteSchedule
   };
 });
 
@@ -28116,7 +28393,12 @@ async function fetchVersion(baseUrl2) {
       requestHeaders.set(key, value);
     }
   }
-  const response = await fetch(new URL(new URL(baseUrl2).origin + "/api/version"), { headers: requestHeaders, method: "GET" });
+  const versionUrl = new URL(new URL(baseUrl2).origin + "/api/version");
+  const response = await fetch(versionUrl, {
+    headers: requestHeaders,
+    method: "GET"
+  });
+  await detectAuthGatewayChallenge(response, versionUrl.toString());
   if (!response.ok) {
     await response.text();
     throw new Error(`Failed to fetch version: ${response.status} ${response.statusText}`);
@@ -28149,6 +28431,7 @@ var init_context = __esm(async () => {
   init_colors2();
   init_log();
   init_mod6();
+  init_http_guards();
   init_git();
   init_levenshtein_distance();
   await __promiseAll([
@@ -33636,23 +33919,23 @@ async function logQueueStatus(workspace, jobId, label = "Job ") {
   try {
     const job = await getJob({ workspace, id: jobId });
     if (!job)
-      return;
+      return false;
     if (job.running === true) {
       info(colors.gray(`${label}${jobId}: running, waiting for completion...`));
-      return;
+      return true;
     }
     if (typeof job.running !== "boolean") {
-      return;
+      return false;
     }
     const scheduledFor = job.scheduled_for;
     if (!scheduledFor) {
       info(colors.gray(`${label}${jobId}: queued, waiting for executor...`));
-      return;
+      return true;
     }
     const scheduledForMs = new Date(scheduledFor).getTime();
     if (!Number.isFinite(scheduledForMs)) {
       info(colors.gray(`${label}${jobId}: queued, waiting for executor...`));
-      return;
+      return true;
     }
     try {
       const pos = await getQueuePosition({
@@ -33665,10 +33948,14 @@ async function logQueueStatus(workspace, jobId, label = "Job ") {
       } else {
         info(colors.gray(`${label}${jobId}: queued, waiting for executor...`));
       }
+      return true;
     } catch {
       info(colors.gray(`${label}${jobId}: queued, waiting for executor...`));
+      return true;
     }
-  } catch {}
+  } catch {
+    return false;
+  }
 }
 async function pollJobWithQueueLogging(workspace, jobId, options) {
   const fastPollIntervalMs = options?.fastPollIntervalMs ?? DEFAULT_FAST_POLL_INTERVAL_MS;
@@ -33677,6 +33964,7 @@ async function pollJobWithQueueLogging(workspace, jobId, options) {
   const label = options?.label ? `[${options.label}] ` : "Job ";
   const startedAt = Date.now();
   let lastQueueLogAt = Date.now();
+  let lastHeartbeatAt = Date.now();
   let consecutiveErrors = 0;
   while (true) {
     try {
@@ -33692,19 +33980,26 @@ async function pollJobWithQueueLogging(workspace, jobId, options) {
     } catch (err) {
       consecutiveErrors++;
       warn(colors.yellow(`${label}${jobId}: error checking job status (${consecutiveErrors}/${MAX_CONSECUTIVE_POLL_ERRORS}): ${err?.message ?? err}`));
+      lastHeartbeatAt = Date.now();
       if (consecutiveErrors >= MAX_CONSECUTIVE_POLL_ERRORS) {
         throw new Error(`Giving up polling job ${jobId} after ${MAX_CONSECUTIVE_POLL_ERRORS} consecutive errors. Last error: ${err?.message ?? err}`);
       }
     }
     if (Date.now() - lastQueueLogAt >= QUEUE_LOG_INTERVAL_MS) {
       lastQueueLogAt = Date.now();
-      await logQueueStatus(workspace, jobId, label);
+      const logged = await logQueueStatus(workspace, jobId, label);
+      if (logged)
+        lastHeartbeatAt = Date.now();
+    }
+    if (Date.now() - lastHeartbeatAt >= HEARTBEAT_INTERVAL_MS) {
+      lastHeartbeatAt = Date.now();
+      info(colors.gray(`${label}${jobId}: still polling, queue status unavailable...`));
     }
     const delayMs = Date.now() - startedAt < fastPollDurationMs ? fastPollIntervalMs : slowPollIntervalMs;
     await new Promise((resolve6) => setTimeout(resolve6, delayMs));
   }
 }
-var DEFAULT_FAST_POLL_INTERVAL_MS = 100, DEFAULT_FAST_POLL_DURATION_MS = 2000, DEFAULT_SLOW_POLL_INTERVAL_MS = 2000, QUEUE_LOG_INTERVAL_MS = 5000, MAX_CONSECUTIVE_POLL_ERRORS = 10;
+var DEFAULT_FAST_POLL_INTERVAL_MS = 100, DEFAULT_FAST_POLL_DURATION_MS = 2000, DEFAULT_SLOW_POLL_INTERVAL_MS = 2000, QUEUE_LOG_INTERVAL_MS = 5000, HEARTBEAT_INTERVAL_MS = 60000, MAX_CONSECUTIVE_POLL_ERRORS = 10;
 var init_job_polling = __esm(() => {
   init_services_gen();
   init_log();
@@ -46847,6 +47142,7 @@ async function downloadZip(workspace, plainSecrets, skipVariables, skipResources
   const baseUrl2 = workspace.remote + "api/w/" + workspace.workspaceId + "/workspaces/tarball?";
   const zipUrl = baseUrl2 + "archive_type=zip" + baseParams;
   const zipResponse = await fetch(zipUrl, { headers: requestHeaders, method: "GET" });
+  await detectAuthGatewayChallenge(zipResponse, zipUrl);
   if (zipResponse.ok) {
     debug("Downloaded zip archive successfully");
     const blob = await zipResponse.blob();
@@ -46857,6 +47153,7 @@ async function downloadZip(workspace, plainSecrets, skipVariables, skipResources
     debug("Zip archive not supported by backend, falling back to tar");
     const tarUrl = baseUrl2 + "archive_type=tar" + baseParams;
     const tarResponse = await fetch(tarUrl, { headers: requestHeaders, method: "GET" });
+    await detectAuthGatewayChallenge(tarResponse, tarUrl);
     if (tarResponse.ok) {
       debug("Downloaded tar archive successfully");
       return await parseTarResponse(tarResponse);
@@ -46885,6 +47182,7 @@ var init_pull = __esm(async () => {
   init_mod3();
   init_log();
   init_tar_stream();
+  init_http_guards();
   await init_utils();
   import_jszip = __toESM(require_lib3(), 1);
   command3 = new Command().description("Pull all definitions in the current workspace from the API and write them to disk.").arguments("<dir:string>").action(stub);
@@ -61279,33 +61577,34 @@ async function resolveWsNameForGitBranch(branchName) {
   const match2 = findWorkspaceByGitBranch(config.workspaces, branchName);
   return match2 ? match2[0] : branchName;
 }
-function getWorkspaceSpecificTypes() {
-  return {
-    variable: ".variable.yaml",
-    resource: ".resource.yaml",
-    schedule: ".schedule.yaml",
-    ...Object.fromEntries(TRIGGER_TYPES.map((t) => [`${t}_trigger`, `.${t}_trigger.yaml`]))
-  };
+function getWorkspaceSpecificTypeKinds() {
+  return [
+    "variable",
+    "resource",
+    "schedule",
+    ...TRIGGER_TYPES.map((t) => `${t}_trigger`)
+  ];
 }
 function isTriggerFile(path7) {
-  return TRIGGER_TYPES.some((type) => path7.endsWith(`.${type}_trigger.yaml`));
+  return TRIGGER_TYPES.some((type) => path7.endsWith(`.${type}_trigger.yaml`) || path7.endsWith(`.${type}_trigger.json`));
 }
 function isScheduleFile(path7) {
-  return path7.endsWith(".schedule.yaml");
+  return path7.endsWith(".schedule.yaml") || path7.endsWith(".schedule.json");
 }
 function getFileTypeSuffix(path7) {
-  for (const [_, suffix] of Object.entries(getWorkspaceSpecificTypes())) {
-    if (path7.endsWith(suffix)) {
-      return suffix;
-    }
+  for (const kind of getWorkspaceSpecificTypeKinds()) {
+    if (path7.endsWith(`.${kind}.yaml`))
+      return `.${kind}.yaml`;
+    if (path7.endsWith(`.${kind}.json`))
+      return `.${kind}.json`;
   }
-  const resourceFileMatch = path7.match(/(\\.resource\\.file\\..+)$/);
+  const resourceFileMatch = path7.match(/(\.resource\.file\..+)$/);
   if (resourceFileMatch) {
     return resourceFileMatch[1];
   }
   return null;
 }
-function buildYamlTypePattern() {
+function buildItemTypePattern() {
   const basicTypes = ["variable", "resource", "schedule"];
   const triggerTypes = TRIGGER_TYPES.map((t) => `${t}_trigger`);
   return `((${basicTypes.join("|")})|(${triggerTypes.join("|")}))`;
@@ -61373,10 +61672,14 @@ function getSpecificItemsForCurrentBranch(config, workspaceNameOverride) {
 function matchesPatterns(path7, patterns) {
   return patterns.some((pattern) => minimatch(path7, pattern));
 }
+function normalizeJsonToYaml(path7) {
+  return path7.endsWith(".json") ? path7.slice(0, -".json".length) + ".yaml" : path7;
+}
 function isItemTypeConfigured(path7, specificItems) {
   if (!specificItems) {
     return false;
   }
+  path7 = normalizeJsonToYaml(path7);
   if (path7.endsWith(".variable.yaml")) {
     return specificItems.variables !== undefined;
   }
@@ -61404,6 +61707,7 @@ function isSpecificItem(path7, specificItems) {
   if (!specificItems) {
     return false;
   }
+  path7 = normalizeJsonToYaml(path7);
   if (path7.endsWith(".variable.yaml")) {
     return specificItems.variables ? matchesPatterns(path7, specificItems.variables) : false;
   }
@@ -61447,12 +61751,13 @@ function toWorkspaceSpecificPath(basePath, workspaceName) {
   if (sanitizedName !== workspaceName) {
     console.warn(`Warning: Workspace name "${workspaceName}" contains filesystem-unsafe characters (/ \\ : * ? " < > | .) and was sanitized to "${sanitizedName}". This may cause collisions with other similarly named branches.`);
   }
-  if (basePath.endsWith("/folder.meta.yaml")) {
-    const pathWithoutMeta = basePath.substring(0, basePath.length - "/folder.meta.yaml".length);
-    return `${pathWithoutMeta}/folder.${sanitizedName}.meta.yaml`;
+  const folderMetaMatch = basePath.match(/^(.*)\/folder\.meta\.(yaml|json)$/);
+  if (folderMetaMatch) {
+    return `${folderMetaMatch[1]}/folder.${sanitizedName}.meta.${folderMetaMatch[2]}`;
   }
-  if (basePath === "settings.yaml") {
-    return `settings.${sanitizedName}.yaml`;
+  const settingsMatch = basePath.match(/^settings\.(yaml|json)$/);
+  if (settingsMatch) {
+    return `settings.${sanitizedName}.${settingsMatch[1]}`;
   }
   const resourceFileMatch = basePath.match(/^(.+?)(\.resource\.file\..+)$/);
   let extension;
@@ -61473,13 +61778,15 @@ function toWorkspaceSpecificPath(basePath, workspaceName) {
 function fromWorkspaceSpecificPath(workspaceSpecificPath, workspaceName) {
   const sanitizedName = workspaceName.replace(/[\/\\:*?"<>|.]/g, "_");
   const escapedName = sanitizedName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const folderPattern = new RegExp(`/folder\\.${escapedName}\\.meta\\.yaml$`);
-  if (folderPattern.test(workspaceSpecificPath)) {
-    return workspaceSpecificPath.replace(folderPattern, "/folder.meta.yaml");
+  const folderPattern = new RegExp(`/folder\\.${escapedName}\\.meta\\.(yaml|json)$`);
+  const folderMatch = workspaceSpecificPath.match(folderPattern);
+  if (folderMatch) {
+    return workspaceSpecificPath.replace(folderPattern, `/folder.meta.${folderMatch[1]}`);
   }
-  const settingsPattern = new RegExp(`^settings\\.${escapedName}\\.yaml$`);
-  if (settingsPattern.test(workspaceSpecificPath)) {
-    return "settings.yaml";
+  const settingsPattern = new RegExp(`^settings\\.${escapedName}\\.(yaml|json)$`);
+  const settingsMatch = workspaceSpecificPath.match(settingsPattern);
+  if (settingsMatch) {
+    return `settings.${settingsMatch[1]}`;
   }
   const resourceFilePattern = new RegExp(`\\.${escapedName}(\\.resource\\.file\\..+)$`);
   const resourceFileMatch = workspaceSpecificPath.match(resourceFilePattern);
@@ -61488,12 +61795,12 @@ function fromWorkspaceSpecificPath(workspaceSpecificPath, workspaceName) {
     const pathWithoutBranchAndExtension2 = workspaceSpecificPath.substring(0, workspaceSpecificPath.length - `.${sanitizedName}${extension2}`.length);
     return `${pathWithoutBranchAndExtension2}${extension2}`;
   }
-  const yamlPattern = new RegExp(`\\.${escapedName}(\\.${buildYamlTypePattern()}\\.yaml)$`);
-  const yamlMatch = workspaceSpecificPath.match(yamlPattern);
-  if (!yamlMatch) {
+  const typedPattern = new RegExp(`\\.${escapedName}(\\.${buildItemTypePattern()}\\.(yaml|json))$`);
+  const typedMatch = workspaceSpecificPath.match(typedPattern);
+  if (!typedMatch) {
     return workspaceSpecificPath;
   }
-  const extension = yamlMatch[1];
+  const extension = typedMatch[1];
   const pathWithoutBranchAndExtension = workspaceSpecificPath.substring(0, workspaceSpecificPath.length - `.${sanitizedName}${extension}`.length);
   return `${pathWithoutBranchAndExtension}${extension}`;
 }
@@ -61529,14 +61836,14 @@ function isCurrentWorkspaceFile(path7, workspaceNameOverride) {
   const escapedName = sanitizedName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   let pattern = workspacePatternCache.get(currentWorkspace);
   if (!pattern) {
-    pattern = new RegExp(`\\.${escapedName}\\.${buildYamlTypePattern()}\\.yaml$|` + `\\.${escapedName}\\.resource\\.file\\..+$|` + `/folder\\.${escapedName}\\.meta\\.yaml$|` + `^settings\\.${escapedName}\\.yaml$`);
+    pattern = new RegExp(`\\.${escapedName}\\.${buildItemTypePattern()}\\.(yaml|json)$|` + `\\.${escapedName}\\.resource\\.file\\..+$|` + `/folder\\.${escapedName}\\.meta\\.(yaml|json)$|` + `^settings\\.${escapedName}\\.(yaml|json)$`);
     workspacePatternCache.set(currentWorkspace, pattern);
   }
   return pattern.test(path7);
 }
 function isWorkspaceSpecificFile(path7) {
-  const yamlTypePattern = buildYamlTypePattern();
-  return new RegExp(`\\.[^.]+\\.${yamlTypePattern}\\.yaml$|` + `\\.[^.]+\\.resource\\.file\\..+$|` + `/folder\\.[^.]+\\.meta\\.yaml$|` + `^settings\\.[^.]+\\.yaml$`).test(path7);
+  const typePattern = buildItemTypePattern();
+  return new RegExp(`\\.[^.]+\\.${typePattern}\\.(yaml|json)$|` + `\\.[^.]+\\.resource\\.file\\..+$|` + `/folder\\.[^.]+\\.meta\\.(yaml|json)$|` + `^settings\\.[^.]+\\.(yaml|json)$`).test(path7);
 }
 var workspacePatternCache;
 var init_specific_items = __esm(async () => {
@@ -63752,7 +64059,7 @@ async function readFilesetDirectory(dirPath) {
   await walk(dirPath, "");
   return result;
 }
-async function pushResource(workspace, remotePath, resource, localResource, originalLocalPath) {
+async function pushResource(workspace, remotePath, resource, localResource, originalLocalPath, wsSpecific) {
   remotePath = removeType(remotePath, "resource");
   try {
     resource = await getResource({
@@ -63789,7 +64096,7 @@ async function pushResource(workspace, remotePath, resource, localResource, orig
     await updateResource({
       workspace,
       path: remotePath.replaceAll(SEP6, "/"),
-      requestBody: { ...localResource }
+      requestBody: { ...localResource, ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {} }
     });
   } else {
     await resolveInlineContent();
@@ -63801,7 +64108,8 @@ async function pushResource(workspace, remotePath, resource, localResource, orig
       workspace,
       requestBody: {
         path: remotePath.replaceAll(SEP6, "/"),
-        ...localResource
+        ...localResource,
+        ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
   }
@@ -64542,6 +64850,7 @@ async function updateFlow2(workspace, flow_value, remotePath, rawWorkspaceDepend
     },
     body: JSON.stringify(body)
   });
+  await detectAuthGatewayChallenge(queueResponse, `${workspace.remote}api/w/${workspace.workspaceId}/jobs/run/flow_dependencies_async`);
   if (!queueResponse.ok) {
     let bodyText = "";
     try {
@@ -64569,6 +64878,7 @@ var init_flow_metadata = __esm(async () => {
   init_log();
   init_extractor();
   init_path_assigner();
+  init_http_guards();
   init_script_common();
   init_job_polling();
   await __promiseAll([
@@ -64972,6 +65282,7 @@ var init_generate_metadata = __esm(async () => {
 // src/commands/sync/sync.ts
 var exports_sync = {};
 __export(exports_sync, {
+  yamlSortedEntries: () => yamlSortedEntries,
   yamlOptions: () => yamlOptions,
   resolveWsNameForConfigFromFlags: () => resolveWsNameForConfigFromFlags,
   readDirRecursiveWithIgnore: () => readDirRecursiveWithIgnore2,
@@ -64986,11 +65297,74 @@ __export(exports_sync, {
   extractFieldsForRawApps: () => extractFieldsForRawApps,
   elementsToMap: () => elementsToMap,
   default: () => sync_default,
+  computeWsSpecificFlagOnlyPushes: () => computeWsSpecificFlagOnlyPushes,
   FSFSElement: () => FSFSElement
 });
 import { writeFile as writeFile7, readdir as readdir4, stat as stat7, rm, copyFile, mkdir as mkdir5 } from "node:fs/promises";
 import * as path11 from "node:path";
 import { sep as SEP9 } from "node:path";
+function configKeyForItemKind(kind) {
+  switch (kind) {
+    case "resource":
+      return "resources";
+    case "variable":
+      return "variables";
+  }
+  return null;
+}
+async function mergeWsSpecificFromServer(workspaceId, specificItems) {
+  let wsSpecificItems;
+  try {
+    wsSpecificItems = await listWsSpecific({ workspace: workspaceId });
+  } catch (err) {
+    const isApiError = err && typeof err === "object" && "name" in err && err.name === "ApiError";
+    const status = isApiError ? err.status : undefined;
+    if (status === 404) {
+      debug("listWsSpecific endpoint not available on server, skipping");
+    } else {
+      const msg = err instanceof Error ? err.message : String(err);
+      warn(`Could not fetch ws_specific items from server (${status ?? "no status"}): ${msg}. ` + `Sync will proceed without server-side ws_specific items.`);
+    }
+    return { merged: specificItems, serverItems: null };
+  }
+  if (wsSpecificItems.length === 0) {
+    return { merged: specificItems, serverItems: wsSpecificItems };
+  }
+  const merged = specificItems ? { ...specificItems } : {};
+  for (const item of wsSpecificItems) {
+    const configKey = configKeyForItemKind(item.item_kind);
+    if (!configKey)
+      continue;
+    if (!merged[configKey]) {
+      merged[configKey] = [];
+    }
+    merged[configKey].push(`${item.path}.${item.item_kind}.yaml`);
+  }
+  return { merged, serverItems: wsSpecificItems };
+}
+function computeWsSpecificFlagOnlyPushes(localMap, localSpecificItems, serverItems) {
+  if (!localSpecificItems || serverItems === null)
+    return [];
+  const serverSet = new Set(serverItems.map((i) => `${i.item_kind}:${i.path}`));
+  const out = [];
+  for (const filePath of Object.keys(localMap)) {
+    let kind;
+    try {
+      kind = getTypeStrFromPath(filePath);
+    } catch {
+      continue;
+    }
+    if (configKeyForItemKind(kind) === null)
+      continue;
+    if (!isSpecificItem(filePath, localSpecificItems))
+      continue;
+    const serverPath = removeType(filePath, kind);
+    if (serverSet.has(`${kind}:${serverPath}`))
+      continue;
+    out.push({ kind, serverPath, filePath });
+  }
+  return out;
+}
 function resolveWsNameFromBranch(opts, branchName) {
   const match2 = findWorkspaceByGitBranch(opts.workspaces, branchName);
   return match2 ? match2[0] : branchName;
@@ -65191,6 +65565,14 @@ function prioritizeName(name) {
     return "azz";
   return name;
 }
+function yamlSortedEntries(rec) {
+  const entries = Object.entries(rec);
+  if (Array.isArray(rec)) {
+    return entries;
+  }
+  entries.sort(([a], [b]) => prioritizeName(a).localeCompare(prioritizeName(b)));
+  return entries;
+}
 function extractFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
     if (typeof v == "object") {
@@ -65314,7 +65696,7 @@ function extractInlineScriptsForApps(key, rec, pathAssigner, toId, removeSchema)
     return [];
   }
   if (typeof rec == "object") {
-    return Object.entries(rec).flatMap(([k, v]) => {
+    return yamlSortedEntries(rec).flatMap(([k, v]) => {
       if (k == "inlineScript" && v != null && typeof v == "object") {
         rec["type"] = undefined;
         const o = v;
@@ -65381,7 +65763,7 @@ async function findFilesetResourceFile(changePath) {
   }
   throw new Error(`No resource metadata file found for fileset resource: ${changePath}`);
 }
-async function pushFilesetParentResource(childPath, workspaceId, alreadySynced, cachedWsName) {
+async function pushFilesetParentResource(childPath, workspaceId, alreadySynced, cachedWsName, specificItems) {
   let resourceFilePath;
   try {
     resourceFilePath = await findFilesetResourceFile(childPath);
@@ -65394,10 +65776,14 @@ async function pushFilesetParentResource(childPath, workspaceId, alreadySynced,
   alreadySynced.push(resourceFilePath);
   const newObj = parseFromPath(resourceFilePath, await readTextFile(resourceFilePath));
   let serverPath = resourceFilePath;
+  let wsSpecific = false;
   if (cachedWsName && isWorkspaceSpecificFile(resourceFilePath)) {
     serverPath = fromWorkspaceSpecificPath(resourceFilePath, cachedWsName);
+    wsSpecific = true;
+  } else if (specificItems && isSpecificItem(childPath, specificItems)) {
+    wsSpecific = true;
   }
-  await pushResource(workspaceId, serverPath, undefined, newObj, resourceFilePath);
+  await pushResource(workspaceId, serverPath, undefined, newObj, resourceFilePath, wsSpecific ? true : undefined);
   return { status: "pushed", resourceFilePath };
 }
 function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, resourceTypeToIsFileset, ignoreCodebaseChanges, stripOnBehalfOf) {
@@ -66453,8 +66839,11 @@ async function pull(opts) {
     wsNameForConfig = inferWsNameFromProfile(opts, workspace);
   }
   const effectiveOpts = await resolveEffectiveSyncOptions(workspace, opts, opts.promotion, wsNameForConfig);
-  const specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
-  const wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : undefined;
+  let specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
+  let wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : workspace.workspaceId;
+  const localSpecificItems = specificItems;
+  const wsSpecificMerge = await mergeWsSpecificFromServer(workspace.workspaceId, specificItems);
+  specificItems = wsSpecificMerge.merged;
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
   const codebases = await listSyncCodebases(opts);
   info(colors.gray("Computing the files to update locally to match remote (taking wmill.yaml into account)"));
@@ -66473,6 +66862,17 @@ async function pull(opts) {
   const local = !opts.stateful ? await FSFSElement(process.cwd(), codebases, true) : await FSFSElement(path11.join(process.cwd(), ".wmill"), [], true);
   const { changes, localMap } = await compareDynFSElement(remote, local, await ignoreF(opts), opts.json ?? false, opts, false, codebases, true, specificItems, wsNameForFiles, true);
   info(`remote (${workspace.name}) -> local: ${changes.length} changes to apply`);
+  if (wsSpecificMerge.serverItems && wsSpecificMerge.serverItems.length > 0) {
+    const changedPaths = new Set(changes.map((c) => c.path));
+    for (const item of wsSpecificMerge.serverItems) {
+      const filePath = `${item.path}.${item.item_kind}.yaml`;
+      if (!changedPaths.has(filePath))
+        continue;
+      if (!isSpecificItem(filePath, localSpecificItems)) {
+        warn(`${item.item_kind} ${item.path} is workspace-specific on the remote ` + `but not flagged in wmill.yaml's specificItems — consider adding it.`);
+      }
+    }
+  }
   if (opts.dryRun && opts.jsonOutput) {
     const result = {
       success: true,
@@ -66696,6 +67096,8 @@ function prettyChanges(changes, specificItems, branchOverride, folderDefaultAnno
           showDiff(change.before, change.after);
         }
       }
+    } else if (change.name === "ws_specific_flag") {
+      info(colors.cyan(`~ ${change.kind} ${displayPath} ` + (change.wsSpecific ? "(mark as workspace-specific)" : "(unmark as workspace-specific)")));
     }
   }
 }
@@ -66735,8 +67137,12 @@ async function push4(opts) {
     wsNameForConfig = inferWsNameFromProfile(opts, workspace);
   }
   const effectiveOpts = await resolveEffectiveSyncOptions(workspace, opts, opts.promotion, wsNameForConfig);
-  const specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
-  const wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : undefined;
+  let specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
+  let wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : workspace.workspaceId;
+  const localSpecificItems = specificItems;
+  const wsSpecificMerge = await mergeWsSpecificFromServer(workspace.workspaceId, specificItems);
+  specificItems = wsSpecificMerge.merged;
+  const serverWsSpecificItems = wsSpecificMerge.serverItems;
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
   if (opts.lint) {
     info("Running lint validation before push...");
@@ -66788,7 +67194,18 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   } catch {}
   const remote = ZipFSElement(await downloadZip(workspace, opts.plainSecrets, opts.skipVariables, opts.skipResources, opts.skipResourceTypes, opts.skipSecrets, opts.includeSchedules, opts.includeTriggers, opts.includeUsers, opts.includeGroups, opts.includeSettings, opts.includeKey, opts.skipWorkspaceDependencies, opts.defaultTs), !opts.json, opts.defaultTs ?? "bun", resourceTypeToFormatExtension, resourceTypeToIsFileset, false, parseSyncBehavior(opts.syncBehavior) >= 1);
   const local = await FSFSElement(path11.join(process.cwd(), ""), codebases, false);
-  const { changes } = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, wsNameForFiles, false);
+  const { changes, localMap } = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, wsNameForFiles, false);
+  const wsSpecificFlagOnly = computeWsSpecificFlagOnlyPushes(localMap, localSpecificItems, serverWsSpecificItems);
+  for (const item of wsSpecificFlagOnly) {
+    if (changes.some((c) => c.path === item.filePath))
+      continue;
+    changes.push({
+      name: "ws_specific_flag",
+      path: item.filePath,
+      kind: item.kind,
+      wsSpecific: true
+    });
+  }
   const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
   const tracker = await buildTracker(changes);
   const autoRegenerate = !!opts.autoMetadata;
@@ -67043,7 +67460,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
         userIsAdminOrDeployer,
         userEmail: user.email
       };
-      await preCheckPermissionedAs(changes, user.email, userIsAdminOrDeployer, opts.acceptOverridingPermissionedAsWithSelf ?? false, !!process.stdin.isTTY);
+      await preCheckPermissionedAs(changes.filter((c) => c.name !== "ws_specific_flag"), user.email, userIsAdminOrDeployer, opts.acceptOverridingPermissionedAsWithSelf ?? false, !!process.stdin.isTTY);
     } else if (folderDefaultAnnotations && folderDefaultAnnotations.size > 0) {
       warn(colors.yellow(`This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`));
     }
@@ -67144,10 +67561,14 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   const newObj2 = parseFromPath(resourceFilePath, await readTextFile(resourceFilePath));
                   let serverPath = resourceFilePath;
                   const currentBranch = cachedWsNameForPush;
+                  let isFileResWsSpecific = false;
                   if (currentBranch && isWorkspaceSpecificFile(resourceFilePath)) {
                     serverPath = fromWorkspaceSpecificPath(resourceFilePath, currentBranch);
+                    isFileResWsSpecific = true;
+                  } else if (specificItems && isSpecificItem(change.path, specificItems)) {
+                    isFileResWsSpecific = true;
                   }
-                  await pushResource(workspace.workspaceId, serverPath, undefined, newObj2, resourceFilePath);
+                  await pushResource(workspace.workspaceId, serverPath, undefined, newObj2, resourceFilePath, isFileResWsSpecific ? true : undefined);
                   if (stateTarget) {
                     await writeFile7(stateTarget, change.after, "utf-8");
                   }
@@ -67155,7 +67576,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                 }
               }
               if (isFilesetResource(change.path)) {
-                const result = await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush);
+                const result = await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
                 if (result.status === "parent-missing") {
                   throw new Error(`No resource metadata file found for fileset resource: ${change.path}`);
                 }
@@ -67169,16 +67590,17 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
               const oldObj = parseFromPath(change.path, change.before);
               const newObj = parseFromPath(change.path, change.after);
               let originalWorkspaceSpecificPath;
-              if (specificItems && isSpecificItem(change.path, specificItems)) {
+              const isWsSpecific = specificItems && isSpecificItem(change.path, specificItems);
+              if (isWsSpecific) {
                 originalWorkspaceSpecificPath = getWorkspaceSpecificPath(change.path, specificItems, wsNameForFiles);
               }
-              await pushObj(workspace.workspaceId, change.path, oldObj, newObj, opts.plainSecrets ?? false, alreadySynced, opts.message, originalWorkspaceSpecificPath, permissionedAsContext);
+              await pushObj(workspace.workspaceId, change.path, oldObj, newObj, opts.plainSecrets ?? false, alreadySynced, opts.message, originalWorkspaceSpecificPath, permissionedAsContext, isWsSpecific ? true : undefined);
               if (stateTarget) {
                 await writeFile7(stateTarget, change.after, "utf-8");
               }
             } else if (change.name === "added") {
               if (isFilesetResource(change.path)) {
-                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush);
+                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
                 continue;
               }
               if (change.path.endsWith(".script.json") || change.path.endsWith(".script.yaml") || change.path.endsWith(".lock") || isFileResource(change.path)) {
@@ -67195,13 +67617,14 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
               }
               const obj = parseFromPath(change.path, change.content);
               let localFilePath = change.path;
-              if (specificItems && isSpecificItem(change.path, specificItems)) {
+              const isAddedWsSpecific = specificItems && isSpecificItem(change.path, specificItems);
+              if (isAddedWsSpecific) {
                 const workspaceSpecificPath = getWorkspaceSpecificPath(change.path, specificItems, wsNameForFiles);
                 if (workspaceSpecificPath) {
                   localFilePath = workspaceSpecificPath;
                 }
               }
-              await pushObj(workspace.workspaceId, change.path, undefined, obj, opts.plainSecrets ?? false, [], opts.message, localFilePath, permissionedAsContext);
+              await pushObj(workspace.workspaceId, change.path, undefined, obj, opts.plainSecrets ?? false, [], opts.message, localFilePath, permissionedAsContext, isAddedWsSpecific ? true : undefined);
               if (stateTarget) {
                 await writeFile7(stateTarget, change.content, "utf-8");
               }
@@ -67214,7 +67637,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                 continue;
               }
               if (isFilesetResource(change.path)) {
-                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush);
+                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
                 continue;
               }
               const typ = getTypeStrFromPath(change.path);
@@ -67483,6 +67906,23 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   await rm(stateTarget);
                 } catch {}
               }
+            } else if (change.name === "ws_specific_flag") {
+              const target = change.path.replaceAll(SEP9, "/");
+              if (change.kind === "resource") {
+                await updateResource({
+                  workspace: workspace.workspaceId,
+                  path: removeType(target, "resource"),
+                  requestBody: { ws_specific: change.wsSpecific }
+                });
+              } else if (change.kind === "variable") {
+                await updateVariable({
+                  workspace: workspace.workspaceId,
+                  path: removeType(target, "variable"),
+                  requestBody: { ws_specific: change.wsSpecific }
+                });
+              } else {
+                warn(`ws_specific_flag change for unsupported kind '${change.kind}' at ${change.path} — skipping`);
+              }
             }
           }
         })();
@@ -68151,6 +68591,7 @@ async function fetchScriptLock(workspace, scriptContent, language, remotePath, r
       temp_script_refs: tempScriptRefs && Object.keys(tempScriptRefs).length > 0 ? tempScriptRefs : null
     })
   });
+  await detectAuthGatewayChallenge(queueResponse, `${workspace.remote}api/w/${workspace.workspaceId}/jobs/run/dependencies_async`);
   if (!queueResponse.ok) {
     let bodyText = "";
     try {
@@ -68635,6 +69076,7 @@ var init_metadata = __esm(async () => {
   init_script_bootstrap();
   init_script_common();
   init_script_common();
+  init_http_guards();
   init_parse_schema();
   init_job_polling();
   await __promiseAll([
@@ -69176,7 +69618,7 @@ async function traverseAndProcessInlineScripts(obj, processor, currentPath = [])
     ])));
   }
   const result = {};
-  for (const [key, value] of Object.entries(obj)) {
+  for (const [key, value] of yamlSortedEntries(obj)) {
     if (key === "inlineScript" && typeof value === "object") {
       result[key] = await processor(value, {
         path: currentPath,
@@ -69336,6 +69778,7 @@ async function generateInlineScriptLock(workspace, content, language, scriptPath
       ...tempScriptRefs && Object.keys(tempScriptRefs).length > 0 ? { temp_script_refs: tempScriptRefs } : {}
     })
   });
+  await detectAuthGatewayChallenge(queueResponse, `${workspace.remote}api/w/${workspace.workspaceId}/jobs/run/dependencies_async`);
   if (!queueResponse.ok) {
     const text = await queueResponse.text();
     throw new Error(`Dependency generation failed: ${queueResponse.status} ${queueResponse.statusText}
@@ -69516,6 +69959,7 @@ var init_app_metadata = __esm(async () => {
   init_colors2();
   init_log();
   init_script_common();
+  init_http_guards();
   init_path_assigner();
   init_job_polling();
   await __promiseAll([
@@ -70615,13 +71059,20 @@ var DEFAULT_PORT = 4000, DEFAULT_HOST = "localhost", createHTML = (jsPath, cssPa
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Windmill App Dev Preview</title>
-  <link rel="stylesheet" href="${cssPath}">
   <style>
-    * {
-      margin: 0;
-      padding: 0;
-      box-sizing: border-box;
+    /* Declared before the user stylesheet so Tailwind's layers (theme, base,
+       components, utilities) are appended after wmill-shell and win the
+       cascade. Unlayered styles would override Tailwind utilities. */
+    @layer wmill-shell {
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
     }
+  </style>
+  <link rel="stylesheet" href="${cssPath}">
+  <style>
     body {
       font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen',
         'Ubuntu', 'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif;
@@ -72228,7 +72679,7 @@ async function get6(opts, path19) {
     console.log(colors.bold("Account:") + " " + (v.account ?? "-"));
   }
 }
-async function pushVariable(workspace, remotePath, variable, localVariable, plainSecrets) {
+async function pushVariable(workspace, remotePath, variable, localVariable, plainSecrets, wsSpecific) {
   remotePath = removeType(remotePath, "variable");
   debug(`Processing local variable ${remotePath}`);
   try {
@@ -72254,7 +72705,8 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
       alreadyEncrypted: !plainSecrets,
       requestBody: {
         ...localVariable,
-        is_secret: localVariable.is_secret && !variable.is_secret ? true : undefined
+        is_secret: localVariable.is_secret && !variable.is_secret ? true : undefined,
+        ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
   } else {
@@ -72264,7 +72716,8 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
       alreadyEncrypted: !plainSecrets,
       requestBody: {
         path: remotePath.replaceAll(SEP16, "/"),
-        ...localVariable
+        ...localVariable,
+        ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
   }
@@ -74681,7 +75134,7 @@ function showConflict(path21, local, remote) {
   info(`
 `);
 }
-async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext) {
+async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext, wsSpecific) {
   const typeEnding = getTypeStrFromPath(p);
   if (typeEnding === "app") {
     const appName = extractResourceName(p, "app");
@@ -74698,7 +75151,7 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   } else if (typeEnding === "folder") {
     await pushFolder(workspace, p, befObj, newObj);
   } else if (typeEnding === "variable") {
-    await pushVariable(workspace, p, befObj, newObj, plainSecrets);
+    await pushVariable(workspace, p, befObj, newObj, plainSecrets, wsSpecific);
   } else if (typeEnding === "flow") {
     const flowName = extractResourceName(p, "flow");
     if (!flowName) {
@@ -74708,7 +75161,7 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   } else if (typeEnding === "resource") {
     if (!alreadySynced3.includes(p)) {
       alreadySynced3.push(p);
-      await pushResource(workspace, p, befObj, newObj, originalLocalPath || p);
+      await pushResource(workspace, p, befObj, newObj, originalLocalPath || p, wsSpecific);
     }
   } else if (typeEnding === "resource-type") {
     await pushResourceType(workspace, p, befObj, newObj);
@@ -78615,6 +79068,7 @@ var dev_default2 = command25;
 
 // src/main.ts
 init_gen();
+init_http_guards();
 await __promiseAll([
   init_utils(),
   init_conf()
@@ -89017,7 +89471,7 @@ var config_default = command35;
 
 // src/main.ts
 await init_context();
-var VERSION = "1.696.1";
+var VERSION = "1.697.0";
 async function checkVersionSafe(cmd) {
   const mainCommand = cmd.getMainCommand();
   const upgradeCommand = mainCommand.getCommand("upgrade");
@@ -89099,6 +89553,10 @@ async function main2() {
     if (extraHeaders) {
       OpenAPI.HEADERS = extraHeaders;
     }
+    OpenAPI.interceptors.response.use(async (response) => {
+      await detectAuthGatewayChallenge(response);
+      return response;
+    });
     await command36.parse(args);
   } catch (e) {
     if (e && typeof e === "object" && "name" in e && e.name === "ApiError") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.696.1",
+  "version": "1.697.0",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",