windmill-cli 1.696.2 → 1.698.0

package/esm/main.js

@@ -16752,7 +16752,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.696.2",
+    VERSION: "1.698.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17216,6 +17216,8 @@ __export(exports_services_gen, {
   loadFilePreview: () => loadFilePreview,
   loadFileMetadata: () => loadFileMetadata,
   loadCsvPreview: () => loadCsvPreview,
+  listWsSpecificVersions: () => listWsSpecificVersions,
+  listWsSpecific: () => listWsSpecific,
   listWorkspacesAsSuperAdmin: () => listWorkspacesAsSuperAdmin,
   listWorkspaces: () => listWorkspaces,
   listWorkspaceInvites: () => listWorkspaceInvites,
@@ -19667,6 +19669,26 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, listWsSpecific = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/workspaces/list_ws_specific",
+    path: {
+      workspace: data3.workspace
+    }
+  });
+}, listWsSpecificVersions = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/workspaces/list_ws_specific_versions",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      kind: data3.kind,
+      path: data3.path
+    }
+  });
 }, setPublicAppRateLimit = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -25373,7 +25395,7 @@ Found ${datatables.length} datatable(s):`);
       workspace: workspace.workspaceId,
       requestBody: {
         id: trueWorkspaceId,
-        name: opts.createWorkspaceName ?? trueWorkspaceId,
+        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
         color: forkColor
       }
     });
@@ -25389,7 +25411,7 @@ Found ${datatables.length} datatable(s):`);
       workspace: workspace.workspaceId,
       requestBody: {
         id: trueWorkspaceId,
-        name: opts.createWorkspaceName ?? trueWorkspaceId,
+        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
         color: forkColor,
         forked_datatables: forkedDatatables
       }
@@ -25475,9 +25497,21 @@ var init_fork = __esm(async () => {
 });
 
 // windmill-utils-internal/src/deploy.ts
+function isTriggerKind(kind) {
+  return TRIGGER_KINDS.includes(kind);
+}
+function isTriggerOrScheduleKind(kind) {
+  return kind === "schedule" || isTriggerKind(kind);
+}
 function folderName(path2) {
   return path2.replace(/^f\//, "");
 }
+function stripOperationalStateOnUpdate(payload, alreadyExists) {
+  if (!alreadyExists)
+    return payload;
+  const { mode: _mode, enabled: _enabled, ...rest } = payload;
+  return rest;
+}
 function getSubModules(flowModule) {
   const type = flowModule?.value?.type;
   if (type === "forloopflow" || type === "whileloopflow") {
@@ -25531,6 +25565,10 @@ async function checkItemExists(provider, kind, path2, workspace) {
     return provider.existsResourceType({ workspace, path: path2 });
   } else if (kind === "folder") {
     return provider.existsFolder({ workspace, name: folderName(path2) });
+  } else if (kind === "schedule") {
+    return provider.existsSchedule({ workspace, path: path2 });
+  } else if (isTriggerKind(kind)) {
+    return provider.existsTriggerByKind(kind, { workspace, path: path2 });
   }
   throw new Error(`Unknown kind: ${kind}`);
 }
@@ -25767,6 +25805,48 @@ async function deployItem(provider, kind, path2, workspaceFrom, workspaceTo, onB
           }
         });
       }
+    } else if (kind === "schedule") {
+      const schedule = await provider.getSchedule({
+        workspace: workspaceFrom,
+        path: path2
+      });
+      const baseBody = stripOperationalStateOnUpdate(schedule, alreadyExists);
+      const requestBody = {
+        ...baseBody,
+        permissioned_as: onBehalfOf,
+        preserve_permissioned_as: preserveOnBehalfOf
+      };
+      if (alreadyExists) {
+        await provider.updateSchedule({
+          workspace: workspaceTo,
+          path: path2,
+          requestBody
+        });
+      } else {
+        await provider.createSchedule({
+          workspace: workspaceTo,
+          requestBody
+        });
+      }
+    } else if (isTriggerKind(kind)) {
+      const triggerBody = await provider.getTriggerForDeploy(kind, {
+        workspace: workspaceFrom,
+        path: path2,
+        onBehalfOf
+      });
+      const requestBody = stripOperationalStateOnUpdate(triggerBody, alreadyExists);
+      if (alreadyExists) {
+        await provider.updateTriggerByKind(kind, {
+          workspace: workspaceTo,
+          path: path2,
+          requestBody
+        });
+      } else {
+        await provider.createTriggerByKind(kind, {
+          workspace: workspaceTo,
+          requestBody
+        });
+      }
     } else {
       throw new Error(`Unknown kind: ${kind}`);
     }
@@ -25795,6 +25875,10 @@ async function deleteItemInWorkspace(provider, kind, path2, workspace) {
       await provider.deleteResourceType({ workspace, path: path2 });
     } else if (kind === "folder") {
       await provider.deleteFolder({ workspace, name: folderName(path2) });
+    } else if (kind === "schedule") {
+      await provider.deleteSchedule({ workspace, path: path2 });
+    } else if (isTriggerKind(kind)) {
+      await provider.deleteTriggerByKind(kind, { workspace, path: path2 });
     } else {
       throw new Error(`Deletion not supported for kind: ${kind}`);
     }
@@ -25814,10 +25898,30 @@ async function getOnBehalfOf(provider, kind, path2, workspace) {
     } else if (kind === "app" || kind === "raw_app") {
       const app = await provider.getAppByPath({ workspace, path: path2 });
       return app.policy?.on_behalf_of_email;
+    } else if (kind === "schedule") {
+      const schedule = await provider.getSchedule({ workspace, path: path2 });
+      return schedule.permissioned_as;
+    } else if (isTriggerKind(kind)) {
+      return await provider.getTriggerPermissionedAs(kind, { workspace, path: path2 });
     }
   } catch {}
   return;
 }
+var TRIGGER_KINDS;
+var init_deploy = __esm(() => {
+  TRIGGER_KINDS = [
+    "http_trigger",
+    "websocket_trigger",
+    "kafka_trigger",
+    "nats_trigger",
+    "postgres_trigger",
+    "mqtt_trigger",
+    "sqs_trigger",
+    "gcp_trigger",
+    "azure_trigger",
+    "email_trigger"
+  ];
+});
 
 // node_modules/@cliffy/prompt/checkbox.js
 var exports_checkbox = {};
@@ -26041,6 +26145,111 @@ var init_checkbox = __esm(async () => {
 });
 
 // src/commands/workspace/merge.ts
+function triggerService(kind) {
+  switch (kind) {
+    case "http_trigger":
+      return {
+        exists: existsHttpTrigger,
+        get: getHttpTrigger,
+        create: createHttpTrigger,
+        update: updateHttpTrigger,
+        delete: deleteHttpTrigger
+      };
+    case "websocket_trigger":
+      return {
+        exists: existsWebsocketTrigger,
+        get: getWebsocketTrigger,
+        create: createWebsocketTrigger,
+        update: updateWebsocketTrigger,
+        delete: deleteWebsocketTrigger
+      };
+    case "kafka_trigger":
+      return {
+        exists: existsKafkaTrigger,
+        get: getKafkaTrigger,
+        create: createKafkaTrigger,
+        update: updateKafkaTrigger,
+        delete: deleteKafkaTrigger
+      };
+    case "nats_trigger":
+      return {
+        exists: existsNatsTrigger,
+        get: getNatsTrigger,
+        create: createNatsTrigger,
+        update: updateNatsTrigger,
+        delete: deleteNatsTrigger
+      };
+    case "postgres_trigger":
+      return {
+        exists: existsPostgresTrigger,
+        get: getPostgresTrigger,
+        create: createPostgresTrigger,
+        update: updatePostgresTrigger,
+        delete: deletePostgresTrigger
+      };
+    case "mqtt_trigger":
+      return {
+        exists: existsMqttTrigger,
+        get: getMqttTrigger,
+        create: createMqttTrigger,
+        update: updateMqttTrigger,
+        delete: deleteMqttTrigger
+      };
+    case "sqs_trigger":
+      return {
+        exists: existsSqsTrigger,
+        get: getSqsTrigger,
+        create: createSqsTrigger,
+        update: updateSqsTrigger,
+        delete: deleteSqsTrigger
+      };
+    case "gcp_trigger":
+      return {
+        exists: existsGcpTrigger,
+        get: getGcpTrigger,
+        create: createGcpTrigger,
+        update: updateGcpTrigger,
+        delete: deleteGcpTrigger
+      };
+    case "azure_trigger":
+      return {
+        exists: existsAzureTrigger,
+        get: getAzureTrigger,
+        create: createAzureTrigger,
+        update: updateAzureTrigger,
+        delete: deleteAzureTrigger
+      };
+    case "email_trigger":
+      return {
+        exists: existsEmailTrigger,
+        get: getEmailTrigger,
+        create: createEmailTrigger,
+        update: updateEmailTrigger,
+        delete: deleteEmailTrigger
+      };
+  }
+}
+function preparePayload(kind, trigger, onBehalfOf) {
+  const preserve = onBehalfOf !== undefined;
+  const base = {
+    ...trigger,
+    permissioned_as: onBehalfOf,
+    preserve_permissioned_as: preserve
+  };
+  if (kind === "gcp_trigger") {
+    base.subscription_id = "";
+    base.subscription_mode = "create_update";
+    if (base.delivery_config) {
+      base.delivery_config = { ...base.delivery_config, audience: "" };
+    }
+    if (base.delivery_type === "push") {
+      base.base_endpoint = OpenAPI.BASE.replace(/\/api\/?$/, "");
+    } else {
+      base.base_endpoint = undefined;
+    }
+  }
+  return base;
+}
 async function mergeWorkspaces(opts) {
   const workspace = await tryResolveBranchWorkspace(opts);
   if (!workspace) {
@@ -26091,6 +26300,10 @@ async function mergeWorkspaces(opts) {
     summaryRows.push(["Resource Types", String(summary.resource_types_changed)]);
   if (summary.folders_changed > 0)
     summaryRows.push(["Folders", String(summary.folders_changed)]);
+  if (summary.schedules_changed > 0)
+    summaryRows.push(["Schedules", String(summary.schedules_changed)]);
+  if (summary.triggers_changed > 0)
+    summaryRows.push(["Triggers", String(summary.triggers_changed)]);
   summaryRows.push(["Total", String(summary.total_diffs)]);
   if (summary.conflicts > 0)
     summaryRows.push([
@@ -26156,11 +26369,9 @@ Direction: ${colors.bold(direction === "to-parent" ? `Fork → Parent (${parentW
   if (opts.all) {
     selectedDiffs = selectableDiffs;
   } else if (opts.skipConflicts) {
-    selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0));
+    selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0) && (!!opts.include || !isTriggerOrScheduleKind(d.kind)));
   } else if (opts.yes && !opts.include && !opts.exclude) {
-    if (direction === "to-fork") {
-      selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0));
-    }
+    selectedDiffs = selectableDiffs.filter((d) => !isTriggerOrScheduleKind(d.kind) && (direction !== "to-fork" || !(d.ahead > 0 && d.behind > 0)));
   } else if (!opts.yes) {
     const { Checkbox: Checkbox2 } = await init_checkbox().then(() => exports_checkbox);
     const defaultForToFork = direction === "to-fork";
@@ -26168,11 +26379,12 @@ Direction: ${colors.bold(direction === "to-parent" ? `Fork → Parent (${parentW
       message: `Select items to deploy (${selectableDiffs.length} available):`,
       options: selectableDiffs.map((d) => {
         const isConflict = d.ahead > 0 && d.behind > 0;
+        const isTriggerOrSchedule = isTriggerOrScheduleKind(d.kind);
         const label = `${d.kind}:${d.path}${isConflict ? colors.red(" [CONFLICT]") : ""}`;
         return {
           name: label,
           value: `${d.kind}:${d.path}`,
-          checked: defaultForToFork ? !isConflict : true
+          checked: !isTriggerOrSchedule && (defaultForToFork ? !isConflict : true)
         };
       })
     });
@@ -26261,6 +26473,8 @@ var init_merge = __esm(async () => {
   init_log();
   init_client();
   init_services_gen();
+  init_OpenAPI();
+  init_deploy();
   await init_context();
   provider = {
     existsFlowByPath,
@@ -26300,7 +26514,28 @@ var init_merge = __esm(async () => {
     getFolder,
     createFolder,
     updateFolder,
-    deleteFolder
+    deleteFolder,
+    existsTriggerByKind: (kind, p) => triggerService(kind).exists(p),
+    getTriggerForDeploy: async (kind, p) => {
+      const trigger = await triggerService(kind).get({
+        workspace: p.workspace,
+        path: p.path
+      });
+      return preparePayload(kind, trigger, p.onBehalfOf);
+    },
+    createTriggerByKind: (kind, p) => triggerService(kind).create(p),
+    updateTriggerByKind: (kind, p) => triggerService(kind).update(p),
+    deleteTriggerByKind: (kind, p) => triggerService(kind).delete(p),
+    getTriggerValue: (kind, p) => triggerService(kind).get(p),
+    getTriggerPermissionedAs: async (kind, p) => {
+      const trigger = await triggerService(kind).get(p);
+      return trigger?.permissioned_as;
+    },
+    existsSchedule,
+    getSchedule,
+    createSchedule,
+    updateSchedule,
+    deleteSchedule
   };
 });
 
@@ -61342,33 +61577,34 @@ async function resolveWsNameForGitBranch(branchName) {
   const match2 = findWorkspaceByGitBranch(config.workspaces, branchName);
   return match2 ? match2[0] : branchName;
 }
-function getWorkspaceSpecificTypes() {
-  return {
-    variable: ".variable.yaml",
-    resource: ".resource.yaml",
-    schedule: ".schedule.yaml",
-    ...Object.fromEntries(TRIGGER_TYPES.map((t) => [`${t}_trigger`, `.${t}_trigger.yaml`]))
-  };
+function getWorkspaceSpecificTypeKinds() {
+  return [
+    "variable",
+    "resource",
+    "schedule",
+    ...TRIGGER_TYPES.map((t) => `${t}_trigger`)
+  ];
 }
 function isTriggerFile(path7) {
-  return TRIGGER_TYPES.some((type) => path7.endsWith(`.${type}_trigger.yaml`));
+  return TRIGGER_TYPES.some((type) => path7.endsWith(`.${type}_trigger.yaml`) || path7.endsWith(`.${type}_trigger.json`));
 }
 function isScheduleFile(path7) {
-  return path7.endsWith(".schedule.yaml");
+  return path7.endsWith(".schedule.yaml") || path7.endsWith(".schedule.json");
 }
 function getFileTypeSuffix(path7) {
-  for (const [_, suffix] of Object.entries(getWorkspaceSpecificTypes())) {
-    if (path7.endsWith(suffix)) {
-      return suffix;
-    }
+  for (const kind of getWorkspaceSpecificTypeKinds()) {
+    if (path7.endsWith(`.${kind}.yaml`))
+      return `.${kind}.yaml`;
+    if (path7.endsWith(`.${kind}.json`))
+      return `.${kind}.json`;
   }
-  const resourceFileMatch = path7.match(/(\\.resource\\.file\\..+)$/);
+  const resourceFileMatch = path7.match(/(\.resource\.file\..+)$/);
   if (resourceFileMatch) {
     return resourceFileMatch[1];
   }
   return null;
 }
-function buildYamlTypePattern() {
+function buildItemTypePattern() {
   const basicTypes = ["variable", "resource", "schedule"];
   const triggerTypes = TRIGGER_TYPES.map((t) => `${t}_trigger`);
   return `((${basicTypes.join("|")})|(${triggerTypes.join("|")}))`;
@@ -61436,10 +61672,14 @@ function getSpecificItemsForCurrentBranch(config, workspaceNameOverride) {
 function matchesPatterns(path7, patterns) {
   return patterns.some((pattern) => minimatch(path7, pattern));
 }
+function normalizeJsonToYaml(path7) {
+  return path7.endsWith(".json") ? path7.slice(0, -".json".length) + ".yaml" : path7;
+}
 function isItemTypeConfigured(path7, specificItems) {
   if (!specificItems) {
     return false;
   }
+  path7 = normalizeJsonToYaml(path7);
   if (path7.endsWith(".variable.yaml")) {
     return specificItems.variables !== undefined;
   }
@@ -61467,6 +61707,7 @@ function isSpecificItem(path7, specificItems) {
   if (!specificItems) {
     return false;
   }
+  path7 = normalizeJsonToYaml(path7);
   if (path7.endsWith(".variable.yaml")) {
     return specificItems.variables ? matchesPatterns(path7, specificItems.variables) : false;
   }
@@ -61510,12 +61751,13 @@ function toWorkspaceSpecificPath(basePath, workspaceName) {
   if (sanitizedName !== workspaceName) {
     console.warn(`Warning: Workspace name "${workspaceName}" contains filesystem-unsafe characters (/ \\ : * ? " < > | .) and was sanitized to "${sanitizedName}". This may cause collisions with other similarly named branches.`);
   }
-  if (basePath.endsWith("/folder.meta.yaml")) {
-    const pathWithoutMeta = basePath.substring(0, basePath.length - "/folder.meta.yaml".length);
-    return `${pathWithoutMeta}/folder.${sanitizedName}.meta.yaml`;
+  const folderMetaMatch = basePath.match(/^(.*)\/folder\.meta\.(yaml|json)$/);
+  if (folderMetaMatch) {
+    return `${folderMetaMatch[1]}/folder.${sanitizedName}.meta.${folderMetaMatch[2]}`;
   }
-  if (basePath === "settings.yaml") {
-    return `settings.${sanitizedName}.yaml`;
+  const settingsMatch = basePath.match(/^settings\.(yaml|json)$/);
+  if (settingsMatch) {
+    return `settings.${sanitizedName}.${settingsMatch[1]}`;
   }
   const resourceFileMatch = basePath.match(/^(.+?)(\.resource\.file\..+)$/);
   let extension;
@@ -61536,13 +61778,15 @@ function toWorkspaceSpecificPath(basePath, workspaceName) {
 function fromWorkspaceSpecificPath(workspaceSpecificPath, workspaceName) {
   const sanitizedName = workspaceName.replace(/[\/\\:*?"<>|.]/g, "_");
   const escapedName = sanitizedName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const folderPattern = new RegExp(`/folder\\.${escapedName}\\.meta\\.yaml$`);
-  if (folderPattern.test(workspaceSpecificPath)) {
-    return workspaceSpecificPath.replace(folderPattern, "/folder.meta.yaml");
+  const folderPattern = new RegExp(`/folder\\.${escapedName}\\.meta\\.(yaml|json)$`);
+  const folderMatch = workspaceSpecificPath.match(folderPattern);
+  if (folderMatch) {
+    return workspaceSpecificPath.replace(folderPattern, `/folder.meta.${folderMatch[1]}`);
   }
-  const settingsPattern = new RegExp(`^settings\\.${escapedName}\\.yaml$`);
-  if (settingsPattern.test(workspaceSpecificPath)) {
-    return "settings.yaml";
+  const settingsPattern = new RegExp(`^settings\\.${escapedName}\\.(yaml|json)$`);
+  const settingsMatch = workspaceSpecificPath.match(settingsPattern);
+  if (settingsMatch) {
+    return `settings.${settingsMatch[1]}`;
   }
   const resourceFilePattern = new RegExp(`\\.${escapedName}(\\.resource\\.file\\..+)$`);
   const resourceFileMatch = workspaceSpecificPath.match(resourceFilePattern);
@@ -61551,12 +61795,12 @@ function fromWorkspaceSpecificPath(workspaceSpecificPath, workspaceName) {
     const pathWithoutBranchAndExtension2 = workspaceSpecificPath.substring(0, workspaceSpecificPath.length - `.${sanitizedName}${extension2}`.length);
     return `${pathWithoutBranchAndExtension2}${extension2}`;
   }
-  const yamlPattern = new RegExp(`\\.${escapedName}(\\.${buildYamlTypePattern()}\\.yaml)$`);
-  const yamlMatch = workspaceSpecificPath.match(yamlPattern);
-  if (!yamlMatch) {
+  const typedPattern = new RegExp(`\\.${escapedName}(\\.${buildItemTypePattern()}\\.(yaml|json))$`);
+  const typedMatch = workspaceSpecificPath.match(typedPattern);
+  if (!typedMatch) {
     return workspaceSpecificPath;
   }
-  const extension = yamlMatch[1];
+  const extension = typedMatch[1];
   const pathWithoutBranchAndExtension = workspaceSpecificPath.substring(0, workspaceSpecificPath.length - `.${sanitizedName}${extension}`.length);
   return `${pathWithoutBranchAndExtension}${extension}`;
 }
@@ -61592,14 +61836,14 @@ function isCurrentWorkspaceFile(path7, workspaceNameOverride) {
   const escapedName = sanitizedName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   let pattern = workspacePatternCache.get(currentWorkspace);
   if (!pattern) {
-    pattern = new RegExp(`\\.${escapedName}\\.${buildYamlTypePattern()}\\.yaml$|` + `\\.${escapedName}\\.resource\\.file\\..+$|` + `/folder\\.${escapedName}\\.meta\\.yaml$|` + `^settings\\.${escapedName}\\.yaml$`);
+    pattern = new RegExp(`\\.${escapedName}\\.${buildItemTypePattern()}\\.(yaml|json)$|` + `\\.${escapedName}\\.resource\\.file\\..+$|` + `/folder\\.${escapedName}\\.meta\\.(yaml|json)$|` + `^settings\\.${escapedName}\\.(yaml|json)$`);
     workspacePatternCache.set(currentWorkspace, pattern);
   }
   return pattern.test(path7);
 }
 function isWorkspaceSpecificFile(path7) {
-  const yamlTypePattern = buildYamlTypePattern();
-  return new RegExp(`\\.[^.]+\\.${yamlTypePattern}\\.yaml$|` + `\\.[^.]+\\.resource\\.file\\..+$|` + `/folder\\.[^.]+\\.meta\\.yaml$|` + `^settings\\.[^.]+\\.yaml$`).test(path7);
+  const typePattern = buildItemTypePattern();
+  return new RegExp(`\\.[^.]+\\.${typePattern}\\.(yaml|json)$|` + `\\.[^.]+\\.resource\\.file\\..+$|` + `/folder\\.[^.]+\\.meta\\.(yaml|json)$|` + `^settings\\.[^.]+\\.(yaml|json)$`).test(path7);
 }
 var workspacePatternCache;
 var init_specific_items = __esm(async () => {
@@ -62265,6 +62509,7 @@ async function readModulesFromDisk(moduleFolderPath, defaultTs, folderLayout = f
 async function createScript2(bundleContent, workspaceId, body, workspace) {
   const start = performance.now();
   const skipIfNoop = "skip_if_noop=true";
+  const extraHeaders = getHeaders2();
   if (!bundleContent) {
     try {
       const url = workspace.remote + "api/w/" + workspaceId + "/scripts/create?" + skipIfNoop;
@@ -62272,10 +62517,12 @@ async function createScript2(bundleContent, workspaceId, body, workspace) {
         method: "POST",
         headers: {
           Authorization: `Bearer ${workspace.token}`,
-          "Content-Type": "application/json"
+          "Content-Type": "application/json",
+          ...extraHeaders
         },
         body: JSON.stringify(body)
       });
+      await detectAuthGatewayChallenge(req, url);
       if (req.status != 201) {
         throw Error(`${req.status} - ${req.statusText} - ${await req.text()}`);
       }
@@ -62289,9 +62536,13 @@ async function createScript2(bundleContent, workspaceId, body, workspace) {
     const url = workspace.remote + "api/w/" + workspace.workspaceId + "/scripts/create_snapshot?" + skipIfNoop;
     const req = await fetch(url, {
       method: "POST",
-      headers: { Authorization: `Bearer ${workspace.token} ` },
+      headers: {
+        Authorization: `Bearer ${workspace.token} `,
+        ...extraHeaders
+      },
       body: form
     });
+    await detectAuthGatewayChallenge(req, url);
     if (req.status != 201) {
       throw Error(`Script snapshot creation was not successful: ${req.status} - ${req.statusText} - ${await req.text()} `);
     }
@@ -62836,11 +63087,16 @@ async function preview(opts, filePath) {
     form.append("preview", JSON.stringify(previewPayload));
     form.append("file", typeof bundledContent === "string" ? new Blob([bundledContent], { type: "application/javascript" }) : bundledContent);
     const url = workspace.remote + "api/w/" + workspace.workspaceId + "/jobs/run/preview_bundle";
+    const extraHeaders = getHeaders2();
     const response = await fetch(url, {
       method: "POST",
-      headers: { Authorization: `Bearer ${workspace.token}` },
+      headers: {
+        Authorization: `Bearer ${workspace.token}`,
+        ...extraHeaders
+      },
       body: form
     });
+    await detectAuthGatewayChallenge(response, url);
     if (!response.ok) {
       throw new Error(`Preview failed: ${response.status} - ${response.statusText} - ${await response.text()}`);
     }
@@ -62948,6 +63204,7 @@ var init_script = __esm(async () => {
   init_mod3();
   init_mod6();
   init_log();
+  init_http_guards();
   init_services_gen();
   init_git();
   init_script_bootstrap();
@@ -63815,7 +64072,7 @@ async function readFilesetDirectory(dirPath) {
   await walk(dirPath, "");
   return result;
 }
-async function pushResource(workspace, remotePath, resource, localResource, originalLocalPath) {
+async function pushResource(workspace, remotePath, resource, localResource, originalLocalPath, wsSpecific) {
   remotePath = removeType(remotePath, "resource");
   try {
     resource = await getResource({
@@ -63852,7 +64109,7 @@ async function pushResource(workspace, remotePath, resource, localResource, orig
     await updateResource({
       workspace,
       path: remotePath.replaceAll(SEP6, "/"),
-      requestBody: { ...localResource }
+      requestBody: { ...localResource, ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {} }
     });
   } else {
     await resolveInlineContent();
@@ -63864,7 +64121,8 @@ async function pushResource(workspace, remotePath, resource, localResource, orig
       workspace,
       requestBody: {
         path: remotePath.replaceAll(SEP6, "/"),
-        ...localResource
+        ...localResource,
+        ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
   }
@@ -64736,6 +64994,7 @@ async function rehashOnly(opts, folder, rehashFilter) {
   }
   const stubWorkspace = {};
   const rehashOpts = { ...opts, rehashOnly: true };
+  const queue = [];
   if (!rehashFilter?.skipScripts) {
     for (const e of scriptPaths) {
       const remotePath = scriptPathToRemotePath(e);
@@ -64745,12 +65004,7 @@ async function rehashOnly(opts, folder, rehashFilter) {
         if (skipIfExisting(remotePath) || skipIfExisting(remotePath, "__script_hash"))
           continue;
       }
-      try {
-        await generateScriptMetadataInternal(e, stubWorkspace, rehashOpts, false, true, {}, codebases, false);
-        counts.scripts++;
-      } catch (err) {
-        warn(`Skipping ${e}: ${err instanceof Error ? err.message : err}`);
-      }
+      queue.push({ kind: "script", scriptPath: e });
     }
   }
   if (!rehashFilter?.skipFlows) {
@@ -64762,12 +65016,7 @@ async function rehashOnly(opts, folder, rehashFilter) {
         if (skipIfExisting(folderNormalized, "__flow_hash"))
           continue;
       }
-      try {
-        await generateFlowLockInternal(f, false, stubWorkspace, rehashOpts, false, true);
-        counts.flows++;
-      } catch (err) {
-        warn(`Skipping ${f}: ${err instanceof Error ? err.message : err}`);
-      }
+      queue.push({ kind: "flow", folder: f });
     }
   }
   if (!rehashFilter?.skipApps) {
@@ -64779,13 +65028,47 @@ async function rehashOnly(opts, folder, rehashFilter) {
         if (skipIfExisting(folderNormalized, "__app_hash"))
           continue;
       }
-      try {
-        await generateAppLocksInternal(appFolder, rawApp, false, stubWorkspace, rehashOpts, false, true);
-        counts.apps++;
-      } catch (err) {
-        warn(`Skipping ${appFolder}: ${err instanceof Error ? err.message : err}`);
+      queue.push({ kind: "app", folder: appFolder, rawApp });
+    }
+  }
+  let parallelism = Number(opts.parallel ?? 1);
+  if (!Number.isFinite(parallelism) || parallelism <= 0)
+    parallelism = 1;
+  if (parallelism > 1) {
+    info(`Parallelizing ${parallelism} items at a time`);
+  }
+  await beginLockfileBatch();
+  try {
+    const pool = new Set;
+    while (queue.length > 0 || pool.size > 0) {
+      while (pool.size < parallelism && queue.length > 0) {
+        const task = queue.shift();
+        const p = (async () => {
+          try {
+            if (task.kind === "script") {
+              await generateScriptMetadataInternal(task.scriptPath, stubWorkspace, rehashOpts, false, true, {}, codebases, false);
+              counts.scripts++;
+            } else if (task.kind === "flow") {
+              await generateFlowLockInternal(task.folder, false, stubWorkspace, rehashOpts, false, true);
+              counts.flows++;
+            } else {
+              await generateAppLocksInternal(task.folder, task.rawApp, false, stubWorkspace, rehashOpts, false, true);
+              counts.apps++;
+            }
+          } catch (err) {
+            const label = task.kind === "script" ? task.scriptPath : task.folder;
+            warn(`Skipping ${label}: ${err instanceof Error ? err.message : err}`);
+          }
+        })();
+        pool.add(p);
+        p.then(() => pool.delete(p));
+      }
+      if (pool.size > 0) {
+        await Promise.race(pool);
       }
     }
+  } finally {
+    await flushLockfileBatch();
   }
   if (counts.scripts + counts.flows + counts.apps > 0 || !rehashFilter?.missingOnly) {
     info(`Rehashed ${colors.bold(String(counts.scripts))} script(s), ` + `${colors.bold(String(counts.flows))} flow(s), ` + `${colors.bold(String(counts.apps))} app(s) from disk.`);
@@ -64948,47 +65231,75 @@ async function generateMetadata2(opts, folder) {
     return colors.dim(colors.white(`[${n}/${total}]`.padEnd(maxWidth, " ")));
   };
   const errors = [];
-  for (const item of scripts) {
-    current++;
-    info(`${formatProgress(current)} script ${item.path}`);
-    try {
-      await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, tree);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      error(`  Failed: ${msg}`);
-    }
-  }
-  for (const item of flows) {
-    current++;
-    try {
-      const result = await generateFlowLockInternal(item.folder.replaceAll("/", SEP8), false, workspace, opts, false, true, tree);
-      const flowResult = result;
-      const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
-      info(`${formatProgress(current)} flow   ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      info(`${formatProgress(current)} flow   ${item.path}`);
-      error(`  Failed: ${msg}`);
-    }
-  }
-  for (const item of apps2) {
-    current++;
-    try {
-      const result = await generateAppLocksInternal(item.folder.replaceAll("/", SEP8), item.isRawApp, false, workspace, opts, false, true, tree);
-      const appResult = result;
-      const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
-      info(`${formatProgress(current)} app    ${item.path}${scriptsInfo}`);
-    } catch (e) {
-      const msg = e instanceof Error ? e.message : String(e);
-      errors.push({ path: item.path, error: msg });
-      info(`${formatProgress(current)} app    ${item.path}`);
-      error(`  Failed: ${msg}`);
+  let parallelism = Number(opts.parallel ?? 1);
+  if (!Number.isFinite(parallelism) || parallelism <= 0)
+    parallelism = 1;
+  if (parallelism > 1) {
+    info(`Parallelizing ${parallelism} items at a time`);
+  }
+  const queue = [
+    ...scripts.map((item) => ({ kind: "script", item })),
+    ...flows.map((item) => ({ kind: "flow", item })),
+    ...apps2.map((item) => ({ kind: "app", item }))
+  ];
+  await beginLockfileBatch();
+  try {
+    const pool = new Set;
+    while (queue.length > 0 || pool.size > 0) {
+      while (pool.size < parallelism && queue.length > 0) {
+        const task = queue.shift();
+        const taskNumber = ++current;
+        const p = (async () => {
+          if (task.kind === "script") {
+            const item = task.item;
+            info(`${formatProgress(taskNumber)} script ${item.path}`);
+            try {
+              await generateScriptMetadataInternal(item.path, workspace, opts, false, true, mismatchedWorkspaceDeps, codebases, false, tree);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              error(`  Failed: ${msg}`);
+            }
+          } else if (task.kind === "flow") {
+            const item = task.item;
+            try {
+              const result = await generateFlowLockInternal(item.folder.replaceAll("/", SEP8), false, workspace, opts, false, true, tree);
+              const flowResult = result;
+              const scriptsInfo = flowResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${flowResult.updatedScripts.join(", ")}`)) : "";
+              info(`${formatProgress(taskNumber)} flow   ${item.path}${scriptsInfo}`);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              info(`${formatProgress(taskNumber)} flow   ${item.path}`);
+              error(`  Failed: ${msg}`);
+            }
+          } else {
+            const item = task.item;
+            try {
+              const result = await generateAppLocksInternal(item.folder.replaceAll("/", SEP8), item.isRawApp, false, workspace, opts, false, true, tree);
+              const appResult = result;
+              const scriptsInfo = appResult?.updatedScripts?.length ? colors.dim(colors.white(`: ${appResult.updatedScripts.join(", ")}`)) : "";
+              info(`${formatProgress(taskNumber)} app    ${item.path}${scriptsInfo}`);
+            } catch (e) {
+              const msg = e instanceof Error ? e.message : String(e);
+              errors.push({ path: item.path, error: msg });
+              info(`${formatProgress(taskNumber)} app    ${item.path}`);
+              error(`  Failed: ${msg}`);
+            }
+          }
+        })();
+        pool.add(p);
+        p.then(() => pool.delete(p));
+      }
+      if (pool.size > 0) {
+        await Promise.race(pool);
+      }
     }
+    const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
+    await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
+  } finally {
+    await flushLockfileBatch();
   }
-  const allStaleDeps = staleItems.filter((i) => i.type === "dependencies");
-  await tree.persistDepsHashes(allStaleDeps.map((d) => d.path));
   const succeeded = total - errors.length;
   info("");
   if (errors.length > 0) {
@@ -65030,13 +65341,14 @@ var init_generate_metadata = __esm(async () => {
     init_codebase(),
     init_dependency_tree()
   ]);
-  command7 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2).command("rehash", new Command().description("Trust on-disk content; rewrite wmill-lock.yaml hashes without backend " + "trips or yaml/lock rewrites. Useful for bootstrapping missing lockfile " + "entries or recovering from older-CLI hash drift.").arguments("[folder:string]").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(rehashCommand));
+  command7 = new Command().description("Generate metadata (locks, schemas) for all scripts, flows, and apps").arguments("[folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Show what would be updated without making changes").option("--lock-only", "Re-generate only the lock files").option("--schema-only", "Re-generate only script schemas (skips flows and apps)").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--strict-folder-boundaries", "Only update items inside the specified folder (requires folder argument)").option("--parallel <n:number>", "Number of items to process in parallel").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(generateMetadata2).command("rehash", new Command().description("Trust on-disk content; rewrite wmill-lock.yaml hashes without backend " + "trips or yaml/lock rewrites. Useful for bootstrapping missing lockfile " + "entries or recovering from older-CLI hash drift.").arguments("[folder:string]").option("--skip-scripts", "Skip processing scripts").option("--skip-flows", "Skip processing flows").option("--skip-apps", "Skip processing apps").option("--parallel <n:number>", "Number of items to process in parallel").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which files to include").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which files to exclude").action(rehashCommand));
   generate_metadata_default = command7;
 });
 
 // src/commands/sync/sync.ts
 var exports_sync = {};
 __export(exports_sync, {
+  yamlSortedEntries: () => yamlSortedEntries,
   yamlOptions: () => yamlOptions,
   resolveWsNameForConfigFromFlags: () => resolveWsNameForConfigFromFlags,
   readDirRecursiveWithIgnore: () => readDirRecursiveWithIgnore2,
@@ -65051,11 +65363,74 @@ __export(exports_sync, {
   extractFieldsForRawApps: () => extractFieldsForRawApps,
   elementsToMap: () => elementsToMap,
   default: () => sync_default,
+  computeWsSpecificFlagOnlyPushes: () => computeWsSpecificFlagOnlyPushes,
   FSFSElement: () => FSFSElement
 });
 import { writeFile as writeFile7, readdir as readdir4, stat as stat7, rm, copyFile, mkdir as mkdir5 } from "node:fs/promises";
 import * as path11 from "node:path";
 import { sep as SEP9 } from "node:path";
+function configKeyForItemKind(kind) {
+  switch (kind) {
+    case "resource":
+      return "resources";
+    case "variable":
+      return "variables";
+  }
+  return null;
+}
+async function mergeWsSpecificFromServer(workspaceId, specificItems) {
+  let wsSpecificItems;
+  try {
+    wsSpecificItems = await listWsSpecific({ workspace: workspaceId });
+  } catch (err) {
+    const isApiError = err && typeof err === "object" && "name" in err && err.name === "ApiError";
+    const status = isApiError ? err.status : undefined;
+    if (status === 404) {
+      debug("listWsSpecific endpoint not available on server, skipping");
+    } else {
+      const msg = err instanceof Error ? err.message : String(err);
+      warn(`Could not fetch ws_specific items from server (${status ?? "no status"}): ${msg}. ` + `Sync will proceed without server-side ws_specific items.`);
+    }
+    return { merged: specificItems, serverItems: null };
+  }
+  if (wsSpecificItems.length === 0) {
+    return { merged: specificItems, serverItems: wsSpecificItems };
+  }
+  const merged = specificItems ? { ...specificItems } : {};
+  for (const item of wsSpecificItems) {
+    const configKey = configKeyForItemKind(item.item_kind);
+    if (!configKey)
+      continue;
+    if (!merged[configKey]) {
+      merged[configKey] = [];
+    }
+    merged[configKey].push(`${item.path}.${item.item_kind}.yaml`);
+  }
+  return { merged, serverItems: wsSpecificItems };
+}
+function computeWsSpecificFlagOnlyPushes(localMap, localSpecificItems, serverItems) {
+  if (!localSpecificItems || serverItems === null)
+    return [];
+  const serverSet = new Set(serverItems.map((i) => `${i.item_kind}:${i.path}`));
+  const out = [];
+  for (const filePath of Object.keys(localMap)) {
+    let kind;
+    try {
+      kind = getTypeStrFromPath(filePath);
+    } catch {
+      continue;
+    }
+    if (configKeyForItemKind(kind) === null)
+      continue;
+    if (!isSpecificItem(filePath, localSpecificItems))
+      continue;
+    const serverPath = removeType(filePath, kind);
+    if (serverSet.has(`${kind}:${serverPath}`))
+      continue;
+    out.push({ kind, serverPath, filePath });
+  }
+  return out;
+}
 function resolveWsNameFromBranch(opts, branchName) {
   const match2 = findWorkspaceByGitBranch(opts.workspaces, branchName);
   return match2 ? match2[0] : branchName;
@@ -65256,6 +65631,14 @@ function prioritizeName(name) {
     return "azz";
   return name;
 }
+function yamlSortedEntries(rec) {
+  const entries = Object.entries(rec);
+  if (Array.isArray(rec)) {
+    return entries;
+  }
+  entries.sort(([a], [b]) => prioritizeName(a).localeCompare(prioritizeName(b)));
+  return entries;
+}
 function extractFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
     if (typeof v == "object") {
@@ -65379,7 +65762,7 @@ function extractInlineScriptsForApps(key, rec, pathAssigner, toId, removeSchema)
     return [];
   }
   if (typeof rec == "object") {
-    return Object.entries(rec).flatMap(([k, v]) => {
+    return yamlSortedEntries(rec).flatMap(([k, v]) => {
       if (k == "inlineScript" && v != null && typeof v == "object") {
         rec["type"] = undefined;
         const o = v;
@@ -65446,7 +65829,7 @@ async function findFilesetResourceFile(changePath) {
   }
   throw new Error(`No resource metadata file found for fileset resource: ${changePath}`);
 }
-async function pushFilesetParentResource(childPath, workspaceId, alreadySynced, cachedWsName) {
+async function pushFilesetParentResource(childPath, workspaceId, alreadySynced, cachedWsName, specificItems) {
   let resourceFilePath;
   try {
     resourceFilePath = await findFilesetResourceFile(childPath);
@@ -65459,10 +65842,14 @@ async function pushFilesetParentResource(childPath, workspaceId, alreadySynced,
   alreadySynced.push(resourceFilePath);
   const newObj = parseFromPath(resourceFilePath, await readTextFile(resourceFilePath));
   let serverPath = resourceFilePath;
+  let wsSpecific = false;
   if (cachedWsName && isWorkspaceSpecificFile(resourceFilePath)) {
     serverPath = fromWorkspaceSpecificPath(resourceFilePath, cachedWsName);
+    wsSpecific = true;
+  } else if (specificItems && isSpecificItem(childPath, specificItems)) {
+    wsSpecific = true;
   }
-  await pushResource(workspaceId, serverPath, undefined, newObj, resourceFilePath);
+  await pushResource(workspaceId, serverPath, undefined, newObj, resourceFilePath, wsSpecific ? true : undefined);
   return { status: "pushed", resourceFilePath };
 }
 function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, resourceTypeToIsFileset, ignoreCodebaseChanges, stripOnBehalfOf) {
@@ -66518,8 +66905,11 @@ async function pull(opts) {
     wsNameForConfig = inferWsNameFromProfile(opts, workspace);
   }
   const effectiveOpts = await resolveEffectiveSyncOptions(workspace, opts, opts.promotion, wsNameForConfig);
-  const specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
-  const wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : undefined;
+  let specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
+  let wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : workspace.workspaceId;
+  const localSpecificItems = specificItems;
+  const wsSpecificMerge = await mergeWsSpecificFromServer(workspace.workspaceId, specificItems);
+  specificItems = wsSpecificMerge.merged;
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
   const codebases = await listSyncCodebases(opts);
   info(colors.gray("Computing the files to update locally to match remote (taking wmill.yaml into account)"));
@@ -66538,6 +66928,17 @@ async function pull(opts) {
   const local = !opts.stateful ? await FSFSElement(process.cwd(), codebases, true) : await FSFSElement(path11.join(process.cwd(), ".wmill"), [], true);
   const { changes, localMap } = await compareDynFSElement(remote, local, await ignoreF(opts), opts.json ?? false, opts, false, codebases, true, specificItems, wsNameForFiles, true);
   info(`remote (${workspace.name}) -> local: ${changes.length} changes to apply`);
+  if (wsSpecificMerge.serverItems && wsSpecificMerge.serverItems.length > 0) {
+    const changedPaths = new Set(changes.map((c) => c.path));
+    for (const item of wsSpecificMerge.serverItems) {
+      const filePath = `${item.path}.${item.item_kind}.yaml`;
+      if (!changedPaths.has(filePath))
+        continue;
+      if (!isSpecificItem(filePath, localSpecificItems)) {
+        warn(`${item.item_kind} ${item.path} is workspace-specific on the remote ` + `but not flagged in wmill.yaml's specificItems — consider adding it.`);
+      }
+    }
+  }
   if (opts.dryRun && opts.jsonOutput) {
     const result = {
       success: true,
@@ -66761,6 +67162,8 @@ function prettyChanges(changes, specificItems, branchOverride, folderDefaultAnno
           showDiff(change.before, change.after);
         }
       }
+    } else if (change.name === "ws_specific_flag") {
+      info(colors.cyan(`~ ${change.kind} ${displayPath} ` + (change.wsSpecific ? "(mark as workspace-specific)" : "(unmark as workspace-specific)")));
     }
   }
 }
@@ -66800,8 +67203,12 @@ async function push4(opts) {
     wsNameForConfig = inferWsNameFromProfile(opts, workspace);
   }
   const effectiveOpts = await resolveEffectiveSyncOptions(workspace, opts, opts.promotion, wsNameForConfig);
-  const specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
-  const wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : undefined;
+  let specificItems = getSpecificItemsForCurrentBranch(opts, wsNameForConfig);
+  let wsNameForFiles = wsNameForConfig ? resolveWsNameForFiles(opts, wsNameForConfig) : workspace.workspaceId;
+  const localSpecificItems = specificItems;
+  const wsSpecificMerge = await mergeWsSpecificFromServer(workspace.workspaceId, specificItems);
+  specificItems = wsSpecificMerge.merged;
+  const serverWsSpecificItems = wsSpecificMerge.serverItems;
   opts = mergeCliWithEffectiveOptions(originalCliOpts, effectiveOpts);
   if (opts.lint) {
     info("Running lint validation before push...");
@@ -66853,7 +67260,18 @@ Push aborted: ${lockIssues.length} script(s) missing locks.`));
   } catch {}
   const remote = ZipFSElement(await downloadZip(workspace, opts.plainSecrets, opts.skipVariables, opts.skipResources, opts.skipResourceTypes, opts.skipSecrets, opts.includeSchedules, opts.includeTriggers, opts.includeUsers, opts.includeGroups, opts.includeSettings, opts.includeKey, opts.skipWorkspaceDependencies, opts.defaultTs), !opts.json, opts.defaultTs ?? "bun", resourceTypeToFormatExtension, resourceTypeToIsFileset, false, parseSyncBehavior(opts.syncBehavior) >= 1);
   const local = await FSFSElement(path11.join(process.cwd(), ""), codebases, false);
-  const { changes } = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, wsNameForFiles, false);
+  const { changes, localMap } = await compareDynFSElement(local, remote, await ignoreF(opts), opts.json ?? false, opts, true, codebases, false, specificItems, wsNameForFiles, false);
+  const wsSpecificFlagOnly = computeWsSpecificFlagOnlyPushes(localMap, localSpecificItems, serverWsSpecificItems);
+  for (const item of wsSpecificFlagOnly) {
+    if (changes.some((c) => c.path === item.filePath))
+      continue;
+    changes.push({
+      name: "ws_specific_flag",
+      path: item.filePath,
+      kind: item.kind,
+      wsSpecific: true
+    });
+  }
   const rawWorkspaceDependencies = await getRawWorkspaceDependencies(true);
   const tracker = await buildTracker(changes);
   const autoRegenerate = !!opts.autoMetadata;
@@ -67108,7 +67526,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
         userIsAdminOrDeployer,
         userEmail: user.email
       };
-      await preCheckPermissionedAs(changes, user.email, userIsAdminOrDeployer, opts.acceptOverridingPermissionedAsWithSelf ?? false, !!process.stdin.isTTY);
+      await preCheckPermissionedAs(changes.filter((c) => c.name !== "ws_specific_flag"), user.email, userIsAdminOrDeployer, opts.acceptOverridingPermissionedAsWithSelf ?? false, !!process.stdin.isTTY);
     } else if (folderDefaultAnnotations && folderDefaultAnnotations.size > 0) {
       warn(colors.yellow(`This workspace has folder default_permissioned_as rules that affect ${folderDefaultAnnotations.size} item(s) being pushed, but syncBehavior is not set in wmill.yaml. Add 'syncBehavior: v1' to enable ownership preservation on update and on_behalf_of stripping on pull.`));
     }
@@ -67209,10 +67627,14 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   const newObj2 = parseFromPath(resourceFilePath, await readTextFile(resourceFilePath));
                   let serverPath = resourceFilePath;
                   const currentBranch = cachedWsNameForPush;
+                  let isFileResWsSpecific = false;
                   if (currentBranch && isWorkspaceSpecificFile(resourceFilePath)) {
                     serverPath = fromWorkspaceSpecificPath(resourceFilePath, currentBranch);
+                    isFileResWsSpecific = true;
+                  } else if (specificItems && isSpecificItem(change.path, specificItems)) {
+                    isFileResWsSpecific = true;
                   }
-                  await pushResource(workspace.workspaceId, serverPath, undefined, newObj2, resourceFilePath);
+                  await pushResource(workspace.workspaceId, serverPath, undefined, newObj2, resourceFilePath, isFileResWsSpecific ? true : undefined);
                   if (stateTarget) {
                     await writeFile7(stateTarget, change.after, "utf-8");
                   }
@@ -67220,7 +67642,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                 }
               }
               if (isFilesetResource(change.path)) {
-                const result = await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush);
+                const result = await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
                 if (result.status === "parent-missing") {
                   throw new Error(`No resource metadata file found for fileset resource: ${change.path}`);
                 }
@@ -67234,16 +67656,17 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
               const oldObj = parseFromPath(change.path, change.before);
               const newObj = parseFromPath(change.path, change.after);
               let originalWorkspaceSpecificPath;
-              if (specificItems && isSpecificItem(change.path, specificItems)) {
+              const isWsSpecific = specificItems && isSpecificItem(change.path, specificItems);
+              if (isWsSpecific) {
                 originalWorkspaceSpecificPath = getWorkspaceSpecificPath(change.path, specificItems, wsNameForFiles);
               }
-              await pushObj(workspace.workspaceId, change.path, oldObj, newObj, opts.plainSecrets ?? false, alreadySynced, opts.message, originalWorkspaceSpecificPath, permissionedAsContext);
+              await pushObj(workspace.workspaceId, change.path, oldObj, newObj, opts.plainSecrets ?? false, alreadySynced, opts.message, originalWorkspaceSpecificPath, permissionedAsContext, isWsSpecific ? true : undefined);
               if (stateTarget) {
                 await writeFile7(stateTarget, change.after, "utf-8");
               }
             } else if (change.name === "added") {
               if (isFilesetResource(change.path)) {
-                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush);
+                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
                 continue;
               }
               if (change.path.endsWith(".script.json") || change.path.endsWith(".script.yaml") || change.path.endsWith(".lock") || isFileResource(change.path)) {
@@ -67260,13 +67683,14 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
               }
               const obj = parseFromPath(change.path, change.content);
               let localFilePath = change.path;
-              if (specificItems && isSpecificItem(change.path, specificItems)) {
+              const isAddedWsSpecific = specificItems && isSpecificItem(change.path, specificItems);
+              if (isAddedWsSpecific) {
                 const workspaceSpecificPath = getWorkspaceSpecificPath(change.path, specificItems, wsNameForFiles);
                 if (workspaceSpecificPath) {
                   localFilePath = workspaceSpecificPath;
                 }
               }
-              await pushObj(workspace.workspaceId, change.path, undefined, obj, opts.plainSecrets ?? false, [], opts.message, localFilePath, permissionedAsContext);
+              await pushObj(workspace.workspaceId, change.path, undefined, obj, opts.plainSecrets ?? false, [], opts.message, localFilePath, permissionedAsContext, isAddedWsSpecific ? true : undefined);
               if (stateTarget) {
                 await writeFile7(stateTarget, change.content, "utf-8");
               }
@@ -67279,7 +67703,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                 continue;
               }
               if (isFilesetResource(change.path)) {
-                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush);
+                await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
                 continue;
               }
               const typ = getTypeStrFromPath(change.path);
@@ -67548,6 +67972,23 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   await rm(stateTarget);
                 } catch {}
               }
+            } else if (change.name === "ws_specific_flag") {
+              const target = change.path.replaceAll(SEP9, "/");
+              if (change.kind === "resource") {
+                await updateResource({
+                  workspace: workspace.workspaceId,
+                  path: removeType(target, "resource"),
+                  requestBody: { ws_specific: change.wsSpecific }
+                });
+              } else if (change.kind === "variable") {
+                await updateVariable({
+                  workspace: workspace.workspaceId,
+                  path: removeType(target, "variable"),
+                  requestBody: { ws_specific: change.wsSpecific }
+                });
+              } else {
+                warn(`ws_specific_flag change for unsupported kind '${change.kind}' at ${change.path} — skipping`);
+              }
             }
           }
         })();
@@ -68576,7 +69017,20 @@ function normalizeLockPath(p) {
     n = n.slice(2);
   return n;
 }
+async function beginLockfileBatch() {
+  if (inMemoryLock)
+    return;
+  inMemoryLock = await readLockfile();
+}
+async function flushLockfileBatch() {
+  if (!inMemoryLock)
+    return;
+  await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(inMemoryLock, yamlOptions), "utf-8");
+  inMemoryLock = null;
+}
 async function readLockfile() {
+  if (inMemoryLock)
+    return inMemoryLock;
   let parsed;
   try {
     parsed = await yamlParseFile(WMILL_LOCKFILE);
@@ -68669,7 +69123,9 @@ async function clearGlobalLock(path13) {
         }
       });
     }
-    await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(conf, yamlOptions), "utf-8");
+    if (!inMemoryLock) {
+      await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(conf, yamlOptions), "utf-8");
+    }
   }
 }
 async function updateMetadataGlobalLock(path13, hash2, subpath) {
@@ -68692,9 +69148,11 @@ async function updateMetadataGlobalLock(path13, hash2, subpath) {
       conf.locks[path13] = hash2;
     }
   }
-  await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(conf, yamlOptions), "utf-8");
+  if (!inMemoryLock) {
+    await writeFile8(WMILL_LOCKFILE, import_yaml13.stringify(conf, yamlOptions), "utf-8");
+  }
 }
-var import_yaml13, _require, _parserCache, LockfileGenerationError, UnknownLockVersionError, MalformedLockfileError, LANG_ANNOTATION_CONFIG, lockCache, WMILL_LOCKFILE = "wmill-lock.yaml", CURRENT_LOCK_VERSION = "v2", KNOWN_LOCK_VERSIONS, SCRIPT_TOP_HASH = "__script_hash";
+var import_yaml13, _require, _parserCache, LockfileGenerationError, UnknownLockVersionError, MalformedLockfileError, LANG_ANNOTATION_CONFIG, lockCache, WMILL_LOCKFILE = "wmill-lock.yaml", CURRENT_LOCK_VERSION = "v2", KNOWN_LOCK_VERSIONS, SCRIPT_TOP_HASH = "__script_hash", inMemoryLock = null;
 var init_metadata = __esm(async () => {
   init_colors2();
   init_log();
@@ -69243,7 +69701,7 @@ async function traverseAndProcessInlineScripts(obj, processor, currentPath = [])
     ])));
   }
   const result = {};
-  for (const [key, value] of Object.entries(obj)) {
+  for (const [key, value] of yamlSortedEntries(obj)) {
     if (key === "inlineScript" && typeof value === "object") {
       result[key] = await processor(value, {
         path: currentPath,
@@ -70592,12 +71050,15 @@ async function getJobStatus(workspace, jobId) {
 }
 async function streamJobWithSSE(workspace, jobId, reqId, ws, baseUrl2, token) {
   const sseUrl = `${baseUrl2}api/w/${workspace}/jobs_u/getupdate_sse/${jobId}?fast=true`;
+  const extraHeaders = getHeaders2();
   const response = await fetch(sseUrl, {
     headers: {
       Accept: "text/event-stream",
-      Authorization: `Bearer ${token}`
+      Authorization: `Bearer ${token}`,
+      ...extraHeaders
     }
   });
+  await detectAuthGatewayChallenge(response, sseUrl);
   if (!response.ok) {
     throw new Error(`SSE request failed: ${response.status} ${response.statusText}`);
   }
@@ -70684,13 +71145,20 @@ var DEFAULT_PORT = 4000, DEFAULT_HOST = "localhost", createHTML = (jsPath, cssPa
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
   <title>Windmill App Dev Preview</title>
-  <link rel="stylesheet" href="${cssPath}">
   <style>
-    * {
-      margin: 0;
-      padding: 0;
-      box-sizing: border-box;
+    /* Declared before the user stylesheet so Tailwind's layers (theme, base,
+       components, utilities) are appended after wmill-shell and win the
+       cascade. Unlayered styles would override Tailwind utilities. */
+    @layer wmill-shell {
+      * {
+        margin: 0;
+        padding: 0;
+        box-sizing: border-box;
+      }
     }
+  </style>
+  <link rel="stylesheet" href="${cssPath}">
+  <style>
     body {
       font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen',
         'Ubuntu', 'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif;
@@ -70949,6 +71417,7 @@ var init_dev = __esm(async () => {
   init_get_port();
   init_port_probe();
   init_open();
+  init_http_guards();
   init_wrapper();
   init_services_gen();
   init_job_polling();
@@ -72297,7 +72766,7 @@ async function get6(opts, path19) {
     console.log(colors.bold("Account:") + " " + (v.account ?? "-"));
   }
 }
-async function pushVariable(workspace, remotePath, variable, localVariable, plainSecrets) {
+async function pushVariable(workspace, remotePath, variable, localVariable, plainSecrets, wsSpecific) {
   remotePath = removeType(remotePath, "variable");
   debug(`Processing local variable ${remotePath}`);
   try {
@@ -72323,7 +72792,8 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
       alreadyEncrypted: !plainSecrets,
       requestBody: {
         ...localVariable,
-        is_secret: localVariable.is_secret && !variable.is_secret ? true : undefined
+        is_secret: localVariable.is_secret && !variable.is_secret ? true : undefined,
+        ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
   } else {
@@ -72333,7 +72803,8 @@ async function pushVariable(workspace, remotePath, variable, localVariable, plai
       alreadyEncrypted: !plainSecrets,
       requestBody: {
         path: remotePath.replaceAll(SEP16, "/"),
-        ...localVariable
+        ...localVariable,
+        ...wsSpecific !== undefined ? { ws_specific: wsSpecific } : {}
       }
     });
   }
@@ -74750,7 +75221,7 @@ function showConflict(path21, local, remote) {
   info(`
 `);
 }
-async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext) {
+async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext, wsSpecific) {
   const typeEnding = getTypeStrFromPath(p);
   if (typeEnding === "app") {
     const appName = extractResourceName(p, "app");
@@ -74767,7 +75238,7 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   } else if (typeEnding === "folder") {
     await pushFolder(workspace, p, befObj, newObj);
   } else if (typeEnding === "variable") {
-    await pushVariable(workspace, p, befObj, newObj, plainSecrets);
+    await pushVariable(workspace, p, befObj, newObj, plainSecrets, wsSpecific);
   } else if (typeEnding === "flow") {
     const flowName = extractResourceName(p, "flow");
     if (!flowName) {
@@ -74777,7 +75248,7 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   } else if (typeEnding === "resource") {
     if (!alreadySynced3.includes(p)) {
       alreadySynced3.push(p);
-      await pushResource(workspace, p, befObj, newObj, originalLocalPath || p);
+      await pushResource(workspace, p, befObj, newObj, originalLocalPath || p, wsSpecific);
     }
   } else if (typeEnding === "resource-type") {
     await pushResourceType(workspace, p, befObj, newObj);
@@ -85719,6 +86190,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
 - \`--skip-flows\` - Skip processing flows
 - \`--skip-apps\` - Skip processing apps
 - \`--strict-folder-boundaries\` - Only update items inside the specified folder (requires folder argument)
+- \`--parallel <n:number>\` - Number of items to process in parallel
 - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
 - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
@@ -85728,6 +86200,7 @@ Generate metadata (locks, schemas) for all scripts, flows, and apps
   - \`--skip-scripts\` - Skip processing scripts
   - \`--skip-flows\` - Skip processing flows
   - \`--skip-apps\` - Skip processing apps
+  - \`--parallel <n:number>\` - Number of items to process in parallel
   - \`-i --includes <patterns:file[]>\` - Comma separated patterns to specify which files to include
   - \`-e --excludes <patterns:file[]>\` - Comma separated patterns to specify which files to exclude
 
@@ -88945,9 +89418,11 @@ await init_generate_metadata();
 init_mod3();
 init_colors2();
 init_log();
+init_http_guards();
 await __promiseAll([
   init_auth(),
-  init_context()
+  init_context(),
+  init_utils()
 ]);
 async function docs(opts, query) {
   await requireLogin(opts);
@@ -88956,19 +89431,22 @@ async function docs(opts, query) {
   console.log(colors.bold(`
 Searching Windmill docs...
 `));
+  const extraHeaders = getHeaders2();
   let res;
   try {
     res = await fetch(url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${workspace.token}`
+        Authorization: `Bearer ${workspace.token}`,
+        ...extraHeaders
       },
       body: JSON.stringify({ query })
     });
   } catch (e) {
     throw new Error(`Network error connecting to ${workspace.remote}: ${e}`);
   }
+  await detectAuthGatewayChallenge(res, url);
   if (res.status === 403) {
     info("Windmill documentation search is an Enterprise Edition feature. Please upgrade to use this command.");
     return;
@@ -89087,7 +89565,7 @@ var config_default = command35;
 
 // src/main.ts
 await init_context();
-var VERSION = "1.696.2";
+var VERSION = "1.698.0";
 async function checkVersionSafe(cmd) {
   const mainCommand = cmd.getMainCommand();
   const upgradeCommand = mainCommand.getCommand("upgrade");