windmill-cli 1.710.1 → 1.712.0

package/esm/main.js

@@ -16772,7 +16772,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.710.1",
+    VERSION: "1.712.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -67379,6 +67379,14 @@ async function pull(opts) {
       checkoutGitSyncDeployBranch(deployBranch);
     }
     if (opts.onlyCreateBranch) {
+      gitSyncDeployPush({
+        items: deployItems,
+        authorName: process.env["WM_USERNAME"] || "windmill",
+        authorEmail: process.env["WM_EMAIL"] || "windmill@windmill.dev",
+        committerName: opts.gitCommitterName,
+        committerEmail: opts.gitCommitterEmail,
+        onlyCreateBranch: true
+      });
       return;
     }
   }
@@ -67662,9 +67670,12 @@ function prettyChanges(changes, specificItems, branchOverride, folderDefaultAnno
     } else if (change.name === "deleted") {
       info(colors.red(`- ${getTypeStrFromPath(change.path)} ` + displayPath + colors.gray(wsNote)));
     } else if (change.name === "edited") {
-      info(colors.yellow(`~ ${getTypeStrFromPath(change.path)} ` + displayPath + colors.gray(wsNote) + (change.codebase ? ` (codebase changed)` : "")));
+      const changeType = getTypeStrFromPath(change.path);
+      info(colors.yellow(`~ ${changeType} ` + displayPath + colors.gray(wsNote) + (change.codebase ? ` (codebase changed)` : "")));
       if (change.before != change.after) {
-        if (change.path.endsWith(".yaml")) {
+        if (changeType === "encryption_key") {
+          showDiff(redactEncryptionKey(change.before), redactEncryptionKey(change.after));
+        } else if (change.path.endsWith(".yaml")) {
           try {
             showDiff(import_yaml11.stringify(yamlParseContent(change.path, change.before), yamlOptions), import_yaml11.stringify(yamlParseContent(change.path, change.after), yamlOptions));
           } catch {
@@ -75804,11 +75815,35 @@ function showDiff(local, remote) {
 }
 function showConflict(path21, local, remote) {
   info(colors.yellow(`- ${path21}`));
-  showDiff(local, remote);
+  let isEncryptionKey = false;
+  try {
+    isEncryptionKey = getTypeStrFromPath(path21) === "encryption_key";
+  } catch {}
+  if (isEncryptionKey) {
+    showDiff(redactEncryptionKey(local), redactEncryptionKey(remote));
+  } else {
+    showDiff(local, remote);
+  }
   info("\x1B[31mlocal\x1B[31m - \x1B[32mremote\x1B[32m");
   info(`
 `);
 }
+function redactEncryptionKey(content) {
+  if (!content)
+    return content;
+  try {
+    const parsed = JSON.parse(content);
+    if (typeof parsed === "string") {
+      return JSON.stringify(redactString(parsed));
+    }
+  } catch {}
+  return redactString(content);
+}
+function redactString(s) {
+  if (s.length <= 5)
+    return s;
+  return s.slice(0, 5) + "*".repeat(s.length - 5);
+}
 async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced3, message, originalLocalPath, permissionedAsContext, wsSpecific) {
   const typeEnding = getTypeStrFromPath(p);
   if (typeEnding === "app") {
@@ -76130,7 +76165,7 @@ var init_local_path_scripts = __esm(async () => {
 });
 
 // src/commands/flow/flow.ts
-import { sep as SEP20 } from "node:path";
+import { dirname as dirname17, sep as SEP20 } from "node:path";
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync7 } from "node:fs";
 function normalizeOptionalString(value) {
   return typeof value === "string" && value.trim() === "" ? undefined : value ?? undefined;
@@ -76501,7 +76536,7 @@ async function preview2(opts, flowPath) {
   const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP20) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP20);
   if (!isFlowDir) {
     if (flowPath.endsWith("flow.yaml") || flowPath.endsWith("flow.json")) {
-      flowPath = flowPath.substring(0, flowPath.lastIndexOf(SEP20));
+      flowPath = dirname17(flowPath);
     } else {
       throw new Error("Flow path must be a .flow/__flow directory or a flow.yaml file");
     }
@@ -76544,15 +76579,20 @@ async function preview2(opts, flowPath) {
     tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, opts, resolvedCodebases, { kind: "flow", folder: flowPath });
   }
   const input = opts.data ? await resolve6(opts.data) : {};
+  debug(`Flow value: ${JSON.stringify(localFlow.value, null, 2)}`);
+  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP20, "/");
+  if (opts.step) {
+    await previewStep(opts.step, localFlow, flowWmPath, workspace, input, tempScriptRefs, opts.silent);
+    return;
+  }
   if (!opts.silent) {
     info(colors.yellow(`Running flow preview for ${flowPath}...`));
   }
-  debug(`Flow value: ${JSON.stringify(localFlow.value, null, 2)}`);
   const jobId = await runFlowPreview({
     workspace: workspace.workspaceId,
     requestBody: {
       value: localFlow.value,
-      path: flowPath.substring(0, flowPath.indexOf(".flow")).replaceAll(SEP20, "/"),
+      path: flowWmPath,
       args: input,
       temp_script_refs: tempScriptRefs
     }
@@ -76575,6 +76615,151 @@ async function preview2(opts, flowPath) {
     info(JSON.stringify(result, null, 2));
   }
 }
+async function previewStep(stepId, localFlow, flowWmPath, workspace, baseArgs, tempScriptRefs, silent) {
+  const module = findStepInFlowValue(localFlow.value, stepId);
+  if (!module) {
+    const available = collectStepIds(localFlow.value).join(", ") || "(none)";
+    throw new Error(`Step '${stepId}' not found in flow. Available steps: ${available}`);
+  }
+  const args = stepId === "preprocessor" ? { _ENTRYPOINT_OVERRIDE: "preprocessor", ...baseArgs } : baseArgs;
+  const moduleValue = module.value;
+  let jobId;
+  if (moduleValue?.type === "rawscript") {
+    info(colors.yellow(`Previewing step '${stepId}' (rawscript, ${moduleValue.language})...`));
+    jobId = await runScriptPreview({
+      workspace: workspace.workspaceId,
+      requestBody: {
+        content: moduleValue.content ?? "",
+        language: moduleValue.language,
+        path: `${flowWmPath}/${stepId}`,
+        flow_path: flowWmPath,
+        args,
+        temp_script_refs: tempScriptRefs
+      }
+    });
+  } else if (moduleValue?.type === "script") {
+    info(colors.yellow(`Previewing step '${stepId}' (script ${moduleValue.path})...`));
+    const script = moduleValue.hash ? await getScriptByHash({
+      workspace: workspace.workspaceId,
+      hash: moduleValue.hash
+    }) : await getScriptByPath({
+      workspace: workspace.workspaceId,
+      path: moduleValue.path
+    });
+    jobId = await runScriptPreview({
+      workspace: workspace.workspaceId,
+      requestBody: {
+        content: script.content,
+        language: script.language,
+        path: moduleValue.path,
+        flow_path: flowWmPath,
+        args,
+        temp_script_refs: tempScriptRefs
+      }
+    });
+  } else if (moduleValue?.type === "flow") {
+    info(colors.yellow(`Previewing step '${stepId}' (flow ${moduleValue.path})...`));
+    jobId = await runFlowByPath({
+      workspace: workspace.workspaceId,
+      path: moduleValue.path,
+      requestBody: args
+    });
+  } else {
+    throw new Error(`Cannot preview step of type '${moduleValue?.type ?? "unknown"}'. Supported types: rawscript, script, flow.`);
+  }
+  const { result, success } = await pollForJobResult(workspace.workspaceId, jobId);
+  if (!success) {
+    if (silent) {
+      console.log(JSON.stringify(result));
+    } else {
+      info(colors.red.bold(`Step '${stepId}' failed:`));
+      info(JSON.stringify(result, null, 2));
+    }
+    process.exitCode = 1;
+    return;
+  }
+  if (silent) {
+    console.log(JSON.stringify(result));
+  } else {
+    info(colors.bold.underline.green(`Step '${stepId}' completed`));
+    info(JSON.stringify(result, null, 2));
+  }
+}
+function stripFlowSuffix(flowPath) {
+  const stripped = flowPath.endsWith(SEP20) ? flowPath.slice(0, -SEP20.length) : flowPath;
+  if (stripped.endsWith(".flow"))
+    return stripped.slice(0, -".flow".length);
+  if (stripped.endsWith("__flow"))
+    return stripped.slice(0, -"__flow".length);
+  return stripped;
+}
+function findStepInFlowValue(flowValue, stepId) {
+  if (!flowValue)
+    return;
+  if (flowValue.failure_module?.id === stepId)
+    return flowValue.failure_module;
+  if (flowValue.preprocessor_module?.id === stepId)
+    return flowValue.preprocessor_module;
+  return findStepInModules(flowValue.modules ?? [], stepId);
+}
+function findStepInModules(modules, stepId) {
+  for (const m of modules) {
+    if (m?.id === stepId)
+      return m;
+    const v = m?.value;
+    if (!v)
+      continue;
+    if (v.type === "forloopflow" || v.type === "whileloopflow") {
+      const found = findStepInModules(v.modules ?? [], stepId);
+      if (found)
+        return found;
+    } else if (v.type === "branchone") {
+      for (const b of v.branches ?? []) {
+        const found2 = findStepInModules(b.modules ?? [], stepId);
+        if (found2)
+          return found2;
+      }
+      const found = findStepInModules(v.default ?? [], stepId);
+      if (found)
+        return found;
+    } else if (v.type === "branchall") {
+      for (const b of v.branches ?? []) {
+        const found = findStepInModules(b.modules ?? [], stepId);
+        if (found)
+          return found;
+      }
+    }
+  }
+  return;
+}
+function collectStepIds(flowValue) {
+  const ids = [];
+  const walkModules = (modules) => {
+    for (const m of modules) {
+      if (m?.id)
+        ids.push(m.id);
+      const v = m?.value;
+      if (!v)
+        continue;
+      if (v.type === "forloopflow" || v.type === "whileloopflow") {
+        walkModules(v.modules ?? []);
+      } else if (v.type === "branchone") {
+        for (const b of v.branches ?? [])
+          walkModules(b.modules ?? []);
+        walkModules(v.default ?? []);
+      } else if (v.type === "branchall") {
+        for (const b of v.branches ?? [])
+          walkModules(b.modules ?? []);
+      }
+    }
+  };
+  if (flowValue?.preprocessor_module?.id)
+    ids.push(flowValue.preprocessor_module.id);
+  if (flowValue?.failure_module?.id)
+    ids.push(flowValue.failure_module.id);
+  walkModules(flowValue?.modules ?? []);
+  return ids;
+}
 async function generateLocks(opts, folder) {
   warn(colors.yellow('This command is deprecated. Use "wmill generate-metadata" instead.'));
   const workspace = await resolveWorkspace(opts);
@@ -76711,7 +76896,7 @@ var init_flow = __esm(async () => {
   ]);
   import_yaml36 = __toESM(require_dist(), 1);
   alreadySynced3 = [];
-  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--message <message:string>", "Deployment message").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").action(preview2).command("generate-locks", 'DEPRECATED: re-generate flow lock files. Use "wmill generate-metadata" instead.').arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion).command("set-permissioned-as", "Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, flowPath, email) => {
+  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--message <message:string>", "Deployment message").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").option("--step <step_id:string>", "Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.").action(preview2).command("generate-locks", 'DEPRECATED: re-generate flow lock files. Use "wmill generate-metadata" instead.').arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion).command("set-permissioned-as", "Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, flowPath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const remote = await getFlowByPath({
@@ -82984,7 +83169,7 @@ Once the flow has real content, **offer** to open the visual preview as a one-se
 
 After writing, tell the user which command fits what they want to do:
 
-- \`wmill flow preview <flow_path>\` — **default when iterating on a local flow.** Runs the local \`flow.yaml\` against local inline scripts without deploying. Add \`--remote\` to use deployed workspace scripts for PathScript steps instead of local files.
+- \`wmill flow preview <flow_path>\` — **default when iterating on a local flow.** Runs the local \`flow.yaml\` against local inline scripts without deploying. Add \`--remote\` to use deployed workspace scripts for PathScript steps instead of local files. Add \`--step <step_id>\` to run only one module in isolation (see "Single-step vs whole-flow preview" below).
 - \`wmill flow run <path>\` — runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
 - \`wmill generate-metadata\` — regenerate stale \`.lock\` and \`.script.yaml\` files. By default it scans **scripts, flows, and apps** across the workspace; pass \`--skip-flows --skip-apps\` (or run from a subdirectory) to limit the scope when you only care about the flow you edited.
 - \`wmill sync push\` — deploy local changes to the workspace. Only suggest/run this when the user explicitly asks to deploy/publish/push — not when they say "run", "try", or "test".
@@ -83001,6 +83186,12 @@ Only use \`sync push\` when:
 - The user explicitly asks to deploy, publish, push, or ship.
 - The preview has already validated the change and the user wants it in the workspace.
 
+### Single-step vs whole-flow preview
+
+Use \`flow preview <flow_path> --step <step_id>\` when the user is iterating on one module and the flow's upstream steps aren't part of what they're trying to validate. It runs only that step's runnable (rawscript: the inline script; script: the PathScript, locally if available; flow: the subflow by path) and is much faster than running the whole flow when previous steps are slow or expensive. The step id is resolved by walking nested branchone/branchall/forloopflow/whileloopflow modules and includes the special \`preprocessor\` and \`failure\` modules.
+
+Use \`flow preview <flow_path>\` (no \`--step\`) when steps depend on each other's outputs, when the user is validating the overall control flow, or when \`--step\` doesn't apply (branchone, branchall, forloopflow, whileloopflow, identity, and AI agent steps cannot themselves be tested in isolation — for branchone/branchall/forloopflow/whileloopflow, the *contained* steps can, by passing the inner step's id).
+
 ### After writing — offer to run, don't wait passively
 
 This is about **programmatic execution** (\`wmill flow preview -d '<args>'\`), which actually runs the flow and has side effects. Visual preview (the \`preview\` skill) is offered separately — see "Visual preview" below.
@@ -84655,10 +84846,11 @@ flow related commands
 - \`flow run <path:string>\` - run a flow by path.
   - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
   - \`-s --silent\` - Do not ouput anything other then the final output. Useful for scripting.
-- \`flow preview <flow_path:string>\` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default.
+- \`flow preview <flow_path:string>\` - preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).
   - \`-d --data <data:string>\` - Inputs specified as a JSON string or a file using @<filename> or stdin using @-.
   - \`-s --silent\` - Do not output anything other then the final output. Useful for scripting.
   - \`--remote\` - Use deployed workspace scripts for PathScript steps instead of local files.
+  - \`--step <step_id:string>\` - Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.
 - \`flow new <flow_path:string>\` - create a new empty flow
   - \`--summary <summary:string>\` - flow summary
   - \`--description <description:string>\` - flow description
@@ -84874,6 +85066,42 @@ Validate Windmill flow, schedule, and trigger YAML files in a directory
 - \`--locks-required\` - Fail if scripts or flow inline scripts that need locks have no locks
 - \`-w, --watch\` - Watch for file changes and re-lint automatically
 
+### object-storage
+
+**Alias:** \`s3\`
+
+**Subcommands:**
+
+- \`object-storage list\` - List configured object storages for the workspace (default + secondary).
+  - \`--json\` - Output as JSON (for piping to jq)
+- \`object-storage files [prefix:string]\` - List files in an object storage. Optionally filter by prefix.
+  - \`--json\` - Output as JSON (for piping to jq)
+  - \`--max-keys <maxKeys:number>\` - Page size (default 100)
+  - \`--marker <marker:string>\` - Pagination marker from a previous response
+  - \`--storage <storage:string>\` - Secondary storage name (omit for the workspace default)
+- \`object-storage upload <local_path:string> <file_key:string>\` - Upload a local file to object storage at the given file key.
+  - \`--storage <storage:string>\` - Secondary storage name
+  - \`--content-type <contentType:string>\` - Content-Type header to set on the object
+  - \`--content-disposition <contentDisposition:string>\` - Content-Disposition header to set on the object
+- \`object-storage download <file_key:string> [output_path:string]\` - Download an object to a local file (or stdout). Default output path is the basename of the file key in the current directory.
+  - \`--storage <storage:string>\` - Secondary storage name
+  - \`--stdout\` - Write file contents to stdout instead of a file
+- \`object-storage delete <file_key:string>\` - Delete an object from object storage. Prompts for confirmation unless --yes is set.
+  - \`--storage <storage:string>\` - Secondary storage name
+  - \`--yes\` - Skip the confirmation prompt
+- \`object-storage move <src_file_key:string> <dest_file_key:string>\` - Move an object within the same storage (rename or relocate by key).
+  - \`--storage <storage:string>\` - Secondary storage name
+- \`object-storage info <file_key:string>\` - Show metadata (size, mime, last-modified) for an object.
+  - \`--json\` - Output as JSON (for piping to jq)
+  - \`--storage <storage:string>\` - Secondary storage name
+- \`object-storage preview <file_key:string>\` - Preview the contents of an object (text/CSV). Use --bytes-from / --bytes-length to peek at a slice of binary files.
+  - \`--storage <storage:string>\` - Secondary storage name
+  - \`--mime <mime:string>\` - Override the detected mime type (e.g. text/csv)
+  - \`--bytes-from <bytesFrom:number>\` - Start offset in bytes
+  - \`--bytes-length <bytesLength:number>\` - Number of bytes to read
+  - \`--csv-separator <csvSeparator:string>\` - CSV column separator (default ,)
+  - \`--csv-header\` - Treat the first CSV row as a header
+
 ### protection-rules
 
 **Subcommands:**
@@ -85210,6 +85438,26 @@ workspace related commands
   - \`--team-name <team_name:string>\` - Slack team name
 - \`workspace disconnect-slack\`
 
+
+
+# Object Storage CLI
+
+\`wmill object-storage\` (alias \`wmill s3\`) exposes the workspace's object storage (S3-compatible: AWS S3, MinIO, GCS, R2, Azure Blob) over the per-workspace \`/job_helpers/*\` endpoints.
+
+## Key concepts (not obvious from per-command --help)
+
+- **\`file_key\` is the path inside the bucket** (e.g. \`reports/2026-05/orders.csv\`), not a Windmill path. Do NOT pass \`u/...\` or \`f/...\` here — those are Windmill paths to scripts/flows/resources, unrelated to objects in the bucket.
+- **Scope is the active workspace.** Object storage is configured per-workspace (default storage + optional secondary storages). Switching workspaces switches which bucket the commands target.
+- **\`--storage <name>\` targets a secondary storage** configured on the workspace. Omit it to use the workspace's default object storage. Use \`wmill object-storage list\` to discover configured storages.
+- **\`preview\` vs \`download\`**: \`preview\` returns a peek (CSV first rows, text content, or a byte slice via \`--bytes-from\`/\`--bytes-length\`) without writing to disk. Use \`download\` when you want the full file on disk.
+
+## Choosing a subcommand
+
+- Look at what's there: \`wmill object-storage files [prefix]\` (alias \`ls\`) — paginated, use \`--marker\` to continue.
+- Inspect one file: \`wmill object-storage info <file_key>\` for size/mime/last-modified, \`wmill object-storage preview <file_key>\` for content peek.
+- Move data in: \`wmill object-storage upload <local_path> <file_key>\` — set \`--content-type\` if the receiver cares (e.g. \`text/csv\`).
+- Move data out: \`wmill object-storage download <file_key> [output_path]\` — \`--stdout\` to pipe.
+- Reorganize: \`wmill object-storage move <src> <dest>\` (same storage), \`wmill object-storage delete <file_key>\` (interactive confirm unless \`--yes\`).
 `,
     preview: `---
 name: preview
@@ -87946,13 +88194,13 @@ await __promiseAll([
 var import_yaml39 = __toESM(require_dist(), 1);
 import { existsSync as existsSync10 } from "node:fs";
 import { writeFile as writeFile19 } from "node:fs/promises";
-import { dirname as dirname17, join as join18 } from "node:path";
+import { dirname as dirname18, join as join18 } from "node:path";
 var PROTECTION_RULES_FILENAME = "protection-rules.yaml";
 function getProtectionRulesPath() {
   const wmillPath = getWmillYamlPath();
   if (!wmillPath)
     return null;
-  return join18(dirname17(wmillPath), PROTECTION_RULES_FILENAME);
+  return join18(dirname18(wmillPath), PROTECTION_RULES_FILENAME);
 }
 async function readProtectionRulesFile(path21) {
   if (!existsSync10(path21))
@@ -89948,7 +90196,11 @@ ${options.includeLine}
 }
 function referencesIncludeLine(content, includeLine) {
   for (const line of content.split(/\r?\n/)) {
-    if (line.trim() === includeLine) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("<!--") || trimmed.endsWith("-->")) {
+      continue;
+    }
+    if (trimmed.split(/\s+/).includes(includeLine)) {
       return true;
     }
   }
@@ -93203,9 +93455,211 @@ async function run5(opts, sql) {
 var command40 = new Command().description("ducklake related commands").command("list", "list all ducklakes in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list18).command("run", "run a SQL query on a ducklake").arguments("<sql:string>").option("-n --name <name:string>", "Ducklake name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run5);
 var ducklake_default = command40;
 
+// src/commands/object-storage/object-storage.ts
+init_mod3();
+init_mod6();
+init_colors2();
+init_log();
+init_services_gen();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_confirm(),
+  init_utils()
+]);
+import { Buffer as Buffer5 } from "node:buffer";
+import { readFile as readFile3, writeFile as writeFile25 } from "node:fs/promises";
+import { basename as basename10 } from "node:path";
+function formatBytes(n2) {
+  if (n2 == null)
+    return "-";
+  if (n2 < 1024)
+    return `${n2}B`;
+  if (n2 < 1024 * 1024)
+    return `${(n2 / 1024).toFixed(1)}K`;
+  if (n2 < 1024 * 1024 * 1024)
+    return `${(n2 / (1024 * 1024)).toFixed(1)}M`;
+  return `${(n2 / (1024 * 1024 * 1024)).toFixed(2)}G`;
+}
+async function listStorages(opts) {
+  if (opts.json)
+    setSilent(true);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const names = await getSecondaryStorageNames({
+    workspace: workspace.workspaceId,
+    includeDefault: true
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(names));
+    return;
+  }
+  if (names.length === 0) {
+    info("No object storage configured for this workspace.");
+    return;
+  }
+  for (const name of names) {
+    console.log(name === "_default_" ? `${name}  ${colors.dim("(default)")}` : name);
+  }
+}
+async function listFiles(opts, prefix) {
+  if (opts.json)
+    setSilent(true);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const result2 = await listStoredFiles({
+    workspace: workspace.workspaceId,
+    maxKeys: opts.maxKeys ?? 100,
+    marker: opts.marker,
+    prefix,
+    storage: opts.storage
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(result2));
+    return;
+  }
+  const files = result2.windmill_large_files ?? [];
+  if (files.length === 0) {
+    info("No files found.");
+    return;
+  }
+  new Table2().header(["Key"]).padding(2).border(true).body(files.map((f3) => [f3.s3])).render();
+  if (result2.next_marker) {
+    info(`
+More results available. Use --marker '${result2.next_marker}' to paginate.`);
+  }
+}
+async function upload(opts, localPath, fileKey) {
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const buf = await readFile3(localPath);
+  const blob = new Blob([buf], { type: opts.contentType ?? "application/octet-stream" });
+  await fileUpload({
+    workspace: workspace.workspaceId,
+    fileKey,
+    storage: opts.storage,
+    contentType: opts.contentType,
+    contentDisposition: opts.contentDisposition,
+    requestBody: blob
+  });
+  info(colors.green(`Uploaded ${localPath} -> ${fileKey}`));
+}
+async function download(opts, fileKey, outputPath) {
+  if (opts.stdout)
+    setSilent(true);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const body = await fileDownload({
+    workspace: workspace.workspaceId,
+    fileKey,
+    storage: opts.storage
+  });
+  let buf;
+  if (typeof body === "string") {
+    buf = Buffer5.from(body, "utf-8");
+  } else if (body instanceof Blob) {
+    buf = Buffer5.from(await body.arrayBuffer());
+  } else if (body instanceof ArrayBuffer) {
+    buf = Buffer5.from(body);
+  } else if (body == null) {
+    buf = Buffer5.alloc(0);
+  } else {
+    buf = Buffer5.from(JSON.stringify(body), "utf-8");
+  }
+  if (opts.stdout) {
+    process.stdout.write(buf);
+    return;
+  }
+  const dest = outputPath ?? basename10(fileKey);
+  await writeFile25(dest, buf);
+  info(colors.green(`Downloaded ${fileKey} -> ${dest}`));
+}
+async function del(opts, fileKey) {
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  if (!opts.yes) {
+    const confirmed = await Confirm.prompt({
+      message: `Delete '${fileKey}' from object storage${opts.storage ? ` (storage: ${opts.storage})` : ""}?`,
+      default: false
+    });
+    if (!confirmed) {
+      info("Aborted.");
+      return;
+    }
+  }
+  await deleteS3File({
+    workspace: workspace.workspaceId,
+    fileKey,
+    storage: opts.storage
+  });
+  info(colors.green(`Deleted ${fileKey}`));
+}
+async function move(opts, srcFileKey, destFileKey) {
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  await moveS3File({
+    workspace: workspace.workspaceId,
+    srcFileKey,
+    destFileKey,
+    storage: opts.storage
+  });
+  info(colors.green(`Moved ${srcFileKey} -> ${destFileKey}`));
+}
+async function info2(opts, fileKey) {
+  if (opts.json)
+    setSilent(true);
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const metadata = await loadFileMetadata({
+    workspace: workspace.workspaceId,
+    fileKey,
+    storage: opts.storage
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(metadata));
+    return;
+  }
+  console.log(colors.bold("Key:") + " " + fileKey);
+  console.log(colors.bold("Size:") + " " + formatBytes(metadata.size_in_bytes));
+  console.log(colors.bold("Mime:") + " " + (metadata.mime_type ?? "-"));
+  console.log(colors.bold("Last Modified:") + " " + (metadata.last_modified ? formatTimestamp(metadata.last_modified) : "-"));
+  if (metadata.expires) {
+    console.log(colors.bold("Expires:") + " " + formatTimestamp(metadata.expires));
+  }
+  if (metadata.version_id) {
+    console.log(colors.bold("Version Id:") + " " + metadata.version_id);
+  }
+}
+async function preview3(opts, fileKey) {
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const result2 = await loadFilePreview({
+    workspace: workspace.workspaceId,
+    fileKey,
+    storage: opts.storage,
+    fileMimeType: opts.mime,
+    readBytesFrom: opts.bytesFrom ?? 0,
+    readBytesLength: opts.bytesLength ?? 128 * 1024,
+    csvSeparator: opts.csvSeparator,
+    csvHasHeader: opts.csvHeader
+  });
+  if (result2.msg) {
+    info(colors.yellow(result2.msg));
+  }
+  if (result2.content != null) {
+    process.stdout.write(result2.content);
+    if (!result2.content.endsWith(`
+`))
+      process.stdout.write(`
+`);
+  }
+}
+var command41 = new Command().alias("s3").description("Object storage (S3) related commands. Operates on the workspace's default object storage; use --storage to target a configured secondary storage.").action(listStorages).command("list", "List configured object storages for the workspace (default + secondary).").option("--json", "Output as JSON (for piping to jq)").action(listStorages).command("files", "List files in an object storage. Optionally filter by prefix.").alias("ls").arguments("[prefix:string]").option("--json", "Output as JSON (for piping to jq)").option("--max-keys <maxKeys:number>", "Page size (default 100)").option("--marker <marker:string>", "Pagination marker from a previous response").option("--storage <storage:string>", "Secondary storage name (omit for the workspace default)").action(listFiles).command("upload", "Upload a local file to object storage at the given file key.").arguments("<local_path:string> <file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--content-type <contentType:string>", "Content-Type header to set on the object").option("--content-disposition <contentDisposition:string>", "Content-Disposition header to set on the object").action(upload).command("download", "Download an object to a local file (or stdout). Default output path is the basename of the file key in the current directory.").arguments("<file_key:string> [output_path:string]").option("--storage <storage:string>", "Secondary storage name").option("--stdout", "Write file contents to stdout instead of a file").action(download).command("delete", "Delete an object from object storage. Prompts for confirmation unless --yes is set.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--yes", "Skip the confirmation prompt").action(del).command("move", "Move an object within the same storage (rename or relocate by key).").arguments("<src_file_key:string> <dest_file_key:string>").option("--storage <storage:string>", "Secondary storage name").action(move).command("info", "Show metadata (size, mime, last-modified) for an object.").arguments("<file_key:string>").option("--json", "Output as JSON (for piping to jq)").option("--storage <storage:string>", "Secondary storage name").action(info2).command("preview", "Preview the contents of an object (text/CSV). Use --bytes-from / --bytes-length to peek at a slice of binary files.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--mime <mime:string>", "Override the detected mime type (e.g. text/csv)").option("--bytes-from <bytesFrom:number>", "Start offset in bytes").option("--bytes-length <bytesLength:number>", "Number of bytes to read").option("--csv-separator <csvSeparator:string>", "CSV column separator (default ,)").option("--csv-header", "Treat the first CSV row as a header").action(preview3);
+var object_storage_default = command41;
+
 // src/main.ts
 await init_context();
-var VERSION = "1.710.1";
+var VERSION = "1.712.0";
 async function checkVersionSafe(cmd) {
   const mainCommand = cmd.getMainCommand();
   const upgradeCommand = mainCommand.getCommand("upgrade");
@@ -93222,7 +93676,7 @@ async function checkVersionSafe(cmd) {
   }
   mainCommand.version(`${currentVersion}  (New version available: ${latestVersion}. Run '${mainCommand.getName()} upgrade' to upgrade to the latest version!)`);
 }
-var command41 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).helpOption("-h, --help", "Show this help.", {
+var command42 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).helpOption("-h, --help", "Show this help.", {
   action: async function() {
     const self2 = this;
     const long = self2.getRawArgs().includes(`--${self2.getHelpOption()?.name}`);
@@ -93234,7 +93688,7 @@ var command41 = new Command().name("wmill").action(() => info(`Welcome to Windmi
     self2.showHelp({ long });
     self2.exit();
   }
-}).command("init", init_default).command("refresh", refresh_default).command("app", app_default).command("flow", flow_default).command("script", script_default).command("workspace", workspace_default).command("resource", resource_default).command("resource-type", resource_type_default).command("user", user_default).command("variable", variable_default).command("hub", hub_default).command("folder", folder_default).command("schedule", schedule_default).command("trigger", trigger_default).command("dev", dev_default2).command("sync", sync_default).command("lint", lint_default).command("gitsync-settings", gitsync_settings_default).command("protection-rules", protection_rules_default).command("instance", instance_default).command("worker-groups", worker_groups_default).command("workers", workers_default).command("queues", queues_default).command("dependencies", dependencies_default).command("jobs", jobs_default).command("job", job_default).command("group", group_default).command("audit", audit_default).command("token", token_default).command("generate-metadata", generate_metadata_default).command("docs", docs_default).command("config", config_default).command("datatable", datatable_default).command("ducklake", ducklake_default).command("version --version", "Show version information").action(async (opts) => {
+}).command("init", init_default).command("refresh", refresh_default).command("app", app_default).command("flow", flow_default).command("script", script_default).command("workspace", workspace_default).command("resource", resource_default).command("resource-type", resource_type_default).command("user", user_default).command("variable", variable_default).command("hub", hub_default).command("folder", folder_default).command("schedule", schedule_default).command("trigger", trigger_default).command("dev", dev_default2).command("sync", sync_default).command("lint", lint_default).command("gitsync-settings", gitsync_settings_default).command("protection-rules", protection_rules_default).command("instance", instance_default).command("worker-groups", worker_groups_default).command("workers", workers_default).command("queues", queues_default).command("dependencies", dependencies_default).command("jobs", jobs_default).command("job", job_default).command("group", group_default).command("audit", audit_default).command("token", token_default).command("generate-metadata", generate_metadata_default).command("docs", docs_default).command("config", config_default).command("datatable", datatable_default).command("ducklake", ducklake_default).command("object-storage", object_storage_default).command("version --version", "Show version information").action(async (opts) => {
   console.log("CLI version: " + VERSION);
   try {
     const provider2 = new NpmProvider({ package: "windmill-cli" });
@@ -93264,20 +93718,20 @@ var command41 = new Command().name("wmill").action(() => info(`Welcome to Windmi
   error(e2);
   info("Try running with sudo and otherwise check the result of the command: npm uninstall windmill-cli && npm install -g windmill-cli");
 })).command("completions", new Command().description("Generate shell completions.").command("bash", new Command().description("Generate bash completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command41, "bash") + `
+  process.stdout.write(generateShellCompletions(command42, "bash") + `
 `);
 })).command("zsh", new Command().description("Generate zsh completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command41, "zsh") + `
+  process.stdout.write(generateShellCompletions(command42, "zsh") + `
 `);
 })).command("fish", new Command().description("Generate fish completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command41, "fish") + `
+  process.stdout.write(generateShellCompletions(command42, "fish") + `
 `);
 })));
 async function main2() {
   try {
     const args = process.argv.slice(2);
     if (args.length === 0) {
-      command41.showHelp();
+      command42.showHelp();
     }
     const LOG_LEVEL = args.includes("--verbose") || args.includes("--debug") ? "DEBUG" : "INFO";
     setShowDiffs(args.includes("--show-diffs"));
@@ -93295,7 +93749,7 @@ async function main2() {
       const { warnIfPromptsStale: warnIfPromptsStale2 } = await init_freshness().then(() => exports_freshness);
       await warnIfPromptsStale2({ argv: process.argv }).catch(() => {});
     }
-    await command41.parse(args);
+    await command42.parse(args);
   } catch (e2) {
     if (e2 && typeof e2 === "object" && "name" in e2 && e2.name === "ApiError") {
       const body = e2.body;
@@ -93331,7 +93785,7 @@ if (isMain()) {
     process.stdin.destroy();
   });
 }
-var main_default = command41;
+var main_default = command42;
 export {
   add as workspaceAdd,
   workspace_default as workspace,
@@ -93347,6 +93801,7 @@ export {
   push4 as push,
   pull,
   protection_rules_default as protectionRules,
+  object_storage_default as objectStorage,
   lint_default as lint,
   job_default as job,
   instance_default as instance,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.710.1",
+  "version": "1.712.0",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",