windmill-cli 1.722.0 → 1.723.0

package/esm/main.js

@@ -16772,7 +16772,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.722.0",
+    VERSION: "1.723.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -25304,16 +25304,18 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.722.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.723.0";
 
 // src/utils/git.ts
 var exports_git = {};
 __export(exports_git, {
+  renameCurrentGitBranch: () => renameCurrentGitBranch,
   isGitRepository: () => isGitRepository,
   isForkWorkspace: () => isForkWorkspace,
   gitSyncIncludePattern: () => gitSyncIncludePattern,
   gitSyncDeployPush: () => gitSyncDeployPush,
   gitSyncCommitMessage: () => gitSyncCommitMessage,
+  gitBranchExists: () => gitBranchExists,
   getWorkspaceIdForWorkspaceForkFromBranchName: () => getWorkspaceIdForWorkspaceForkFromBranchName,
   getOriginalBranchForWorkspaceForks: () => getOriginalBranchForWorkspaceForks,
   getCurrentGitBranch: () => getCurrentGitBranch,
@@ -25337,6 +25339,19 @@ function getCurrentGitBranch() {
     return null;
   }
 }
+function gitBranchExists(branchName) {
+  const r = spawnSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`], { stdio: "pipe" });
+  return r.status === 0;
+}
+function renameCurrentGitBranch(newName) {
+  const r = spawnSync("git", ["branch", "-m", newName], {
+    encoding: "utf8",
+    stdio: "pipe"
+  });
+  if ((r.status ?? 1) !== 0) {
+    throw new Error(`git branch -m ${newName} failed (exit ${r.status}): ${r.stderr ?? ""}`);
+  }
+}
 function getOriginalBranchForWorkspaceForks(branchName) {
   if (!branchName || !branchName.startsWith(WM_FORK_PREFIX)) {
     return null;
@@ -25578,1898 +25593,2027 @@ var init_git = __esm(() => {
   FORK_WORKSPACE_PREFIX = `${WM_FORK_PREFIX}-`;
 });
 
-// src/commands/workspace/fork.ts
-async function createWorkspaceFork2(opts, workspaceName, workspaceId = undefined) {
-  if (!isGitRepository()) {
-    throw new Error("You can only create forks within a git repo. Forks are tracked with git and synced to your instance with the git sync workflow.");
-  }
-  const workspace = await tryResolveBranchWorkspace(opts);
-  if (!workspace) {
-    throw new Error("Could not resolve workspace from branch name. Make sure you are in a git repo to use workspace forks");
-  }
-  info(`You are forking workspace (${workspace.workspaceId})`);
-  const currentBranch = getCurrentGitBranch();
-  if (!currentBranch) {
-    throw new Error("Could not get git branch name");
-  }
-  const originalBranchIfForked = getOriginalBranchForWorkspaceForks(currentBranch);
-  let clonedBranchName;
-  if (originalBranchIfForked) {
-    info(`You are creating a fork of a fork. The branch will be linked to the original branch this was forked from, i.e. \`${originalBranchIfForked}\`, for all settings and overrides.`);
-    clonedBranchName = originalBranchIfForked;
-  } else {
-    clonedBranchName = currentBranch;
-  }
-  if (!clonedBranchName) {
-    throw new Error("Failed to get current branch name, aborting operation");
+// src/utils/resource_folders.ts
+import { sep as SEP2 } from "node:path";
+import * as fs6 from "node:fs";
+import * as path2 from "node:path";
+import process9 from "node:process";
+function setNonDottedPaths(value) {
+  if (value && !_nonDottedPathsLogged) {
+    debug("Using non-dotted paths (__flow, __app, __raw_app)");
+    _nonDottedPathsLogged = true;
   }
-  if (opts.workspace) {
-    info(colors.red.bold("! Workspace needs to be specified as positional argument, not as option."));
-    return;
+  _nonDottedPaths = value;
+}
+function getNonDottedPaths() {
+  return _nonDottedPaths;
+}
+async function loadNonDottedPathsSetting() {
+  let currentDir = process9.cwd();
+  while (true) {
+    const wmillYamlPath = path2.join(currentDir, "wmill.yaml");
+    if (fs6.existsSync(wmillYamlPath)) {
+      try {
+        const config = await yamlParseFile(wmillYamlPath);
+        setNonDottedPaths(config?.nonDottedPaths ?? false);
+        debug(`Found wmill.yaml at ${wmillYamlPath}, nonDottedPaths=${config?.nonDottedPaths ?? false}`);
+      } catch (e) {
+        debug(`Failed to parse wmill.yaml at ${wmillYamlPath}: ${e}`);
+      }
+      return;
+    }
+    const parentDir = path2.dirname(currentDir);
+    if (parentDir === currentDir) {
+      debug("No wmill.yaml found, using default dotted paths");
+      return;
+    }
+    currentDir = parentDir;
   }
-  while (workspaceName === undefined) {
-    if (!workspaceName) {
-      workspaceName = await Input.prompt("Name this forked workspace:");
+}
+function getFolderSuffixes() {
+  return _nonDottedPaths ? NON_DOTTED_SUFFIXES : DOTTED_SUFFIXES;
+}
+function getFolderSuffix(type) {
+  return getFolderSuffixes()[type];
+}
+function getMetadataFileName(type, format6) {
+  return METADATA_FILES[type][format6];
+}
+function getMetadataPathSuffix(type, format6) {
+  return getFolderSuffixes()[type] + "/" + METADATA_FILES[type][format6];
+}
+function hasWrongFormatSuffix(dirName) {
+  const wrongSuffixes = _nonDottedPaths ? DOTTED_SUFFIXES : NON_DOTTED_SUFFIXES;
+  for (const [type, suffix] of Object.entries(wrongSuffixes)) {
+    if (dirName.endsWith(suffix)) {
+      return type;
     }
   }
-  if (!workspaceId) {
-    workspaceId = await Input.prompt({
-      message: `Enter the ID of this forked workspace, it will then be prefixed by ${WM_FORK_PREFIX}. It will also determine the branch name`,
-      default: workspaceName,
-      suggestions: [workspaceName]
-    });
+  return null;
+}
+function normalizeSep(p) {
+  return p.replaceAll("\\", "/");
+}
+function isFlowPath(p) {
+  return normalizeSep(p).includes(getFolderSuffixes().flow + "/");
+}
+function isAppPath(p) {
+  return normalizeSep(p).includes(getFolderSuffixes().app + "/");
+}
+function isRawAppPath(p) {
+  return normalizeSep(p).includes(getFolderSuffixes().raw_app + "/");
+}
+function isFolderResourcePathAnyFormat(p) {
+  const n = normalizeSep(p);
+  for (const suffixes of [DOTTED_SUFFIXES, NON_DOTTED_SUFFIXES]) {
+    if (n.includes(suffixes.flow + "/") || n.includes(suffixes.app + "/") || n.includes(suffixes.raw_app + "/")) {
+      return true;
+    }
   }
-  const token = workspace.token;
-  if (!token) {
-    throw new Error("Not logged in. Please run 'wmill workspace add' first.");
+  return false;
+}
+function isAppInlineScriptPath(filePath) {
+  const suffixes = getFolderSuffixes();
+  const normalizedPath = filePath.replaceAll(SEP2, "/");
+  const escapedSuffix = suffixes.app.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`${escapedSuffix}/`);
+  return pattern.test(normalizedPath);
+}
+function isFlowInlineScriptPath(filePath) {
+  const suffixes = getFolderSuffixes();
+  const normalizedPath = filePath.replaceAll(SEP2, "/");
+  const escapedSuffix = suffixes.flow.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const pattern = new RegExp(`${escapedSuffix}/`);
+  return pattern.test(normalizedPath);
+}
+function extractResourceName(p, type) {
+  const normalized = normalizeSep(p);
+  const suffix = getFolderSuffixes()[type] + "/";
+  const index = normalized.indexOf(suffix);
+  if (index === -1)
+    return null;
+  return normalized.substring(0, index);
+}
+function extractFolderPath(p, type) {
+  const normalized = normalizeSep(p);
+  const suffix = getFolderSuffixes()[type] + "/";
+  const index = normalized.indexOf(suffix);
+  if (index === -1)
+    return null;
+  return normalized.substring(0, index) + suffix;
+}
+function buildFolderPath(resourceName, type) {
+  return resourceName + getFolderSuffixes()[type];
+}
+function hasFolderSuffix(dirName, type) {
+  return dirName.endsWith(getFolderSuffixes()[type]);
+}
+function extractNameFromFolder(folderName, type) {
+  const suffix = getFolderSuffixes()[type];
+  if (folderName.endsWith(suffix)) {
+    return folderName.substring(0, folderName.length - suffix.length);
   }
-  const remote = workspace.remote;
-  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
-  info(colors.blue(`Creating forked workspace: ${workspaceName}...`));
-  const trueWorkspaceId = `${WM_FORK_PREFIX}-${workspaceId}`;
-  let alreadyExists = false;
-  try {
-    alreadyExists = await existsWorkspace({
-      requestBody: { id: trueWorkspaceId }
-    });
-  } catch (e) {
-    info(colors.red.bold("! Credentials or instance is invalid. Aborting."));
-    throw e;
+  return folderName;
+}
+function isFlowMetadataFile(p) {
+  if (p.endsWith(DOTTED_SUFFIXES.flow + ".json") || p.endsWith(DOTTED_SUFFIXES.flow + ".yaml")) {
+    return true;
   }
-  if (alreadyExists) {
-    throw new Error(`This forked workspace '${workspaceId}' (${workspaceName}) already exists, possibly archived (archiving keeps the id reserved). ` + `Permanently delete it with \`wmill workspace delete-fork ${workspaceId}\` to reuse the id, or choose a different id`);
+  if (_nonDottedPaths) {
+    return p.endsWith(NON_DOTTED_SUFFIXES.flow + ".json") || p.endsWith(NON_DOTTED_SUFFIXES.flow + ".yaml");
   }
-  const forkedDatatables = [];
-  let datatables = [];
-  try {
-    datatables = await listDataTables({
-      workspace: workspace.workspaceId
-    });
-  } catch (e) {
-    info(colors.yellow(`Note: Could not list datatables: ${e.message}`));
+  return false;
+}
+function isAppMetadataFile(p) {
+  if (p.endsWith(DOTTED_SUFFIXES.app + ".json") || p.endsWith(DOTTED_SUFFIXES.app + ".yaml")) {
+    return true;
   }
-  if (datatables && datatables.length > 0) {
-    const behavior = opts.datatableBehavior ?? (opts.yes ? "skip" : undefined);
-    if (behavior !== "skip") {
-      info(`
-Found ${datatables.length} datatable(s):`);
-      for (const dt of datatables) {
-        let dtBehavior;
-        if (behavior === "schema_only" || behavior === "schema_and_data") {
-          dtBehavior = behavior;
-        } else {
-          const { Select: Select2 } = await init_select().then(() => exports_select);
-          dtBehavior = await Select2.prompt({
-            message: `Datatable "${dt.name}" (${dt.resource_type}):`,
-            options: [
-              { name: "Keep original (no cloning)", value: "keep_original" },
-              { name: "Clone schema only", value: "schema_only" },
-              { name: "Clone schema and data", value: "schema_and_data" }
-            ]
-          });
-        }
-        if (dtBehavior === "keep_original") {
-          continue;
-        }
-        const newDbName = `${trueWorkspaceId.replace(/-/g, "_")}__${dt.name}`;
-        try {
-          info(colors.blue(`  Creating database "${newDbName}" for datatable "${dt.name}"...`));
-          await createPgDatabase({
-            workspace: workspace.workspaceId,
-            requestBody: {
-              source: `datatable://${dt.name}`,
-              target_dbname: newDbName
-            }
-          });
-          info(colors.blue(`  Importing ${dtBehavior === "schema_only" ? "schema" : "schema + data"}...`));
-          await importPgDatabase({
-            workspace: workspace.workspaceId,
-            requestBody: {
-              source: `datatable://${dt.name}`,
-              target: `datatable://${dt.name}`,
-              target_dbname_override: newDbName,
-              fork_behavior: dtBehavior
-            }
-          });
-          info(colors.green(`  ✓ Datatable "${dt.name}" cloned.`));
-          forkedDatatables.push({ name: dt.name, new_dbname: newDbName });
-        } catch (e) {
-          info(colors.yellow(`  ✗ Failed to clone datatable "${dt.name}": ${e.message}`));
-        }
-      }
-    }
+  if (_nonDottedPaths) {
+    return p.endsWith(NON_DOTTED_SUFFIXES.app + ".json") || p.endsWith(NON_DOTTED_SUFFIXES.app + ".yaml");
   }
-  const forkColor = opts.color;
-  try {
-    const gitSyncJobIds = await createWorkspaceForkGitBranch({
-      workspace: workspace.workspaceId,
-      requestBody: {
-        id: trueWorkspaceId,
-        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
-        color: forkColor
-      }
-    });
-    if (gitSyncJobIds && gitSyncJobIds.length > 0) {
-      info(colors.blue(`Git sync branch creation triggered (${gitSyncJobIds.length} job(s)). These will complete asynchronously.`));
-    }
-  } catch (e) {
-    error(colors.red(`Failed to create git branch for fork: ${e.message}`));
-    throw e;
+  return false;
+}
+function isRawAppMetadataFile(p) {
+  if (p.endsWith(DOTTED_SUFFIXES.raw_app + ".json") || p.endsWith(DOTTED_SUFFIXES.raw_app + ".yaml")) {
+    return true;
   }
-  try {
-    const result = await createWorkspaceFork({
-      workspace: workspace.workspaceId,
-      requestBody: {
-        id: trueWorkspaceId,
-        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
-        color: forkColor,
-        forked_datatables: forkedDatatables
-      }
-    });
-    info(colors.green(`✅ ${result}`));
-  } catch (error2) {
-    error(colors.red(`Failed to create forked workspace: ${error2.message}`));
-    throw error2;
+  if (_nonDottedPaths) {
+    return p.endsWith(NON_DOTTED_SUFFIXES.raw_app + ".json") || p.endsWith(NON_DOTTED_SUFFIXES.raw_app + ".yaml");
   }
-  const newBranchName = `${WM_FORK_PREFIX}/${clonedBranchName}/${workspaceId}`;
-  info(`Created forked workspace ${trueWorkspaceId}. To start contributing to your fork, create and push edits to the branch \`${newBranchName}\` by using the command:
-
-	` + colors.white(`git checkout -b ${newBranchName}`) + `
-
-When doing operations on the forked workspace, it will use the remote setup in the workspaces section for the branch it was forked from.
-
-To merge changes back to the parent workspace, you can:
-  - Use the CLI: ` + colors.white(`git checkout ${newBranchName} && wmill workspace merge`) + `
-  - Use the Merge UI from the forked workspace home page
-  - Use git: ` + colors.white(`git checkout ${clonedBranchName} && git merge ${newBranchName} && wmill sync push`) + `
-  See: https://www.windmill.dev/docs/advanced/workspace_forks`);
+  return false;
 }
-async function deleteWorkspaceFork(opts, name) {
-  let forkWorkspaceId;
-  let token;
-  let remote;
-  let hasLocalProfile = false;
-  const orgWorkspaces = await allWorkspaces(opts.configDir);
-  const idxOf = orgWorkspaces.findIndex((x) => x.name === name);
-  if (idxOf !== -1) {
-    const workspace = orgWorkspaces[idxOf];
-    if (!workspace.workspaceId.startsWith(WM_FORK_PREFIX)) {
-      throw new Error(`You can only delete forked workspaces where the workspace id starts with \`${WM_FORK_PREFIX}.\` Failed while attempting to delete \`${workspace.workspaceId}\``);
-    }
-    forkWorkspaceId = workspace.workspaceId;
-    token = workspace.token;
-    remote = workspace.remote;
-    hasLocalProfile = true;
-  } else {
-    const parentWorkspace = await tryResolveBranchWorkspace(opts);
-    if (!parentWorkspace) {
-      throw new Error("Could not resolve parent workspace. Make sure you are in a git repo with 'workspaces' configured in wmill.yaml, or create a local workspace profile for the fork.");
-    }
-    forkWorkspaceId = name.startsWith(`${WM_FORK_PREFIX}-`) ? name : `${WM_FORK_PREFIX}-${name}`;
-    token = parentWorkspace.token;
-    remote = parentWorkspace.remote;
-  }
-  if (!opts.yes) {
-    const { Select: Select2 } = await init_select().then(() => exports_select);
-    const choice = await Select2.prompt({
-      message: `Are you sure you want to delete the forked workspace \`${forkWorkspaceId}\`?`,
-      options: [
-        { name: "Yes", value: "confirm" },
-        { name: "No", value: "cancel" }
-      ]
-    });
-    if (choice === "cancel") {
-      info("Operation cancelled");
-      return;
-    }
+function isRawAppFolderMetadataFile(p) {
+  return p.endsWith(getMetadataPathSuffix("raw_app", "yaml")) || p.endsWith(getMetadataPathSuffix("raw_app", "json"));
+}
+function isAppFolderMetadataFile(p) {
+  return p.endsWith(getMetadataPathSuffix("app", "yaml")) || p.endsWith(getMetadataPathSuffix("app", "json"));
+}
+function isFlowFolderMetadataFile(p) {
+  return p.endsWith(getMetadataPathSuffix("flow", "yaml")) || p.endsWith(getMetadataPathSuffix("flow", "json"));
+}
+function getModuleFolderSuffix() {
+  return MODULE_SUFFIX;
+}
+function isScriptModulePath(p) {
+  return normalizeSep(p).includes(MODULE_SUFFIX + "/");
+}
+function isModuleEntryPoint(p) {
+  const norm = normalizeSep(p);
+  const suffix = MODULE_SUFFIX + "/";
+  const idx = norm.indexOf(suffix);
+  if (idx === -1)
+    return false;
+  const rest = norm.slice(idx + suffix.length);
+  return rest.startsWith("script.") && !rest.includes("/");
+}
+function getScriptBasePathFromModulePath(p) {
+  const norm = normalizeSep(p);
+  const suffix = MODULE_SUFFIX + "/";
+  const idx = norm.indexOf(suffix);
+  if (idx === -1)
+    return;
+  return norm.slice(0, idx);
+}
+function scriptPathToRemotePath(p) {
+  return (isModuleEntryPoint(p) ? getScriptBasePathFromModulePath(p) : p.substring(0, p.indexOf("."))).replaceAll(SEP2, "/");
+}
+function getDeleteSuffix(type, format6) {
+  return getFolderSuffixes()[type] + "/" + METADATA_FILES[type][format6];
+}
+function transformJsonPathToDir(p, type) {
+  const apiSuffix = DOTTED_SUFFIXES[type] + ".json";
+  if (p.endsWith(apiSuffix)) {
+    const basePath = p.substring(0, p.length - apiSuffix.length);
+    return basePath + getFolderSuffixes()[type];
   }
-  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
-  const result = await deleteWorkspace({
-    workspace: forkWorkspaceId
-  });
-  info(colors.green(`✅ Forked workspace '${forkWorkspaceId}' deleted successfully!
-${result}`));
-  if (hasLocalProfile) {
-    await removeWorkspace(name, false, opts);
+  const userSuffix = getFolderSuffixes()[type] + ".json";
+  if (p.endsWith(userSuffix)) {
+    return p.substring(0, p.length - 5);
   }
+  return p;
 }
-var init_fork = __esm(async () => {
-  init_colors2();
+var DOTTED_SUFFIXES, NON_DOTTED_SUFFIXES, _nonDottedPaths = false, _nonDottedPathsLogged = false, METADATA_FILES, MODULE_SUFFIX = "__mod";
+var init_resource_folders = __esm(async () => {
   init_log();
-  init_client();
-  init_services_gen();
-  init_git();
-  await __promiseAll([
-    init_input(),
-    init_workspace(),
-    init_context()
-  ]);
+  await init_yaml();
+  DOTTED_SUFFIXES = {
+    flow: ".flow",
+    app: ".app",
+    raw_app: ".raw_app"
+  };
+  NON_DOTTED_SUFFIXES = {
+    flow: "__flow",
+    app: "__app",
+    raw_app: "__raw_app"
+  };
+  METADATA_FILES = {
+    flow: { yaml: "flow.yaml", json: "flow.json" },
+    app: { yaml: "app.yaml", json: "app.json" },
+    raw_app: { yaml: "raw_app.yaml", json: "raw_app.json" }
+  };
 });
 
-// windmill-utils-internal/src/deploy.ts
-function isTriggerKind(kind) {
-  return TRIGGER_KINDS.includes(kind);
-}
-function isTriggerOrScheduleKind(kind) {
-  return kind === "schedule" || isTriggerKind(kind);
+// src/core/conf.ts
+var exports_conf = {};
+__export(exports_conf, {
+  validateBranchConfiguration: () => validateBranchConfiguration,
+  showDiffs: () => showDiffs,
+  setShowDiffs: () => setShowDiffs,
+  readConfigFile: () => readConfigFile,
+  parseSyncBehavior: () => parseSyncBehavior,
+  mergeConfigWithConfigFile: () => mergeConfigWithConfigFile,
+  getWorkspaceNames: () => getWorkspaceNames,
+  getWmillYamlPath: () => getWmillYamlPath,
+  getEffectiveWorkspaceId: () => getEffectiveWorkspaceId,
+  getEffectiveSettings: () => getEffectiveSettings,
+  getEffectiveGitBranch: () => getEffectiveGitBranch,
+  findWorkspaceByGitBranch: () => findWorkspaceByGitBranch,
+  convertGitBranchesToWorkspaces: () => convertGitBranchesToWorkspaces,
+  SUPPORTED_SYNC_BEHAVIOR_VERSION: () => SUPPORTED_SYNC_BEHAVIOR_VERSION,
+  GLOBAL_CONFIG_OPT: () => GLOBAL_CONFIG_OPT,
+  DEFAULT_SYNC_OPTIONS: () => DEFAULT_SYNC_OPTIONS
+});
+import { join as join7, dirname as dirname6, resolve as resolve5, relative as relative4 } from "node:path";
+import { existsSync as existsSync2 } from "node:fs";
+import { writeFile } from "node:fs/promises";
+import { execSync as execSync2 } from "node:child_process";
+function setShowDiffs(value) {
+  showDiffs = value;
 }
-function folderName(path2) {
-  return path2.replace(/^f\//, "");
+function parseSyncBehavior(value) {
+  if (!value && value !== 0)
+    return 0;
+  const s = String(value);
+  const match = s.match(/^v(\d+)$/);
+  return match ? parseInt(match[1], 10) : 0;
 }
-function stripOperationalStateOnUpdate(payload, alreadyExists) {
-  if (!alreadyExists)
-    return payload;
-  const { mode: _mode, enabled: _enabled, ...rest } = payload;
-  return rest;
+function getGitRepoRoot() {
+  try {
+    const result = execSync2("git rev-parse --show-toplevel", {
+      encoding: "utf8",
+      stdio: "pipe"
+    });
+    return result.trim();
+  } catch (error2) {
+    return null;
+  }
 }
-function getSubModules(flowModule) {
-  const type = flowModule?.value?.type;
-  if (type === "forloopflow" || type === "whileloopflow") {
-    return [flowModule.value.modules ?? []];
-  } else if (type === "branchall") {
-    return (flowModule.value.branches ?? []).map((branch) => branch.modules ?? []);
-  } else if (type === "branchone") {
-    return [
-      ...(flowModule.value.branches ?? []).map((b) => b.modules ?? []),
-      flowModule.value.default ?? []
-    ];
-  } else if (type === "aiagent") {
-    if (flowModule.value.tools) {
-      return [
-        flowModule.value.tools.filter((t) => t.value?.type === "script" || t.value?.type === "flow").map((t) => ({
-          id: t.id,
-          value: t.value,
-          summary: t.summary
-        }))
-      ];
+function findWmillYaml() {
+  const startDir = resolve5(process.cwd());
+  const isInGitRepo = isGitRepository();
+  const gitRoot = isInGitRepo ? getGitRepoRoot() : null;
+  let currentDir = startDir;
+  let foundPath = null;
+  while (true) {
+    const wmillYamlPath = join7(currentDir, "wmill.yaml");
+    if (existsSync2(wmillYamlPath)) {
+      foundPath = wmillYamlPath;
+      break;
     }
+    if (gitRoot && resolve5(currentDir) === resolve5(gitRoot)) {
+      break;
+    }
+    const parentDir = dirname6(currentDir);
+    if (parentDir === currentDir) {
+      break;
+    }
+    currentDir = parentDir;
   }
-  return [];
+  if (!GLOBAL_CONFIG_OPT.noCdToRoot && foundPath && resolve5(dirname6(foundPath)) !== resolve5(startDir)) {
+    const configDir = dirname6(foundPath);
+    const relativePath = relative4(startDir, foundPath);
+    warn(`⚠️  wmill.yaml found in parent directory: ${relativePath}`);
+    process.chdir(configDir);
+    info(`\uD83D\uDCC1 Changed working directory to: ${configDir}`);
+  }
+  return foundPath;
 }
-function getAllSubmodules(flowModule) {
-  return getSubModules(flowModule).map((modules) => modules.flatMap((m) => [m, ...getAllSubmodules(m)])).flat();
+function getWmillYamlPath() {
+  return findWmillYaml();
 }
-function getAllModules(flowModules, failureModule) {
-  return [
-    ...flowModules,
-    ...flowModules.flatMap((x) => getAllSubmodules(x)),
-    ...failureModule ? [failureModule] : []
-  ];
-}
-function toError(e) {
-  const err = e;
-  return err.body || err.message || String(e);
-}
-async function checkItemExists(provider, kind, path2, workspace) {
-  if (kind === "flow") {
-    return provider.existsFlowByPath({ workspace, path: path2 });
-  } else if (kind === "script") {
-    return provider.existsScriptByPath({ workspace, path: path2 });
-  } else if (kind === "app" || kind === "raw_app") {
-    return provider.existsApp({ workspace, path: path2 });
-  } else if (kind === "variable") {
-    return provider.existsVariable({ workspace, path: path2 });
-  } else if (kind === "resource") {
-    return provider.existsResource({ workspace, path: path2 });
-  } else if (kind === "resource_type") {
-    return provider.existsResourceType({ workspace, path: path2 });
-  } else if (kind === "folder") {
-    return provider.existsFolder({ workspace, name: folderName(path2) });
-  } else if (kind === "schedule") {
-    return provider.existsSchedule({ workspace, path: path2 });
-  } else if (isTriggerKind(kind)) {
-    return provider.existsTriggerByKind(kind, { workspace, path: path2 });
-  }
-  throw new Error(`Unknown kind: ${kind}`);
-}
-async function deployItem(provider, kind, path2, workspaceFrom, workspaceTo, onBehalfOf) {
-  const preserveOnBehalfOf = onBehalfOf !== undefined;
-  try {
-    const alreadyExists = await checkItemExists(provider, kind, path2, workspaceTo);
-    if (kind === "flow") {
-      const flow = await provider.getFlowByPath({
-        workspace: workspaceFrom,
-        path: path2
-      });
-      getAllModules(flow.value?.modules ?? [], flow.value?.failure_module).forEach((x) => {
-        if (x.value?.type === "script" && x.value.hash != null) {
-          x.value.hash = undefined;
-        }
-      });
-      if (alreadyExists) {
-        await provider.updateFlow({
-          workspace: workspaceTo,
-          path: path2,
-          requestBody: {
-            ...flow,
-            preserve_on_behalf_of: preserveOnBehalfOf,
-            on_behalf_of_email: onBehalfOf
-          }
-        });
-      } else {
-        await provider.createFlow({
-          workspace: workspaceTo,
-          requestBody: {
-            ...flow,
-            preserve_on_behalf_of: preserveOnBehalfOf,
-            on_behalf_of_email: onBehalfOf
-          }
-        });
-      }
-    } else if (kind === "script") {
-      const script = await provider.getScriptByPath({
-        workspace: workspaceFrom,
-        path: path2
-      });
-      let parentHash;
-      if (alreadyExists) {
-        const existing = await provider.getScriptByPath({
-          workspace: workspaceTo,
-          path: path2
-        });
-        parentHash = existing.hash;
-      }
-      await provider.createScript({
-        workspace: workspaceTo,
-        requestBody: {
-          ...script,
-          lock: script.lock,
-          parent_hash: parentHash,
-          preserve_on_behalf_of: preserveOnBehalfOf,
-          on_behalf_of_email: onBehalfOf
-        }
-      });
-    } else if (kind === "app" || kind === "raw_app") {
-      const app = await provider.getAppByPath({
-        workspace: workspaceFrom,
-        path: path2
-      });
-      if (alreadyExists) {
-        if (app.raw_app) {
-          const secret = await provider.getPublicSecretOfLatestVersionOfApp({
-            workspace: workspaceFrom,
-            path: app.path
-          });
-          const js = await provider.getRawAppData({
-            secretWithExtension: `${secret}.js`,
-            workspace: workspaceFrom
-          });
-          const css = await provider.getRawAppData({
-            secretWithExtension: `${secret}.css`,
-            workspace: workspaceFrom
-          });
-          await provider.updateAppRaw({
-            workspace: workspaceTo,
-            path: path2,
-            formData: {
-              app: { ...app, preserve_on_behalf_of: preserveOnBehalfOf },
-              css,
-              js
-            }
-          });
-        } else {
-          await provider.updateApp({
-            workspace: workspaceTo,
-            path: path2,
-            requestBody: {
-              ...app,
-              preserve_on_behalf_of: preserveOnBehalfOf
-            }
-          });
-        }
-      } else {
-        if (app.raw_app) {
-          const secret = await provider.getPublicSecretOfLatestVersionOfApp({
-            workspace: workspaceFrom,
-            path: app.path
-          });
-          const js = await provider.getRawAppData({
-            secretWithExtension: `${secret}.js`,
-            workspace: workspaceFrom
-          });
-          const css = await provider.getRawAppData({
-            secretWithExtension: `${secret}.css`,
-            workspace: workspaceFrom
-          });
-          await provider.createAppRaw({
-            workspace: workspaceTo,
-            formData: {
-              app: { ...app, preserve_on_behalf_of: preserveOnBehalfOf },
-              css,
-              js
-            }
-          });
-        } else {
-          await provider.createApp({
-            workspace: workspaceTo,
-            requestBody: {
-              ...app,
-              preserve_on_behalf_of: preserveOnBehalfOf
-            }
-          });
-        }
-      }
-    } else if (kind === "variable") {
-      const variable = await provider.getVariable({
-        workspace: workspaceFrom,
-        path: path2,
-        decryptSecret: true
-      });
-      if (alreadyExists) {
-        await provider.updateVariable({
-          workspace: workspaceTo,
-          path: path2,
-          requestBody: {
-            path: path2,
-            value: variable.value ?? "",
-            is_secret: variable.is_secret,
-            description: variable.description ?? ""
-          },
-          alreadyEncrypted: false
-        });
-      } else {
-        await provider.createVariable({
-          workspace: workspaceTo,
-          requestBody: {
-            path: path2,
-            value: variable.value ?? "",
-            is_secret: variable.is_secret,
-            description: variable.description ?? ""
-          }
-        });
-      }
-    } else if (kind === "resource") {
-      const resource = await provider.getResource({
-        workspace: workspaceFrom,
-        path: path2
-      });
-      if (alreadyExists) {
-        await provider.updateResource({
-          workspace: workspaceTo,
-          path: path2,
-          requestBody: {
-            path: path2,
-            value: resource.value ?? "",
-            description: resource.description ?? ""
-          }
-        });
-      } else {
-        await provider.createResource({
-          workspace: workspaceTo,
-          requestBody: {
-            path: path2,
-            value: resource.value ?? "",
-            resource_type: resource.resource_type,
-            description: resource.description ?? ""
-          }
-        });
-      }
-    } else if (kind === "resource_type") {
-      const rt = await provider.getResourceType({
-        workspace: workspaceFrom,
-        path: path2
-      });
-      if (alreadyExists) {
-        await provider.updateResourceType({
-          workspace: workspaceTo,
-          path: path2,
-          requestBody: {
-            schema: rt.schema,
-            description: rt.description ?? ""
-          }
-        });
-      } else {
-        await provider.createResourceType({
-          workspace: workspaceTo,
-          requestBody: {
-            name: rt.name,
-            schema: rt.schema,
-            description: rt.description ?? ""
-          }
-        });
-      }
-    } else if (kind === "folder") {
-      const name = folderName(path2);
-      const folder = await provider.getFolder({
-        workspace: workspaceFrom,
-        name
-      });
-      if (alreadyExists) {
-        await provider.updateFolder({
-          workspace: workspaceTo,
-          name,
-          requestBody: {
-            owners: folder.owners,
-            extra_perms: folder.extra_perms,
-            summary: folder.summary ?? undefined
-          }
-        });
-      } else {
-        await provider.createFolder({
-          workspace: workspaceTo,
-          requestBody: {
-            name,
-            owners: folder.owners,
-            extra_perms: folder.extra_perms,
-            summary: folder.summary ?? undefined
-          }
-        });
-      }
-    } else if (kind === "schedule") {
-      const schedule = await provider.getSchedule({
-        workspace: workspaceFrom,
-        path: path2
-      });
-      const baseBody = stripOperationalStateOnUpdate(schedule, alreadyExists);
-      const requestBody = {
-        ...baseBody,
-        permissioned_as: onBehalfOf,
-        preserve_permissioned_as: preserveOnBehalfOf
-      };
-      if (alreadyExists) {
-        await provider.updateSchedule({
-          workspace: workspaceTo,
-          path: path2,
-          requestBody
-        });
-      } else {
-        await provider.createSchedule({
-          workspace: workspaceTo,
-          requestBody
-        });
-      }
-    } else if (isTriggerKind(kind)) {
-      const triggerBody = await provider.getTriggerForDeploy(kind, {
-        workspace: workspaceFrom,
-        path: path2,
-        onBehalfOf
-      });
-      const requestBody = stripOperationalStateOnUpdate(triggerBody, alreadyExists);
-      if (alreadyExists) {
-        await provider.updateTriggerByKind(kind, {
-          workspace: workspaceTo,
-          path: path2,
-          requestBody
-        });
-      } else {
-        await provider.createTriggerByKind(kind, {
-          workspace: workspaceTo,
-          requestBody
-        });
-      }
-    } else {
-      throw new Error(`Unknown kind: ${kind}`);
-    }
-    return { success: true };
-  } catch (e) {
-    return { success: false, error: toError(e) };
-  }
-}
-async function deleteItemInWorkspace(provider, kind, path2, workspace) {
-  try {
-    if (kind === "script") {
-      await provider.archiveScriptByPath({ workspace, path: path2 });
-    } else if (kind === "flow") {
-      await provider.archiveFlowByPath({
-        workspace,
-        path: path2,
-        requestBody: { archived: true }
-      });
-    } else if (kind === "app" || kind === "raw_app") {
-      await provider.deleteApp({ workspace, path: path2 });
-    } else if (kind === "variable") {
-      await provider.deleteVariable({ workspace, path: path2 });
-    } else if (kind === "resource") {
-      await provider.deleteResource({ workspace, path: path2 });
-    } else if (kind === "resource_type") {
-      await provider.deleteResourceType({ workspace, path: path2 });
-    } else if (kind === "folder") {
-      await provider.deleteFolder({ workspace, name: folderName(path2) });
-    } else if (kind === "schedule") {
-      await provider.deleteSchedule({ workspace, path: path2 });
-    } else if (isTriggerKind(kind)) {
-      await provider.deleteTriggerByKind(kind, { workspace, path: path2 });
-    } else {
-      throw new Error(`Deletion not supported for kind: ${kind}`);
-    }
-    return { success: true };
-  } catch (e) {
-    return { success: false, error: toError(e) };
-  }
-}
-async function getOnBehalfOf(provider, kind, path2, workspace) {
+async function readConfigFile(opts) {
+  const warnIfMissing = opts?.warnIfMissing ?? true;
   try {
-    if (kind === "flow") {
-      const flow = await provider.getFlowByPath({ workspace, path: path2 });
-      return flow.on_behalf_of_email;
-    } else if (kind === "script") {
-      const script = await provider.getScriptByPath({ workspace, path: path2 });
-      return script.on_behalf_of_email;
-    } else if (kind === "app" || kind === "raw_app") {
-      const app = await provider.getAppByPath({ workspace, path: path2 });
-      return app.policy?.on_behalf_of_email;
-    } else if (kind === "schedule") {
-      const schedule = await provider.getSchedule({ workspace, path: path2 });
-      return schedule.permissioned_as;
-    } else if (isTriggerKind(kind)) {
-      return await provider.getTriggerPermissionedAs(kind, { workspace, path: path2 });
-    }
-  } catch {}
-  return;
-}
-var TRIGGER_KINDS;
-var init_deploy = __esm(() => {
-  TRIGGER_KINDS = [
-    "http_trigger",
-    "websocket_trigger",
-    "kafka_trigger",
-    "nats_trigger",
-    "postgres_trigger",
-    "mqtt_trigger",
-    "sqs_trigger",
-    "gcp_trigger",
-    "azure_trigger",
-    "email_trigger"
-  ];
-});
-
-// node_modules/@cliffy/prompt/checkbox.js
-var exports_checkbox = {};
-__export(exports_checkbox, {
-  isCheckboxOptionGroup: () => isCheckboxOptionGroup,
-  Checkbox: () => Checkbox
-});
-function areSomeChecked(options) {
-  return options.some((option) => isOptionGroup(option) ? areSomeChecked(option.options) : option.checked);
-}
-function areAllChecked(options) {
-  return options.every((option) => isOptionGroup(option) ? areAllChecked(option.options) : option.checked);
-}
-function flatOptions(options) {
-  return flat(options);
-  function flat(options2, indentLevel = 0, opts = []) {
-    for (const option of options2) {
-      option.indentLevel = indentLevel;
-      if (isOption2(option)) {
-        opts.push(option);
-      }
-      if (isOptionGroup(option)) {
-        flat(option.options, ++indentLevel, opts);
+    const wmillYamlPath = findWmillYaml();
+    if (!wmillYamlPath) {
+      if (warnIfMissing) {
+        warn("No wmill.yaml found. Use 'wmill init' to bootstrap it.");
       }
+      return {};
     }
-    return opts;
-  }
-}
-function isCheckboxOptionGroup(option) {
-  return isOptionGroup(option);
-}
-var Checkbox;
-var init_checkbox = __esm(async () => {
-  init_equal();
-  init_colors();
-  init__figures();
-  await __promiseAll([
-    init__generic_list(),
-    init__generic_prompt()
-  ]);
-  Checkbox = class Checkbox extends GenericList {
-    settings;
-    options;
-    listIndex;
-    listOffset;
-    confirmSubmit = false;
-    static prompt(options) {
-      return new this(options).prompt();
-    }
-    static inject(value) {
-      GenericPrompt.inject(value);
-    }
-    constructor(options) {
-      super();
-      this.settings = this.getDefaultSettings(options);
-      this.options = this.settings.options.slice();
-      this.listIndex = this.getListIndex();
-      this.listOffset = this.getPageOffset(this.listIndex);
-    }
-    getDefaultSettings(options) {
-      const settings = super.getDefaultSettings(options);
-      return {
-        confirmSubmit: true,
-        ...settings,
-        check: options.check ?? green(Figures.TICK),
-        uncheck: options.uncheck ?? red(Figures.CROSS),
-        partialCheck: options.partialCheck ?? green(Figures.RADIO_ON),
-        minOptions: options.minOptions ?? 0,
-        maxOptions: options.maxOptions ?? Infinity,
-        options: this.mapOptions(options, options.options),
-        keys: {
-          check: [
-            "space"
-          ],
-          checkAll: [
-            "a"
-          ],
-          ...settings.keys ?? {},
-          open: options.keys?.open ?? [
-            "right"
-          ],
-          back: options.keys?.back ?? [
-            "left",
-            "escape"
-          ]
-        }
-      };
-    }
-    mapOptions(promptOptions, options) {
-      return options.map((option) => typeof option === "string" || typeof option === "number" ? this.mapOption(promptOptions, {
-        value: option
-      }) : isCheckboxOptionGroup(option) ? this.mapOptionGroup(promptOptions, option) : this.mapOption(promptOptions, option));
-    }
-    mapOption(options, option) {
-      if (isOption2(option)) {
-        return {
-          ...super.mapOption(options, option),
-          checked: typeof option.checked === "undefined" && options.default && options.default.indexOf(option.value) !== -1 ? true : !!option.checked,
-          icon: typeof option.icon === "undefined" ? true : option.icon
-        };
+    const conf = await yamlParseFile(wmillYamlPath);
+    if (conf && "overrides" in conf) {
+      const overrides = conf.overrides;
+      const hasSettings = overrides && typeof overrides === "object" && Object.keys(overrides).length > 0;
+      if (hasSettings) {
+        throw new Error(`❌ The 'overrides' field is no longer supported.
+` + `   The configuration system now uses workspace-based configuration.
+` + "   Please delete your wmill.yaml and run 'wmill init' to recreate it with the new format.");
       } else {
-        return {
-          ...super.mapOption(options, option),
-          checked: false,
-          icon: false
-        };
-      }
-    }
-    mapOptionGroup(promptOptions, option) {
-      const options = this.mapOptions(promptOptions, option.options);
-      const optionGroup = super.mapOptionGroup(promptOptions, option, false);
-      return {
-        ...optionGroup,
-        get checked() {
-          return areAllChecked(options);
-        },
-        get disabled() {
-          return optionGroup.disabled || options.every((opt) => opt.disabled);
-        },
-        options,
-        icon: typeof option.icon === "undefined" ? true : option.icon
-      };
-    }
-    match() {
-      super.match();
-      if (this.isSearching()) {
-        this.selectSearch();
-      }
-    }
-    getListItemIcon(option) {
-      return this.getCheckboxIcon(option) + super.getListItemIcon(option);
-    }
-    getCheckboxIcon(option) {
-      if (!option.icon) {
-        return "";
-      }
-      const icon = option.checked ? this.settings.check + " " : isOptionGroup(option) && areSomeChecked(option.options) ? this.settings.partialCheck + " " : this.settings.uncheck + " ";
-      return option.disabled ? dim(icon) : icon;
-    }
-    getValue() {
-      return flatOptions(this.settings.options).filter((option) => option.checked).map((option) => option.value);
-    }
-    async handleEvent(event) {
-      const hasConfirmed = this.confirmSubmit;
-      this.confirmSubmit = false;
-      switch (true) {
-        case (this.isKey(this.settings.keys, "check", event) && !this.isSearchSelected()):
-          this.checkValue();
-          break;
-        case this.isKey(this.settings.keys, "submit", event):
-          await this.submit(hasConfirmed);
-          break;
-        case (event.ctrl && this.isKey(this.settings.keys, "checkAll", event)):
-          this.checkAllOption();
-          break;
-        default:
-          await super.handleEvent(event);
-      }
-    }
-    hint() {
-      if (this.confirmSubmit) {
-        const info2 = this.isBackButton(this.selectedOption) ? ` To leave the current group press ${getFiguresByKeys(this.settings.keys.back ?? []).join(", ")}.` : isOptionGroup(this.selectedOption) ? ` To open the selected group press ${getFiguresByKeys(this.settings.keys.open ?? []).join(", ")}.` : ` To check or uncheck the selected option press ${getFiguresByKeys(this.settings.keys.check ?? []).join(", ")}.`;
-        return this.settings.indent + brightBlue(`Press ${getFiguresByKeys(this.settings.keys.submit ?? [])} again to submit.${info2}`);
-      }
-      return super.hint();
-    }
-    async submit(hasConfirmed) {
-      if (!hasConfirmed && this.settings.confirmSubmit && !this.isSearchSelected()) {
-        this.confirmSubmit = true;
-        return;
+        delete conf.overrides;
       }
-      await super.submit();
     }
-    checkValue() {
-      const option = this.options.at(this.listIndex);
-      if (!option) {
-        this.setErrorMessage("No option available to select.");
-        return;
-      } else if (option.disabled) {
-        this.setErrorMessage("This option is disabled and cannot be changed.");
-        return;
+    if (conf && !conf.workspaces) {
+      let legacyKey = null;
+      let legacyData;
+      if (conf.gitBranches) {
+        legacyKey = "gitBranches";
+        legacyData = conf.gitBranches;
+      } else if (conf.environments) {
+        legacyKey = "environments";
+        legacyData = conf.environments;
+      } else if (conf.git_branches) {
+        legacyKey = "git_branches";
+        legacyData = conf.git_branches;
       }
-      this.checkOption(option, !option.checked);
-    }
-    checkOption(option, checked) {
-      if (isOption2(option)) {
-        option.checked = checked;
-      } else {
-        for (const childOption of option.options) {
-          this.checkOption(childOption, checked);
+      if (legacyKey && legacyData) {
+        conf.workspaces = convertGitBranchesToWorkspaces(legacyData);
+        if (!legacyConfigWarned) {
+          warn(`⚠️  '${legacyKey}' in wmill.yaml is deprecated. Use 'workspaces' instead.
+` + `   Run 'wmill config migrate' to update your configuration automatically.`);
+          legacyConfigWarned = true;
         }
       }
-    }
-    checkAllOption() {
-      const checked = this.options.some((option) => option.checked);
-      for (const option of this.options) {
-        this.checkOption(option, !checked);
-      }
-    }
-    validate(value) {
-      const options = flatOptions(this.settings.options);
-      const isValidValue = Array.isArray(value) && value.every((val) => options.findIndex((option) => equal(option.value, val)) !== -1);
-      if (!isValidValue) {
-        return false;
-      }
-      if (value.length < this.settings.minOptions) {
-        return `The minimum number of options is ${this.settings.minOptions} but got ${value.length}.`;
-      }
-      if (value.length > this.settings.maxOptions) {
-        return `The maximum number of options is ${this.settings.maxOptions} but got ${value.length}.`;
+    } else if (conf?.workspaces) {
+      for (const legacyKey of ["gitBranches", "environments", "git_branches"]) {
+        if (conf[legacyKey]) {
+          warn(`⚠️  Both 'workspaces' and '${legacyKey}' found in wmill.yaml. Using 'workspaces' and ignoring '${legacyKey}'.`);
+        }
       }
-      return true;
     }
-    transform(value) {
-      return value;
+    delete conf?.gitBranches;
+    delete conf?.environments;
+    delete conf?.git_branches;
+    if (conf?.defaultTs == undefined) {
+      warn("No defaultTs defined in your wmill.yaml. Using 'bun' as default.");
     }
-    format(value) {
-      return value.map((val) => this.settings.format?.(val) ?? this.getOptionByValue(val)?.name ?? String(val)).join(", ");
+    setNonDottedPaths(conf?.nonDottedPaths ?? false);
+    const syncBehaviorVersion = parseSyncBehavior(conf?.syncBehavior);
+    if (syncBehaviorVersion > SUPPORTED_SYNC_BEHAVIOR_VERSION) {
+      error(`Your wmill.yaml specifies syncBehavior: ${conf.syncBehavior}, but this CLI only supports up to v${SUPPORTED_SYNC_BEHAVIOR_VERSION}. Run 'wmill upgrade' to update.`);
+      process.exit(1);
     }
-  };
-});
-
-// src/commands/workspace/merge.ts
-function triggerService(kind) {
-  switch (kind) {
-    case "http_trigger":
-      return {
-        exists: existsHttpTrigger,
-        get: getHttpTrigger,
-        create: createHttpTrigger,
-        update: updateHttpTrigger,
-        delete: deleteHttpTrigger
-      };
-    case "websocket_trigger":
-      return {
-        exists: existsWebsocketTrigger,
-        get: getWebsocketTrigger,
-        create: createWebsocketTrigger,
-        update: updateWebsocketTrigger,
-        delete: deleteWebsocketTrigger
-      };
-    case "kafka_trigger":
-      return {
-        exists: existsKafkaTrigger,
-        get: getKafkaTrigger,
-        create: createKafkaTrigger,
-        update: updateKafkaTrigger,
-        delete: deleteKafkaTrigger
-      };
-    case "nats_trigger":
-      return {
-        exists: existsNatsTrigger,
-        get: getNatsTrigger,
-        create: createNatsTrigger,
-        update: updateNatsTrigger,
-        delete: deleteNatsTrigger
-      };
-    case "postgres_trigger":
-      return {
-        exists: existsPostgresTrigger,
-        get: getPostgresTrigger,
-        create: createPostgresTrigger,
-        update: updatePostgresTrigger,
-        delete: deletePostgresTrigger
-      };
-    case "mqtt_trigger":
-      return {
-        exists: existsMqttTrigger,
-        get: getMqttTrigger,
-        create: createMqttTrigger,
-        update: updateMqttTrigger,
-        delete: deleteMqttTrigger
-      };
-    case "sqs_trigger":
-      return {
-        exists: existsSqsTrigger,
-        get: getSqsTrigger,
-        create: createSqsTrigger,
-        update: updateSqsTrigger,
-        delete: deleteSqsTrigger
-      };
-    case "gcp_trigger":
-      return {
-        exists: existsGcpTrigger,
-        get: getGcpTrigger,
-        create: createGcpTrigger,
-        update: updateGcpTrigger,
-        delete: deleteGcpTrigger
-      };
-    case "azure_trigger":
-      return {
-        exists: existsAzureTrigger,
-        get: getAzureTrigger,
-        create: createAzureTrigger,
-        update: updateAzureTrigger,
-        delete: deleteAzureTrigger
-      };
-    case "email_trigger":
-      return {
-        exists: existsEmailTrigger,
-        get: getEmailTrigger,
-        create: createEmailTrigger,
-        update: updateEmailTrigger,
-        delete: deleteEmailTrigger
-      };
-  }
-}
-function preparePayload(kind, trigger, onBehalfOf) {
-  const preserve = onBehalfOf !== undefined;
-  const base = {
-    ...trigger,
-    permissioned_as: onBehalfOf,
-    preserve_permissioned_as: preserve
-  };
-  if (kind === "gcp_trigger") {
-    base.subscription_id = "";
-    base.subscription_mode = "create_update";
-    if (base.delivery_config) {
-      base.delivery_config = { ...base.delivery_config, audience: "" };
+    return typeof conf == "object" ? conf : {};
+  } catch (e) {
+    if (e instanceof Error && (e.message.includes("overrides") || e.message.includes("Obsolete configuration format"))) {
+      throw e;
     }
-    if (base.delivery_type === "push") {
-      base.base_endpoint = OpenAPI.BASE.replace(/\/api\/?$/, "");
+    if (e instanceof Error && e.message.includes("Error parsing yaml")) {
+      const yamlError = e.cause instanceof Error ? e.cause.message : String(e.cause);
+      throw new Error(`❌ YAML syntax error in wmill.yaml:
+` + "   " + yamlError + `
+` + "   Please fix the YAML syntax in wmill.yaml or delete the file to start fresh.");
     } else {
-      base.base_endpoint = undefined;
+      throw new Error(`❌ Failed to read wmill.yaml:
+` + "   " + (e instanceof Error ? e.message : String(e)) + `
+` + "   Please check file permissions or fix the syntax.");
     }
   }
-  return base;
 }
-async function mergeWorkspaces(opts) {
-  const workspace = await tryResolveBranchWorkspace(opts);
-  if (!workspace) {
-    throw new Error("Could not resolve workspace from branch name. Make sure you are in a git repo with 'workspaces' configured in wmill.yaml.");
-  }
-  const token = workspace.token;
-  if (!token) {
-    throw new Error("Not logged in. Please run 'wmill workspace add' first.");
-  }
-  const remote = workspace.remote;
-  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
-  const forkWorkspaceId = workspace.workspaceId;
-  const userWorkspaces = await listUserWorkspaces();
-  const forkEntry = userWorkspaces.workspaces?.find((w) => w.id === forkWorkspaceId);
-  if (!forkEntry?.parent_workspace_id) {
-    throw new Error(`Workspace '${forkWorkspaceId}' is not a fork (no parent_workspace_id). ` + `You can only merge from a forked workspace.`);
-  }
-  const parentWorkspaceId = forkEntry.parent_workspace_id;
-  info(`Fork: ${colors.bold(forkWorkspaceId)} → Parent: ${colors.bold(parentWorkspaceId)}`);
-  info("Comparing workspaces...");
-  const comparison = await compareWorkspaces({
-    workspace: parentWorkspaceId,
-    targetWorkspaceId: forkWorkspaceId
-  });
-  if (comparison.skipped_comparison) {
-    info(colors.yellow("This fork was created before change tracking was available. " + "Use the UI or git-based merge instead."));
+async function mergeConfigWithConfigFile(opts) {
+  const configFile = await readConfigFile();
+  return Object.assign(configFile ?? {}, opts);
+}
+async function validateBranchConfiguration(opts, workspaceNameOverride) {
+  if (opts.skipBranchValidation || workspaceNameOverride || !isGitRepository()) {
     return;
   }
-  const summary = comparison.summary;
-  if (summary.total_diffs === 0) {
-    info(colors.green("Everything is up to date. No differences found."));
-    return;
+  const config = await readConfigFile();
+  const { workspaces } = config;
+  const rawBranch = getCurrentGitBranch();
+  const originalBranchIfForked = getOriginalBranchForWorkspaceForks(rawBranch);
+  let currentBranch;
+  if (originalBranchIfForked) {
+    info(`Workspace fork detected from branch name \`${rawBranch}\`. Validating workspace configuration using original branch \`${originalBranchIfForked}\``);
+    currentBranch = originalBranchIfForked;
+  } else {
+    currentBranch = rawBranch;
   }
-  info("");
-  info(colors.bold("Comparison Summary:"));
-  const summaryRows = [];
-  if (summary.scripts_changed > 0)
-    summaryRows.push(["Scripts", String(summary.scripts_changed)]);
-  if (summary.flows_changed > 0)
-    summaryRows.push(["Flows", String(summary.flows_changed)]);
-  if (summary.apps_changed > 0)
-    summaryRows.push(["Apps", String(summary.apps_changed)]);
-  if (summary.resources_changed > 0)
-    summaryRows.push(["Resources", String(summary.resources_changed)]);
-  if (summary.variables_changed > 0)
-    summaryRows.push(["Variables", String(summary.variables_changed)]);
-  if (summary.resource_types_changed > 0)
-    summaryRows.push(["Resource Types", String(summary.resource_types_changed)]);
-  if (summary.folders_changed > 0)
-    summaryRows.push(["Folders", String(summary.folders_changed)]);
-  if (summary.schedules_changed > 0)
-    summaryRows.push(["Schedules", String(summary.schedules_changed)]);
-  if (summary.triggers_changed > 0)
-    summaryRows.push(["Triggers", String(summary.triggers_changed)]);
-  summaryRows.push(["Total", String(summary.total_diffs)]);
-  if (summary.conflicts > 0)
-    summaryRows.push([
-      colors.red("Conflicts"),
-      colors.red(String(summary.conflicts))
-    ]);
-  new Table2().header(["Type", "Changed"]).padding(2).border(true).body(summaryRows).render();
-  const diffs = comparison.diffs.filter((d) => d.has_changes !== false);
-  if (diffs.length === 0) {
-    info(colors.green("No effective changes to deploy."));
+  if (!workspaces || getWorkspaceNames(workspaces).length === 0) {
+    warn(`⚠️  WARNING: In a Git repository, the 'workspaces' section is recommended in wmill.yaml.
+` + `   Consider adding a workspaces section to map workspace names to Windmill instances.
+` + "   Run 'wmill init' to recreate the configuration file with proper workspace setup.");
     return;
   }
-  info("");
-  info(colors.bold("Changed items:"));
-  new Table2().header(["#", "Kind", "Path", "Ahead", "Behind", "Conflict"]).padding(1).border(true).body(diffs.map((d, i) => {
-    const isConflict = d.ahead > 0 && d.behind > 0;
-    return [
-      String(i + 1),
-      d.kind,
-      d.path,
-      d.ahead > 0 ? colors.green(String(d.ahead)) : "0",
-      d.behind > 0 ? colors.yellow(String(d.behind)) : "0",
-      isConflict ? colors.red("YES") : ""
-    ];
-  })).render();
-  let direction;
-  if (opts.direction === "to-parent" || opts.direction === "to-fork") {
-    direction = opts.direction;
-  } else if (opts.direction) {
-    throw new Error(`Invalid direction '${opts.direction}'. Use 'to-parent' or 'to-fork'.`);
-  } else if (opts.yes) {
-    direction = "to-parent";
-  } else {
-    const { Select: Select2 } = await init_select().then(() => exports_select);
-    direction = await Select2.prompt({
-      message: "Deploy direction:",
-      options: [
-        {
-          name: `Deploy to parent (${parentWorkspaceId}) ← fork changes`,
-          value: "to-parent"
-        },
-        {
-          name: `Update fork (${forkWorkspaceId}) ← parent changes`,
-          value: "to-fork"
-        }
-      ]
-    });
-  }
-  info(`
-Direction: ${colors.bold(direction === "to-parent" ? `Fork → Parent (${parentWorkspaceId})` : `Parent → Fork (${forkWorkspaceId})`)}`);
-  const selectableDiffs = diffs.filter((d) => {
-    if (direction === "to-parent") {
-      return d.ahead > 0;
+  const branchToWsNames = new Map;
+  for (const name of getWorkspaceNames(workspaces)) {
+    const entry = workspaces[name];
+    const branch = getEffectiveGitBranch(name, entry);
+    const existing = branchToWsNames.get(branch);
+    if (existing) {
+      existing.push(name);
     } else {
-      return d.behind > 0;
+      branchToWsNames.set(branch, [name]);
     }
-  });
-  if (selectableDiffs.length === 0) {
-    info(colors.yellow(`No items to deploy in the '${direction}' direction.`));
-    return;
   }
-  let selectedDiffs = selectableDiffs;
-  if (opts.all) {
-    selectedDiffs = selectableDiffs;
-  } else if (opts.skipConflicts) {
-    selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0) && (!!opts.include || !isTriggerOrScheduleKind(d.kind)));
-  } else if (opts.yes && !opts.include && !opts.exclude) {
-    selectedDiffs = selectableDiffs.filter((d) => !isTriggerOrScheduleKind(d.kind) && (direction !== "to-fork" || !(d.ahead > 0 && d.behind > 0)));
-  } else if (!opts.yes) {
-    const { Checkbox: Checkbox2 } = await init_checkbox().then(() => exports_checkbox);
-    const defaultForToFork = direction === "to-fork";
-    const selectedValues = await Checkbox2.prompt({
-      message: `Select items to deploy (${selectableDiffs.length} available):`,
-      options: selectableDiffs.map((d) => {
-        const isConflict = d.ahead > 0 && d.behind > 0;
-        const isTriggerOrSchedule = isTriggerOrScheduleKind(d.kind);
-        const label = `${d.kind}:${d.path}${isConflict ? colors.red(" [CONFLICT]") : ""}`;
-        return {
-          name: label,
-          value: `${d.kind}:${d.path}`,
-          checked: !isTriggerOrSchedule && (defaultForToFork ? !isConflict : true)
-        };
-      })
-    });
-    selectedDiffs = selectableDiffs.filter((d) => selectedValues.includes(`${d.kind}:${d.path}`));
-  }
-  if (opts.include) {
-    const includeSet = new Set(opts.include.split(",").map((s) => s.trim()));
-    selectedDiffs = selectedDiffs.filter((d) => includeSet.has(`${d.kind}:${d.path}`));
-  }
-  if (opts.exclude) {
-    const excludeSet = new Set(opts.exclude.split(",").map((s) => s.trim()));
-    selectedDiffs = selectedDiffs.filter((d) => !excludeSet.has(`${d.kind}:${d.path}`));
+  for (const [branch, names] of branchToWsNames) {
+    if (names.length > 1) {
+      warn(`⚠️  WARNING: Multiple workspaces map to git branch '${branch}': ${names.join(", ")}.
+` + `   Only the first ('${names[0]}') will be used during auto-detection. Use --workspace to select explicitly.`);
+    }
   }
-  if (selectedDiffs.length === 0) {
-    info(colors.yellow("No items selected for deployment."));
-    return;
+  if (currentBranch && !findWorkspaceByGitBranch(workspaces, currentBranch)) {
+    const wsNames = getWorkspaceNames(workspaces);
+    const availableInfo = wsNames.map((n) => {
+      const entry = workspaces[n];
+      const branch = getEffectiveGitBranch(n, entry);
+      return branch !== n ? `${n} (gitBranch: ${branch})` : n;
+    }).join(", ");
+    if (!!process.stdin.isTTY) {
+      info(`Current Git branch '${currentBranch}' does not match any workspace in the configuration.
+` + `Available workspaces: ${availableInfo}`);
+      const shouldCreate = opts.yes || await Confirm.prompt({
+        message: `Create empty workspace configuration for branch '${currentBranch}'?`,
+        default: true
+      });
+      if (shouldCreate) {
+        if (/[\/\\:*?"<>|.]/.test(currentBranch)) {
+          const sanitizedBranchName = currentBranch.replace(/[\/\\:*?"<>|.]/g, "_");
+          warn(`⚠️  WARNING: Branch name "${currentBranch}" contains filesystem-unsafe characters (/ \\ : * ? " < > | .).`);
+          warn(`   Branch-specific files will be saved with sanitized name: "${sanitizedBranchName}"`);
+          warn(`   Example: "file.variable.yaml" → "file.${sanitizedBranchName}.variable.yaml"`);
+        }
+        const currentConfig = await readConfigFile();
+        if (!currentConfig.workspaces) {
+          currentConfig.workspaces = {};
+        }
+        currentConfig.workspaces[currentBranch] = {};
+        await writeFile("wmill.yaml", import_yaml3.stringify(currentConfig), "utf-8");
+        info(`✅ Created empty workspace configuration for '${currentBranch}'`);
+      } else {
+        warn("⚠️  WARNING: Workspace creation cancelled. You can manually add a workspace to the 'workspaces' section in wmill.yaml or use 'wmill gitsync-settings pull' to pull configuration from an existing windmill workspace git-sync configuration.");
+        return;
+      }
+    } else {
+      if (/[\/\\:*?"<>|.]/.test(currentBranch)) {
+        const sanitizedBranchName = currentBranch.replace(/[\/\\:*?"<>|.]/g, "_");
+        warn(`⚠️  WARNING: Branch name "${currentBranch}" contains filesystem-unsafe characters (/ \\ : * ? " < > | .).`);
+        warn(`   Branch-specific files will use sanitized name: "${sanitizedBranchName}"`);
+      }
+      warn(`⚠️  WARNING: Current Git branch '${currentBranch}' does not match any workspace in the configuration.
+` + `   Consider adding a workspace entry for branch '${currentBranch}' in the 'workspaces' section of wmill.yaml.
+` + `   Available workspaces: ${availableInfo}`);
+      return;
+    }
   }
-  const conflicts = selectedDiffs.filter((d) => d.ahead > 0 && d.behind > 0);
-  if (conflicts.length > 0) {
-    info(colors.yellow(`
-⚠ ${conflicts.length} conflicting item(s) will be deployed (source will overwrite target):`));
-    for (const c of conflicts) {
-      info(colors.yellow(`  - ${c.kind}:${c.path}`));
+}
+async function getEffectiveSettings(config, promotion, skipBranchValidation, suppressLogs, workspaceNameOverride) {
+  const { workspaces, ...topLevelSettings } = config;
+  const effective = { ...topLevelSettings };
+  let resolvedWsName = null;
+  let resolvedWsEntry = null;
+  let originalBranchIfForked = null;
+  let rawGitBranch = null;
+  if (workspaceNameOverride) {
+    if (workspaces && workspaces[workspaceNameOverride]) {
+      resolvedWsName = workspaceNameOverride;
+      resolvedWsEntry = workspaces[workspaceNameOverride];
     }
-    if (!opts.yes) {
-      const { Confirm: Confirm2 } = await init_confirm().then(() => exports_confirm);
-      const proceed = await Confirm2.prompt("Proceed with deploying conflicting items?");
-      if (!proceed) {
-        info("Aborted.");
-        return;
+  } else if (isGitRepository()) {
+    rawGitBranch = getCurrentGitBranch();
+    originalBranchIfForked = getOriginalBranchForWorkspaceForks(rawGitBranch);
+    const branch = originalBranchIfForked ?? rawGitBranch;
+    if (originalBranchIfForked) {
+      info(`Using overrides from original branch \`${originalBranchIfForked}\``);
+    }
+    if (branch) {
+      const match = findWorkspaceByGitBranch(workspaces, branch);
+      if (match) {
+        [resolvedWsName, resolvedWsEntry] = match;
       }
     }
+  } else {
+    debug("Not in a Git repository and no workspace override provided, using top-level settings");
   }
-  info(`
-Deploying ${colors.bold(String(selectedDiffs.length))} item(s)...`);
-  const sorted = [...selectedDiffs].sort((a, b) => {
-    const aFolder = a.kind === "folder" ? 0 : 1;
-    const bFolder = b.kind === "folder" ? 0 : 1;
-    return aFolder - bFolder;
-  });
-  const workspaceFrom = direction === "to-parent" ? forkWorkspaceId : parentWorkspaceId;
-  const workspaceTo = direction === "to-parent" ? parentWorkspaceId : forkWorkspaceId;
-  let successCount = 0;
-  let failCount = 0;
-  for (const diff2 of sorted) {
-    const label = `${diff2.kind}:${diff2.path}`;
-    const itemDeletedInSource = direction === "to-parent" ? diff2.exists_in_fork === false : diff2.exists_in_source === false;
-    let result;
-    if (itemDeletedInSource) {
-      info(colors.yellow(`  ⌫ ${label} (removing from target)`));
-      result = await deleteItemInWorkspace(provider, diff2.kind, diff2.path, workspaceTo);
-    } else {
-      let onBehalfOf;
-      if (opts.preserveOnBehalfOf) {
-        onBehalfOf = await getOnBehalfOf(provider, diff2.kind, diff2.path, workspaceFrom);
+  if (promotion && workspaces) {
+    const promotionMatch = findWorkspaceByGitBranch(workspaces, promotion);
+    if (promotionMatch) {
+      const [, targetWs] = promotionMatch;
+      if (targetWs.promotionOverrides) {
+        Object.assign(effective, targetWs.promotionOverrides);
+        if (!suppressLogs) {
+          info(`Applied promotion settings from workspace for branch: ${promotion}`);
+        }
+      } else if (targetWs.overrides) {
+        Object.assign(effective, targetWs.overrides);
+        if (!suppressLogs) {
+          info(`Applied settings from workspace for branch: ${promotion} (no promotionOverrides found)`);
+        }
+      } else {
+        debug(`No promotion or regular overrides found for '${promotion}', using top-level settings`);
       }
-      result = await deployItem(provider, diff2.kind, diff2.path, workspaceFrom, workspaceTo, onBehalfOf);
     }
-    if (result.success) {
-      info(colors.green(`  ✓ ${label}`));
-      successCount++;
-    } else {
-      info(colors.red(`  ✗ ${label}: ${result.error}`));
-      failCount++;
+  } else if (resolvedWsEntry?.overrides) {
+    Object.assign(effective, resolvedWsEntry.overrides);
+    if (!suppressLogs) {
+      const extraLog = originalBranchIfForked ? ` (because it is the origin of the workspace fork branch \`${rawGitBranch}\`)` : "";
+      info(`Applied settings for workspace '${resolvedWsName}'${extraLog}`);
     }
+  } else if (resolvedWsName) {
+    debug(`No overrides found for workspace '${resolvedWsName}', using top-level settings`);
   }
-  if (successCount > 0) {
-    try {
-      await resetDiffTally({
-        workspace: parentWorkspaceId,
-        forkWorkspaceId
-      });
-    } catch {}
-  }
-  info("");
-  if (failCount === 0) {
-    info(colors.green(`✅ Successfully deployed ${successCount} item(s) from ${workspaceFrom} to ${workspaceTo}.`));
-  } else {
-    info(colors.yellow(`Deployed ${successCount} item(s), ${colors.red(String(failCount) + " failed")} from ${workspaceFrom} to ${workspaceTo}.`));
-  }
+  return effective;
 }
-var provider;
-var init_merge = __esm(async () => {
-  init_colors2();
-  init_mod6();
-  init_log();
-  init_client();
-  init_services_gen();
-  init_OpenAPI();
-  init_deploy();
-  await init_context();
-  provider = {
-    existsFlowByPath,
-    existsScriptByPath,
-    existsApp,
-    existsVariable,
-    existsResource,
-    existsResourceType,
-    existsFolder,
-    getFlowByPath,
-    createFlow,
-    updateFlow,
-    archiveFlowByPath,
-    getScriptByPath,
-    createScript,
-    archiveScriptByPath,
-    getAppByPath,
-    createApp,
-    updateApp,
-    createAppRaw,
-    updateAppRaw,
-    getPublicSecretOfLatestVersionOfApp,
-    getRawAppData,
-    deleteApp,
-    getVariable,
-    createVariable,
-    updateVariable,
-    deleteVariable,
-    getResource,
-    createResource,
-    updateResource,
-    deleteResource,
-    getResourceType,
-    createResourceType,
-    updateResourceType,
-    deleteResourceType,
-    getFolder,
-    createFolder,
-    updateFolder,
-    deleteFolder,
-    existsTriggerByKind: (kind, p) => triggerService(kind).exists(p),
-    getTriggerForDeploy: async (kind, p) => {
-      const trigger = await triggerService(kind).get({
-        workspace: p.workspace,
-        path: p.path
-      });
-      return preparePayload(kind, trigger, p.onBehalfOf);
-    },
-    createTriggerByKind: (kind, p) => triggerService(kind).create(p),
-    updateTriggerByKind: (kind, p) => triggerService(kind).update(p),
-    deleteTriggerByKind: (kind, p) => triggerService(kind).delete(p),
-    getTriggerValue: (kind, p) => triggerService(kind).get(p),
-    getTriggerPermissionedAs: async (kind, p) => {
-      const trigger = await triggerService(kind).get(p);
-      return trigger?.permissioned_as;
-    },
-    existsSchedule,
-    getSchedule,
-    createSchedule,
-    updateSchedule,
-    deleteSchedule
-  };
-});
-
-// src/commands/workspace/slack.ts
-async function connectSlack2(opts) {
-  await requireLogin(opts);
-  const workspace = await resolveWorkspace(opts);
-  await connectSlack({
-    workspace: workspace.workspaceId,
-    requestBody: {
-      bot_token: opts.botToken,
-      team_id: opts.teamId,
-      team_name: opts.teamName
+function findWorkspaceByGitBranch(workspaces, branchName) {
+  if (!workspaces)
+    return;
+  for (const [name, entry] of Object.entries(workspaces)) {
+    if (RESERVED_WORKSPACE_KEYS.has(name))
+      continue;
+    const effectiveBranch = entry.gitBranch ?? name;
+    if (effectiveBranch === branchName) {
+      return [name, entry];
     }
-  });
-  info(colors.bold.underline.green(`Slack connected to workspace ${workspace.workspaceId} (team ${opts.teamName} / ${opts.teamId})`));
+  }
+  return;
 }
-async function disconnectSlack2(opts) {
-  await requireLogin(opts);
-  const workspace = await resolveWorkspace(opts);
-  await disconnectSlack({ workspace: workspace.workspaceId });
-  info(colors.bold.underline.green(`Slack disconnected from workspace ${workspace.workspaceId} (slack_team_id / slack_name cleared). ` + `To also remove the bot token variable/resource/folder/group, delete the corresponding files from the local sync folder and run 'wmill sync push'. ` + `To remove the workspace-level OAuth override (if any), set slack_oauth_client_id/_secret to '' in settings.yaml and push.`));
+function getEffectiveWorkspaceId(workspaceName, config) {
+  return config.workspaceId ?? workspaceName;
 }
-var init_slack = __esm(async () => {
-  init_colors2();
+function getEffectiveGitBranch(workspaceName, config) {
+  return config.gitBranch ?? workspaceName;
+}
+function getWorkspaceNames(workspaces) {
+  if (!workspaces)
+    return [];
+  return Object.keys(workspaces).filter((k) => !RESERVED_WORKSPACE_KEYS.has(k));
+}
+function convertGitBranchesToWorkspaces(gitBranches) {
+  const workspaces = {};
+  for (const [key, value] of Object.entries(gitBranches)) {
+    if (key === "commonSpecificItems") {
+      workspaces.commonSpecificItems = value;
+      continue;
+    }
+    workspaces[key] = { ...value };
+  }
+  return workspaces;
+}
+var import_yaml3, showDiffs = false, SUPPORTED_SYNC_BEHAVIOR_VERSION = 1, GLOBAL_CONFIG_OPT, legacyConfigWarned = false, DEFAULT_SYNC_OPTIONS, RESERVED_WORKSPACE_KEYS;
+var init_conf = __esm(async () => {
   init_log();
-  init_services_gen();
+  init_git();
   await __promiseAll([
-    init_auth(),
-    init_context()
+    init_yaml(),
+    init_confirm(),
+    init_resource_folders()
   ]);
+  import_yaml3 = __toESM(require_dist(), 1);
+  GLOBAL_CONFIG_OPT = { noCdToRoot: false };
+  DEFAULT_SYNC_OPTIONS = {
+    defaultTs: "bun",
+    includes: ["f/**"],
+    excludes: [],
+    codebases: [],
+    skipVariables: false,
+    skipResources: false,
+    skipResourceTypes: false,
+    skipSecrets: true,
+    skipScripts: false,
+    skipFlows: false,
+    skipApps: false,
+    skipFolders: false,
+    includeSchedules: false,
+    includeTriggers: false,
+    includeUsers: false,
+    includeGroups: false,
+    includeSettings: false,
+    includeKey: false,
+    skipWorkspaceDependencies: false,
+    nonDottedPaths: false,
+    syncBehavior: "v1"
+  };
+  RESERVED_WORKSPACE_KEYS = new Set(["commonSpecificItems"]);
 });
 
-// src/utils/resource_folders.ts
-import { sep as SEP2 } from "node:path";
-import * as fs6 from "node:fs";
-import * as path2 from "node:path";
-import process9 from "node:process";
-function setNonDottedPaths(value) {
-  if (value && !_nonDottedPathsLogged) {
-    debug("Using non-dotted paths (__flow, __app, __raw_app)");
-    _nonDottedPathsLogged = true;
+// src/commands/workspace/fork.ts
+import process10 from "node:process";
+async function createWorkspaceFork2(opts, workspaceName, workspaceId = undefined) {
+  if (!isGitRepository()) {
+    throw new Error("You can only create forks within a git repo. Forks are tracked with git and synced to your instance with the git sync workflow.");
   }
-  _nonDottedPaths = value;
-}
-function getNonDottedPaths() {
-  return _nonDottedPaths;
-}
-async function loadNonDottedPathsSetting() {
-  let currentDir = process9.cwd();
-  while (true) {
-    const wmillYamlPath = path2.join(currentDir, "wmill.yaml");
-    if (fs6.existsSync(wmillYamlPath)) {
-      try {
-        const config = await yamlParseFile(wmillYamlPath);
-        setNonDottedPaths(config?.nonDottedPaths ?? false);
-        debug(`Found wmill.yaml at ${wmillYamlPath}, nonDottedPaths=${config?.nonDottedPaths ?? false}`);
-      } catch (e) {
-        debug(`Failed to parse wmill.yaml at ${wmillYamlPath}: ${e}`);
-      }
-      return;
+  const currentBranch = getCurrentGitBranch();
+  if (!currentBranch) {
+    throw new Error("Could not get git branch name");
+  }
+  const config = await readConfigFile({ warnIfMissing: false });
+  const originalBranchIfForked = getOriginalBranchForWorkspaceForks(currentBranch);
+  const isBaseBranch = (branch) => branch === "main" || branch === "master" || findWorkspaceByGitBranch(config.workspaces, branch) !== undefined;
+  let clonedBranchName;
+  let renameCurrent;
+  if (opts.fromBranch) {
+    if (opts.fromBranch === currentBranch) {
+      throw new Error(`--from-branch is for converting a *different* working branch into the fork branch, but you are already on \`${currentBranch}\`. ` + `Omit --from-branch to create a fresh fork branch with \`git checkout -b\`.`);
     }
-    const parentDir = path2.dirname(currentDir);
-    if (parentDir === currentDir) {
-      debug("No wmill.yaml found, using default dotted paths");
-      return;
+    if (isBaseBranch(currentBranch)) {
+      throw new Error(`Refusing to rename your current branch \`${currentBranch}\` — it looks like a base branch (mapped to a workspace in wmill.yaml, or main/master). ` + `Check out the disposable working branch you want to convert first.`);
     }
-    currentDir = parentDir;
+    if (getOriginalBranchForWorkspaceForks(currentBranch)) {
+      throw new Error(`Refusing to rename your current branch \`${currentBranch}\` — it is already a fork branch. ` + `To fork a fork, omit --from-branch: \`wmill workspace fork\` bases the new fork on this fork's original branch and creates a fresh fork branch without renaming.`);
+    }
+    if (!findWorkspaceByGitBranch(config.workspaces, opts.fromBranch)) {
+      throw new Error(`Could not find a workspace mapped to branch \`${opts.fromBranch}\` in wmill.yaml's workspaces section. ` + `Pass the base branch your fork should be based on (e.g. the branch bound to the parent workspace).`);
+    }
+    clonedBranchName = opts.fromBranch;
+    renameCurrent = true;
+  } else if (originalBranchIfForked) {
+    info(`You are creating a fork of a fork. The branch will be linked to the original branch this was forked from, i.e. \`${originalBranchIfForked}\`, for all settings and overrides.`);
+    clonedBranchName = originalBranchIfForked;
+    renameCurrent = false;
+  } else if (isBaseBranch(currentBranch)) {
+    clonedBranchName = currentBranch;
+    renameCurrent = false;
+  } else {
+    clonedBranchName = await resolveWorkingBranchBase(config, opts, currentBranch);
+    renameCurrent = true;
   }
-}
-function getFolderSuffixes() {
-  return _nonDottedPaths ? NON_DOTTED_SUFFIXES : DOTTED_SUFFIXES;
-}
-function getFolderSuffix(type) {
-  return getFolderSuffixes()[type];
-}
-function getMetadataFileName(type, format6) {
-  return METADATA_FILES[type][format6];
-}
-function getMetadataPathSuffix(type, format6) {
-  return getFolderSuffixes()[type] + "/" + METADATA_FILES[type][format6];
-}
-function hasWrongFormatSuffix(dirName) {
-  const wrongSuffixes = _nonDottedPaths ? DOTTED_SUFFIXES : NON_DOTTED_SUFFIXES;
-  for (const [type, suffix] of Object.entries(wrongSuffixes)) {
-    if (dirName.endsWith(suffix)) {
-      return type;
+  let workspace;
+  if (clonedBranchName === currentBranch) {
+    workspace = await tryResolveBranchWorkspace(opts);
+  } else {
+    const baseMatch = findWorkspaceByGitBranch(config.workspaces, clonedBranchName);
+    workspace = baseMatch ? await tryResolveBranchWorkspace(opts, baseMatch[0]) : await tryResolveBranchWorkspace(opts);
+  }
+  if (!workspace) {
+    throw new Error("Could not resolve workspace from branch name. Make sure you are in a git repo to use workspace forks");
+  }
+  info(`You are forking workspace (${workspace.workspaceId})`);
+  if (opts.workspace) {
+    info(colors.red.bold("! Workspace needs to be specified as positional argument, not as option."));
+    return;
+  }
+  const branchDefaultId = renameCurrent ? branchToForkId(currentBranch) : undefined;
+  const interactive = process10.stdin.isTTY && opts.yes !== true;
+  if (workspaceName === undefined) {
+    if (branchDefaultId && !interactive) {
+      workspaceName = branchDefaultId;
+      info(`Naming the fork after the current branch: \`${workspaceName}\``);
+    } else {
+      workspaceName = await Input.prompt({
+        message: "Name this forked workspace:",
+        default: branchDefaultId
+      });
     }
   }
-  return null;
-}
-function normalizeSep(p) {
-  return p.replaceAll("\\", "/");
-}
-function isFlowPath(p) {
-  return normalizeSep(p).includes(getFolderSuffixes().flow + "/");
-}
-function isAppPath(p) {
-  return normalizeSep(p).includes(getFolderSuffixes().app + "/");
-}
-function isRawAppPath(p) {
-  return normalizeSep(p).includes(getFolderSuffixes().raw_app + "/");
-}
-function isFolderResourcePathAnyFormat(p) {
-  const n = normalizeSep(p);
-  for (const suffixes of [DOTTED_SUFFIXES, NON_DOTTED_SUFFIXES]) {
-    if (n.includes(suffixes.flow + "/") || n.includes(suffixes.app + "/") || n.includes(suffixes.raw_app + "/")) {
-      return true;
+  if (!workspaceId) {
+    const idDefault = branchToForkId(workspaceName);
+    if (branchDefaultId && !interactive) {
+      workspaceId = idDefault;
+    } else {
+      workspaceId = await Input.prompt({
+        message: `Enter the ID of this forked workspace, it will then be prefixed by ${WM_FORK_PREFIX}. It will also determine the branch name`,
+        default: idDefault,
+        suggestions: [idDefault]
+      });
     }
   }
-  return false;
-}
-function isAppInlineScriptPath(filePath) {
-  const suffixes = getFolderSuffixes();
-  const normalizedPath = filePath.replaceAll(SEP2, "/");
-  const escapedSuffix = suffixes.app.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`${escapedSuffix}/`);
-  return pattern.test(normalizedPath);
-}
-function isFlowInlineScriptPath(filePath) {
-  const suffixes = getFolderSuffixes();
-  const normalizedPath = filePath.replaceAll(SEP2, "/");
-  const escapedSuffix = suffixes.flow.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const pattern = new RegExp(`${escapedSuffix}/`);
-  return pattern.test(normalizedPath);
-}
-function extractResourceName(p, type) {
-  const normalized = normalizeSep(p);
-  const suffix = getFolderSuffixes()[type] + "/";
-  const index = normalized.indexOf(suffix);
-  if (index === -1)
-    return null;
-  return normalized.substring(0, index);
-}
-function extractFolderPath(p, type) {
-  const normalized = normalizeSep(p);
-  const suffix = getFolderSuffixes()[type] + "/";
-  const index = normalized.indexOf(suffix);
-  if (index === -1)
-    return null;
-  return normalized.substring(0, index) + suffix;
-}
-function buildFolderPath(resourceName, type) {
-  return resourceName + getFolderSuffixes()[type];
-}
-function hasFolderSuffix(dirName, type) {
-  return dirName.endsWith(getFolderSuffixes()[type]);
-}
-function extractNameFromFolder(folderName2, type) {
-  const suffix = getFolderSuffixes()[type];
-  if (folderName2.endsWith(suffix)) {
-    return folderName2.substring(0, folderName2.length - suffix.length);
+  const token = workspace.token;
+  if (!token) {
+    throw new Error("Not logged in. Please run 'wmill workspace add' first.");
+  }
+  const remote = workspace.remote;
+  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
+  info(colors.blue(`Creating forked workspace: ${workspaceName}...`));
+  const trueWorkspaceId = `${WM_FORK_PREFIX}-${workspaceId}`;
+  validateForkWorkspaceId(trueWorkspaceId);
+  let alreadyExists = false;
+  try {
+    alreadyExists = await existsWorkspace({
+      requestBody: { id: trueWorkspaceId }
+    });
+  } catch (e) {
+    info(colors.red.bold("! Credentials or instance is invalid. Aborting."));
+    throw e;
+  }
+  if (alreadyExists) {
+    throw new Error(`This forked workspace '${workspaceId}' (${workspaceName}) already exists, possibly archived (archiving keeps the id reserved). ` + `Permanently delete it with \`wmill workspace delete-fork ${workspaceId}\` to reuse the id, or choose a different id`);
+  }
+  const forkedDatatables = [];
+  let datatables = [];
+  try {
+    datatables = await listDataTables({
+      workspace: workspace.workspaceId
+    });
+  } catch (e) {
+    info(colors.yellow(`Note: Could not list datatables: ${e.message}`));
+  }
+  if (datatables && datatables.length > 0) {
+    const behavior = opts.datatableBehavior ?? (opts.yes ? "skip" : undefined);
+    if (behavior !== "skip") {
+      info(`
+Found ${datatables.length} datatable(s):`);
+      for (const dt of datatables) {
+        let dtBehavior;
+        if (behavior === "schema_only" || behavior === "schema_and_data") {
+          dtBehavior = behavior;
+        } else {
+          const { Select: Select2 } = await init_select().then(() => exports_select);
+          dtBehavior = await Select2.prompt({
+            message: `Datatable "${dt.name}" (${dt.resource_type}):`,
+            options: [
+              { name: "Keep original (no cloning)", value: "keep_original" },
+              { name: "Clone schema only", value: "schema_only" },
+              { name: "Clone schema and data", value: "schema_and_data" }
+            ]
+          });
+        }
+        if (dtBehavior === "keep_original") {
+          continue;
+        }
+        const newDbName = `${trueWorkspaceId.replace(/-/g, "_")}__${dt.name}`;
+        try {
+          info(colors.blue(`  Creating database "${newDbName}" for datatable "${dt.name}"...`));
+          await createPgDatabase({
+            workspace: workspace.workspaceId,
+            requestBody: {
+              source: `datatable://${dt.name}`,
+              target_dbname: newDbName
+            }
+          });
+          info(colors.blue(`  Importing ${dtBehavior === "schema_only" ? "schema" : "schema + data"}...`));
+          await importPgDatabase({
+            workspace: workspace.workspaceId,
+            requestBody: {
+              source: `datatable://${dt.name}`,
+              target: `datatable://${dt.name}`,
+              target_dbname_override: newDbName,
+              fork_behavior: dtBehavior
+            }
+          });
+          info(colors.green(`  ✓ Datatable "${dt.name}" cloned.`));
+          forkedDatatables.push({ name: dt.name, new_dbname: newDbName });
+        } catch (e) {
+          info(colors.yellow(`  ✗ Failed to clone datatable "${dt.name}": ${e.message}`));
+        }
+      }
+    }
   }
-  return folderName2;
-}
-function isFlowMetadataFile(p) {
-  if (p.endsWith(DOTTED_SUFFIXES.flow + ".json") || p.endsWith(DOTTED_SUFFIXES.flow + ".yaml")) {
-    return true;
+  const forkColor = opts.color;
+  try {
+    const gitSyncJobIds = await createWorkspaceForkGitBranch({
+      workspace: workspace.workspaceId,
+      requestBody: {
+        id: trueWorkspaceId,
+        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
+        color: forkColor
+      }
+    });
+    if (gitSyncJobIds && gitSyncJobIds.length > 0) {
+      info(colors.blue(`Git sync branch creation triggered (${gitSyncJobIds.length} job(s)). These will complete asynchronously.`));
+    }
+  } catch (e) {
+    error(colors.red(`Failed to create git branch for fork: ${e.message}`));
+    throw e;
   }
-  if (_nonDottedPaths) {
-    return p.endsWith(NON_DOTTED_SUFFIXES.flow + ".json") || p.endsWith(NON_DOTTED_SUFFIXES.flow + ".yaml");
+  try {
+    const result = await createWorkspaceFork({
+      workspace: workspace.workspaceId,
+      requestBody: {
+        id: trueWorkspaceId,
+        name: opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId,
+        color: forkColor,
+        forked_datatables: forkedDatatables
+      }
+    });
+    info(colors.green(`✅ ${result}`));
+  } catch (error2) {
+    error(colors.red(`Failed to create forked workspace: ${error2.message}`));
+    throw error2;
   }
-  return false;
+  const newBranchName = `${WM_FORK_PREFIX}/${clonedBranchName}/${workspaceId}`;
+  let onForkBranch = false;
+  if (renameCurrent) {
+    if (currentBranch === newBranchName) {
+      onForkBranch = true;
+      info(colors.green(`Your current branch is already \`${newBranchName}\`.`));
+    } else if (gitBranchExists(newBranchName)) {
+      warn(`Branch \`${newBranchName}\` already exists locally, so the current branch \`${currentBranch}\` was not renamed. Check out the fork branch yourself (e.g. \`git checkout ${newBranchName}\`).`);
+    } else {
+      renameCurrentGitBranch(newBranchName);
+      onForkBranch = true;
+      info(colors.green(`Renamed \`${currentBranch}\` → \`${newBranchName}\`. Your existing commits are now on the fork branch.`));
+    }
+  }
+  const checkoutHint = onForkBranch ? `Created forked workspace ${trueWorkspaceId}. You are on the fork branch \`${newBranchName}\` — push it to sync your fork.` : `Created forked workspace ${trueWorkspaceId}. To start contributing to your fork, create and push edits to the branch \`${newBranchName}\` by using the command:
+
+	` + colors.white(`git checkout -b ${newBranchName}`);
+  info(`${checkoutHint}
+
+When doing operations on the forked workspace, it will use the remote setup in the workspaces section for the branch it was forked from.
+
+To merge changes back to the parent workspace, you can:
+  - Use the CLI: ` + colors.white(`git checkout ${newBranchName} && wmill workspace merge`) + `
+  - Use the Merge UI from the forked workspace home page
+  - Use git: ` + colors.white(`git checkout ${clonedBranchName} && git merge ${newBranchName} && wmill sync push`) + `
+  See: https://www.windmill.dev/docs/advanced/workspace_forks`);
 }
-function isAppMetadataFile(p) {
-  if (p.endsWith(DOTTED_SUFFIXES.app + ".json") || p.endsWith(DOTTED_SUFFIXES.app + ".yaml")) {
-    return true;
+async function resolveWorkingBranchBase(config, opts, currentBranch) {
+  const interactive = process10.stdin.isTTY && opts.yes !== true;
+  if (!interactive) {
+    throw new Error(`You are on working branch \`${currentBranch}\`, which is not a base branch. Pass --from-branch <base> to base the fork on a base branch and rename this branch onto the fork branch, or check out a base branch and run \`wmill workspace fork\` to create a fresh fork branch.`);
   }
-  if (_nonDottedPaths) {
-    return p.endsWith(NON_DOTTED_SUFFIXES.app + ".json") || p.endsWith(NON_DOTTED_SUFFIXES.app + ".yaml");
+  const { Select: Select2 } = await init_select().then(() => exports_select);
+  const proceed = await Select2.prompt({
+    message: `You're on working branch \`${currentBranch}\`, not a base branch. Base a fork on it and rename it onto the fork branch?`,
+    options: [
+      { name: "Yes, base the fork on this branch and rename it", value: "yes" },
+      { name: "No, cancel", value: "no" }
+    ]
+  });
+  if (proceed !== "yes") {
+    throw new Error("Fork cancelled. Check out a base branch to create a fresh fork branch instead.");
+  }
+  const baseBranches = listConfiguredBaseBranches(config);
+  if (baseBranches.length === 0) {
+    throw new Error(`No base branches are configured in wmill.yaml's workspaces section, so the fork can't be linked to a parent. Add the parent workspace to wmill.yaml, or pass --from-branch <base>.`);
+  }
+  if (baseBranches.length === 1) {
+    info(`Basing the fork on \`${baseBranches[0]}\`.`);
+    return baseBranches[0];
+  }
+  return await Select2.prompt({
+    message: "Which base branch is this fork based on (the parent)?",
+    options: baseBranches.map((b) => ({ name: b, value: b }))
+  });
+}
+function branchToForkId(branch) {
+  const slug = branch.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_FORK_ID_SLUG).replace(/-+$/g, "");
+  return slug || "fork";
+}
+function validateForkWorkspaceId(id) {
+  const reject = (reason) => {
+    throw new Error(`Fork workspace id \`${id}\` is invalid: ${reason}. Choose a shorter or simpler name/id.`);
+  };
+  if (id.length > 50) {
+    reject(`too long (${id.length} chars; max 50 including the \`${WM_FORK_PREFIX}-\` prefix)`);
+  }
+  if (id.endsWith("."))
+    reject("cannot end with '.'");
+  if (id.endsWith(".lock"))
+    reject("cannot end with '.lock'");
+  if (id.includes(".."))
+    reject("cannot contain '..'");
+  if (id.includes("@{"))
+    reject("cannot contain '@{'");
+  if (id.includes("//"))
+    reject("cannot contain '//'");
+  for (const ch of id) {
+    if (":~^?*[\\ ".includes(ch))
+      reject(`contains forbidden character '${ch}'`);
+    const code2 = ch.charCodeAt(0);
+    if (code2 < 32 || code2 === 127)
+      reject("contains a control character");
+  }
+  for (const component of id.split("/")) {
+    if (component.startsWith("."))
+      reject("a path component cannot start with '.'");
+    if (component.endsWith(".lock"))
+      reject("a path component cannot end with '.lock'");
+  }
+}
+function listConfiguredBaseBranches(config) {
+  const workspaces = config.workspaces;
+  const branches = new Set;
+  for (const name of getWorkspaceNames(workspaces)) {
+    branches.add(getEffectiveGitBranch(name, workspaces[name]));
   }
-  return false;
+  return [...branches];
 }
-function isRawAppMetadataFile(p) {
-  if (p.endsWith(DOTTED_SUFFIXES.raw_app + ".json") || p.endsWith(DOTTED_SUFFIXES.raw_app + ".yaml")) {
-    return true;
+async function deleteWorkspaceFork(opts, name) {
+  let forkWorkspaceId;
+  let token;
+  let remote;
+  let hasLocalProfile = false;
+  const orgWorkspaces = await allWorkspaces(opts.configDir);
+  const idxOf = orgWorkspaces.findIndex((x) => x.name === name);
+  if (idxOf !== -1) {
+    const workspace = orgWorkspaces[idxOf];
+    if (!workspace.workspaceId.startsWith(WM_FORK_PREFIX)) {
+      throw new Error(`You can only delete forked workspaces where the workspace id starts with \`${WM_FORK_PREFIX}.\` Failed while attempting to delete \`${workspace.workspaceId}\``);
+    }
+    forkWorkspaceId = workspace.workspaceId;
+    token = workspace.token;
+    remote = workspace.remote;
+    hasLocalProfile = true;
+  } else {
+    const parentWorkspace = await tryResolveBranchWorkspace(opts);
+    if (!parentWorkspace) {
+      throw new Error("Could not resolve parent workspace. Make sure you are in a git repo with 'workspaces' configured in wmill.yaml, or create a local workspace profile for the fork.");
+    }
+    forkWorkspaceId = name.startsWith(`${WM_FORK_PREFIX}-`) ? name : `${WM_FORK_PREFIX}-${name}`;
+    token = parentWorkspace.token;
+    remote = parentWorkspace.remote;
   }
-  if (_nonDottedPaths) {
-    return p.endsWith(NON_DOTTED_SUFFIXES.raw_app + ".json") || p.endsWith(NON_DOTTED_SUFFIXES.raw_app + ".yaml");
+  if (!opts.yes) {
+    const { Select: Select2 } = await init_select().then(() => exports_select);
+    const choice = await Select2.prompt({
+      message: `Are you sure you want to delete the forked workspace \`${forkWorkspaceId}\`?`,
+      options: [
+        { name: "Yes", value: "confirm" },
+        { name: "No", value: "cancel" }
+      ]
+    });
+    if (choice === "cancel") {
+      info("Operation cancelled");
+      return;
+    }
+  }
+  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
+  const result = await deleteWorkspace({
+    workspace: forkWorkspaceId
+  });
+  info(colors.green(`✅ Forked workspace '${forkWorkspaceId}' deleted successfully!
+${result}`));
+  if (hasLocalProfile) {
+    await removeWorkspace(name, false, opts);
   }
-  return false;
 }
-function isRawAppFolderMetadataFile(p) {
-  return p.endsWith(getMetadataPathSuffix("raw_app", "yaml")) || p.endsWith(getMetadataPathSuffix("raw_app", "json"));
+var MAX_FORK_ID_SLUG = 42;
+var init_fork = __esm(async () => {
+  init_colors2();
+  init_log();
+  init_client();
+  init_services_gen();
+  init_git();
+  await __promiseAll([
+    init_input(),
+    init_workspace(),
+    init_context(),
+    init_conf()
+  ]);
+});
+
+// windmill-utils-internal/src/deploy.ts
+function isTriggerKind(kind) {
+  return TRIGGER_KINDS.includes(kind);
 }
-function isAppFolderMetadataFile(p) {
-  return p.endsWith(getMetadataPathSuffix("app", "yaml")) || p.endsWith(getMetadataPathSuffix("app", "json"));
+function isTriggerOrScheduleKind(kind) {
+  return kind === "schedule" || isTriggerKind(kind);
 }
-function isFlowFolderMetadataFile(p) {
-  return p.endsWith(getMetadataPathSuffix("flow", "yaml")) || p.endsWith(getMetadataPathSuffix("flow", "json"));
+function folderName(path3) {
+  return path3.replace(/^f\//, "");
 }
-function getModuleFolderSuffix() {
-  return MODULE_SUFFIX;
+function stripOperationalStateOnUpdate(payload, alreadyExists) {
+  if (!alreadyExists)
+    return payload;
+  const { mode: _mode, enabled: _enabled, ...rest } = payload;
+  return rest;
 }
-function isScriptModulePath(p) {
-  return normalizeSep(p).includes(MODULE_SUFFIX + "/");
+function getSubModules(flowModule) {
+  const type = flowModule?.value?.type;
+  if (type === "forloopflow" || type === "whileloopflow") {
+    return [flowModule.value.modules ?? []];
+  } else if (type === "branchall") {
+    return (flowModule.value.branches ?? []).map((branch) => branch.modules ?? []);
+  } else if (type === "branchone") {
+    return [
+      ...(flowModule.value.branches ?? []).map((b) => b.modules ?? []),
+      flowModule.value.default ?? []
+    ];
+  } else if (type === "aiagent") {
+    if (flowModule.value.tools) {
+      return [
+        flowModule.value.tools.filter((t) => t.value?.type === "script" || t.value?.type === "flow").map((t) => ({
+          id: t.id,
+          value: t.value,
+          summary: t.summary
+        }))
+      ];
+    }
+  }
+  return [];
 }
-function isModuleEntryPoint(p) {
-  const norm = normalizeSep(p);
-  const suffix = MODULE_SUFFIX + "/";
-  const idx = norm.indexOf(suffix);
-  if (idx === -1)
-    return false;
-  const rest = norm.slice(idx + suffix.length);
-  return rest.startsWith("script.") && !rest.includes("/");
+function getAllSubmodules(flowModule) {
+  return getSubModules(flowModule).map((modules) => modules.flatMap((m) => [m, ...getAllSubmodules(m)])).flat();
 }
-function getScriptBasePathFromModulePath(p) {
-  const norm = normalizeSep(p);
-  const suffix = MODULE_SUFFIX + "/";
-  const idx = norm.indexOf(suffix);
-  if (idx === -1)
-    return;
-  return norm.slice(0, idx);
+function getAllModules(flowModules, failureModule) {
+  return [
+    ...flowModules,
+    ...flowModules.flatMap((x) => getAllSubmodules(x)),
+    ...failureModule ? [failureModule] : []
+  ];
 }
-function scriptPathToRemotePath(p) {
-  return (isModuleEntryPoint(p) ? getScriptBasePathFromModulePath(p) : p.substring(0, p.indexOf("."))).replaceAll(SEP2, "/");
+function toError(e) {
+  const err = e;
+  return err.body || err.message || String(e);
 }
-function getDeleteSuffix(type, format6) {
-  return getFolderSuffixes()[type] + "/" + METADATA_FILES[type][format6];
+async function checkItemExists(provider, kind, path3, workspace) {
+  if (kind === "flow") {
+    return provider.existsFlowByPath({ workspace, path: path3 });
+  } else if (kind === "script") {
+    return provider.existsScriptByPath({ workspace, path: path3 });
+  } else if (kind === "app" || kind === "raw_app") {
+    return provider.existsApp({ workspace, path: path3 });
+  } else if (kind === "variable") {
+    return provider.existsVariable({ workspace, path: path3 });
+  } else if (kind === "resource") {
+    return provider.existsResource({ workspace, path: path3 });
+  } else if (kind === "resource_type") {
+    return provider.existsResourceType({ workspace, path: path3 });
+  } else if (kind === "folder") {
+    return provider.existsFolder({ workspace, name: folderName(path3) });
+  } else if (kind === "schedule") {
+    return provider.existsSchedule({ workspace, path: path3 });
+  } else if (isTriggerKind(kind)) {
+    return provider.existsTriggerByKind(kind, { workspace, path: path3 });
+  }
+  throw new Error(`Unknown kind: ${kind}`);
 }
-function transformJsonPathToDir(p, type) {
-  const apiSuffix = DOTTED_SUFFIXES[type] + ".json";
-  if (p.endsWith(apiSuffix)) {
-    const basePath = p.substring(0, p.length - apiSuffix.length);
-    return basePath + getFolderSuffixes()[type];
+async function deployItem(provider, kind, path3, workspaceFrom, workspaceTo, onBehalfOf) {
+  const preserveOnBehalfOf = onBehalfOf !== undefined;
+  try {
+    const alreadyExists = await checkItemExists(provider, kind, path3, workspaceTo);
+    if (kind === "flow") {
+      const flow = await provider.getFlowByPath({
+        workspace: workspaceFrom,
+        path: path3
+      });
+      getAllModules(flow.value?.modules ?? [], flow.value?.failure_module).forEach((x) => {
+        if (x.value?.type === "script" && x.value.hash != null) {
+          x.value.hash = undefined;
+        }
+      });
+      if (alreadyExists) {
+        await provider.updateFlow({
+          workspace: workspaceTo,
+          path: path3,
+          requestBody: {
+            ...flow,
+            preserve_on_behalf_of: preserveOnBehalfOf,
+            on_behalf_of_email: onBehalfOf
+          }
+        });
+      } else {
+        await provider.createFlow({
+          workspace: workspaceTo,
+          requestBody: {
+            ...flow,
+            preserve_on_behalf_of: preserveOnBehalfOf,
+            on_behalf_of_email: onBehalfOf
+          }
+        });
+      }
+    } else if (kind === "script") {
+      const script = await provider.getScriptByPath({
+        workspace: workspaceFrom,
+        path: path3
+      });
+      let parentHash;
+      if (alreadyExists) {
+        const existing = await provider.getScriptByPath({
+          workspace: workspaceTo,
+          path: path3
+        });
+        parentHash = existing.hash;
+      }
+      await provider.createScript({
+        workspace: workspaceTo,
+        requestBody: {
+          ...script,
+          lock: script.lock,
+          parent_hash: parentHash,
+          preserve_on_behalf_of: preserveOnBehalfOf,
+          on_behalf_of_email: onBehalfOf
+        }
+      });
+    } else if (kind === "app" || kind === "raw_app") {
+      const app = await provider.getAppByPath({
+        workspace: workspaceFrom,
+        path: path3
+      });
+      if (alreadyExists) {
+        if (app.raw_app) {
+          const secret = await provider.getPublicSecretOfLatestVersionOfApp({
+            workspace: workspaceFrom,
+            path: app.path
+          });
+          const js = await provider.getRawAppData({
+            secretWithExtension: `${secret}.js`,
+            workspace: workspaceFrom
+          });
+          const css = await provider.getRawAppData({
+            secretWithExtension: `${secret}.css`,
+            workspace: workspaceFrom
+          });
+          await provider.updateAppRaw({
+            workspace: workspaceTo,
+            path: path3,
+            formData: {
+              app: { ...app, preserve_on_behalf_of: preserveOnBehalfOf },
+              css,
+              js
+            }
+          });
+        } else {
+          await provider.updateApp({
+            workspace: workspaceTo,
+            path: path3,
+            requestBody: {
+              ...app,
+              preserve_on_behalf_of: preserveOnBehalfOf
+            }
+          });
+        }
+      } else {
+        if (app.raw_app) {
+          const secret = await provider.getPublicSecretOfLatestVersionOfApp({
+            workspace: workspaceFrom,
+            path: app.path
+          });
+          const js = await provider.getRawAppData({
+            secretWithExtension: `${secret}.js`,
+            workspace: workspaceFrom
+          });
+          const css = await provider.getRawAppData({
+            secretWithExtension: `${secret}.css`,
+            workspace: workspaceFrom
+          });
+          await provider.createAppRaw({
+            workspace: workspaceTo,
+            formData: {
+              app: { ...app, preserve_on_behalf_of: preserveOnBehalfOf },
+              css,
+              js
+            }
+          });
+        } else {
+          await provider.createApp({
+            workspace: workspaceTo,
+            requestBody: {
+              ...app,
+              preserve_on_behalf_of: preserveOnBehalfOf
+            }
+          });
+        }
+      }
+    } else if (kind === "variable") {
+      const variable = await provider.getVariable({
+        workspace: workspaceFrom,
+        path: path3,
+        decryptSecret: true
+      });
+      if (alreadyExists) {
+        await provider.updateVariable({
+          workspace: workspaceTo,
+          path: path3,
+          requestBody: {
+            path: path3,
+            value: variable.value ?? "",
+            is_secret: variable.is_secret,
+            description: variable.description ?? ""
+          },
+          alreadyEncrypted: false
+        });
+      } else {
+        await provider.createVariable({
+          workspace: workspaceTo,
+          requestBody: {
+            path: path3,
+            value: variable.value ?? "",
+            is_secret: variable.is_secret,
+            description: variable.description ?? ""
+          }
+        });
+      }
+    } else if (kind === "resource") {
+      const resource = await provider.getResource({
+        workspace: workspaceFrom,
+        path: path3
+      });
+      if (alreadyExists) {
+        await provider.updateResource({
+          workspace: workspaceTo,
+          path: path3,
+          requestBody: {
+            path: path3,
+            value: resource.value ?? "",
+            description: resource.description ?? ""
+          }
+        });
+      } else {
+        await provider.createResource({
+          workspace: workspaceTo,
+          requestBody: {
+            path: path3,
+            value: resource.value ?? "",
+            resource_type: resource.resource_type,
+            description: resource.description ?? ""
+          }
+        });
+      }
+    } else if (kind === "resource_type") {
+      const rt = await provider.getResourceType({
+        workspace: workspaceFrom,
+        path: path3
+      });
+      if (alreadyExists) {
+        await provider.updateResourceType({
+          workspace: workspaceTo,
+          path: path3,
+          requestBody: {
+            schema: rt.schema,
+            description: rt.description ?? ""
+          }
+        });
+      } else {
+        await provider.createResourceType({
+          workspace: workspaceTo,
+          requestBody: {
+            name: rt.name,
+            schema: rt.schema,
+            description: rt.description ?? ""
+          }
+        });
+      }
+    } else if (kind === "folder") {
+      const name = folderName(path3);
+      const folder = await provider.getFolder({
+        workspace: workspaceFrom,
+        name
+      });
+      if (alreadyExists) {
+        await provider.updateFolder({
+          workspace: workspaceTo,
+          name,
+          requestBody: {
+            owners: folder.owners,
+            extra_perms: folder.extra_perms,
+            summary: folder.summary ?? undefined
+          }
+        });
+      } else {
+        await provider.createFolder({
+          workspace: workspaceTo,
+          requestBody: {
+            name,
+            owners: folder.owners,
+            extra_perms: folder.extra_perms,
+            summary: folder.summary ?? undefined
+          }
+        });
+      }
+    } else if (kind === "schedule") {
+      const schedule = await provider.getSchedule({
+        workspace: workspaceFrom,
+        path: path3
+      });
+      const baseBody = stripOperationalStateOnUpdate(schedule, alreadyExists);
+      const requestBody = {
+        ...baseBody,
+        permissioned_as: onBehalfOf,
+        preserve_permissioned_as: preserveOnBehalfOf
+      };
+      if (alreadyExists) {
+        await provider.updateSchedule({
+          workspace: workspaceTo,
+          path: path3,
+          requestBody
+        });
+      } else {
+        await provider.createSchedule({
+          workspace: workspaceTo,
+          requestBody
+        });
+      }
+    } else if (isTriggerKind(kind)) {
+      const triggerBody = await provider.getTriggerForDeploy(kind, {
+        workspace: workspaceFrom,
+        path: path3,
+        onBehalfOf
+      });
+      const requestBody = stripOperationalStateOnUpdate(triggerBody, alreadyExists);
+      if (alreadyExists) {
+        await provider.updateTriggerByKind(kind, {
+          workspace: workspaceTo,
+          path: path3,
+          requestBody
+        });
+      } else {
+        await provider.createTriggerByKind(kind, {
+          workspace: workspaceTo,
+          requestBody
+        });
+      }
+    } else {
+      throw new Error(`Unknown kind: ${kind}`);
+    }
+    return { success: true };
+  } catch (e) {
+    return { success: false, error: toError(e) };
   }
-  const userSuffix = getFolderSuffixes()[type] + ".json";
-  if (p.endsWith(userSuffix)) {
-    return p.substring(0, p.length - 5);
+}
+async function deleteItemInWorkspace(provider, kind, path3, workspace) {
+  try {
+    if (kind === "script") {
+      await provider.archiveScriptByPath({ workspace, path: path3 });
+    } else if (kind === "flow") {
+      await provider.archiveFlowByPath({
+        workspace,
+        path: path3,
+        requestBody: { archived: true }
+      });
+    } else if (kind === "app" || kind === "raw_app") {
+      await provider.deleteApp({ workspace, path: path3 });
+    } else if (kind === "variable") {
+      await provider.deleteVariable({ workspace, path: path3 });
+    } else if (kind === "resource") {
+      await provider.deleteResource({ workspace, path: path3 });
+    } else if (kind === "resource_type") {
+      await provider.deleteResourceType({ workspace, path: path3 });
+    } else if (kind === "folder") {
+      await provider.deleteFolder({ workspace, name: folderName(path3) });
+    } else if (kind === "schedule") {
+      await provider.deleteSchedule({ workspace, path: path3 });
+    } else if (isTriggerKind(kind)) {
+      await provider.deleteTriggerByKind(kind, { workspace, path: path3 });
+    } else {
+      throw new Error(`Deletion not supported for kind: ${kind}`);
+    }
+    return { success: true };
+  } catch (e) {
+    return { success: false, error: toError(e) };
   }
-  return p;
 }
-var DOTTED_SUFFIXES, NON_DOTTED_SUFFIXES, _nonDottedPaths = false, _nonDottedPathsLogged = false, METADATA_FILES, MODULE_SUFFIX = "__mod";
-var init_resource_folders = __esm(async () => {
-  init_log();
-  await init_yaml();
-  DOTTED_SUFFIXES = {
-    flow: ".flow",
-    app: ".app",
-    raw_app: ".raw_app"
-  };
-  NON_DOTTED_SUFFIXES = {
-    flow: "__flow",
-    app: "__app",
-    raw_app: "__raw_app"
-  };
-  METADATA_FILES = {
-    flow: { yaml: "flow.yaml", json: "flow.json" },
-    app: { yaml: "app.yaml", json: "app.json" },
-    raw_app: { yaml: "raw_app.yaml", json: "raw_app.json" }
-  };
+async function getOnBehalfOf(provider, kind, path3, workspace) {
+  try {
+    if (kind === "flow") {
+      const flow = await provider.getFlowByPath({ workspace, path: path3 });
+      return flow.on_behalf_of_email;
+    } else if (kind === "script") {
+      const script = await provider.getScriptByPath({ workspace, path: path3 });
+      return script.on_behalf_of_email;
+    } else if (kind === "app" || kind === "raw_app") {
+      const app = await provider.getAppByPath({ workspace, path: path3 });
+      return app.policy?.on_behalf_of_email;
+    } else if (kind === "schedule") {
+      const schedule = await provider.getSchedule({ workspace, path: path3 });
+      return schedule.permissioned_as;
+    } else if (isTriggerKind(kind)) {
+      return await provider.getTriggerPermissionedAs(kind, { workspace, path: path3 });
+    }
+  } catch {}
+  return;
+}
+var TRIGGER_KINDS;
+var init_deploy = __esm(() => {
+  TRIGGER_KINDS = [
+    "http_trigger",
+    "websocket_trigger",
+    "kafka_trigger",
+    "nats_trigger",
+    "postgres_trigger",
+    "mqtt_trigger",
+    "sqs_trigger",
+    "gcp_trigger",
+    "azure_trigger",
+    "email_trigger"
+  ];
 });
 
-// src/core/conf.ts
-var exports_conf = {};
-__export(exports_conf, {
-  validateBranchConfiguration: () => validateBranchConfiguration,
-  showDiffs: () => showDiffs,
-  setShowDiffs: () => setShowDiffs,
-  readConfigFile: () => readConfigFile,
-  parseSyncBehavior: () => parseSyncBehavior,
-  mergeConfigWithConfigFile: () => mergeConfigWithConfigFile,
-  getWorkspaceNames: () => getWorkspaceNames,
-  getWmillYamlPath: () => getWmillYamlPath,
-  getEffectiveWorkspaceId: () => getEffectiveWorkspaceId,
-  getEffectiveSettings: () => getEffectiveSettings,
-  getEffectiveGitBranch: () => getEffectiveGitBranch,
-  findWorkspaceByGitBranch: () => findWorkspaceByGitBranch,
-  convertGitBranchesToWorkspaces: () => convertGitBranchesToWorkspaces,
-  SUPPORTED_SYNC_BEHAVIOR_VERSION: () => SUPPORTED_SYNC_BEHAVIOR_VERSION,
-  GLOBAL_CONFIG_OPT: () => GLOBAL_CONFIG_OPT,
-  DEFAULT_SYNC_OPTIONS: () => DEFAULT_SYNC_OPTIONS
+// node_modules/@cliffy/prompt/checkbox.js
+var exports_checkbox = {};
+__export(exports_checkbox, {
+  isCheckboxOptionGroup: () => isCheckboxOptionGroup,
+  Checkbox: () => Checkbox
 });
-import { join as join7, dirname as dirname6, resolve as resolve5, relative as relative4 } from "node:path";
-import { existsSync as existsSync2 } from "node:fs";
-import { writeFile } from "node:fs/promises";
-import { execSync as execSync2 } from "node:child_process";
-function setShowDiffs(value) {
-  showDiffs = value;
+function areSomeChecked(options) {
+  return options.some((option) => isOptionGroup(option) ? areSomeChecked(option.options) : option.checked);
 }
-function parseSyncBehavior(value) {
-  if (!value && value !== 0)
-    return 0;
-  const s = String(value);
-  const match = s.match(/^v(\d+)$/);
-  return match ? parseInt(match[1], 10) : 0;
+function areAllChecked(options) {
+  return options.every((option) => isOptionGroup(option) ? areAllChecked(option.options) : option.checked);
 }
-function getGitRepoRoot() {
-  try {
-    const result = execSync2("git rev-parse --show-toplevel", {
-      encoding: "utf8",
-      stdio: "pipe"
-    });
-    return result.trim();
-  } catch (error2) {
-    return null;
+function flatOptions(options) {
+  return flat(options);
+  function flat(options2, indentLevel = 0, opts = []) {
+    for (const option of options2) {
+      option.indentLevel = indentLevel;
+      if (isOption2(option)) {
+        opts.push(option);
+      }
+      if (isOptionGroup(option)) {
+        flat(option.options, ++indentLevel, opts);
+      }
+    }
+    return opts;
   }
 }
-function findWmillYaml() {
-  const startDir = resolve5(process.cwd());
-  const isInGitRepo = isGitRepository();
-  const gitRoot = isInGitRepo ? getGitRepoRoot() : null;
-  let currentDir = startDir;
-  let foundPath = null;
-  while (true) {
-    const wmillYamlPath = join7(currentDir, "wmill.yaml");
-    if (existsSync2(wmillYamlPath)) {
-      foundPath = wmillYamlPath;
-      break;
+function isCheckboxOptionGroup(option) {
+  return isOptionGroup(option);
+}
+var Checkbox;
+var init_checkbox = __esm(async () => {
+  init_equal();
+  init_colors();
+  init__figures();
+  await __promiseAll([
+    init__generic_list(),
+    init__generic_prompt()
+  ]);
+  Checkbox = class Checkbox extends GenericList {
+    settings;
+    options;
+    listIndex;
+    listOffset;
+    confirmSubmit = false;
+    static prompt(options) {
+      return new this(options).prompt();
     }
-    if (gitRoot && resolve5(currentDir) === resolve5(gitRoot)) {
-      break;
+    static inject(value) {
+      GenericPrompt.inject(value);
     }
-    const parentDir = dirname6(currentDir);
-    if (parentDir === currentDir) {
-      break;
+    constructor(options) {
+      super();
+      this.settings = this.getDefaultSettings(options);
+      this.options = this.settings.options.slice();
+      this.listIndex = this.getListIndex();
+      this.listOffset = this.getPageOffset(this.listIndex);
     }
-    currentDir = parentDir;
-  }
-  if (!GLOBAL_CONFIG_OPT.noCdToRoot && foundPath && resolve5(dirname6(foundPath)) !== resolve5(startDir)) {
-    const configDir = dirname6(foundPath);
-    const relativePath = relative4(startDir, foundPath);
-    warn(`⚠️  wmill.yaml found in parent directory: ${relativePath}`);
-    process.chdir(configDir);
-    info(`\uD83D\uDCC1 Changed working directory to: ${configDir}`);
-  }
-  return foundPath;
-}
-function getWmillYamlPath() {
-  return findWmillYaml();
-}
-async function readConfigFile(opts) {
-  const warnIfMissing = opts?.warnIfMissing ?? true;
-  try {
-    const wmillYamlPath = findWmillYaml();
-    if (!wmillYamlPath) {
-      if (warnIfMissing) {
-        warn("No wmill.yaml found. Use 'wmill init' to bootstrap it.");
-      }
-      return {};
+    getDefaultSettings(options) {
+      const settings = super.getDefaultSettings(options);
+      return {
+        confirmSubmit: true,
+        ...settings,
+        check: options.check ?? green(Figures.TICK),
+        uncheck: options.uncheck ?? red(Figures.CROSS),
+        partialCheck: options.partialCheck ?? green(Figures.RADIO_ON),
+        minOptions: options.minOptions ?? 0,
+        maxOptions: options.maxOptions ?? Infinity,
+        options: this.mapOptions(options, options.options),
+        keys: {
+          check: [
+            "space"
+          ],
+          checkAll: [
+            "a"
+          ],
+          ...settings.keys ?? {},
+          open: options.keys?.open ?? [
+            "right"
+          ],
+          back: options.keys?.back ?? [
+            "left",
+            "escape"
+          ]
+        }
+      };
     }
-    const conf = await yamlParseFile(wmillYamlPath);
-    if (conf && "overrides" in conf) {
-      const overrides = conf.overrides;
-      const hasSettings = overrides && typeof overrides === "object" && Object.keys(overrides).length > 0;
-      if (hasSettings) {
-        throw new Error(`❌ The 'overrides' field is no longer supported.
-` + `   The configuration system now uses workspace-based configuration.
-` + "   Please delete your wmill.yaml and run 'wmill init' to recreate it with the new format.");
+    mapOptions(promptOptions, options) {
+      return options.map((option) => typeof option === "string" || typeof option === "number" ? this.mapOption(promptOptions, {
+        value: option
+      }) : isCheckboxOptionGroup(option) ? this.mapOptionGroup(promptOptions, option) : this.mapOption(promptOptions, option));
+    }
+    mapOption(options, option) {
+      if (isOption2(option)) {
+        return {
+          ...super.mapOption(options, option),
+          checked: typeof option.checked === "undefined" && options.default && options.default.indexOf(option.value) !== -1 ? true : !!option.checked,
+          icon: typeof option.icon === "undefined" ? true : option.icon
+        };
       } else {
-        delete conf.overrides;
+        return {
+          ...super.mapOption(options, option),
+          checked: false,
+          icon: false
+        };
       }
     }
-    if (conf && !conf.workspaces) {
-      let legacyKey = null;
-      let legacyData;
-      if (conf.gitBranches) {
-        legacyKey = "gitBranches";
-        legacyData = conf.gitBranches;
-      } else if (conf.environments) {
-        legacyKey = "environments";
-        legacyData = conf.environments;
-      } else if (conf.git_branches) {
-        legacyKey = "git_branches";
-        legacyData = conf.git_branches;
+    mapOptionGroup(promptOptions, option) {
+      const options = this.mapOptions(promptOptions, option.options);
+      const optionGroup = super.mapOptionGroup(promptOptions, option, false);
+      return {
+        ...optionGroup,
+        get checked() {
+          return areAllChecked(options);
+        },
+        get disabled() {
+          return optionGroup.disabled || options.every((opt) => opt.disabled);
+        },
+        options,
+        icon: typeof option.icon === "undefined" ? true : option.icon
+      };
+    }
+    match() {
+      super.match();
+      if (this.isSearching()) {
+        this.selectSearch();
       }
-      if (legacyKey && legacyData) {
-        conf.workspaces = convertGitBranchesToWorkspaces(legacyData);
-        if (!legacyConfigWarned) {
-          warn(`⚠️  '${legacyKey}' in wmill.yaml is deprecated. Use 'workspaces' instead.
-` + `   Run 'wmill config migrate' to update your configuration automatically.`);
-          legacyConfigWarned = true;
-        }
+    }
+    getListItemIcon(option) {
+      return this.getCheckboxIcon(option) + super.getListItemIcon(option);
+    }
+    getCheckboxIcon(option) {
+      if (!option.icon) {
+        return "";
       }
-    } else if (conf?.workspaces) {
-      for (const legacyKey of ["gitBranches", "environments", "git_branches"]) {
-        if (conf[legacyKey]) {
-          warn(`⚠️  Both 'workspaces' and '${legacyKey}' found in wmill.yaml. Using 'workspaces' and ignoring '${legacyKey}'.`);
+      const icon = option.checked ? this.settings.check + " " : isOptionGroup(option) && areSomeChecked(option.options) ? this.settings.partialCheck + " " : this.settings.uncheck + " ";
+      return option.disabled ? dim(icon) : icon;
+    }
+    getValue() {
+      return flatOptions(this.settings.options).filter((option) => option.checked).map((option) => option.value);
+    }
+    async handleEvent(event) {
+      const hasConfirmed = this.confirmSubmit;
+      this.confirmSubmit = false;
+      switch (true) {
+        case (this.isKey(this.settings.keys, "check", event) && !this.isSearchSelected()):
+          this.checkValue();
+          break;
+        case this.isKey(this.settings.keys, "submit", event):
+          await this.submit(hasConfirmed);
+          break;
+        case (event.ctrl && this.isKey(this.settings.keys, "checkAll", event)):
+          this.checkAllOption();
+          break;
+        default:
+          await super.handleEvent(event);
+      }
+    }
+    hint() {
+      if (this.confirmSubmit) {
+        const info2 = this.isBackButton(this.selectedOption) ? ` To leave the current group press ${getFiguresByKeys(this.settings.keys.back ?? []).join(", ")}.` : isOptionGroup(this.selectedOption) ? ` To open the selected group press ${getFiguresByKeys(this.settings.keys.open ?? []).join(", ")}.` : ` To check or uncheck the selected option press ${getFiguresByKeys(this.settings.keys.check ?? []).join(", ")}.`;
+        return this.settings.indent + brightBlue(`Press ${getFiguresByKeys(this.settings.keys.submit ?? [])} again to submit.${info2}`);
+      }
+      return super.hint();
+    }
+    async submit(hasConfirmed) {
+      if (!hasConfirmed && this.settings.confirmSubmit && !this.isSearchSelected()) {
+        this.confirmSubmit = true;
+        return;
+      }
+      await super.submit();
+    }
+    checkValue() {
+      const option = this.options.at(this.listIndex);
+      if (!option) {
+        this.setErrorMessage("No option available to select.");
+        return;
+      } else if (option.disabled) {
+        this.setErrorMessage("This option is disabled and cannot be changed.");
+        return;
+      }
+      this.checkOption(option, !option.checked);
+    }
+    checkOption(option, checked) {
+      if (isOption2(option)) {
+        option.checked = checked;
+      } else {
+        for (const childOption of option.options) {
+          this.checkOption(childOption, checked);
         }
       }
     }
-    delete conf?.gitBranches;
-    delete conf?.environments;
-    delete conf?.git_branches;
-    if (conf?.defaultTs == undefined) {
-      warn("No defaultTs defined in your wmill.yaml. Using 'bun' as default.");
+    checkAllOption() {
+      const checked = this.options.some((option) => option.checked);
+      for (const option of this.options) {
+        this.checkOption(option, !checked);
+      }
     }
-    setNonDottedPaths(conf?.nonDottedPaths ?? false);
-    const syncBehaviorVersion = parseSyncBehavior(conf?.syncBehavior);
-    if (syncBehaviorVersion > SUPPORTED_SYNC_BEHAVIOR_VERSION) {
-      error(`Your wmill.yaml specifies syncBehavior: ${conf.syncBehavior}, but this CLI only supports up to v${SUPPORTED_SYNC_BEHAVIOR_VERSION}. Run 'wmill upgrade' to update.`);
-      process.exit(1);
+    validate(value) {
+      const options = flatOptions(this.settings.options);
+      const isValidValue = Array.isArray(value) && value.every((val) => options.findIndex((option) => equal(option.value, val)) !== -1);
+      if (!isValidValue) {
+        return false;
+      }
+      if (value.length < this.settings.minOptions) {
+        return `The minimum number of options is ${this.settings.minOptions} but got ${value.length}.`;
+      }
+      if (value.length > this.settings.maxOptions) {
+        return `The maximum number of options is ${this.settings.maxOptions} but got ${value.length}.`;
+      }
+      return true;
     }
-    return typeof conf == "object" ? conf : {};
-  } catch (e) {
-    if (e instanceof Error && (e.message.includes("overrides") || e.message.includes("Obsolete configuration format"))) {
-      throw e;
+    transform(value) {
+      return value;
     }
-    if (e instanceof Error && e.message.includes("Error parsing yaml")) {
-      const yamlError = e.cause instanceof Error ? e.cause.message : String(e.cause);
-      throw new Error(`❌ YAML syntax error in wmill.yaml:
-` + "   " + yamlError + `
-` + "   Please fix the YAML syntax in wmill.yaml or delete the file to start fresh.");
-    } else {
-      throw new Error(`❌ Failed to read wmill.yaml:
-` + "   " + (e instanceof Error ? e.message : String(e)) + `
-` + "   Please check file permissions or fix the syntax.");
+    format(value) {
+      return value.map((val) => this.settings.format?.(val) ?? this.getOptionByValue(val)?.name ?? String(val)).join(", ");
     }
+  };
+});
+
+// src/commands/workspace/merge.ts
+function triggerService(kind) {
+  switch (kind) {
+    case "http_trigger":
+      return {
+        exists: existsHttpTrigger,
+        get: getHttpTrigger,
+        create: createHttpTrigger,
+        update: updateHttpTrigger,
+        delete: deleteHttpTrigger
+      };
+    case "websocket_trigger":
+      return {
+        exists: existsWebsocketTrigger,
+        get: getWebsocketTrigger,
+        create: createWebsocketTrigger,
+        update: updateWebsocketTrigger,
+        delete: deleteWebsocketTrigger
+      };
+    case "kafka_trigger":
+      return {
+        exists: existsKafkaTrigger,
+        get: getKafkaTrigger,
+        create: createKafkaTrigger,
+        update: updateKafkaTrigger,
+        delete: deleteKafkaTrigger
+      };
+    case "nats_trigger":
+      return {
+        exists: existsNatsTrigger,
+        get: getNatsTrigger,
+        create: createNatsTrigger,
+        update: updateNatsTrigger,
+        delete: deleteNatsTrigger
+      };
+    case "postgres_trigger":
+      return {
+        exists: existsPostgresTrigger,
+        get: getPostgresTrigger,
+        create: createPostgresTrigger,
+        update: updatePostgresTrigger,
+        delete: deletePostgresTrigger
+      };
+    case "mqtt_trigger":
+      return {
+        exists: existsMqttTrigger,
+        get: getMqttTrigger,
+        create: createMqttTrigger,
+        update: updateMqttTrigger,
+        delete: deleteMqttTrigger
+      };
+    case "sqs_trigger":
+      return {
+        exists: existsSqsTrigger,
+        get: getSqsTrigger,
+        create: createSqsTrigger,
+        update: updateSqsTrigger,
+        delete: deleteSqsTrigger
+      };
+    case "gcp_trigger":
+      return {
+        exists: existsGcpTrigger,
+        get: getGcpTrigger,
+        create: createGcpTrigger,
+        update: updateGcpTrigger,
+        delete: deleteGcpTrigger
+      };
+    case "azure_trigger":
+      return {
+        exists: existsAzureTrigger,
+        get: getAzureTrigger,
+        create: createAzureTrigger,
+        update: updateAzureTrigger,
+        delete: deleteAzureTrigger
+      };
+    case "email_trigger":
+      return {
+        exists: existsEmailTrigger,
+        get: getEmailTrigger,
+        create: createEmailTrigger,
+        update: updateEmailTrigger,
+        delete: deleteEmailTrigger
+      };
   }
 }
-async function mergeConfigWithConfigFile(opts) {
-  const configFile = await readConfigFile();
-  return Object.assign(configFile ?? {}, opts);
+function preparePayload(kind, trigger, onBehalfOf) {
+  const preserve = onBehalfOf !== undefined;
+  const base = {
+    ...trigger,
+    permissioned_as: onBehalfOf,
+    preserve_permissioned_as: preserve
+  };
+  if (kind === "gcp_trigger") {
+    base.subscription_id = "";
+    base.subscription_mode = "create_update";
+    if (base.delivery_config) {
+      base.delivery_config = { ...base.delivery_config, audience: "" };
+    }
+    if (base.delivery_type === "push") {
+      base.base_endpoint = OpenAPI.BASE.replace(/\/api\/?$/, "");
+    } else {
+      base.base_endpoint = undefined;
+    }
+  }
+  return base;
 }
-async function validateBranchConfiguration(opts, workspaceNameOverride) {
-  if (opts.skipBranchValidation || workspaceNameOverride || !isGitRepository()) {
+async function mergeWorkspaces(opts) {
+  const workspace = await tryResolveBranchWorkspace(opts);
+  if (!workspace) {
+    throw new Error("Could not resolve workspace from branch name. Make sure you are in a git repo with 'workspaces' configured in wmill.yaml.");
+  }
+  const token = workspace.token;
+  if (!token) {
+    throw new Error("Not logged in. Please run 'wmill workspace add' first.");
+  }
+  const remote = workspace.remote;
+  setClient(token, remote.endsWith("/") ? remote.substring(0, remote.length - 1) : remote);
+  const forkWorkspaceId = workspace.workspaceId;
+  const userWorkspaces = await listUserWorkspaces();
+  const forkEntry = userWorkspaces.workspaces?.find((w) => w.id === forkWorkspaceId);
+  if (!forkEntry?.parent_workspace_id) {
+    throw new Error(`Workspace '${forkWorkspaceId}' is not a fork (no parent_workspace_id). ` + `You can only merge from a forked workspace.`);
+  }
+  const parentWorkspaceId = forkEntry.parent_workspace_id;
+  info(`Fork: ${colors.bold(forkWorkspaceId)} → Parent: ${colors.bold(parentWorkspaceId)}`);
+  info("Comparing workspaces...");
+  const comparison = await compareWorkspaces({
+    workspace: parentWorkspaceId,
+    targetWorkspaceId: forkWorkspaceId
+  });
+  if (comparison.skipped_comparison) {
+    info(colors.yellow("This fork was created before change tracking was available. " + "Use the UI or git-based merge instead."));
+    return;
+  }
+  const summary = comparison.summary;
+  if (summary.total_diffs === 0) {
+    info(colors.green("Everything is up to date. No differences found."));
     return;
   }
-  const config = await readConfigFile();
-  const { workspaces } = config;
-  const rawBranch = getCurrentGitBranch();
-  const originalBranchIfForked = getOriginalBranchForWorkspaceForks(rawBranch);
-  let currentBranch;
-  if (originalBranchIfForked) {
-    info(`Workspace fork detected from branch name \`${rawBranch}\`. Validating workspace configuration using original branch \`${originalBranchIfForked}\``);
-    currentBranch = originalBranchIfForked;
-  } else {
-    currentBranch = rawBranch;
-  }
-  if (!workspaces || getWorkspaceNames(workspaces).length === 0) {
-    warn(`⚠️  WARNING: In a Git repository, the 'workspaces' section is recommended in wmill.yaml.
-` + `   Consider adding a workspaces section to map workspace names to Windmill instances.
-` + "   Run 'wmill init' to recreate the configuration file with proper workspace setup.");
+  info("");
+  info(colors.bold("Comparison Summary:"));
+  const summaryRows = [];
+  if (summary.scripts_changed > 0)
+    summaryRows.push(["Scripts", String(summary.scripts_changed)]);
+  if (summary.flows_changed > 0)
+    summaryRows.push(["Flows", String(summary.flows_changed)]);
+  if (summary.apps_changed > 0)
+    summaryRows.push(["Apps", String(summary.apps_changed)]);
+  if (summary.resources_changed > 0)
+    summaryRows.push(["Resources", String(summary.resources_changed)]);
+  if (summary.variables_changed > 0)
+    summaryRows.push(["Variables", String(summary.variables_changed)]);
+  if (summary.resource_types_changed > 0)
+    summaryRows.push(["Resource Types", String(summary.resource_types_changed)]);
+  if (summary.folders_changed > 0)
+    summaryRows.push(["Folders", String(summary.folders_changed)]);
+  if (summary.schedules_changed > 0)
+    summaryRows.push(["Schedules", String(summary.schedules_changed)]);
+  if (summary.triggers_changed > 0)
+    summaryRows.push(["Triggers", String(summary.triggers_changed)]);
+  summaryRows.push(["Total", String(summary.total_diffs)]);
+  if (summary.conflicts > 0)
+    summaryRows.push([
+      colors.red("Conflicts"),
+      colors.red(String(summary.conflicts))
+    ]);
+  new Table2().header(["Type", "Changed"]).padding(2).border(true).body(summaryRows).render();
+  const diffs = comparison.diffs.filter((d) => d.has_changes !== false);
+  if (diffs.length === 0) {
+    info(colors.green("No effective changes to deploy."));
     return;
   }
-  const branchToWsNames = new Map;
-  for (const name of getWorkspaceNames(workspaces)) {
-    const entry = workspaces[name];
-    const branch = getEffectiveGitBranch(name, entry);
-    const existing = branchToWsNames.get(branch);
-    if (existing) {
-      existing.push(name);
+  info("");
+  info(colors.bold("Changed items:"));
+  new Table2().header(["#", "Kind", "Path", "Ahead", "Behind", "Conflict"]).padding(1).border(true).body(diffs.map((d, i) => {
+    const isConflict = d.ahead > 0 && d.behind > 0;
+    return [
+      String(i + 1),
+      d.kind,
+      d.path,
+      d.ahead > 0 ? colors.green(String(d.ahead)) : "0",
+      d.behind > 0 ? colors.yellow(String(d.behind)) : "0",
+      isConflict ? colors.red("YES") : ""
+    ];
+  })).render();
+  let direction;
+  if (opts.direction === "to-parent" || opts.direction === "to-fork") {
+    direction = opts.direction;
+  } else if (opts.direction) {
+    throw new Error(`Invalid direction '${opts.direction}'. Use 'to-parent' or 'to-fork'.`);
+  } else if (opts.yes) {
+    direction = "to-parent";
+  } else {
+    const { Select: Select2 } = await init_select().then(() => exports_select);
+    direction = await Select2.prompt({
+      message: "Deploy direction:",
+      options: [
+        {
+          name: `Deploy to parent (${parentWorkspaceId}) ← fork changes`,
+          value: "to-parent"
+        },
+        {
+          name: `Update fork (${forkWorkspaceId}) ← parent changes`,
+          value: "to-fork"
+        }
+      ]
+    });
+  }
+  info(`
+Direction: ${colors.bold(direction === "to-parent" ? `Fork → Parent (${parentWorkspaceId})` : `Parent → Fork (${forkWorkspaceId})`)}`);
+  const selectableDiffs = diffs.filter((d) => {
+    if (direction === "to-parent") {
+      return d.ahead > 0;
     } else {
-      branchToWsNames.set(branch, [name]);
+      return d.behind > 0;
     }
+  });
+  if (selectableDiffs.length === 0) {
+    info(colors.yellow(`No items to deploy in the '${direction}' direction.`));
+    return;
   }
-  for (const [branch, names] of branchToWsNames) {
-    if (names.length > 1) {
-      warn(`⚠️  WARNING: Multiple workspaces map to git branch '${branch}': ${names.join(", ")}.
-` + `   Only the first ('${names[0]}') will be used during auto-detection. Use --workspace to select explicitly.`);
-    }
+  let selectedDiffs = selectableDiffs;
+  if (opts.all) {
+    selectedDiffs = selectableDiffs;
+  } else if (opts.skipConflicts) {
+    selectedDiffs = selectableDiffs.filter((d) => !(d.ahead > 0 && d.behind > 0) && (!!opts.include || !isTriggerOrScheduleKind(d.kind)));
+  } else if (opts.yes && !opts.include && !opts.exclude) {
+    selectedDiffs = selectableDiffs.filter((d) => !isTriggerOrScheduleKind(d.kind) && (direction !== "to-fork" || !(d.ahead > 0 && d.behind > 0)));
+  } else if (!opts.yes) {
+    const { Checkbox: Checkbox2 } = await init_checkbox().then(() => exports_checkbox);
+    const defaultForToFork = direction === "to-fork";
+    const selectedValues = await Checkbox2.prompt({
+      message: `Select items to deploy (${selectableDiffs.length} available):`,
+      options: selectableDiffs.map((d) => {
+        const isConflict = d.ahead > 0 && d.behind > 0;
+        const isTriggerOrSchedule = isTriggerOrScheduleKind(d.kind);
+        const label = `${d.kind}:${d.path}${isConflict ? colors.red(" [CONFLICT]") : ""}`;
+        return {
+          name: label,
+          value: `${d.kind}:${d.path}`,
+          checked: !isTriggerOrSchedule && (defaultForToFork ? !isConflict : true)
+        };
+      })
+    });
+    selectedDiffs = selectableDiffs.filter((d) => selectedValues.includes(`${d.kind}:${d.path}`));
   }
-  if (currentBranch && !findWorkspaceByGitBranch(workspaces, currentBranch)) {
-    const wsNames = getWorkspaceNames(workspaces);
-    const availableInfo = wsNames.map((n) => {
-      const entry = workspaces[n];
-      const branch = getEffectiveGitBranch(n, entry);
-      return branch !== n ? `${n} (gitBranch: ${branch})` : n;
-    }).join(", ");
-    if (!!process.stdin.isTTY) {
-      info(`Current Git branch '${currentBranch}' does not match any workspace in the configuration.
-` + `Available workspaces: ${availableInfo}`);
-      const shouldCreate = opts.yes || await Confirm.prompt({
-        message: `Create empty workspace configuration for branch '${currentBranch}'?`,
-        default: true
-      });
-      if (shouldCreate) {
-        if (/[\/\\:*?"<>|.]/.test(currentBranch)) {
-          const sanitizedBranchName = currentBranch.replace(/[\/\\:*?"<>|.]/g, "_");
-          warn(`⚠️  WARNING: Branch name "${currentBranch}" contains filesystem-unsafe characters (/ \\ : * ? " < > | .).`);
-          warn(`   Branch-specific files will be saved with sanitized name: "${sanitizedBranchName}"`);
-          warn(`   Example: "file.variable.yaml" → "file.${sanitizedBranchName}.variable.yaml"`);
-        }
-        const currentConfig = await readConfigFile();
-        if (!currentConfig.workspaces) {
-          currentConfig.workspaces = {};
-        }
-        currentConfig.workspaces[currentBranch] = {};
-        await writeFile("wmill.yaml", import_yaml3.stringify(currentConfig), "utf-8");
-        info(`✅ Created empty workspace configuration for '${currentBranch}'`);
-      } else {
-        warn("⚠️  WARNING: Workspace creation cancelled. You can manually add a workspace to the 'workspaces' section in wmill.yaml or use 'wmill gitsync-settings pull' to pull configuration from an existing windmill workspace git-sync configuration.");
-        return;
-      }
-    } else {
-      if (/[\/\\:*?"<>|.]/.test(currentBranch)) {
-        const sanitizedBranchName = currentBranch.replace(/[\/\\:*?"<>|.]/g, "_");
-        warn(`⚠️  WARNING: Branch name "${currentBranch}" contains filesystem-unsafe characters (/ \\ : * ? " < > | .).`);
-        warn(`   Branch-specific files will use sanitized name: "${sanitizedBranchName}"`);
-      }
-      warn(`⚠️  WARNING: Current Git branch '${currentBranch}' does not match any workspace in the configuration.
-` + `   Consider adding a workspace entry for branch '${currentBranch}' in the 'workspaces' section of wmill.yaml.
-` + `   Available workspaces: ${availableInfo}`);
-      return;
-    }
+  if (opts.include) {
+    const includeSet = new Set(opts.include.split(",").map((s) => s.trim()));
+    selectedDiffs = selectedDiffs.filter((d) => includeSet.has(`${d.kind}:${d.path}`));
   }
-}
-async function getEffectiveSettings(config, promotion, skipBranchValidation, suppressLogs, workspaceNameOverride) {
-  const { workspaces, ...topLevelSettings } = config;
-  const effective = { ...topLevelSettings };
-  let resolvedWsName = null;
-  let resolvedWsEntry = null;
-  let originalBranchIfForked = null;
-  let rawGitBranch = null;
-  if (workspaceNameOverride) {
-    if (workspaces && workspaces[workspaceNameOverride]) {
-      resolvedWsName = workspaceNameOverride;
-      resolvedWsEntry = workspaces[workspaceNameOverride];
-    }
-  } else if (isGitRepository()) {
-    rawGitBranch = getCurrentGitBranch();
-    originalBranchIfForked = getOriginalBranchForWorkspaceForks(rawGitBranch);
-    const branch = originalBranchIfForked ?? rawGitBranch;
-    if (originalBranchIfForked) {
-      info(`Using overrides from original branch \`${originalBranchIfForked}\``);
+  if (opts.exclude) {
+    const excludeSet = new Set(opts.exclude.split(",").map((s) => s.trim()));
+    selectedDiffs = selectedDiffs.filter((d) => !excludeSet.has(`${d.kind}:${d.path}`));
+  }
+  if (selectedDiffs.length === 0) {
+    info(colors.yellow("No items selected for deployment."));
+    return;
+  }
+  const conflicts = selectedDiffs.filter((d) => d.ahead > 0 && d.behind > 0);
+  if (conflicts.length > 0) {
+    info(colors.yellow(`
+⚠ ${conflicts.length} conflicting item(s) will be deployed (source will overwrite target):`));
+    for (const c of conflicts) {
+      info(colors.yellow(`  - ${c.kind}:${c.path}`));
     }
-    if (branch) {
-      const match = findWorkspaceByGitBranch(workspaces, branch);
-      if (match) {
-        [resolvedWsName, resolvedWsEntry] = match;
+    if (!opts.yes) {
+      const { Confirm: Confirm2 } = await init_confirm().then(() => exports_confirm);
+      const proceed = await Confirm2.prompt("Proceed with deploying conflicting items?");
+      if (!proceed) {
+        info("Aborted.");
+        return;
       }
     }
-  } else {
-    debug("Not in a Git repository and no workspace override provided, using top-level settings");
   }
-  if (promotion && workspaces) {
-    const promotionMatch = findWorkspaceByGitBranch(workspaces, promotion);
-    if (promotionMatch) {
-      const [, targetWs] = promotionMatch;
-      if (targetWs.promotionOverrides) {
-        Object.assign(effective, targetWs.promotionOverrides);
-        if (!suppressLogs) {
-          info(`Applied promotion settings from workspace for branch: ${promotion}`);
-        }
-      } else if (targetWs.overrides) {
-        Object.assign(effective, targetWs.overrides);
-        if (!suppressLogs) {
-          info(`Applied settings from workspace for branch: ${promotion} (no promotionOverrides found)`);
-        }
-      } else {
-        debug(`No promotion or regular overrides found for '${promotion}', using top-level settings`);
+  info(`
+Deploying ${colors.bold(String(selectedDiffs.length))} item(s)...`);
+  const sorted = [...selectedDiffs].sort((a, b) => {
+    const aFolder = a.kind === "folder" ? 0 : 1;
+    const bFolder = b.kind === "folder" ? 0 : 1;
+    return aFolder - bFolder;
+  });
+  const workspaceFrom = direction === "to-parent" ? forkWorkspaceId : parentWorkspaceId;
+  const workspaceTo = direction === "to-parent" ? parentWorkspaceId : forkWorkspaceId;
+  let successCount = 0;
+  let failCount = 0;
+  for (const diff2 of sorted) {
+    const label = `${diff2.kind}:${diff2.path}`;
+    const itemDeletedInSource = direction === "to-parent" ? diff2.exists_in_fork === false : diff2.exists_in_source === false;
+    let result;
+    if (itemDeletedInSource) {
+      info(colors.yellow(`  ⌫ ${label} (removing from target)`));
+      result = await deleteItemInWorkspace(provider, diff2.kind, diff2.path, workspaceTo);
+    } else {
+      let onBehalfOf;
+      if (opts.preserveOnBehalfOf) {
+        onBehalfOf = await getOnBehalfOf(provider, diff2.kind, diff2.path, workspaceFrom);
       }
+      result = await deployItem(provider, diff2.kind, diff2.path, workspaceFrom, workspaceTo, onBehalfOf);
     }
-  } else if (resolvedWsEntry?.overrides) {
-    Object.assign(effective, resolvedWsEntry.overrides);
-    if (!suppressLogs) {
-      const extraLog = originalBranchIfForked ? ` (because it is the origin of the workspace fork branch \`${rawGitBranch}\`)` : "";
-      info(`Applied settings for workspace '${resolvedWsName}'${extraLog}`);
+    if (result.success) {
+      info(colors.green(`  ✓ ${label}`));
+      successCount++;
+    } else {
+      info(colors.red(`  ✗ ${label}: ${result.error}`));
+      failCount++;
     }
-  } else if (resolvedWsName) {
-    debug(`No overrides found for workspace '${resolvedWsName}', using top-level settings`);
   }
-  return effective;
-}
-function findWorkspaceByGitBranch(workspaces, branchName) {
-  if (!workspaces)
-    return;
-  for (const [name, entry] of Object.entries(workspaces)) {
-    if (RESERVED_WORKSPACE_KEYS.has(name))
-      continue;
-    const effectiveBranch = entry.gitBranch ?? name;
-    if (effectiveBranch === branchName) {
-      return [name, entry];
-    }
+  if (successCount > 0) {
+    try {
+      await resetDiffTally({
+        workspace: parentWorkspaceId,
+        forkWorkspaceId
+      });
+    } catch {}
+  }
+  info("");
+  if (failCount === 0) {
+    info(colors.green(`✅ Successfully deployed ${successCount} item(s) from ${workspaceFrom} to ${workspaceTo}.`));
+  } else {
+    info(colors.yellow(`Deployed ${successCount} item(s), ${colors.red(String(failCount) + " failed")} from ${workspaceFrom} to ${workspaceTo}.`));
   }
-  return;
-}
-function getEffectiveWorkspaceId(workspaceName, config) {
-  return config.workspaceId ?? workspaceName;
-}
-function getEffectiveGitBranch(workspaceName, config) {
-  return config.gitBranch ?? workspaceName;
-}
-function getWorkspaceNames(workspaces) {
-  if (!workspaces)
-    return [];
-  return Object.keys(workspaces).filter((k) => !RESERVED_WORKSPACE_KEYS.has(k));
 }
-function convertGitBranchesToWorkspaces(gitBranches) {
-  const workspaces = {};
-  for (const [key, value] of Object.entries(gitBranches)) {
-    if (key === "commonSpecificItems") {
-      workspaces.commonSpecificItems = value;
-      continue;
+var provider;
+var init_merge = __esm(async () => {
+  init_colors2();
+  init_mod6();
+  init_log();
+  init_client();
+  init_services_gen();
+  init_OpenAPI();
+  init_deploy();
+  await init_context();
+  provider = {
+    existsFlowByPath,
+    existsScriptByPath,
+    existsApp,
+    existsVariable,
+    existsResource,
+    existsResourceType,
+    existsFolder,
+    getFlowByPath,
+    createFlow,
+    updateFlow,
+    archiveFlowByPath,
+    getScriptByPath,
+    createScript,
+    archiveScriptByPath,
+    getAppByPath,
+    createApp,
+    updateApp,
+    createAppRaw,
+    updateAppRaw,
+    getPublicSecretOfLatestVersionOfApp,
+    getRawAppData,
+    deleteApp,
+    getVariable,
+    createVariable,
+    updateVariable,
+    deleteVariable,
+    getResource,
+    createResource,
+    updateResource,
+    deleteResource,
+    getResourceType,
+    createResourceType,
+    updateResourceType,
+    deleteResourceType,
+    getFolder,
+    createFolder,
+    updateFolder,
+    deleteFolder,
+    existsTriggerByKind: (kind, p) => triggerService(kind).exists(p),
+    getTriggerForDeploy: async (kind, p) => {
+      const trigger = await triggerService(kind).get({
+        workspace: p.workspace,
+        path: p.path
+      });
+      return preparePayload(kind, trigger, p.onBehalfOf);
+    },
+    createTriggerByKind: (kind, p) => triggerService(kind).create(p),
+    updateTriggerByKind: (kind, p) => triggerService(kind).update(p),
+    deleteTriggerByKind: (kind, p) => triggerService(kind).delete(p),
+    getTriggerValue: (kind, p) => triggerService(kind).get(p),
+    getTriggerPermissionedAs: async (kind, p) => {
+      const trigger = await triggerService(kind).get(p);
+      return trigger?.permissioned_as;
+    },
+    existsSchedule,
+    getSchedule,
+    createSchedule,
+    updateSchedule,
+    deleteSchedule
+  };
+});
+
+// src/commands/workspace/slack.ts
+async function connectSlack2(opts) {
+  await requireLogin(opts);
+  const workspace = await resolveWorkspace(opts);
+  await connectSlack({
+    workspace: workspace.workspaceId,
+    requestBody: {
+      bot_token: opts.botToken,
+      team_id: opts.teamId,
+      team_name: opts.teamName
     }
-    workspaces[key] = { ...value };
-  }
-  return workspaces;
+  });
+  info(colors.bold.underline.green(`Slack connected to workspace ${workspace.workspaceId} (team ${opts.teamName} / ${opts.teamId})`));
 }
-var import_yaml3, showDiffs = false, SUPPORTED_SYNC_BEHAVIOR_VERSION = 1, GLOBAL_CONFIG_OPT, legacyConfigWarned = false, DEFAULT_SYNC_OPTIONS, RESERVED_WORKSPACE_KEYS;
-var init_conf = __esm(async () => {
+async function disconnectSlack2(opts) {
+  await requireLogin(opts);
+  const workspace = await resolveWorkspace(opts);
+  await disconnectSlack({ workspace: workspace.workspaceId });
+  info(colors.bold.underline.green(`Slack disconnected from workspace ${workspace.workspaceId} (slack_team_id / slack_name cleared). ` + `To also remove the bot token variable/resource/folder/group, delete the corresponding files from the local sync folder and run 'wmill sync push'. ` + `To remove the workspace-level OAuth override (if any), set slack_oauth_client_id/_secret to '' in settings.yaml and push.`));
+}
+var init_slack = __esm(async () => {
+  init_colors2();
   init_log();
-  init_git();
+  init_services_gen();
   await __promiseAll([
-    init_yaml(),
-    init_confirm(),
-    init_resource_folders()
+    init_auth(),
+    init_context()
   ]);
-  import_yaml3 = __toESM(require_dist(), 1);
-  GLOBAL_CONFIG_OPT = { noCdToRoot: false };
-  DEFAULT_SYNC_OPTIONS = {
-    defaultTs: "bun",
-    includes: ["f/**"],
-    excludes: [],
-    codebases: [],
-    skipVariables: false,
-    skipResources: false,
-    skipResourceTypes: false,
-    skipSecrets: true,
-    skipScripts: false,
-    skipFlows: false,
-    skipApps: false,
-    skipFolders: false,
-    includeSchedules: false,
-    includeTriggers: false,
-    includeUsers: false,
-    includeGroups: false,
-    includeSettings: false,
-    includeKey: false,
-    skipWorkspaceDependencies: false,
-    nonDottedPaths: false,
-    syncBehavior: "v1"
-  };
-  RESERVED_WORKSPACE_KEYS = new Set(["commonSpecificItems"]);
 });
 
 // src/utils/resource_types.ts
@@ -27517,7 +27661,7 @@ __export(exports_resource_type, {
 import { writeFileSync } from "node:fs";
 import { stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
 import path3 from "node:path";
-import process10 from "node:process";
+import process11 from "node:process";
 async function pushResourceType(workspace, remotePath, resource, localResource) {
   remotePath = removeType(remotePath, "resource-type");
   try {
@@ -27637,7 +27781,7 @@ async function generateRTNamespace(opts) {
 `);
   namespaceContent += `
 }`;
-  writeFileSync(path3.join(process10.cwd(), "rt.d.ts"), namespaceContent);
+  writeFileSync(path3.join(process11.cwd(), "rt.d.ts"), namespaceContent);
   info(colors.green("Created rt.d.ts with resource types namespace (RT) for TypeScript."));
 }
 var import_yaml4, command, resource_type_default;
@@ -27673,7 +27817,7 @@ __export(exports_workspace, {
   add: () => add
 });
 import { writeFile as writeFile3, open as fsOpen } from "node:fs/promises";
-import process11 from "node:process";
+import process12 from "node:process";
 async function allWorkspaces(configDirOverride) {
   try {
     const file = await getWorkspaceConfigFilePath(configDirOverride);
@@ -27785,7 +27929,7 @@ async function add(opts, workspaceName, workspaceId, remote) {
   }
   remote = new URL(remote).toString();
   let token = await tryGetLoginInfo(opts);
-  if (!token && !(process11.stdin.isTTY ?? false)) {
+  if (!token && !(process12.stdin.isTTY ?? false)) {
     info("Not a TTY, can't login interactively. Pass the token in --token");
     return;
   }
@@ -27827,7 +27971,7 @@ async function add(opts, workspaceName, workspaceId, remote) {
         info(`- ${workspace.id} (name: ${workspace.name})`);
       }
     }
-    process11.exit(1);
+    process12.exit(1);
   }
   const added = await addWorkspace({
     name: workspaceName,
@@ -27844,7 +27988,7 @@ async function add(opts, workspaceName, workspaceId, remote) {
 async function addWorkspace(workspace, opts) {
   workspace.remote = new URL(workspace.remote).toString();
   const existingWorkspaces = await allWorkspaces(opts.configDir);
-  const isInteractive = (process11.stdin.isTTY ?? false) && (process11.stdout.isTTY ?? false) && !opts.force;
+  const isInteractive = (process12.stdin.isTTY ?? false) && (process12.stdout.isTTY ?? false) && !opts.force;
   const nameConflict = existingWorkspaces.find((w) => w.name === workspace.name);
   if (nameConflict) {
     if (nameConflict.remote === workspace.remote && nameConflict.workspaceId === workspace.workspaceId) {
@@ -28020,7 +28164,7 @@ async function bind(opts, doBind) {
   if (!config.workspaces) {
     config.workspaces = {};
   }
-  const isInteractive = !!process11.stdin.isTTY;
+  const isInteractive = !!process12.stdin.isTTY;
   const inGitRepo = isGitRepository2();
   const currentBranch = inGitRepo ? getCurrentGitBranch2() : null;
   if (doBind) {
@@ -28175,7 +28319,7 @@ var init_workspace = __esm(async () => {
   ]);
   command2 = new Command().alias("profile").description("workspace related commands").action(list3).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
     default: "admin"
-  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list3).command("list-remote").description("List workspaces on the remote server that you have access to").option("--as-superadmin", "List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Create or update a workspace entry in wmill.yaml from the active profile").option("--workspace <name:string>", "Workspace name (default: current branch or workspaceId)").option("--branch <branch:string>", "Git branch to associate (default: workspace name)").action((opts) => bind(opts, true)).command("unbind").description("Remove baseUrl and workspaceId from a workspace entry").option("--workspace <name:string>", "Workspace to unbind").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--color <color:string>", "Workspace color (hex code, e.g. #ff0000)").option("--datatable-behavior <behavior:string>", "How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)").option("-y --yes", "Skip interactive prompts (defaults datatable behavior to 'skip')").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork).command("merge").description("Compare and deploy changes between a fork and its parent workspace").option("--direction <direction:string>", "Deploy direction: to-parent or to-fork").option("--all", "Deploy all changed items including conflicts").option("--skip-conflicts", "Skip items modified in both workspaces").option("--include <items:string>", "Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)").option("--exclude <items:string>", "Comma-separated kind:path items to exclude").option("--preserve-on-behalf-of", "Preserve original on_behalf_of/permissioned_as values").option("-y --yes", "Non-interactive mode (deploy without prompts)").action(mergeWorkspaces).command("connect-slack").description("Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).action(connectSlack2).command("disconnect-slack").description("Clear slack_team_id / slack_name on the active workspace (marks the workspace as disconnected). Does NOT remove the bot token variable/resource/folder/group — delete those from the local sync folder and run 'wmill sync push' to tear them down. Does NOT remove the workspace-level OAuth override — set slack_oauth_client_id/_secret to '' in settings.yaml and push.").action(disconnectSlack2);
+  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list3).command("list-remote").description("List workspaces on the remote server that you have access to").option("--as-superadmin", "List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Create or update a workspace entry in wmill.yaml from the active profile").option("--workspace <name:string>", "Workspace name (default: current branch or workspaceId)").option("--branch <branch:string>", "Git branch to associate (default: workspace name)").action((opts) => bind(opts, true)).command("unbind").description("Remove baseUrl and workspaceId from a workspace entry").option("--workspace <name:string>", "Workspace to unbind").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--color <color:string>", "Workspace color (hex code, e.g. #ff0000)").option("--datatable-behavior <behavior:string>", "How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)").option("--from-branch <branch:string>", "Non-interactive override for the 'turn my current working branch into the fork' workflow: base the fork on <branch> (its bound workspace is the parent) and rename the current branch onto wm-fork/<branch>/<id>. Usually unneeded — from a working branch `wmill workspace fork` offers this interactively; from a base branch it creates a fresh fork branch.").option("-y --yes", "Skip interactive prompts (defaults datatable behavior to 'skip'). On a non-base branch, requires --from-branch since the base branch can't be prompted for.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork).command("merge").description("Compare and deploy changes between a fork and its parent workspace").option("--direction <direction:string>", "Deploy direction: to-parent or to-fork").option("--all", "Deploy all changed items including conflicts").option("--skip-conflicts", "Skip items modified in both workspaces").option("--include <items:string>", "Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)").option("--exclude <items:string>", "Comma-separated kind:path items to exclude").option("--preserve-on-behalf-of", "Preserve original on_behalf_of/permissioned_as values").option("-y --yes", "Non-interactive mode (deploy without prompts)").action(mergeWorkspaces).command("connect-slack").description("Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).action(connectSlack2).command("disconnect-slack").description("Clear slack_team_id / slack_name on the active workspace (marks the workspace as disconnected). Does NOT remove the bot token variable/resource/folder/group — delete those from the local sync folder and run 'wmill sync push' to tear them down. Does NOT remove the workspace-level OAuth override — set slack_oauth_client_id/_secret to '' in settings.yaml and push.").action(disconnectSlack2);
   workspace_default = command2;
 });
 
@@ -33798,7 +33942,7 @@ var init_wrapper = __esm(() => {
 // src/commands/app/bundle.ts
 import * as fs7 from "node:fs";
 import * as path4 from "node:path";
-import process12 from "node:process";
+import process13 from "node:process";
 import { spawn } from "node:child_process";
 function detectFrameworks(appDir) {
   const packageJsonPath = path4.join(appDir, "package.json");
@@ -33826,7 +33970,7 @@ function createSveltePlugin(appDir) {
       build.onLoad({ filter: /\.svelte$/ }, async (args) => {
         const svelte = await import("svelte/compiler");
         const source = await readTextFile(args.path);
-        const filename = path4.relative(process12.cwd(), args.path);
+        const filename = path4.relative(process13.cwd(), args.path);
         const convertMessage = ({ message, start, end }) => {
           let location;
           if (start && end) {
@@ -33867,7 +34011,7 @@ async function createFrameworkPlugins(appDir) {
   return plugins;
 }
 async function ensureNodeModules(appDir) {
-  const targetDir = appDir ?? process12.cwd();
+  const targetDir = appDir ?? process13.cwd();
   const nodeModulesPath = path4.join(targetDir, "node_modules");
   if (!fs7.existsSync(nodeModulesPath)) {
     info(colors.yellow("\uD83D\uDCE6 node_modules not found, running npm install..."));
@@ -33888,7 +34032,7 @@ async function ensureNodeModules(appDir) {
 }
 async function createBundle(options = {}) {
   const esbuild = await import("esbuild");
-  const appDir = options.entryPoint ? path4.dirname(options.entryPoint) : process12.cwd();
+  const appDir = options.entryPoint ? path4.dirname(options.entryPoint) : process13.cwd();
   const frameworks = detectFrameworks(appDir);
   const defaultEntry = frameworks.svelte || frameworks.vue ? "index.ts" : "index.tsx";
   const entryPoint = options.entryPoint ?? defaultEntry;
@@ -33901,7 +34045,7 @@ async function createBundle(options = {}) {
   }
   await ensureNodeModules(appDir);
   const frameworkPlugins = await createFrameworkPlugins(appDir);
-  const distDir = path4.join(process12.cwd(), outDir);
+  const distDir = path4.join(process13.cwd(), outDir);
   if (!fs7.existsSync(distDir)) {
     fs7.mkdirSync(distDir, { recursive: true });
   }
@@ -33977,8 +34121,8 @@ async function createBundle(options = {}) {
       throw new Error("Build failed with errors");
     }
     info(colors.green("✅ Bundle created successfully"));
-    const jsPath = path4.join(process12.cwd(), outfile);
-    const cssPath = path4.join(process12.cwd(), outDir, "bundle.css");
+    const jsPath = path4.join(process13.cwd(), outfile);
+    const cssPath = path4.join(process13.cwd(), outDir, "bundle.css");
     if (!fs7.existsSync(jsPath)) {
       throw new Error(`Expected JS bundle at ${jsPath} but file not found`);
     }
@@ -64780,7 +64924,7 @@ var init_script = __esm(async () => {
 
 // src/commands/lint/lint.ts
 import { stat as stat5, readdir as readdir2 } from "node:fs/promises";
-import process13 from "node:process";
+import process14 from "node:process";
 import * as path8 from "node:path";
 import { sep as SEP7 } from "node:path";
 function normalizePath(p) {
@@ -65014,8 +65158,8 @@ async function checkRawAppRunnables(backendDir, rawAppYamlPath, defaultTs) {
   return issues;
 }
 async function checkMissingLocks(opts, directory) {
-  const initialCwd = process13.cwd();
-  const targetDirectory = directory ? path8.resolve(initialCwd, directory) : process13.cwd();
+  const initialCwd = process14.cwd();
+  const targetDirectory = directory ? path8.resolve(initialCwd, directory) : process14.cwd();
   const { ...syncOpts } = opts;
   const mergedOpts = await mergeConfigWithConfigFile(syncOpts);
   const ignore = await ignoreF(mergedOpts);
@@ -65151,11 +65295,11 @@ async function checkMissingLocks(opts, directory) {
   return issues;
 }
 async function runLint(opts, directory) {
-  const initialCwd = process13.cwd();
+  const initialCwd = process14.cwd();
   const explicitTargetDirectory = directory ? path8.resolve(initialCwd, directory) : undefined;
   const { json: _json, ...syncOpts } = opts;
   const mergedOpts = await mergeConfigWithConfigFile(syncOpts);
-  const targetDirectory = explicitTargetDirectory ?? process13.cwd();
+  const targetDirectory = explicitTargetDirectory ?? process14.cwd();
   const stats = await stat5(targetDirectory).catch(() => null);
   if (!stats) {
     throw new Error(`Directory not found: ${targetDirectory}`);
@@ -65270,7 +65414,7 @@ async function lint(opts, directory) {
     const report = await runLint(opts, directory);
     printReport(report, !!opts.json);
     if (report.exitCode !== 0) {
-      process13.exit(report.exitCode);
+      process14.exit(report.exitCode);
     }
   } catch (error2) {
     const message = error2 instanceof Error ? error2.message : String(error2);
@@ -65283,17 +65427,17 @@ async function lint(opts, directory) {
     } else {
       error(colors.red(`❌ ${message}`));
     }
-    process13.exit(1);
+    process14.exit(1);
   }
 }
 async function lintWatch(opts, directory) {
   const { watch } = await import("node:fs");
-  const targetDir = directory ? path8.resolve(process13.cwd(), directory) : process13.cwd();
+  const targetDir = directory ? path8.resolve(process14.cwd(), directory) : process14.cwd();
   info(colors.blue(`Watching ${targetDir} for changes... (Ctrl+C to stop)`));
   async function runAndReport() {
     try {
       const report = await runLint(opts, directory);
-      process13.stdout.write("\x1Bc");
+      process14.stdout.write("\x1Bc");
       info(colors.gray(`[${new Date().toLocaleTimeString()}] Lint results:
 `));
       printReport(report, false);
@@ -70757,7 +70901,7 @@ var init_app_metadata = __esm(async () => {
 import * as fs10 from "node:fs";
 import { writeFile as writeFile9 } from "node:fs/promises";
 import path14 from "node:path";
-import process14 from "node:process";
+import process15 from "node:process";
 function generateDatatablesMarkdown(schemas, localData) {
   const defaultDatatable = localData?.datatable;
   const defaultSchema = localData?.schema;
@@ -70905,7 +71049,7 @@ async function regenerateAgentDocs(workspaceId, targetDir, silent = false) {
   }
 }
 async function generateAgents(opts, appFolder) {
-  const cwd = process14.cwd();
+  const cwd = process15.cwd();
   let targetDir = cwd;
   if (appFolder) {
     targetDir = path14.isAbsolute(appFolder) ? appFolder : path14.join(cwd, appFolder);
@@ -70916,13 +71060,13 @@ async function generateAgents(opts, appFolder) {
     if (!hasFolderSuffix(path14.basename(cwd), "raw_app") && !appFolder) {
       error(colors.red(`Error: Must be run inside a ${getFolderSuffix("raw_app")} folder or specify one as argument.`));
       info(colors.gray("Usage: wmill app generate-agents [app_folder]"));
-      process14.exit(1);
+      process15.exit(1);
     }
   }
   const rawAppPath = path14.join(targetDir, "raw_app.yaml");
   if (!fs10.existsSync(rawAppPath)) {
     error(colors.red(`Error: raw_app.yaml not found in ${targetDir}`));
-    process14.exit(1);
+    process15.exit(1);
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
@@ -70950,18 +71094,18 @@ import { sep as SEP13 } from "node:path";
 import * as http2 from "node:http";
 import * as fs11 from "node:fs";
 import * as path15 from "node:path";
-import process15 from "node:process";
+import process16 from "node:process";
 import { writeFileSync as writeFileSync5 } from "node:fs";
 async function dev(opts, appFolder) {
   GLOBAL_CONFIG_OPT.noCdToRoot = true;
   await loadNonDottedPathsSetting();
-  const originalCwd = process15.cwd();
+  const originalCwd = process16.cwd();
   let targetDir = originalCwd;
   if (appFolder) {
     targetDir = path15.isAbsolute(appFolder) ? appFolder : path15.join(originalCwd, appFolder);
     if (!fs11.existsSync(targetDir)) {
       error(colors.red(`Error: Directory not found: ${targetDir}`));
-      process15.exit(1);
+      process16.exit(1);
     }
   }
   const targetDirName = path15.basename(targetDir);
@@ -70969,13 +71113,13 @@ async function dev(opts, appFolder) {
     error(colors.red(`Error: The dev command must be run inside a ${getFolderSuffix("raw_app")} folder.
 ` + `Target directory: ${targetDirName}
 ` + `Please navigate to a folder ending with '${getFolderSuffix("raw_app")}' or specify one as argument.`));
-    process15.exit(1);
+    process16.exit(1);
   }
   const rawAppPath = path15.join(targetDir, "raw_app.yaml");
   if (!fs11.existsSync(rawAppPath)) {
     error(colors.red(`Error: raw_app.yaml not found in ${targetDir}.
 ` + `The dev command requires a ${getFolderSuffix("raw_app")} folder containing a raw_app.yaml file.`));
-    process15.exit(1);
+    process16.exit(1);
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
@@ -70988,20 +71132,20 @@ async function dev(opts, appFolder) {
     const mergedOpts = await mergeConfigWithConfigFile(opts);
     const codebases = await listSyncCodebases(mergedOpts);
     const { buildPreviewTempScriptRefs: buildPreviewTempScriptRefs2 } = await init_generate_metadata().then(() => exports_generate_metadata);
-    const savedCwd = process15.cwd();
+    const savedCwd = process16.cwd();
     if (workspaceRoot !== savedCwd) {
-      process15.chdir(workspaceRoot);
+      process16.chdir(workspaceRoot);
     }
     try {
       appTempRefs = await buildPreviewTempScriptRefs2(workspace, mergedOpts, codebases, { kind: "app", folder: relAppFolder, rawApp: true });
     } finally {
       if (workspaceRoot !== savedCwd) {
-        process15.chdir(savedCwd);
+        process16.chdir(savedCwd);
       }
     }
   }
   if (appFolder) {
-    process15.chdir(targetDir);
+    process16.chdir(targetDir);
   }
   const rawApp = await yamlParseFile(rawAppPath);
   const appPath = rawApp?.custom_path ?? "u/unknown/newapp";
@@ -71015,30 +71159,30 @@ async function dev(opts, appFolder) {
     port: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10].map((p) => p + DEFAULT_PORT)
   });
   const shouldOpen = opts.open ?? true;
-  const frameworks = detectFrameworks(process15.cwd());
+  const frameworks = detectFrameworks(process16.cwd());
   const defaultEntry = frameworks.svelte || frameworks.vue ? "index.ts" : "index.tsx";
   const entryPoint = opts.entry ?? defaultEntry;
   if (!fs11.existsSync(entryPoint)) {
     error(colors.red(`Entry point "${entryPoint}" not found. Please specify a valid entry point with --entry.`));
-    process15.exit(1);
+    process16.exit(1);
   }
-  const appDir = path15.dirname(entryPoint) || process15.cwd();
+  const appDir = path15.dirname(entryPoint) || process16.cwd();
   await ensureNodeModules(appDir);
   const inferredSchemas = {};
   try {
-    Object.assign(inferredSchemas, await inferAllInlineSchemas(process15.cwd()));
+    Object.assign(inferredSchemas, await inferAllInlineSchemas(process16.cwd()));
   } catch (err) {
     warn(colors.yellow(`Could not seed inline schemas at startup: ${err.message}`));
   }
   const pathRunnableSchemas = {};
   try {
-    const initialRunnables = await loadRunnablesFromBackend(path15.join(process15.cwd(), APP_BACKEND_FOLDER));
+    const initialRunnables = await loadRunnablesFromBackend(path15.join(process16.cwd(), APP_BACKEND_FOLDER));
     Object.assign(pathRunnableSchemas, await fetchPathRunnableSchemas(workspaceId, initialRunnables));
   } catch (err) {
     warn(colors.yellow(`Could not fetch schemas for path-based runnables: ${err.message}`));
   }
   await genRunnablesTs(inferredSchemas, pathRunnableSchemas);
-  const distDir = path15.join(process15.cwd(), "dist");
+  const distDir = path15.join(process16.cwd(), "dist");
   if (!fs11.existsSync(distDir)) {
     fs11.mkdirSync(distDir);
   }
@@ -71101,7 +71245,7 @@ data: reload
   info(colors.blue(`\uD83D\uDC40 Watching for file changes...
 `));
   await ctx.rebuild();
-  const runnablesPath = path15.join(process15.cwd(), APP_BACKEND_FOLDER);
+  const runnablesPath = path15.join(process16.cwd(), APP_BACKEND_FOLDER);
   let runnablesWatcher;
   if (fs11.existsSync(runnablesPath)) {
     info(colors.blue(`\uD83D\uDC41️  Watching runnables folder at: ${runnablesPath}
@@ -71114,7 +71258,7 @@ data: reload
         return;
       const fileStr = typeof filename === "string" ? filename : filename.toString();
       const changedPath = path15.join(runnablesPath, fileStr);
-      const relativePath = path15.relative(process15.cwd(), changedPath);
+      const relativePath = path15.relative(process16.cwd(), changedPath);
       const relativeToRunnables = fileStr;
       if (changedPath.endsWith(".lock")) {
         return;
@@ -71127,7 +71271,7 @@ data: reload
         delete schemaInferenceTimeouts[changedPath];
         try {
           info(colors.cyan(`\uD83D\uDCDD Inferring schema for: ${relativeToRunnables}`));
-          const result = await inferRunnableSchemaFromFile(process15.cwd(), relativeToRunnables);
+          const result = await inferRunnableSchemaFromFile(process16.cwd(), relativeToRunnables);
           if (result) {
             inferredSchemas[result.runnableId] = result.schema;
             info(colors.green(`  Inferred Schemas: ${JSON.stringify(inferredSchemas, null, 2)}`));
@@ -71165,7 +71309,7 @@ data: reload
       return;
     }
     if (url === "/dist/bundle.js" || url === "/bundle.js") {
-      const jsPath = path15.join(process15.cwd(), "dist/bundle.js");
+      const jsPath = path15.join(process16.cwd(), "dist/bundle.js");
       if (fs11.existsSync(jsPath)) {
         res.writeHead(200, { "Content-Type": "application/javascript" });
         res.end(fs11.readFileSync(jsPath));
@@ -71176,7 +71320,7 @@ data: reload
       return;
     }
     if (url === "/dist/bundle.css" || url === "/bundle.css") {
-      const cssPath = path15.join(process15.cwd(), "dist/bundle.css");
+      const cssPath = path15.join(process16.cwd(), "dist/bundle.css");
       if (fs11.existsSync(cssPath)) {
         res.writeHead(200, { "Content-Type": "text/css" });
         res.end(fs11.readFileSync(cssPath));
@@ -71187,7 +71331,7 @@ data: reload
       return;
     }
     if (url === "/dist/bundle.js.map" || url === "/bundle.js.map") {
-      const mapPath = path15.join(process15.cwd(), "dist/bundle.js.map");
+      const mapPath = path15.join(process16.cwd(), "dist/bundle.js.map");
       if (fs11.existsSync(mapPath)) {
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(fs11.readFileSync(mapPath));
@@ -71198,7 +71342,7 @@ data: reload
       return;
     }
     if (url === "/dist/bundle.css.map" || url === "/bundle.css.map") {
-      const mapPath = path15.join(process15.cwd(), "dist/bundle.css.map");
+      const mapPath = path15.join(process16.cwd(), "dist/bundle.css.map");
       if (fs11.existsSync(mapPath)) {
         res.writeHead(200, { "Content-Type": "application/json" });
         res.end(fs11.readFileSync(mapPath));
@@ -71212,12 +71356,12 @@ data: reload
     res.end(createHTML("/dist/bundle.js", "/dist/bundle.css"));
   });
   const wss = new import_websocket_server.default({ server });
-  const sqlToApplyPath = path15.join(process15.cwd(), "sql_to_apply");
+  const sqlToApplyPath = path15.join(process16.cwd(), "sql_to_apply");
   const sqlFileQueue = [];
   let currentSqlFile = null;
   async function getDatatableConfig() {
     try {
-      const rawApp2 = await yamlParseFile(path15.join(process15.cwd(), "raw_app.yaml"));
+      const rawApp2 = await yamlParseFile(path15.join(process16.cwd(), "raw_app.yaml"));
       return rawApp2?.data?.datatable;
     } catch {
       return;
@@ -71436,7 +71580,7 @@ data: reload
                 await onSqlFileCompleted(currentSqlFile, true);
               }
               try {
-                await regenerateAgentDocs(workspaceId, process15.cwd(), true);
+                await regenerateAgentDocs(workspaceId, process16.cwd(), true);
                 info(colors.gray(`[SQL Migration] Refreshed AGENTS.md and DATATABLES.md`));
               } catch (regenError) {
                 warn(colors.yellow(`[SQL Migration] Could not refresh docs: ${regenError.message}`));
@@ -71535,7 +71679,7 @@ data: reload
     const url = `http://${host}:${port}`;
     info(colors.bold.green(`\uD83D\uDE80 Dev server running at ${url}`));
     info(colors.cyan(`\uD83D\uDD0C WebSocket server running at ws://${host}:${port}`));
-    info(colors.gray(`\uD83D\uDCE6 Serving files from: ${process15.cwd()}`));
+    info(colors.gray(`\uD83D\uDCE6 Serving files from: ${process16.cwd()}`));
     info(colors.gray(`\uD83D\uDD04 Live reload enabled
 `));
     if (shouldOpen) {
@@ -71549,7 +71693,7 @@ data: reload
       }
     }
   });
-  process15.on("SIGINT", async () => {
+  process16.on("SIGINT", async () => {
     info(colors.yellow(`
 
 \uD83D\uDED1 Shutting down...`));
@@ -71562,12 +71706,12 @@ data: reload
       sqlWatcher.close();
     }
     await ctx.dispose();
-    process15.exit(0);
+    process16.exit(0);
   });
 }
 async function genRunnablesTs(inlineSchemaOverrides = {}, pathSchemaOverrides = {}) {
   info(colors.blue("\uD83D\uDD04 Generating wmill.d.ts..."));
-  const localPath = process15.cwd();
+  const localPath = process16.cwd();
   const backendPath = path15.join(localPath, APP_BACKEND_FOLDER);
   let runnables = await loadRunnablesFromBackend(backendPath);
   if (Object.keys(runnables).length === 0) {
@@ -71580,7 +71724,7 @@ async function genRunnablesTs(inlineSchemaOverrides = {}, pathSchemaOverrides =
   }
   try {
     const newWmillTs = buildWmillTs(runnables, inlineSchemaOverrides, pathSchemaOverrides);
-    writeFileSync5(path15.join(process15.cwd(), "wmill.d.ts"), newWmillTs);
+    writeFileSync5(path15.join(process16.cwd(), "wmill.d.ts"), newWmillTs);
   } catch (error2) {
     error(colors.red(`Failed to generate wmill.d.ts: ${error2.message}`));
   }
@@ -71649,7 +71793,7 @@ function convertRunnablesToApiFormat(runnables) {
 }
 async function loadRunnables() {
   try {
-    const localPath = process15.cwd();
+    const localPath = process16.cwd();
     const backendPath = path15.join(localPath, APP_BACKEND_FOLDER);
     let runnables = await loadRunnablesFromBackend(backendPath);
     if (Object.keys(runnables).length === 0) {
@@ -72158,7 +72302,7 @@ var init_dev = __esm(async () => {
 // src/commands/app/lint.ts
 import * as fs12 from "node:fs";
 import * as path16 from "node:path";
-import process16 from "node:process";
+import process17 from "node:process";
 function validateRawAppYaml(appData) {
   const errors = [];
   const warnings = [];
@@ -72254,7 +72398,7 @@ async function lintRawApp(appDir, opts) {
 }
 async function lint2(opts, appFolder) {
   await loadNonDottedPathsSetting();
-  const targetDir = appFolder ?? process16.cwd();
+  const targetDir = appFolder ?? process17.cwd();
   info(colors.bold.blue(`
 \uD83D\uDD0D Linting raw app: ${targetDir}
 `));
@@ -72275,7 +72419,7 @@ async function lint2(opts, appFolder) {
     info(colors.red(`
 ❌ Lint failed
 `));
-    process16.exit(1);
+    process17.exit(1);
   }
   info(colors.green(`
 ✅ All checks passed
@@ -73948,7 +74092,7 @@ async function decrypt(combinedCiphertext, keyString) {
 var init_local_encryption = () => {};
 
 // src/core/settings.ts
-import process17 from "node:process";
+import process18 from "node:process";
 import { writeFile as writeFile14 } from "node:fs/promises";
 function migrateToGroupedFormat(settings) {
   const result = { name: settings.name ?? "" };
@@ -74252,7 +74396,7 @@ async function pushWorkspaceKey(workspace, _path, key, localKey, opts) {
   }
   if (localKey && key !== localKey) {
     let reencrypt;
-    const explicitSkip = opts?.skipReencrypt || (process17.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? "").toLowerCase() === "true";
+    const explicitSkip = opts?.skipReencrypt || (process18.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? "").toLowerCase() === "true";
     if (explicitSkip) {
       reencrypt = false;
       info("Workspace encryption key changed; leaving remote ciphertexts untouched (skip re-encryption requested).");
@@ -74291,7 +74435,7 @@ async function readInstanceSettings(opts) {
   return localSettings;
 }
 async function processInstanceSettings(settings, mode) {
-  const encKey = process17.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;
+  const encKey = process18.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;
   if (encKey) {
     const res = [];
     for (const s of settings) {
@@ -77236,7 +77380,7 @@ class GitSyncSettingsConverter {
 }
 
 // src/commands/gitsync-settings/legacySettings.ts
-import process18 from "node:process";
+import process19 from "node:process";
 async function handleLegacyRepositoryMigration(selectedRepo, gitSyncSettings, workspace, opts, operationName = "operation") {
   if (selectedRepo.settings) {
     return selectedRepo;
@@ -77246,7 +77390,7 @@ async function handleLegacyRepositoryMigration(selectedRepo, gitSyncSettings, wo
   }
   const workspaceIncludePath = gitSyncSettings.include_path;
   const workspaceIncludeType = gitSyncSettings.include_type;
-  if (!!process18.stdout.isTTY && !opts.yes) {
+  if (!!process19.stdout.isTTY && !opts.yes) {
     console.log(colors.yellow(`
 ⚠️  Legacy git-sync settings detected!`));
     console.log(`
@@ -77352,7 +77496,7 @@ Repository "${selectedRepo.git_repo_resource_path}" has legacy settings format.`
       console.error(`   wmill gitsync-settings push
 `);
     }
-    process18.exit(1);
+    process19.exit(1);
   }
 }
 var init_legacySettings = __esm(async () => {
@@ -77808,14 +77952,14 @@ var init_pull2 = __esm(async () => {
 });
 
 // src/commands/gitsync-settings/push.ts
-import process19 from "node:process";
+import process20 from "node:process";
 async function pushGitSyncSettings(opts) {
   try {
     await validateBranchConfiguration({ yes: opts.yes });
   } catch (error2) {
     if (error2 instanceof Error && error2.message.includes("overrides")) {
       error(error2.message);
-      process19.exit(1);
+      process20.exit(1);
     }
     throw error2;
   }
@@ -77825,7 +77969,7 @@ async function pushGitSyncSettings(opts) {
     const wmillYamlPath = getWmillYamlPath();
     if (!wmillYamlPath) {
       error(colors.red("No wmill.yaml file found. Please run 'wmill init' first to create the configuration file."));
-      process19.exit(1);
+      process20.exit(1);
     }
     const localConfig = await readConfigFile();
     let settings;
@@ -77941,7 +78085,7 @@ async function pushGitSyncSettings(opts) {
           displayChanges(changes);
         }
       }
-      if (!opts.yes && !!process19.stdin.isTTY) {
+      if (!opts.yes && !!process20.stdin.isTTY) {
         const confirmed = await Confirm.prompt({
           message: `Do you want to apply these changes to the remote?`,
           default: true
@@ -78060,7 +78204,7 @@ The line below pulls in Windmill's managed CLI guidance (skills, deploy flow,
 debugging jobs, etc.). Refresh it with \`wmill refresh prompts\`. Remove the
 include line if you don't want the managed guidance in this project.
 
-${AGENTS_CLI_INCLUDE_LINE}
+${AGENTS_WMILL_INCLUDE_LINE}
 
 ## Project-specific instructions
 
@@ -78139,10 +78283,11 @@ There are two ways local changes reach the workspace. Pick based on how the repo
 Before deploying, check whether this repo has a **GitHub Actions (or other CI) workflow that runs \`wmill sync push\` on push**. That workflow is the signal that pushing a branch will deploy:
 
 - Look for \`.github/workflows/*.yml\` (or other CI configs) that invoke \`wmill sync push\`, \`wmill\` deployment commands, or similar.
-- Cache the result for the rest of the session — don't re-scan on every deploy.
 
 If such a workflow exists → **use \`git push\`** (Option A). Otherwise → **use \`wmill sync push\`** directly (Option B).
 
+**Save the preference so you don't re-detect it every session.** Once you've determined which option this repo uses (or the user tells you), record it in the **project-specific instructions** section of \`AGENTS.md\` (user-owned — never overwritten by \`wmill refresh prompts\`), e.g. a line like \`Deploy mode: git push (CI runs wmill sync push)\` or \`Deploy mode: wmill sync push (no CI wiring)\`. On later sessions, read that line first and skip the scan. Re-detect only if the CI wiring visibly changed.
+
 ### Option A — \`git push\` (CI is wired to sync)
 
 The CI workflow will pick up the commit and run \`wmill sync push\` on the backend, which is how deployments are intended to happen in this repo. Don't bypass it.
@@ -78164,6 +78309,19 @@ No CI workflow runs \`wmill sync push\` automatically, so deploy directly from t
 
 Only deploy when the user explicitly asks to deploy, publish, push, or ship — not when they say "run", "try", or "test". For testing local edits use the per-entity \`preview\` commands (\`wmill script preview\`, \`wmill flow preview\`) — they don't deploy.
 
+## Workspace forks
+
+A **fork** is an isolated copy of a workspace for parallel or experimental work — make changes (including to datatables, which are cloned per fork) without touching the parent, then merge back after review. Each fork is paired with a git branch named \`wm-fork/<base>/<id>\`. Forks require a git repo.
+
+Just run \`wmill workspace fork\` — it adapts to where you are:
+
+- **On a base branch** (e.g. \`main\`, or a branch bound to a workspace): it bases the fork on that branch and prints a \`git checkout -b wm-fork/<base>/<id>\` to start a fresh fork branch.
+- **On a working branch** (e.g. you've branched and already edited a forked datatable): it offers to base the fork on that branch and rename it onto \`wm-fork/<base>/<id>\` in place, preserving its commits — asking which base branch is the parent if there's more than one.
+
+For non-interactive runs from a working branch, pass \`--from-branch <base>\` to skip the prompts. The CLI refuses to rename a base branch.
+
+Merge a fork back into its parent with \`wmill workspace merge\` (or the Merge UI on the fork's home page). Full reference: https://www.windmill.dev/docs/advanced/workspace_forks
+
 ## Debugging Jobs
 
 When the user reports a script or flow failure, is investigating unexpected output, or asks why something ran the way it did, use the CLI to fetch job details before speculating. See the \`cli-commands\` skill for all flags.
@@ -78194,7 +78352,7 @@ For Windmill concepts not covered by the skills (triggers, schedules, workers, f
 - https://www.windmill.dev/llms-full.txt is the entire documentation as a single ~2.3 MB file — only for bulk indexing/RAG, do NOT load it directly into context.
 `;
 }
-var AGENTS_CLI_INCLUDE_LINE = "@AGENTS.cli.md";
+var AGENTS_WMILL_FILENAME = "AGENTS.wmill.md", AGENTS_WMILL_INCLUDE_LINE = "@AGENTS.wmill.md", LEGACY_AGENTS_CLI_FILENAME = "AGENTS.cli.md", LEGACY_AGENTS_CLI_INCLUDE_LINE = "@AGENTS.cli.md";
 
 // src/guidance/skills.gen.ts
 var SKILLS, SKILL_CONTENT, SCHEMAS, SCHEMA_MAPPINGS;
@@ -78482,6 +78640,10 @@ import Stripe from "stripe";
 import { someFunction } from "some-package";
 \`\`\`
 
+## Prefer \`//native\` when the runtime allows it
+
+If a script only needs \`fetch\` and the JavaScript standard library — including when it uses \`windmill-client\` — prefer making it a **native** script: add \`//native\` as the first line and write it with the \`write-script-bunnative\` skill. Native scripts run on a lightweight V8 isolate, start faster, and parallelize heavily. \`windmill-client\` works on the native worker (its calls go over \`fetch\`), so needing the Windmill client is **not** a reason to avoid \`//native\`. Use the regular \`bun\` language only when the code (or a dependency) needs Node/Bun runtime APIs — \`node:*\` modules, the filesystem, child processes, or native addons.
+
 ## Windmill Client
 
 Import the windmill client for platform interactions:
@@ -78490,7 +78652,9 @@ Import the windmill client for platform interactions:
 import * as wmill from "windmill-client";
 \`\`\`
 
-See the SDK documentation for available methods.
+**Prefer \`windmill-client\` over raw \`fetch\` for anything that talks to Windmill** — reading resources/variables/states, running scripts and flows, S3 object operations, etc. It handles auth, the workspace, and the base URL for you, so you don't hand-roll URLs or tokens. Reserve \`fetch\` for calling *external* HTTP APIs that aren't Windmill.
+
+The full \`windmill-client\` API reference (every exported function and its signature) is included in this skill below — consult it for the exact method to use instead of guessing or falling back to \`fetch\`.
 
 ## Preprocessor Scripts
 
@@ -79203,7 +79367,9 @@ export async function main(url: string) {
 
 ## Windmill Client
 
-\`windmill-client\` is available for Windmill-specific primitives such as the S3 helpers below (\`loadS3File\`, \`loadS3FileStream\`, \`writeS3File\`, \`S3Object\`). Use \`fetch\` for plain HTTP.
+\`windmill-client\` works on the native worker (its calls go over \`fetch\`), so use it as the **preferred way to talk to Windmill** — reading resources/variables/states, running scripts and flows, and the S3 helpers below (\`loadS3File\`, \`loadS3FileStream\`, \`writeS3File\`, \`S3Object\`). It handles auth, the workspace, and the base URL for you. Reserve raw \`fetch\` for calling *external* HTTP APIs that aren't Windmill.
+
+The full \`windmill-client\` API reference (every exported function and its signature) is included in this skill below — consult it for the exact method instead of hand-rolling a \`fetch\` against the Windmill API.
 
 ## Preprocessor Scripts
 
@@ -80004,7 +80170,9 @@ Import the windmill client for platform interactions:
 import * as wmill from "windmill-client";
 \`\`\`
 
-See the SDK documentation for available methods.
+**Prefer \`windmill-client\` over raw \`fetch\` for anything that talks to Windmill** — reading resources/variables/states, running scripts and flows, S3 object operations, etc. It handles auth, the workspace, and the base URL for you. Reserve \`fetch\` for calling *external* HTTP APIs that aren't Windmill.
+
+The full \`windmill-client\` API reference (every exported function and its signature) is included in this skill below — consult it for the exact method instead of guessing or falling back to \`fetch\`.
 
 ## Preprocessor Scripts
 
@@ -82685,7 +82853,7 @@ Once the flow has real content, **offer** to open the visual preview as a one-se
 
 ## CLI Commands — running, previewing, deploying
 
-After writing, tell the user which command fits what they want to do:
+After writing, act on the user's intent instead of just listing commands. Run the safe, non-deploying command yourself when it fits (\`wmill flow preview\` — see "After writing — offer to run, don't wait passively" below); only *name* the commands that deploy or rewrite files (\`wmill sync push\`, \`wmill generate-metadata\`) so the user can approve them. The options:
 
 - \`wmill flow preview <flow_path>\` — **default when iterating on a local flow.** Runs the local \`flow.yaml\` against local inline scripts without deploying. Add \`--remote\` to use deployed workspace scripts for PathScript steps instead of local files. Add \`--step <step_id>\` to run only one module in isolation (see "Single-step vs whole-flow preview" below).
 - \`wmill flow run <path>\` — runs the flow **already deployed** in the workspace. Use only when the user explicitly wants to test the deployed version, not local edits.
@@ -83151,7 +83319,7 @@ The runnable ID is the filename without extension. For example, \`get_user.ts\`
 | C#               | \`.cs\`        | \`myFunc.cs\`      |
 | Java             | \`.java\`      | \`myFunc.java\`    |
 
-After creating a runnable, tell the user they can generate lock files by running:
+After creating a runnable, offer to generate its lock files as a one-sentence next step (e.g. "Want me to generate the lock files?") and run it yourself once they agree — don't just name the command and wait. If the user already asked you to finish/lock the app, run it directly. It writes local lock files (not a deploy), so offer rather than running silently:
 \`\`\`bash
 wmill generate-metadata
 \`\`\`
@@ -83242,15 +83410,16 @@ data:
 
 ## CLI Commands
 
-\`wmill app new\` is the exception: you run it yourself, with flags, per the "Creating a Raw App" section above.
+Two commands you run yourself, not the user:
+- \`wmill app new\` — run it with flags, per the "Creating a Raw App" section above.
+- \`wmill generate-metadata\` — generates local lock files; offer it and run it on consent, per "After creating a runnable" above (it writes local lock files, not a deploy).
 
-For everything else, tell the user which command fits their intent and let them run it — these touch the workspace or local lock files, and the user should consent each time:
+For the rest, tell the user which command fits their intent and let them run it — these deploy to the workspace, overwrite local files, or launch a long-running server, so the user should consent each time:
 
 | Command | Description |
 |---------|-------------|
 | \`wmill app dev\` | Start dev server with live reload (see the \`preview\` skill for the full open-the-app-in-the-IDE-pane procedure). |
 | \`wmill app generate-agents\` | Refresh AGENTS.md and DATATABLES.md |
-| \`wmill generate-metadata\` | Generate lock files for backend runnables |
 | \`wmill sync push\` | Deploy app to Windmill |
 | \`wmill sync pull\` | Pull latest from Windmill |
 
@@ -84647,12 +84816,12 @@ List all queues with their metrics
 
 ### refresh
 
-Refresh wmill-managed project files (AGENTS.cli.md, skills, tsconfig.wmill.json)
+Refresh wmill-managed project files (AGENTS.wmill.md, skills, tsconfig.wmill.json)
 
 **Subcommands:**
 
-- \`refresh prompts\` - Refresh AGENTS.cli.md and managed skills. User-owned AGENTS.md and CLAUDE.md are never overwritten unless you opt in.
-  - \`--yes\` - Non-interactive: append the @AGENTS.cli.md include to an existing AGENTS.md / CLAUDE.md without prompting. Without it, a non-interactive run leaves an unlinked file untouched.
+- \`refresh prompts\` - Refresh AGENTS.wmill.md and managed skills. User-owned AGENTS.md and CLAUDE.md are never overwritten unless you opt in.
+  - \`--yes\` - Non-interactive: append the @AGENTS.wmill.md include to an existing AGENTS.md / CLAUDE.md without prompting. Without it, a non-interactive run leaves an unlinked file untouched.
 - \`refresh tsconfig\` - Refresh the wmill-managed tsconfig.wmill.json (and Deno import map for Deno projects)
   - \`--yes\` - Non-interactive: wire an existing custom tsconfig.json/deno.json to the managed file without prompting (a previously-generated config is always migrated automatically).
 
@@ -84943,7 +85112,8 @@ workspace related commands
   - \`--create-workspace-name <workspace_name:string>\` - Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.
   - \`--color <color:string>\` - Workspace color (hex code, e.g. #ff0000)
   - \`--datatable-behavior <behavior:string>\` - How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)
-  - \`-y --yes\` - Skip interactive prompts (defaults datatable behavior to 'skip')
+  - \`--from-branch <branch:string>\` - Non-interactive override for the 'turn my current working branch into the fork' workflow: base the fork on <branch> (its bound workspace is the parent) and rename the current branch onto wm-fork/<branch>/<id>. Usually unneeded — from a working branch \`wmill workspace fork\` offers this interactively; from a base branch it creates a fresh fork branch.
+  - \`-y --yes\` - Skip interactive prompts (defaults datatable behavior to 'skip'). On a non-base branch, requires --from-branch since the base branch can't be prompted for.
 - \`workspace delete-fork <fork_name:string>\` - Delete a forked workspace and git branch
   - \`-y --yes\` - Skip confirmation prompt
 - \`workspace merge\` - Compare and deploy changes between a fork and its parent workspace
@@ -86304,9 +86474,15 @@ async function warnIfPromptsStale(opts) {
   if (opts?.argv && !shouldRunFreshnessCheck(opts.argv))
     return;
   const cwd = opts?.cwd ?? process.cwd();
-  const path21 = `${cwd}/AGENTS.cli.md`;
-  if (!await stat18(path21).catch(() => null))
-    return;
+  let fileName = AGENTS_WMILL_FILENAME;
+  let path21 = `${cwd}/${fileName}`;
+  if (!await stat18(path21).catch(() => null)) {
+    fileName = LEGACY_AGENTS_CLI_FILENAME;
+    path21 = `${cwd}/${fileName}`;
+    if (!await stat18(path21).catch(() => null)) {
+      return;
+    }
+  }
   let content;
   try {
     content = await readTextFile(path21);
@@ -86315,7 +86491,7 @@ async function warnIfPromptsStale(opts) {
   }
   const stored = extractPromptsHash(content);
   if (!stored) {
-    emitWarning("Your AGENTS.cli.md predates prompt versioning. Run `wmill refresh prompts` to refresh and add a version marker.");
+    emitWarning(`Your ${fileName} predates prompt versioning. Run \`wmill refresh prompts\` to refresh and add a version marker.`);
     return;
   }
   let nonDottedPaths = opts?.nonDottedPaths;
@@ -86330,7 +86506,7 @@ async function warnIfPromptsStale(opts) {
   }
   const current = currentPromptsHash(nonDottedPaths);
   if (stored !== current) {
-    emitWarning("Your AGENTS.cli.md is out of date. Run `wmill refresh prompts` to refresh.");
+    emitWarning(`Your ${fileName} is out of date. Run \`wmill refresh prompts\` to refresh.`);
   }
 }
 function emitWarning(message) {
@@ -86357,7 +86533,7 @@ import { execSync as execSync6 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync12, readFileSync as readFileSync4, writeFileSync as writeFileSync7 } from "node:fs";
 import path21 from "node:path";
-import process22 from "node:process";
+import process23 from "node:process";
 function buildManagedTsconfig() {
   const paths = {};
   for (const dir of WORKSPACE_IMPORT_DIRS) {
@@ -86408,7 +86584,7 @@ async function refreshTsconfig(opts) {
   const assumeYes = opts?.yes === true;
   const mode = {
     assumeYes,
-    interactive: !!process22.stdin.isTTY && !assumeYes
+    interactive: !!process23.stdin.isTTY && !assumeYes
   };
   await refreshManagedTsconfig(defaultTs, mode);
   if (defaultTs === "deno") {
@@ -86423,7 +86599,7 @@ async function refreshManagedTsconfig(defaultTs, mode) {
   }
   const header = MANAGED_NOTICE + TSCONFIG_HASH_PREFIX + currentTsconfigHash() + `
 `;
-  writeFileSync7(path21.join(process22.cwd(), MANAGED_TSCONFIG), header + JSON.stringify(managed, null, 2) + `
+  writeFileSync7(path21.join(process23.cwd(), MANAGED_TSCONFIG), header + JSON.stringify(managed, null, 2) + `
 `);
   info(colors.green(`Refreshed ${MANAGED_TSCONFIG}`));
   await ensureUserReferencesManaged({
@@ -86459,7 +86635,7 @@ async function refreshManagedDenoImportMap(mode) {
   for (const dir of WORKSPACE_IMPORT_DIRS) {
     imports[`/${dir}/`] = `./${dir}/`;
   }
-  writeFileSync7(path21.join(process22.cwd(), MANAGED_IMPORT_MAP), JSON.stringify({ imports }, null, 2) + `
+  writeFileSync7(path21.join(process23.cwd(), MANAGED_IMPORT_MAP), JSON.stringify({ imports }, null, 2) + `
 `);
   info(colors.green(`Refreshed ${MANAGED_IMPORT_MAP}`));
   await ensureUserReferencesManaged({
@@ -86482,9 +86658,9 @@ async function refreshManagedDenoImportMap(mode) {
   });
 }
 async function ensureUserReferencesManaged(opts) {
-  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path21.join(process22.cwd(), f)).find((p) => existsSync12(p));
+  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path21.join(process23.cwd(), f)).find((p) => existsSync12(p));
   if (!existing) {
-    const userPath = path21.join(process22.cwd(), opts.file);
+    const userPath = path21.join(process23.cwd(), opts.file);
     writeFileSync7(userPath, JSON.stringify(opts.create, null, 2) + `
 `);
     info(colors.green(`Created ${opts.file} (references ${opts.token})`));
@@ -86533,7 +86709,7 @@ async function ensureUserReferencesManaged(opts) {
   info(colors.green(`Linked ${existingName} → ${opts.token}`));
 }
 function ensureBunTypesAvailable() {
-  const cwd = process22.cwd();
+  const cwd = process23.cwd();
   if (existsSync12(path21.join(cwd, "node_modules", "bun-types"))) {
     return true;
   }
@@ -86555,7 +86731,7 @@ function ensureBunTypesAvailable() {
   }
 }
 async function warnIfTsconfigStale(opts) {
-  const cwd = opts?.cwd ?? process22.cwd();
+  const cwd = opts?.cwd ?? process23.cwd();
   const managedPath = path21.join(cwd, MANAGED_TSCONFIG);
   if (!existsSync12(managedPath))
     return;
@@ -86575,7 +86751,7 @@ async function warnIfTsconfigStale(opts) {
   }
 }
 function emitTsconfigWarning(message) {
-  process22.stderr.write(`${colors.yellow(message)}
+  process23.stderr.write(`${colors.yellow(message)}
 `);
 }
 var WORKSPACE_IMPORT_DIRS, MANAGED_TSCONFIG = "tsconfig.wmill.json", MANAGED_IMPORT_MAP = "import_map.wmill.json", MANAGED_NOTICE, TSCONFIG_HASH_PREFIX = "// wmill-tsconfig-hash: ", TSCONFIG_HASH_REGEX, LEGACY_GENERATED_TSCONFIGS, command30, tsconfig_default;
@@ -88061,7 +88237,7 @@ async function configureClientForWorkspace(opts, ws, resolver) {
 // src/commands/protection-rules/utils.ts
 init_colors2();
 init_log();
-import process20 from "node:process";
+import process21 from "node:process";
 function outputResult2(opts, result) {
   if (opts.jsonOutput) {
     console.log(JSON.stringify(result));
@@ -88073,7 +88249,7 @@ function outputResult2(opts, result) {
 }
 function fail(opts, result) {
   outputResult2(opts, { ...result, success: false });
-  process20.exit(1);
+  process21.exit(1);
 }
 function describeEntry(entry) {
   const n = ProtectionRulesConverter.normalizeEntry(entry);
@@ -88217,7 +88393,7 @@ await __promiseAll([
   init_confirm(),
   init_conf()
 ]);
-import process21 from "node:process";
+import process22 from "node:process";
 import { existsSync as existsSync10 } from "node:fs";
 async function pushProtectionRules(opts, workspaceArg) {
   if (opts.jsonOutput)
@@ -88298,7 +88474,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       workspaces: Object.fromEntries(wsPlans.map((w) => [w.ws, structuredPlan(w.plan)]))
     }));
     if (hadError)
-      process21.exit(1);
+      process22.exit(1);
     return;
   }
   if (!opts.jsonOutput) {
@@ -88312,7 +88488,7 @@ async function pushProtectionRules(opts, workspaceArg) {
         error: "One or more workspaces failed (see errors above); the rest are in sync",
         partialFailure: true
       });
-      process21.exit(1);
+      process22.exit(1);
     }
     if (!opts.dryRun) {
       outputResult2(opts, {
@@ -88324,7 +88500,7 @@ async function pushProtectionRules(opts, workspaceArg) {
   }
   if (opts.dryRun) {
     if (hadError)
-      process21.exit(1);
+      process22.exit(1);
     return;
   }
   for (const w of wsPlans) {
@@ -88333,7 +88509,7 @@ async function pushProtectionRules(opts, workspaceArg) {
     }
   }
   const totalDeletes = changed.reduce((n, w) => n + w.plan.toDelete.length, 0);
-  if (!opts.yes && !!process21.stdin.isTTY) {
+  if (!opts.yes && !!process22.stdin.isTTY) {
     const confirmed = await Confirm.prompt({
       message: totalDeletes > 0 ? `Apply these changes? This DELETES ${totalDeletes} protection rule(s) across ${changed.length} workspace(s).` : `Apply these changes to ${changed.length} workspace(s)?`,
       default: totalDeletes === 0
@@ -88395,7 +88571,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       partialFailure: true,
       ...applied
     });
-    process21.exit(1);
+    process22.exit(1);
   }
   outputResult2(opts, {
     success: true,
@@ -89433,7 +89609,7 @@ await __promiseAll([
   init_workspace(),
   init_resource_type()
 ]);
-import { stat as stat20, writeFile as writeFile22, rm as rm5 } from "node:fs/promises";
+import { stat as stat20, writeFile as writeFile22, rm as rm6 } from "node:fs/promises";
 
 // src/commands/init/template.ts
 var NON_SCHEMA_KEYS = new Set([
@@ -89914,7 +90090,7 @@ await __promiseAll([
   init_utils(),
   init_freshness()
 ]);
-import { cp, mkdir as mkdir13, readdir as readdir11, stat as stat19, writeFile as writeFile21 } from "node:fs/promises";
+import { cp, mkdir as mkdir13, readdir as readdir11, rm as rm5, stat as stat19, writeFile as writeFile21 } from "node:fs/promises";
 import { join as join20 } from "node:path";
 var WMILL_INIT_AI_SKILLS_SOURCE_ENV = "WMILL_INIT_AI_SKILLS_SOURCE";
 var WMILL_INIT_AI_AGENTS_SOURCE_ENV = "WMILL_INIT_AI_AGENTS_SOURCE";
@@ -89928,13 +90104,14 @@ async function writeAiGuidanceFiles(options) {
   const skillMetadata = options.skillsSourcePath ? await readSkillMetadataFromDirectory(options.skillsSourcePath) : getGeneratedSkillMetadata();
   const rawAgentsCliContent = options.agentsSourcePath != null ? await readTextFile(options.agentsSourcePath) : generateAgentsCliMdContent(buildSkillsReference(skillMetadata));
   const agentsCliContent = injectPromptsHashMarker(rawAgentsCliContent, currentPromptsHash(nonDottedPaths));
-  const agentsCliPath = join20(options.targetDir, "AGENTS.cli.md");
+  const agentsCliPath = join20(options.targetDir, AGENTS_WMILL_FILENAME);
   await writeFile21(agentsCliPath, agentsCliContent, "utf8");
   const agentsCliWritten = true;
+  const legacyManagedRemoved = await migrateLegacyManagedFile(options.targetDir);
   const resolveMigration = cacheOnce(options.resolveAgentsMdMigration);
   const agentsMdResult = await reconcileIncludingFile({
     path: join20(options.targetDir, "AGENTS.md"),
-    includeLine: AGENTS_CLI_INCLUDE_LINE,
+    includeLine: AGENTS_WMILL_INCLUDE_LINE,
     skeleton: generateAgentsMdSkeleton(),
     resolveMigration
   });
@@ -89956,9 +90133,35 @@ async function writeAiGuidanceFiles(options) {
     agentsMigration: agentsMdResult.migration,
     claudeCreated: claudeMdResult.created,
     claudeMigration: claudeMdResult.migration,
-    skillCount: skillMetadata.length
+    skillCount: skillMetadata.length,
+    legacyManagedRemoved
   };
 }
+async function migrateLegacyManagedFile(targetDir) {
+  for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
+    const filePath = join20(targetDir, fileName);
+    const existing = await readTextFile(filePath).catch(() => null);
+    if (existing == null)
+      continue;
+    const rewritten = rewriteIncludeToken(existing, LEGACY_AGENTS_CLI_INCLUDE_LINE, AGENTS_WMILL_INCLUDE_LINE);
+    if (rewritten !== existing) {
+      await writeFile21(filePath, rewritten, "utf8");
+    }
+  }
+  const legacyPath = join20(targetDir, LEGACY_AGENTS_CLI_FILENAME);
+  const legacyExists = await stat19(legacyPath).catch(() => null) != null;
+  if (legacyExists) {
+    await rm5(legacyPath, { force: true });
+  }
+  return legacyExists;
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function rewriteIncludeToken(content, from, to) {
+  const re = new RegExp(`(?<=^|\\s)${escapeRegExp(from)}(?=\\s|$)`, "gm");
+  return content.replace(re, to);
+}
 function cacheOnce(resolver) {
   if (!resolver)
     return;
@@ -90159,10 +90362,13 @@ async function refreshPrompts(opts) {
         return "skip";
       }
     });
-    info(colors.green("Refreshed AGENTS.cli.md"));
+    info(colors.green("Refreshed AGENTS.wmill.md"));
+    if (result.legacyManagedRemoved) {
+      info(colors.yellow("Migrated legacy AGENTS.cli.md → AGENTS.wmill.md (removed the old file and rewrote any @AGENTS.cli.md include)."));
+    }
     reportReconciliation({
       file: "AGENTS.md",
-      includeLine: "@AGENTS.cli.md",
+      includeLine: "@AGENTS.wmill.md",
       created: result.agentsCreated,
       migration: result.agentsMigration
     });
@@ -90231,7 +90437,7 @@ async function promptMigration() {
 async function promptsAction(opts) {
   await refreshPrompts({ yes: opts.yes === true });
 }
-var command29 = new Command().description("Refresh AGENTS.cli.md and managed skills. User-owned AGENTS.md and CLAUDE.md are never overwritten unless you opt in.").option("--yes", "Non-interactive: append the @AGENTS.cli.md include to an existing AGENTS.md / CLAUDE.md without prompting. Without it, a non-interactive run leaves an unlinked file untouched.").action(promptsAction);
+var command29 = new Command().description("Refresh AGENTS.wmill.md and managed skills. User-owned AGENTS.md and CLAUDE.md are never overwritten unless you opt in.").option("--yes", "Non-interactive: append the @AGENTS.wmill.md include to an existing AGENTS.md / CLAUDE.md without prompting. Without it, a non-interactive run leaves an unlinked file untouched.").action(promptsAction);
 var prompts_default = command29;
 
 // src/commands/init/init.ts
@@ -90349,8 +90555,8 @@ async function initAction(opts) {
             });
             if (choice === "cancel") {
               try {
-                await rm5("wmill.yaml");
-                await rm5("wmill-lock.yaml");
+                await rm6("wmill.yaml");
+                await rm6("wmill-lock.yaml");
               } catch {}
               info("Init cancelled");
               process.exit(0);
@@ -90403,7 +90609,7 @@ var init_default = command31;
 // src/commands/refresh/refresh.ts
 init_mod3();
 await init_tsconfig();
-var command32 = new Command().description("Refresh wmill-managed project files (AGENTS.cli.md, skills, tsconfig.wmill.json)").command("prompts", prompts_default).command("tsconfig", tsconfig_default);
+var command32 = new Command().description("Refresh wmill-managed project files (AGENTS.wmill.md, skills, tsconfig.wmill.json)").command("prompts", prompts_default).command("tsconfig", tsconfig_default);
 var refresh_default = command32;
 
 // src/main.ts