windmill-cli 1.743.0 → 1.745.0

package/esm/main.js

@@ -16784,7 +16784,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.743.0",
+    VERSION: "1.745.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17128,6 +17128,7 @@ __export(exports_services_gen, {
   star: () => star,
   signS3Objects: () => signS3Objects,
   setupCustomInstanceDb: () => setupCustomInstanceDb,
+  setWsSpecific: () => setWsSpecific,
   setWorkspaceSlackOauthConfig: () => setWorkspaceSlackOauthConfig,
   setWorkspaceEncryptionKey: () => setWorkspaceEncryptionKey,
   setWebsocketTriggerMode: () => setWebsocketTriggerMode,
@@ -17369,6 +17370,8 @@ __export(exports_services_gen, {
   listAuditLogs: () => listAuditLogs,
   listAssetsByUsage: () => listAssetsByUsage,
   listAssets: () => listAssets,
+  listAssetSchemas: () => listAssetSchemas,
+  listAssetPartitions: () => listAssetPartitions,
   listAssetDispatchEdges: () => listAssetDispatchEdges,
   listApps: () => listApps,
   listAppPathsFromWorkspaceRunnable: () => listAppPathsFromWorkspaceRunnable,
@@ -17536,6 +17539,7 @@ __export(exports_services_gen, {
   getFlowAllLogs: () => getFlowAllLogs,
   getEmailTrigger: () => getEmailTrigger,
   getDraftForUser: () => getDraftForUser,
+  getDevWorkspace: () => getDevWorkspace,
   getDeployTo: () => getDeployTo,
   getDependentsAmounts: () => getDependentsAmounts,
   getDependents: () => getDependents,
@@ -17651,6 +17655,7 @@ __export(exports_services_gen, {
   disconnectSlack: () => disconnectSlack,
   disconnectAccount: () => disconnectAccount,
   diffRawScriptsWithDeployed: () => diffRawScriptsWithDeployed,
+  detachDevWorkspace: () => detachDevWorkspace,
   deleteWorkspaceSlackOauthConfig: () => deleteWorkspaceSlackOauthConfig,
   deleteWorkspaceDependencies: () => deleteWorkspaceDependencies,
   deleteWorkspace: () => deleteWorkspace,
@@ -17782,6 +17787,7 @@ __export(exports_services_gen, {
   batchReRunJobs: () => batchReRunJobs,
   backendVersion: () => backendVersion,
   backendUptodate: () => backendUptodate,
+  attachDevWorkspace: () => attachDevWorkspace,
   assignGhesInstallation: () => assignGhesInstallation,
   archiveWorkspaceDependencies: () => archiveWorkspaceDependencies,
   archiveWorkspace: () => archiveWorkspace,
@@ -18183,6 +18189,34 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, attachDevWorkspace = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/workspaces/attach_dev_workspace",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
+}, detachDevWorkspace = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/workspaces/detach_dev_workspace",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
+}, getDevWorkspace = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/workspaces/get_dev_workspace",
+    path: {
+      workspace: data3.workspace
+    }
+  });
 }, existsWorkspace = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -19820,6 +19854,16 @@ var backendVersion = () => {
       path: data3.path
     }
   });
+}, setWsSpecific = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/workspaces/set_ws_specific",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
 }, setPublicAppRateLimit = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -25353,6 +25397,28 @@ var backendVersion = () => {
       workspace: data3.workspace
     }
   });
+}, listAssetPartitions = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/assets/partitions",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      path: data3.path
+    }
+  });
+}, listAssetSchemas = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/assets/asset_schemas",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      path: data3.path
+    }
+  });
 }, listVolumes = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -25542,7 +25608,7 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.743.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.745.0";
 
 // src/utils/git.ts
 var exports_git = {};
@@ -26514,6 +26580,10 @@ async function createWorkspaceFork2(opts, workspaceName, workspaceId = undefined
   info(colors.blue(`Creating forked workspace: ${workspaceName}...`));
   const trueWorkspaceId = `${WM_FORK_PREFIX}-${workspaceId}`;
   validateForkWorkspaceId(trueWorkspaceId);
+  const effectiveName = opts.createWorkspaceName ?? workspaceName ?? trueWorkspaceId;
+  if (effectiveName.length > 50) {
+    throw new Error(`Fork workspace name is too long (${effectiveName.length} chars; max 50). Choose a shorter name.`);
+  }
   let alreadyExists = false;
   try {
     alreadyExists = await existsWorkspace({
@@ -28557,7 +28627,7 @@ var init_workspace = __esm(async () => {
   ]);
   command2 = new Command().alias("profile").description("workspace related commands").action(list3).command("switch").complete("workspace", async () => (await allWorkspaces()).map((x) => x.name)).description("Switch to another workspace").arguments("<workspace_name:string:workspace>").action(switchC).command("add").description("Add a workspace").arguments("[workspace_name:string] [workspace_id:string] [remote:string]").option("-c --create", "Create the workspace if it does not exist").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--create-username <username:string>", "Specify your own username in the newly created workspace. Ignored if --create is not specified, the workspace already exists or automatic username creation is enabled on the instance.", {
     default: "admin"
-  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list3).command("list-remote").description("List workspaces on the remote server that you have access to").option("--as-superadmin", "List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Create or update a workspace entry in wmill.yaml from the active profile").option("--workspace <name:string>", "Workspace name (default: current branch or workspaceId)").option("--branch <branch:string>", "Git branch to associate (default: workspace name)").action((opts) => bind(opts, true)).command("unbind").description("Remove baseUrl and workspaceId from a workspace entry").option("--workspace <name:string>", "Workspace to unbind").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--color <color:string>", "Workspace color (hex code, e.g. #ff0000)").option("--datatable-behavior <behavior:string>", "How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)").option("--from-branch <branch:string>", "Non-interactive override for the 'turn my current working branch into the fork' workflow: base the fork on <branch> (its bound workspace is the parent) and rename the current branch onto wm-fork/<branch>/<id>. Usually unneeded — from a working branch `wmill workspace fork` offers this interactively; from a base branch it creates a fresh fork branch.").option("-y --yes", "Skip interactive prompts (defaults datatable behavior to 'skip'). On a non-base branch, requires --from-branch since the base branch can't be prompted for.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace and git branch").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork).command("merge").description("Compare and deploy changes between a fork and its parent workspace").option("--direction <direction:string>", "Deploy direction: to-parent or to-fork").option("--all", "Deploy all changed items including conflicts").option("--skip-conflicts", "Skip items modified in both workspaces").option("--include <items:string>", "Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)").option("--exclude <items:string>", "Comma-separated kind:path items to exclude").option("--preserve-on-behalf-of", "Preserve original on_behalf_of/permissioned_as values").option("-y --yes", "Non-interactive mode (deploy without prompts)").action(mergeWorkspaces).command("connect-slack").description("Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).action(connectSlack2).command("disconnect-slack").description("Clear slack_team_id / slack_name on the active workspace (marks the workspace as disconnected). Does NOT remove the bot token variable/resource/folder/group — delete those from the local sync folder and run 'wmill sync push' to tear them down. Does NOT remove the workspace-level OAuth override — set slack_oauth_client_id/_secret to '' in settings.yaml and push.").action(disconnectSlack2);
+  }).action(add).command("remove").description("Remove a workspace").arguments("<workspace_name:string>").action(remove).command("whoami").description("Show the currently active user").action(whoami2).command("list").description("List local workspace profiles").action(list3).command("list-remote").description("List workspaces on the remote server that you have access to").option("--as-superadmin", "List ALL workspaces on the instance (requires the token to belong to a superadmin/devops user)").action(listRemote).command("list-forks").description("List forked workspaces on the remote server").action(listForks).command("bind").description("Create or update a workspace entry in wmill.yaml from the active profile").option("--workspace <name:string>", "Workspace name (default: current branch or workspaceId)").option("--branch <branch:string>", "Git branch to associate (default: workspace name)").action((opts) => bind(opts, true)).command("unbind").description("Remove baseUrl and workspaceId from a workspace entry").option("--workspace <name:string>", "Workspace to unbind").action((opts) => bind(opts, false)).command("fork").description("Create a forked workspace").arguments("[workspace_name:string] [workspace_id:string]").option("--create-workspace-name <workspace_name:string>", "Specify the workspace name. Ignored if --create is not specified or the workspace already exists. Will default to the workspace id.").option("--color <color:string>", "Workspace color (hex code, e.g. #ff0000)").option("--datatable-behavior <behavior:string>", "How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)").option("--from-branch <branch:string>", "Non-interactive override for the 'turn my current working branch into the fork' workflow: base the fork on <branch> (its bound workspace is the parent) and rename the current branch onto wm-fork/<branch>/<id>. Usually unneeded — from a working branch `wmill workspace fork` offers this interactively; from a base branch it creates a fresh fork branch.").option("-y --yes", "Skip interactive prompts (defaults datatable behavior to 'skip'). On a non-base branch, requires --from-branch since the base branch can't be prompted for.").action(createWorkspaceFork2).command("delete-fork").description("Delete a forked workspace").arguments("<fork_name:string>").option("-y --yes", "Skip confirmation prompt").action(deleteWorkspaceFork).command("merge").description("Compare and deploy changes between a fork and its parent workspace").option("--direction <direction:string>", "Deploy direction: to-parent or to-fork").option("--all", "Deploy all changed items including conflicts").option("--skip-conflicts", "Skip items modified in both workspaces").option("--include <items:string>", "Comma-separated kind:path items to include (e.g. script:f/test/main,flow:f/my/flow)").option("--exclude <items:string>", "Comma-separated kind:path items to exclude").option("--preserve-on-behalf-of", "Preserve original on_behalf_of/permissioned_as values").option("-y --yes", "Non-interactive mode (deploy without prompts)").action(mergeWorkspaces).command("connect-slack").description("Non-interactively connect Slack to the active workspace using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: workspace_settings fields, g/slack group, f/slack_bot folder, and the encrypted bot token variable + resource at f/slack_bot/bot_token.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).action(connectSlack2).command("disconnect-slack").description("Clear slack_team_id / slack_name on the active workspace (marks the workspace as disconnected). Does NOT remove the bot token variable/resource/folder/group — delete those from the local sync folder and run 'wmill sync push' to tear them down. Does NOT remove the workspace-level OAuth override — set slack_oauth_client_id/_secret to '' in settings.yaml and push.").action(disconnectSlack2);
   workspace_default = command2;
 });
 
@@ -85832,11 +85902,20 @@ inspect asset-driven pipelines (scripts marked \`// pipeline\`, wired by \`// on
   - \`--json\` - Output as JSON (for piping to jq)
 - \`pipeline show <folder:string>\` - render a pipeline folder's DAG (sources, lineage, subscriptions) in the terminal
   - \`--json\` - Output the raw asset graph as JSON
+  - \`--local\` - Build the graph from local working-tree files (// pipeline scripts) instead of the deployed workspace — no deploy needed.
 - \`pipeline run <folder:string>\` - run a bounded cascade: from a schedule/manual root, fan downstream up to the --to end node(s)
   - \`--from <script:string>\` - Start script (short name or path). Defaults to the folder's sole schedule/manual root.
   - \`--to <node:string>\` - End node(s) to stop at — script names/paths or asset URIs (e.g. datatable://main/staged). Repeatable or comma-separated. Omit to run the full downstream.
   - \`--dry-run\` - Print the topological run plan without executing.
   - \`--json\` - Output the plan as JSON (for piping to jq).
+  - \`--local\` - Run the local working-tree scripts via preview (no deploy) instead of the deployed versions; the graph is built from local files.
+  - \`--upload <binding:string>\` - Bind an object to a data_upload/webhook entry point so it runs in the cascade, as SCRIPT[:PARAM]=SOURCE (SOURCE is a local file or an s3://key). Local files are uploaded to the workspace store; the S3Object param is inferred when the script has exactly one. Repeatable.
+- \`pipeline docs <folder:string>\` - generate PIPELINE.md (+ AGENTS.md pointer) describing a folder's pipeline graph and datatable schemas, for an editor / agentic loop
+  - \`--local\` - Build the graph from local working-tree files instead of the deployed workspace.
+- \`pipeline dev [folder:string]\` - Live-preview a data pipeline from local files: watch an \`f/<folder>\` of \`// pipeline\` scripts, push the working-tree graph to the dev page, and run the cascade via preview (no deploy).
+  - \`--port <port:number>\` - Port for the dev WebSocket server.
+  - \`--no-open\` - Do not open the browser automatically.
+  - \`--frontend <origin:string>\` - Origin serving the /pipeline_dev page (e.g. http://localhost:3000 for a locally-run frontend). Defaults to the workspace remote; use it when the remote's deployed frontend predates the dev page.
 
 ### protection-rules
 
@@ -86168,7 +86247,7 @@ workspace related commands
   - \`--datatable-behavior <behavior:string>\` - How to handle datatables: skip, schema_only, or schema_and_data (default: interactive prompt)
   - \`--from-branch <branch:string>\` - Non-interactive override for the 'turn my current working branch into the fork' workflow: base the fork on <branch> (its bound workspace is the parent) and rename the current branch onto wm-fork/<branch>/<id>. Usually unneeded — from a working branch \`wmill workspace fork\` offers this interactively; from a base branch it creates a fresh fork branch.
   - \`-y --yes\` - Skip interactive prompts (defaults datatable behavior to 'skip'). On a non-base branch, requires --from-branch since the base branch can't be prompted for.
-- \`workspace delete-fork <fork_name:string>\` - Delete a forked workspace and git branch
+- \`workspace delete-fork <fork_name:string>\` - Delete a forked workspace
   - \`-y --yes\` - Skip confirmation prompt
 - \`workspace merge\` - Compare and deploy changes between a fork and its parent workspace
   - \`--direction <direction:string>\` - Deploy direction: to-parent or to-fork
@@ -94754,14 +94833,16 @@ var scriptNodeId = (path23) => `${SCRIPT_PREFIX}${path23}`;
 var isScriptNode = (id) => id.startsWith(SCRIPT_PREFIX);
 var scriptPathOf = (id) => id.slice(SCRIPT_PREFIX.length);
 var assetNodeId = (kind, path23) => `${kind}:${path23}`;
-var EVENT_TRIGGER_KINDS = new Set([
+var NON_AUTORUN_TRIGGER_KINDS = new Set([
   "kafka",
   "mqtt",
   "nats",
   "postgres",
   "sqs",
   "gcp",
-  "email"
+  "email",
+  "webhook",
+  "data_upload"
 ]);
 function assetUriToNodeId(uri) {
   const m3 = uri.match(/^([a-z0-9_]+):\/\/(.+)$/i);
@@ -94823,6 +94904,26 @@ function closure(adj, start) {
 }
 var descendants = (dag, n2) => closure(dag.down, n2);
 var ancestors = (dag, n2) => closure(dag.up, n2);
+function reachableCutting(dag, starts, barriers) {
+  const seen = new Set;
+  const queue = [];
+  for (const s2 of starts) {
+    if (barriers.has(s2) || seen.has(s2))
+      continue;
+    seen.add(s2);
+    queue.push(s2);
+  }
+  while (queue.length > 0) {
+    const n2 = queue.shift();
+    for (const next of dag.down.get(n2) ?? []) {
+      if (barriers.has(next) || seen.has(next))
+        continue;
+      seen.add(next);
+      queue.push(next);
+    }
+  }
+  return seen;
+}
 function boundedSet(dag, start, ends) {
   const downSet = new Set(descendants(dag, start));
   downSet.add(start);
@@ -94847,7 +94948,7 @@ function boundedSet(dag, start, ends) {
 function validStarts(g2) {
   const subscribers = new Set;
   const scheduleScripts = new Set;
-  const eventScripts = new Set;
+  const nonAutorunScripts = new Set;
   for (const t2 of g2.triggers ?? []) {
     if (t2.runnable_kind !== "script")
       continue;
@@ -94855,8 +94956,8 @@ function validStarts(g2) {
       subscribers.add(t2.runnable_path);
     else if (t2.trigger_kind === "schedule")
       scheduleScripts.add(t2.runnable_path);
-    else if (EVENT_TRIGGER_KINDS.has(t2.trigger_kind))
-      eventScripts.add(t2.runnable_path);
+    else if (NON_AUTORUN_TRIGGER_KINDS.has(t2.trigger_kind))
+      nonAutorunScripts.add(t2.runnable_path);
   }
   const out = new Set;
   for (const r2 of g2.runnables ?? []) {
@@ -94865,11 +94966,20 @@ function validStarts(g2) {
     const p3 = r2.path;
     if (scheduleScripts.has(p3))
       out.add(scriptNodeId(p3));
-    else if (!subscribers.has(p3) && !eventScripts.has(p3))
+    else if (!subscribers.has(p3) && !nonAutorunScripts.has(p3))
       out.add(scriptNodeId(p3));
   }
   return out;
 }
+function nonAutorunTriggerScripts(g2) {
+  const out = new Set;
+  for (const t2 of g2.triggers ?? []) {
+    if (t2.runnable_kind === "script" && NON_AUTORUN_TRIGGER_KINDS.has(t2.trigger_kind)) {
+      out.add(scriptNodeId(t2.runnable_path));
+    }
+  }
+  return out;
+}
 function scriptsOf(nodes) {
   const out = [];
   for (const id of nodes)
@@ -94931,14 +95041,716 @@ function topoOrder(g2, scripts) {
   return { order, cyclic };
 }
 
+// src/commands/pipeline/localGraph.ts
+init_script_common();
+await __promiseAll([
+  init_metadata(),
+  init_script(),
+  init_conf()
+]);
+import * as fs17 from "node:fs";
+import * as path23 from "node:path";
+import process25 from "node:process";
+function workspaceRoot() {
+  const yaml = getWmillYamlPath();
+  return yaml ? path23.dirname(yaml) : process25.cwd();
+}
+function wasmFnForLanguage(language) {
+  switch (language) {
+    case "bun":
+    case "deno":
+    case "nativets":
+      return "parse_assets_ts";
+    case "bunnative":
+      return "parse_assets_ts";
+    case "python3":
+      return "parse_assets_py";
+    case "duckdb":
+    case "postgresql":
+    case "mysql":
+    case "bigquery":
+    case "snowflake":
+    case "mssql":
+    case "oracledb":
+      return "parse_assets_sql";
+    default:
+      return;
+  }
+}
+var ASSET_WASM_PKG = "windmill-parser-wasm-asset";
+function commentPrefix(language) {
+  if (language === "python3" || language === "bash" || language === "ansible" || language === "ruby" || language === "rlang" || language === "nu" || language === "powershell")
+    return "#";
+  if (language === "postgresql" || language === "mysql" || language === "bigquery" || language === "snowflake" || language === "mssql" || language === "oracledb" || language === "duckdb")
+    return "--";
+  return "//";
+}
+var NATIVE_KINDS = new Set([
+  "schedule",
+  "webhook",
+  "email",
+  "kafka",
+  "mqtt",
+  "nats",
+  "postgres",
+  "sqs",
+  "gcp",
+  "data_upload"
+]);
+function fallbackParse(content, language) {
+  const raw = commentPrefix(language);
+  const p3 = raw.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const out = { in_pipeline: false, triggers: [] };
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "")
+      continue;
+    if (!trimmed.startsWith(raw))
+      break;
+    if (line.match(new RegExp(`^\\s*${p3}\\s*pipeline\\s*$`))) {
+      out.in_pipeline = true;
+      continue;
+    }
+    const tag = line.match(new RegExp(`^\\s*${p3}\\s*tag\\s+(\\S+)\\s*$`));
+    if (tag) {
+      out.tag = tag[1];
+      continue;
+    }
+    const on = line.match(new RegExp(`^\\s*${p3}\\s*on\\s+(.+?)\\s*$`));
+    if (!on)
+      continue;
+    const rest = on[1].trim();
+    const firstTok = rest.split(/\s+/)[0];
+    const uri = firstTok.match(/^([a-z0-9_]+):\/\/(.+)$/i);
+    if (uri) {
+      const prefix = uri[1].toLowerCase();
+      const kind = prefix === "s3" ? "s3object" : prefix;
+      out.triggers.push({ kind: "asset", asset_kind: kind, path: uri[2] });
+    } else if (NATIVE_KINDS.has(firstTok) && rest === firstTok) {
+      out.triggers.push({ kind: firstTok });
+    }
+  }
+  return out;
+}
+function volumeCommentPrefix(language) {
+  switch (language) {
+    case "python3":
+    case "bash":
+    case "powershell":
+    case "ansible":
+    case "ruby":
+    case "rlang":
+      return "#";
+    case "deno":
+    case "bun":
+    case "bunnative":
+    case "nativets":
+    case "go":
+      return "//";
+    default:
+      return;
+  }
+}
+function parseVolumeAnnotations(content, prefix) {
+  const out = [];
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "")
+      continue;
+    if (!trimmed.startsWith(prefix))
+      break;
+    const after = trimmed.slice(prefix.length).trim();
+    const m3 = after.match(/^volume:\s*(\S+)/);
+    if (m3)
+      out.push({ kind: "volume", path: m3[1], access_type: "rw" });
+  }
+  return out;
+}
+async function inferScriptAssets(content, language) {
+  const out = await inferScriptAssetsBody(content, language);
+  const vp = volumeCommentPrefix(language);
+  if (vp) {
+    const vols = parseVolumeAnnotations(content, vp);
+    if (vols.length > 0)
+      out.assets = [...out.assets ?? [], ...vols];
+  }
+  return out;
+}
+async function inferScriptAssetsBody(content, language) {
+  const fn = wasmFnForLanguage(language);
+  if (!fn)
+    return fallbackParse(content, language);
+  let raw;
+  try {
+    const mod = await loadParser(ASSET_WASM_PKG);
+    raw = mod[fn](content);
+  } catch {
+    return fallbackParse(content, language);
+  }
+  if (raw.startsWith("err:"))
+    return fallbackParse(content, language);
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fallbackParse(content, language);
+  }
+}
+async function collectScripts(folderDir, root, defaultTs) {
+  const out = [];
+  function walk(dir) {
+    let entries;
+    try {
+      entries = fs17.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e2 of entries) {
+      if (e2.name.startsWith(".") || e2.name === "node_modules")
+        continue;
+      const abs = path23.join(dir, e2.name);
+      if (e2.isDirectory()) {
+        walk(abs);
+        continue;
+      }
+      if (!e2.isFile())
+        continue;
+      const ext2 = exts.find((x3) => e2.name.endsWith(x3));
+      if (!ext2)
+        continue;
+      const relFromRoot = path23.relative(root, abs).replaceAll("\\", "/");
+      let language;
+      try {
+        language = inferContentTypeFromFilePath(abs, defaultTs);
+      } catch {
+        continue;
+      }
+      out.push({
+        path: removeExtensionToPath(relFromRoot),
+        content: fs17.readFileSync(abs, "utf-8"),
+        language
+      });
+    }
+  }
+  walk(folderDir);
+  out.sort((a2, b2) => a2.path.localeCompare(b2.path));
+  return out;
+}
+async function buildLocalPipelineGraph(args) {
+  const folderClean = args.folder.replace(/^f\//, "").replace(/\/$/, "");
+  const folderDir = path23.join(args.root, "f", folderClean);
+  const all = await collectScripts(folderDir, args.root, args.defaultTs);
+  const runnables = [];
+  const edges = [];
+  const triggers = [];
+  const assetSet = new Map;
+  const pipelineScripts = [];
+  for (const s2 of all) {
+    const out = await inferScriptAssets(s2.content, s2.language);
+    if (!out.in_pipeline)
+      continue;
+    pipelineScripts.push(out.tag ? { ...s2, tag: out.tag } : s2);
+    const mat = out.materialize;
+    const materialize_strategy = mat && !mat.manual ? mat.append ? "append" : mat.unique_key ? "merge" : "replace" : undefined;
+    runnables.push({
+      path: s2.path,
+      usage_kind: "script",
+      in_pipeline: true,
+      ...out.partition ? { partition_kind: out.partition.kind } : {},
+      ...out.freshness ? { freshness: out.freshness.duration } : {},
+      ...out.tag ? { tag: out.tag } : {},
+      ...out.retry ? { retry: out.retry } : {},
+      ...out.data_tests && out.data_tests.length > 0 ? { data_tests: out.data_tests } : {},
+      ...out.column_lineage && out.column_lineage.length > 0 ? { column_lineage: out.column_lineage } : {},
+      ...mat ? { materialize_target: { kind: mat.target_kind, path: mat.target_path } } : {},
+      ...materialize_strategy ? { materialize_strategy } : {}
+    });
+    for (const a2 of out.assets ?? []) {
+      assetSet.set(`${a2.kind}:${a2.path}`, { kind: a2.kind, path: a2.path });
+      edges.push({
+        runnable_kind: "script",
+        runnable_path: s2.path,
+        asset_kind: a2.kind,
+        asset_path: a2.path,
+        access_type: a2.access_type
+      });
+    }
+    if (mat) {
+      assetSet.set(`${mat.target_kind}:${mat.target_path}`, {
+        kind: mat.target_kind,
+        path: mat.target_path
+      });
+      const hasWrite = edges.some((e2) => e2.runnable_path === s2.path && e2.asset_kind === mat.target_kind && e2.asset_path === mat.target_path && (e2.access_type === "w" || e2.access_type === "rw"));
+      if (!hasWrite) {
+        edges.push({
+          runnable_kind: "script",
+          runnable_path: s2.path,
+          asset_kind: mat.target_kind,
+          asset_path: mat.target_path,
+          access_type: "w"
+        });
+      }
+    }
+    for (const t2 of out.triggers ?? []) {
+      if (t2.kind === "asset") {
+        const at = t2;
+        assetSet.set(`${at.asset_kind}:${at.path}`, {
+          kind: at.asset_kind,
+          path: at.path
+        });
+        triggers.push({
+          trigger_kind: "asset",
+          asset_kind: at.asset_kind,
+          asset_path: at.path,
+          runnable_kind: "script",
+          runnable_path: s2.path
+        });
+      } else {
+        triggers.push({
+          trigger_kind: t2.kind,
+          runnable_kind: "script",
+          runnable_path: s2.path
+        });
+      }
+    }
+  }
+  return {
+    graph: {
+      runnables,
+      assets: [...assetSet.values()],
+      edges,
+      triggers
+    },
+    scripts: pipelineScripts
+  };
+}
+
+// src/commands/pipeline/pipeline.ts
+await __promiseAll([
+  init_conf(),
+  init_codebase(),
+  init_metadata()
+]);
+import { readFile as readFile3 } from "node:fs/promises";
+
+// src/commands/pipeline/dev.ts
+init_mod3();
+init_colors2();
+init_open();
+init_wrapper();
+init_log();
+init_port_probe();
+init_config();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf(),
+  init_codebase()
+]);
+import * as http4 from "node:http";
+import * as fs18 from "node:fs";
+import * as path24 from "node:path";
+import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
+import process26 from "node:process";
+var PORT2 = 3201;
+var LISTEN_HOST = "127.0.0.1";
+async function stableWsToken(remote, workspaceId, root, folder, port) {
+  const key = createHash3("sha256").update(`${remote}\x00${workspaceId}\x00${root}\x00${folder}\x00${port}`).digest("hex").slice(0, 32);
+  let tokenFile;
+  try {
+    tokenFile = path24.join(await getConfigDirPath(), `pipeline-dev-${key}.token`);
+    const existing = fs18.readFileSync(tokenFile, "utf-8").trim();
+    if (existing)
+      return existing;
+  } catch {}
+  const token = randomBytes2(24).toString("base64url");
+  if (tokenFile) {
+    try {
+      fs18.writeFileSync(tokenFile, token, { mode: 384 });
+    } catch {}
+  }
+  return token;
+}
+function resolveFolder(root, folderArg) {
+  if (folderArg)
+    return folderArg.replace(/^f\//, "").replace(/\/$/, "");
+  const rel = path24.relative(root, process26.cwd()).replaceAll("\\", "/");
+  if (rel === "" || rel.startsWith(".."))
+    return;
+  const segs = rel.split("/");
+  if (segs[0] === "f" && segs[1])
+    return segs[1];
+  return;
+}
+async function dev3(opts, folderArg) {
+  const root = workspaceRoot();
+  const folder = resolveFolder(root, folderArg);
+  if (!folder) {
+    error(colors.red("Could not determine the pipeline folder. Pass it explicitly " + "(`wmill pipeline dev <folder>`) or run from inside an `f/<folder>` directory."));
+    process26.exit(1);
+  }
+  const folderDir = path24.join(root, "f", folder);
+  if (!fs18.existsSync(folderDir)) {
+    error(colors.red(`Folder not found on disk: ${folderDir}`));
+    process26.exit(1);
+  }
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const merged = await mergeConfigWithConfigFile(opts);
+  const codebases = await listSyncCodebases(merged);
+  let tempScriptRefs;
+  try {
+    const { buildPreviewTempScriptRefs: buildPreviewTempScriptRefs2 } = await init_generate_metadata().then(() => exports_generate_metadata);
+    tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, merged, codebases, { kind: "all" });
+  } catch {}
+  const EMPTY_GRAPH = { runnables: [], assets: [], edges: [], triggers: [] };
+  async function buildBundle() {
+    const { graph, scripts } = await buildLocalPipelineGraph({
+      root,
+      folder,
+      defaultTs: merged.defaultTs
+    });
+    return {
+      type: "pipeline",
+      folder,
+      graph,
+      scripts,
+      temp_script_refs: tempScriptRefs
+    };
+  }
+  let current;
+  try {
+    current = await buildBundle();
+  } catch (e2) {
+    error(colors.red(`Initial graph build failed: ${e2.message}`));
+    current = { type: "pipeline", folder, graph: EMPTY_GRAPH, scripts: [], temp_script_refs: tempScriptRefs };
+  }
+  info(colors.blue(`Watching f/${folder} — ${current.scripts.length} pipeline script(s)`));
+  const clients = new Set;
+  function broadcast() {
+    const msg = JSON.stringify(current);
+    for (const ws of clients) {
+      if (ws.readyState === import_websocket.default.OPEN)
+        ws.send(msg);
+    }
+  }
+  let timer;
+  const watcher = fs18.watch(folderDir, { recursive: true });
+  watcher.on("change", (_ev, filename) => {
+    if (filename && filename.toString().endsWith(".lock"))
+      return;
+    if (timer)
+      clearTimeout(timer);
+    timer = setTimeout(async () => {
+      timer = undefined;
+      try {
+        current = await buildBundle();
+        info(colors.cyan(`↻ rebuilt graph (${current.scripts.length} scripts)`));
+        broadcast();
+      } catch (e2) {
+        error(colors.red(`Failed to rebuild pipeline graph: ${e2.message}`));
+      }
+    }, 150);
+  });
+  watcher.on("error", (e2) => error(colors.red(`Watcher error: ${e2.message}`)));
+  const port = await resolveBindPort(opts.port ?? PORT2, "wmill pipeline dev", {
+    info: (m3) => info(m3),
+    warn: (m3) => warn(m3)
+  });
+  const server = http4.createServer((_req, res) => {
+    res.writeHead(200);
+    res.end();
+  });
+  const wsToken = await stableWsToken(workspace.remote, workspace.workspaceId, root, folder, port);
+  const wss = new import_websocket_server.default({
+    server,
+    verifyClient: (info2) => {
+      try {
+        const u2 = new URL(info2.req.url ?? "", "http://localhost");
+        return u2.searchParams.get("token") === wsToken;
+      } catch {
+        return false;
+      }
+    }
+  });
+  wss.on("connection", (ws) => {
+    clients.add(ws);
+    try {
+      ws.send(JSON.stringify(current));
+    } catch {}
+    ws.on("close", () => clients.delete(ws));
+    ws.on("error", () => clients.delete(ws));
+  });
+  const pageBase = (opts.frontend ?? workspace.remote).replace(/\/?$/, "/");
+  const url = `${pageBase}pipeline_dev?workspace=${workspace.workspaceId}&wm_token=${workspace.token}&folder=${encodeURIComponent(folder)}&port=${port}&ws_token=${encodeURIComponent(wsToken)}`;
+  server.listen(port, LISTEN_HOST, () => {
+    info(colors.green.bold(`\uD83D\uDE80 Pipeline dev server on ws://localhost:${port}/ws`));
+    info(colors.gray(`Open: ${url}`));
+    if (opts.open !== false) {
+      open_default(url).catch((e2) => warn(colors.yellow(`Failed to open browser: ${e2.message}`)));
+    }
+  });
+  process26.on("SIGINT", () => {
+    info(colors.yellow(`
+\uD83D\uDED1 Shutting down…`));
+    watcher.close();
+    for (const ws of clients)
+      ws.close();
+    server.close();
+    process26.exit(0);
+  });
+}
+var command41 = new Command().description("Live-preview a data pipeline from local files: watch an `f/<folder>` of `// pipeline` scripts, push the working-tree graph to the dev page, and run the cascade via preview (no deploy).").arguments("[folder:string]").option("--port <port:number>", "Port for the dev WebSocket server.").option("--no-open", "Do not open the browser automatically.").option("--frontend <origin:string>", "Origin serving the /pipeline_dev page (e.g. http://localhost:3000 for a locally-run frontend). Defaults to the workspace remote; use it when the remote's deployed frontend predates the dev page.").action(dev3);
+var dev_default3 = command41;
+
+// src/commands/pipeline/docs.ts
+init_gen();
+init_services_gen();
+init_log();
+init_colors2();
+await __promiseAll([
+  init_auth(),
+  init_context(),
+  init_conf()
+]);
+import { writeFile as writeFile25 } from "node:fs/promises";
+import { existsSync as existsSync16, readFileSync as readFileSync7 } from "node:fs";
+import * as path25 from "node:path";
+var ASSET_KINDS = "s3object,ducklake,datatable,volume";
+function assetUri(kind, p3) {
+  const prefix = kind === "s3object" ? "s3" : kind;
+  return `${prefix}://${p3}`;
+}
+async function fetchDeployedGraph(workspaceId, folder) {
+  const res = await fetch(`${OpenAPI.BASE}/w/${workspaceId}/assets/graph?folder=${encodeURIComponent(folder)}&asset_kinds=${ASSET_KINDS}`, { headers: { Authorization: `Bearer ${OpenAPI.TOKEN}` } });
+  if (!res.ok) {
+    throw new Error(`GET assets/graph -> ${res.status}: ${await res.text()}`);
+  }
+  return await res.json();
+}
+function generatePipelineMarkdown(folder, graph, datatableSchemas, local) {
+  const writesByScript = new Map;
+  const readsByScript = new Map;
+  for (const e2 of graph.edges) {
+    if (e2.runnable_kind !== "script")
+      continue;
+    const uri = assetUri(e2.asset_kind, e2.asset_path);
+    if (e2.access_type === "w" || e2.access_type === "rw") {
+      (writesByScript.get(e2.runnable_path) ?? writesByScript.set(e2.runnable_path, []).get(e2.runnable_path)).push(uri);
+    }
+    if (e2.access_type === "r" || e2.access_type === "rw" || e2.access_type === undefined) {
+      (readsByScript.get(e2.runnable_path) ?? readsByScript.set(e2.runnable_path, []).get(e2.runnable_path)).push(uri);
+    }
+  }
+  const onByScript = new Map;
+  const nativeByScript = new Map;
+  for (const t2 of graph.triggers) {
+    if (t2.runnable_kind !== "script")
+      continue;
+    if (t2.trigger_kind === "asset") {
+      const at = t2;
+      (onByScript.get(at.runnable_path) ?? onByScript.set(at.runnable_path, []).get(at.runnable_path)).push(assetUri(at.asset_kind, at.asset_path));
+    } else {
+      (nativeByScript.get(t2.runnable_path) ?? nativeByScript.set(t2.runnable_path, []).get(t2.runnable_path)).push(t2.trigger_kind);
+    }
+  }
+  const scripts = graph.runnables.filter((r2) => r2.usage_kind === "script").map((r2) => r2.path).sort();
+  let md = `# Pipeline \`f/${folder}\`
+
+${local ? "_Built from local working-tree files (`// pipeline` scripts)._" : "_Built from the deployed workspace asset graph._"}
+
+A data pipeline is a folder of scripts marked \`// pipeline\` and wired by asset
+annotations. A script subscribes to upstream data with \`// on <asset-uri>\` and
+produces data by reading/writing assets in its body (\`datatable://\`,
+\`ducklake://\`, \`s3://\`, \`volume://\`). The cascade runs a producer, then every
+downstream subscriber, in topological order.
+
+- **${scripts.length}** script${scripts.length === 1 ? "" : "s"} · **${graph.assets.length}** asset${graph.assets.length === 1 ? "" : "s"}
+
+## Scripts
+
+`;
+  for (const s2 of scripts) {
+    const on = onByScript.get(s2) ?? [];
+    const native = nativeByScript.get(s2) ?? [];
+    const writes = [...new Set(writesByScript.get(s2) ?? [])].sort();
+    const reads = [...new Set(readsByScript.get(s2) ?? [])].sort();
+    md += `### \`${s2}\`
+
+`;
+    if (native.length)
+      md += `- **Triggers:** ${native.map((n2) => `\`${n2}\``).join(", ")}
+`;
+    if (on.length)
+      md += `- **On (subscribes to):** ${on.map((u2) => `\`${u2}\``).join(", ")}
+`;
+    if (reads.length)
+      md += `- **Reads:** ${reads.map((u2) => `\`${u2}\``).join(", ")}
+`;
+    if (writes.length)
+      md += `- **Writes:** ${writes.map((u2) => `\`${u2}\``).join(", ")}
+`;
+    if (!native.length && !on.length && !reads.length && !writes.length) {
+      md += `- _No declared triggers or asset IO._
+`;
+    }
+    md += `
+`;
+  }
+  const referencedDatatables = new Set(graph.assets.filter((a2) => a2.kind === "datatable").map((a2) => a2.path.split("/")[0]));
+  const relevant = (datatableSchemas ?? []).filter((dt) => referencedDatatables.has(dt.datatable_name));
+  if (relevant.length > 0) {
+    md += `## Datatable schemas
+
+`;
+    for (const dt of relevant) {
+      md += `### Datatable \`${dt.datatable_name}\`
+
+`;
+      if (dt.error) {
+        md += `> ⚠️ ${dt.error}
+
+`;
+        continue;
+      }
+      for (const [schemaName, tables3] of Object.entries(dt.schemas ?? {})) {
+        for (const [tableName, columns] of Object.entries(tables3)) {
+          const ref = schemaName === "public" ? `${dt.datatable_name}/${tableName}` : `${dt.datatable_name}/${schemaName}:${tableName}`;
+          md += `- \`datatable://${ref}\`
+`;
+          for (const [col, type] of Object.entries(columns)) {
+            md += `  - \`${col}\`: ${type}
+`;
+          }
+        }
+      }
+      md += `
+`;
+    }
+  }
+  md += `## Working with this pipeline
+
+- **Inspect the graph:** \`wmill pipeline show ${folder} --local\`
+- **Run the cascade locally (no deploy):** \`wmill pipeline run ${folder} --local\`
+  (optionally \`--from <script> --to <script>\` to bound it, \`--dry-run\` to preview the plan)
+- **Live visual preview while editing:** \`wmill pipeline dev ${folder}\`
+- **Deploy:** \`wmill sync push\`
+
+Mark a script as part of this pipeline with a bare \`// pipeline\` comment
+(\`#\` for Python, \`--\` for SQL). Add \`// on <asset-uri>\` lines to subscribe it to
+upstream assets.
+
+---
+*Generated by \`wmill pipeline docs\`.*
+`;
+  return md;
+}
+async function generatePipelineDocs(opts, folder) {
+  const workspace = await resolveWorkspace(opts);
+  await requireLogin(opts);
+  const f3 = folder.replace(/^f\//, "").replace(/\/$/, "");
+  if (f3.split("/").includes("..")) {
+    error(colors.red(`Invalid folder '${folder}': '..' path segments are not allowed.`));
+    return;
+  }
+  const root = workspaceRoot();
+  const merged = await mergeConfigWithConfigFile(opts);
+  const graph = opts.local ? (await buildLocalPipelineGraph({ root, folder: f3, defaultTs: merged.defaultTs })).graph : await fetchDeployedGraph(workspace.workspaceId, f3);
+  if (graph.runnables.length === 0) {
+    if (!opts.local) {
+      try {
+        const localCount = (await buildLocalPipelineGraph({ root, folder: f3, defaultTs: merged.defaultTs })).graph.runnables.length;
+        if (localCount > 0) {
+          info(`No deployed pipeline scripts in f/${f3}, but ${localCount} \`// pipeline\` script(s) exist in the local working tree — run \`wmill pipeline docs ${f3} --local\` to document those.`);
+          return;
+        }
+      } catch {}
+    }
+    info(`No pipeline scripts in f/${f3}.`);
+    return;
+  }
+  let datatableSchemas = [];
+  try {
+    datatableSchemas = await listDataTableSchemas({ workspace: workspace.workspaceId });
+  } catch (err) {
+    warn(colors.yellow(`Could not fetch datatable schemas: ${err.message}`));
+  }
+  const md = generatePipelineMarkdown(f3, graph, datatableSchemas, !!opts.local);
+  const folderDir = path25.join(root, "f", f3);
+  await writeFile25(path25.join(folderDir, "PIPELINE.md"), md, "utf-8");
+  const written = ["PIPELINE.md"];
+  const pointers = [
+    ["AGENTS.md", `See @PIPELINE.md for this pipeline's graph, assets, and how to run it.
+`],
+    ["CLAUDE.md", `Instructions are in @PIPELINE.md
+`]
+  ];
+  for (const [name, content] of pointers) {
+    const p3 = path25.join(folderDir, name);
+    if (existsSync16(p3)) {
+      let existing;
+      try {
+        existing = readFileSync7(p3, "utf-8");
+      } catch {
+        continue;
+      }
+      if (existing.trim() !== content.trim()) {
+        warn(colors.yellow(`Kept existing f/${f3}/${name} (hand-written — not the generated pointer)`));
+        continue;
+      }
+    }
+    await writeFile25(p3, content, "utf-8");
+    written.push(name);
+  }
+  info(colors.green(`✓ Wrote ${written.join(", ")} to f/${f3}`));
+}
+
+// src/commands/pipeline/pipelineUpload.ts
+import { basename as basename10 } from "node:path";
+function parseUploadBinding(spec) {
+  const eq = spec.indexOf("=");
+  const left = eq < 0 ? "" : spec.slice(0, eq).trim();
+  const source = eq < 0 ? "" : spec.slice(eq + 1).trim();
+  if (!left || !source) {
+    throw new Error(`--upload '${spec}' must be <script>[:<param>]=<file-or-s3-uri>`);
+  }
+  const colon = left.indexOf(":");
+  if (colon < 0)
+    return { scriptTok: left, source };
+  const scriptTok = left.slice(0, colon).trim();
+  const param = left.slice(colon + 1).trim();
+  if (!scriptTok || !param) {
+    throw new Error(`--upload '${spec}' must be <script>[:<param>]=<file-or-s3-uri>`);
+  }
+  return { scriptTok, param, source };
+}
+function s3ObjectParams(schema) {
+  const props = schema?.properties ?? {};
+  return Object.keys(props).filter((k2) => props[k2]?.format === "resource-s3_object");
+}
+function devUploadKey(scriptPath, param, source) {
+  return `wmilldev/pipeline/${scriptPath}/${param}/${basename10(source)}`;
+}
+function parseS3Uri(source) {
+  const m3 = source.match(/^s3:\/\/([^/]*)\/(.*)$/);
+  if (!m3)
+    return { s3: source.slice("s3://".length) };
+  const storage = m3[1] || undefined;
+  return storage ? { s3: m3[2], storage } : { s3: m3[2] };
+}
+function s3Arg(param, obj) {
+  return { [param]: obj };
+}
+
 // src/commands/pipeline/pipeline.ts
-async function apiGet(path23) {
-  const response = await fetch(`${OpenAPI.BASE}${path23}`, {
+async function apiGet(path26) {
+  const response = await fetch(`${OpenAPI.BASE}${path26}`, {
     headers: { Authorization: `Bearer ${OpenAPI.TOKEN}` }
   });
   if (!response.ok) {
     const body = await response.text();
-    throw new Error(`GET ${path23} -> ${response.status}: ${body}`);
+    throw new Error(`GET ${path26} -> ${response.status}: ${body}`);
   }
   return await response.json();
 }
@@ -94956,10 +95768,10 @@ async function list18(opts) {
     new Table2().header(["Folder", "Scripts"]).padding(2).border(true).body(items.map((p3) => [`f/${p3.folder}`, String(p3.script_count)])).render();
   }
 }
-var ASSET_KINDS = "s3object,ducklake,datatable,volume";
-function assetUri(kind, path23) {
+var ASSET_KINDS2 = "s3object,ducklake,datatable,volume";
+function assetUri2(kind, path26) {
   const prefix = kind === "s3object" ? "s3" : kind;
-  return `${prefix}://${path23}`;
+  return `${prefix}://${path26}`;
 }
 function shortName(scriptPath) {
   return scriptPath.split("/").pop() ?? scriptPath;
@@ -94970,22 +95782,88 @@ function pushTo(map, key, val) {
 async function show2(opts, folder) {
   if (opts.json)
     setSilent(true);
-  const workspace = await resolveWorkspace(opts);
-  await requireLogin(opts);
   const f3 = folder.replace(/^f\//, "").replace(/\/$/, "");
-  const graph = await apiGet(`/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f3)}&asset_kinds=${ASSET_KINDS}`);
+  let graph;
+  let enrich;
+  if (opts.local) {
+    const merged = await mergeConfigWithConfigFile(opts);
+    graph = (await buildLocalPipelineGraph({ root: workspaceRoot(), folder: f3, defaultTs: merged.defaultTs })).graph;
+  } else {
+    const workspace = await resolveWorkspace(opts);
+    await requireLogin(opts);
+    graph = await apiGet(`/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f3)}&asset_kinds=${ASSET_KINDS2}`);
+    enrich = (nativeByScript, roots) => enrichRootMarkers(workspace.workspaceId, graph, nativeByScript, roots);
+  }
   if (opts.json) {
     console.log(JSON.stringify(graph));
     return;
   }
   if (graph.runnables.length === 0) {
-    info(`No pipeline scripts in f/${f3}. Mark scripts with a \`// pipeline\` comment and push them.`);
+    info(opts.local ? `No \`// pipeline\` scripts found in f/${f3} locally. Mark scripts with a \`// pipeline\` comment.` : `No pipeline scripts in f/${f3}. Mark scripts with a \`// pipeline\` comment and push them.`);
     return;
   }
+  await renderGraph(graph, f3, enrich);
+}
+var MARKER_KINDS = new Set(["data_upload", "webhook", "email"]);
+function recoverHeaderMarkers(content) {
+  const found = [];
+  for (const line of content.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed === "")
+      continue;
+    if (!trimmed.startsWith("//") && !trimmed.startsWith("--") && !trimmed.startsWith("#"))
+      break;
+    const m3 = line.match(/^\s*(?:\/\/|--|#)\s*on\s+(\w+)\s*$/);
+    if (m3 && MARKER_KINDS.has(m3[1]) && !found.includes(m3[1]))
+      found.push(m3[1]);
+  }
+  return found;
+}
+async function enrichRootMarkers(workspaceId, graph, nativeByScript, roots) {
+  await Promise.all(roots.map(async (p3) => {
+    const r2 = graph.runnables.find((x3) => x3.path === p3);
+    if (r2?.usage_kind !== "script")
+      return;
+    try {
+      const script = await getScriptByPath({ workspace: workspaceId, path: p3 });
+      const existing = nativeByScript.get(p3) ?? [];
+      for (const kind of recoverHeaderMarkers(script.content ?? "")) {
+        if (!existing.some((t2) => t2.kind === kind))
+          existing.push({ kind });
+      }
+      if (existing.length > 0)
+        nativeByScript.set(p3, existing);
+    } catch {}
+  }));
+}
+async function enrichDeployedNonAutorunTriggers(workspaceId, graph) {
+  const scripts = (graph.runnables ?? []).filter((r2) => r2.usage_kind === "script");
+  await Promise.all(scripts.map(async (r2) => {
+    const known = new Set((graph.triggers ?? []).filter((t2) => t2.runnable_path === r2.path && MARKER_KINDS.has(t2.trigger_kind)).map((t2) => t2.trigger_kind));
+    let script;
+    try {
+      script = await getScriptByPath({ workspace: workspaceId, path: r2.path });
+    } catch (e2) {
+      throw new Error(`Could not verify triggers for ${r2.path} (${e2?.body ?? e2?.message ?? e2}) — ` + `aborting so an input-only entrypoint isn't run with empty args; retry once resolved.`);
+    }
+    for (const kind of recoverHeaderMarkers(script.content ?? "")) {
+      if (known.has(kind))
+        continue;
+      known.add(kind);
+      graph.triggers.push({
+        trigger_kind: kind,
+        runnable_kind: "script",
+        runnable_path: r2.path
+      });
+    }
+  }));
+}
+async function renderGraph(graph, f3, enrich) {
   const writesByScript = new Map;
   for (const e2 of graph.edges) {
     if (e2.access_type === "w" || e2.access_type === "rw") {
-      const uri = assetUri(e2.asset_kind, e2.asset_path);
+      const uri = assetUri2(e2.asset_kind, e2.asset_path);
       pushTo(writesByScript, e2.runnable_path, uri);
     }
   }
@@ -94995,7 +95873,7 @@ async function show2(opts, folder) {
   for (const t2 of graph.triggers) {
     if (t2.trigger_kind === "asset") {
       const at = t2;
-      const uri = assetUri(at.asset_kind, at.asset_path);
+      const uri = assetUri2(at.asset_kind, at.asset_path);
       pushTo(subsByAsset, uri, t2.runnable_path);
       pushTo(subsByScript, t2.runnable_path, uri);
     } else {
@@ -95046,33 +95924,8 @@ async function show2(opts, folder) {
     });
   }
   const roots = graph.runnables.map((r2) => r2.path).filter((p3) => !subsByScript.get(p3)?.length).sort();
-  const MARKER_KINDS = ["data_upload", "webhook", "email"];
-  await Promise.all(roots.map(async (p3) => {
-    const r2 = graph.runnables.find((x3) => x3.path === p3);
-    if (r2?.usage_kind !== "script")
-      return;
-    try {
-      const script = await getScriptByPath({
-        workspace: workspace.workspaceId,
-        path: p3
-      });
-      const existing = nativeByScript.get(p3) ?? [];
-      for (const line of (script.content ?? "").split(`
-`)) {
-        const m3 = line.match(/^\s*(?:\/\/|--|#)\s*on\s+(\w+)\s*$/);
-        if (!m3)
-          continue;
-        const kind = m3[1];
-        if (!MARKER_KINDS.includes(kind))
-          continue;
-        if (!existing.some((t2) => t2.kind === kind)) {
-          existing.push({ kind });
-        }
-      }
-      if (existing.length > 0)
-        nativeByScript.set(p3, existing);
-    } catch {}
-  }));
+  if (enrich)
+    await enrich(nativeByScript, roots);
   const scriptCount = graph.runnables.length;
   const assetCount = graph.assets.length;
   info(colors.bold(`Pipeline f/${f3}`) + colors.dim(` — ${scriptCount} script${scriptCount === 1 ? "" : "s"} · ${assetCount} asset${assetCount === 1 ? "" : "s"}`));
@@ -95106,14 +95959,101 @@ async function waitJob(workspace, id) {
   }
   throw new Error(`Timed out waiting for job ${id}`);
 }
+async function resolveUploadArgs(bindings, scriptPath, workspaceId, local, localScripts) {
+  let schema;
+  const loadSchema = async () => {
+    if (schema)
+      return schema;
+    if (local) {
+      const ls = localScripts?.get(scriptPath);
+      if (!ls) {
+        throw new Error(`No local file for ${scriptPath} to infer its S3Object parameter.`);
+      }
+      schema = (await inferSchema(ls.language, ls.content, {}, scriptPath)).schema;
+    } else {
+      schema = (await getScriptByPath({ workspace: workspaceId, path: scriptPath })).schema;
+    }
+    return schema;
+  };
+  const args = {};
+  for (const binding of bindings) {
+    let param = binding.param;
+    if (!param) {
+      const params = s3ObjectParams(await loadSchema());
+      if (params.length === 1)
+        param = params[0];
+      else if (params.length === 0) {
+        throw new Error(`${scriptPath} declares no S3Object parameter to bind --upload to.`);
+      } else {
+        throw new Error(`${scriptPath} has multiple S3Object parameters (${params.join(", ")}) — pick one with --upload ${binding.scriptTok}:<param>=${binding.source}`);
+      }
+    }
+    if (param in args) {
+      throw new Error(`--upload binds ${scriptPath}:${param} more than once.`);
+    }
+    let obj;
+    if (binding.source.startsWith("s3://")) {
+      obj = parseS3Uri(binding.source);
+    } else {
+      const buf = await readFile3(binding.source);
+      const key = devUploadKey(scriptPath, param, binding.source);
+      await fileUpload({
+        workspace: workspaceId,
+        fileKey: key,
+        requestBody: new Blob([buf])
+      });
+      info(colors.gray(`  ↑ ${binding.source} → s3://${key}`));
+      obj = { s3: key };
+    }
+    Object.assign(args, s3Arg(param, obj));
+  }
+  return args;
+}
 async function run5(opts, folder) {
   if (opts.json)
     setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const f3 = folder.replace(/^f\//, "").replace(/\/$/, "");
-  const graph = await apiGet(`/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f3)}&asset_kinds=${ASSET_KINDS}`);
-  const starts = validStarts(graph);
+  let graph;
+  let localScripts;
+  let tempScriptRefs;
+  if (opts.local) {
+    const merged = await mergeConfigWithConfigFile(opts);
+    const built = await buildLocalPipelineGraph({
+      root: workspaceRoot(),
+      folder: f3,
+      defaultTs: merged.defaultTs
+    });
+    graph = built.graph;
+    localScripts = new Map(built.scripts.map((s2) => [s2.path, s2]));
+    try {
+      const codebases = await listSyncCodebases(merged);
+      const { buildPreviewTempScriptRefs: buildPreviewTempScriptRefs2 } = await init_generate_metadata().then(() => exports_generate_metadata);
+      tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, merged, codebases, { kind: "all" });
+    } catch {}
+  } else {
+    graph = await apiGet(`/w/${workspace.workspaceId}/assets/graph?folder=${encodeURIComponent(f3)}&asset_kinds=${ASSET_KINDS2}`);
+    await enrichDeployedNonAutorunTriggers(workspace.workspaceId, graph);
+  }
+  const boundBindingsByPath = new Map;
+  const boundNodeIds = new Set;
+  for (const spec of opts.upload ?? []) {
+    const binding = parseUploadBinding(spec);
+    const id = resolveToken(graph, binding.scriptTok);
+    if (!id || !id.startsWith("script:")) {
+      const matches = graph.runnables.filter((r2) => r2.usage_kind === "script" && (r2.path.split("/").pop() ?? r2.path) === binding.scriptTok);
+      if (matches.length > 1) {
+        throw new Error(`--upload '${binding.scriptTok}' matches multiple scripts (${matches.map((r2) => r2.path).sort().join(", ")}) — use the full path.`);
+      }
+      throw new Error(`--upload '${binding.scriptTok}' matched no script in f/${f3}.`);
+    }
+    const p3 = scriptPathOf(id);
+    (boundBindingsByPath.get(p3) ?? boundBindingsByPath.set(p3, []).get(p3)).push(binding);
+    boundNodeIds.add(id);
+  }
+  const starts = new Set([...validStarts(graph), ...boundNodeIds]);
+  let runAll = false;
   let start;
   if (opts.from) {
     const resolved = resolveToken(graph, opts.from);
@@ -95132,8 +96072,10 @@ async function run5(opts, folder) {
     start = [...starts][0];
   } else if (starts.size === 0) {
     throw new Error(`No schedule or manual root in f/${f3} to start a bounded run from.`);
+  } else if ((opts.to ?? []).length === 0) {
+    runAll = true;
   } else {
-    throw new Error(`f/${f3} has ${starts.size} possible starts — pass --from <script>. Candidates: ${scriptsOf(starts).sort().join(", ")}`);
+    throw new Error(`f/${f3} has ${starts.size} possible starts — pass --from <script> when using --to. Candidates: ${scriptsOf(starts).sort().join(", ")}`);
   }
   const toTokens = (opts.to ?? []).flatMap((t2) => t2.split(",")).map((t2) => t2.trim()).filter(Boolean);
   const ends = [];
@@ -95154,34 +96096,50 @@ async function run5(opts, folder) {
   }
   const idLabel = (id) => id.startsWith("script:") ? scriptPathOf(id) : id;
   const dag = buildLineageDag(graph);
+  const barriers = new Set([...nonAutorunTriggerScripts(graph)].filter((id) => !starts.has(id)));
   let selectedScripts;
   let reachableEnds = [];
   let droppedEnds = [];
-  if (ends.length === 0) {
-    const all = new Set(descendants(dag, start));
-    all.add(start);
-    selectedScripts = new Set(scriptsOf(all));
+  if (runAll) {
+    selectedScripts = new Set(scriptsOf(reachableCutting(dag, starts, barriers)));
+  } else if (ends.length === 0) {
+    selectedScripts = new Set(scriptsOf(reachableCutting(dag, [start], barriers)));
   } else {
     const res = boundedSet(dag, start, ends);
-    reachableEnds = res.reachableEnds;
     droppedEnds = res.droppedEnds;
     for (const d3 of droppedEnds) {
       warn(`end '${idLabel(d3)}' is not downstream of the start — ignored.`);
     }
-    selectedScripts = new Set(scriptsOf(res.nodes));
+    const reachable = reachableCutting(dag, [start], barriers);
+    selectedScripts = new Set(scriptsOf([...res.nodes].filter((n2) => reachable.has(n2))));
+    for (const e2 of res.reachableEnds) {
+      if (reachable.has(e2)) {
+        reachableEnds.push(e2);
+      } else {
+        droppedEnds.push(e2);
+        warn(`end '${idLabel(e2)}' is only reachable through a skipped input/event handler — not run (bind it with --upload to include it).`);
+      }
+    }
   }
   const { order, cyclic } = topoOrder(graph, selectedScripts);
   if (cyclic.length > 0) {
     warn(`Skipping ${cyclic.length} script(s) on a dependency cycle: ${cyclic.sort().join(", ")}`);
   }
+  const orderSet = new Set(order);
+  const boundInOrder = [...boundBindingsByPath.keys()].filter((p3) => orderSet.has(p3)).sort();
+  for (const p3 of boundBindingsByPath.keys()) {
+    if (!orderSet.has(p3))
+      warn(`--upload for ${p3} is unused — it isn't in the run selection.`);
+  }
   if (opts.json) {
     console.log(JSON.stringify({
-      start: scriptPathOf(start),
+      start: runAll ? null : scriptPathOf(start),
       ends: ends.map(idLabel),
       reachableEnds: reachableEnds.map(idLabel),
       droppedEnds: droppedEnds.map(idLabel),
       order,
-      cyclic
+      cyclic,
+      uploads: boundInOrder
     }));
   }
   if (order.length === 0) {
@@ -95191,32 +96149,56 @@ async function run5(opts, folder) {
   }
   if (opts.dryRun) {
     if (!opts.json) {
-      info(colors.bold(`Bounded run plan — ${order.length} script${order.length === 1 ? "" : "s"}`) + colors.dim(` (from ${shortName(scriptPathOf(start))})`));
-      order.forEach((p3, i) => info(`  ${i + 1}. ${p3}`));
+      info(colors.bold(`Bounded run plan — ${order.length} script${order.length === 1 ? "" : "s"}`) + colors.dim(runAll ? ` (whole pipeline)` : ` (from ${shortName(scriptPathOf(start))})`));
+      order.forEach((p3, i) => info(`  ${i + 1}. ${p3}${boundBindingsByPath.has(p3) ? colors.dim(" (← --upload)") : ""}`));
     }
     return;
   }
-  for (const path23 of order) {
+  const uploadArgs = new Map;
+  for (const nodePath2 of boundInOrder) {
+    uploadArgs.set(nodePath2, await resolveUploadArgs(boundBindingsByPath.get(nodePath2), nodePath2, workspace.workspaceId, opts.local, localScripts));
+  }
+  for (const nodePath2 of order) {
     if (!opts.json)
-      info(colors.gray(`▶ running ${path23}…`));
-    const id = await runScriptByPath({
-      workspace: workspace.workspaceId,
-      path: path23,
-      requestBody: { _wmill_skip_asset_dispatch: true }
-    });
+      info(colors.gray(`▶ running ${nodePath2}…`));
+    const nodeArgs = { ...uploadArgs.get(nodePath2) ?? {}, _wmill_skip_asset_dispatch: true };
+    let id;
+    if (opts.local) {
+      const ls = localScripts.get(nodePath2);
+      if (!ls) {
+        throw new Error(`No local file for ${nodePath2} — is it a \`// pipeline\` script in f/${f3}?`);
+      }
+      id = await runScriptPreview({
+        workspace: workspace.workspaceId,
+        requestBody: {
+          content: ls.content,
+          language: ls.language,
+          path: nodePath2,
+          args: nodeArgs,
+          temp_script_refs: tempScriptRefs,
+          ...ls.tag ? { tag: ls.tag } : {}
+        }
+      });
+    } else {
+      id = await runScriptByPath({
+        workspace: workspace.workspaceId,
+        path: nodePath2,
+        requestBody: nodeArgs
+      });
+    }
     const ok = await waitJob(workspace.workspaceId, id);
     if (!ok) {
-      throw new Error(`Bounded run failed at ${path23} (job ${id}).`);
+      throw new Error(`Bounded run failed at ${nodePath2} (job ${id}).`);
     }
     if (!opts.json)
-      info(colors.green(`  ✓ ${path23}`));
+      info(colors.green(`  ✓ ${nodePath2}`));
   }
   if (!opts.json) {
     info(colors.green.bold(`Bounded run complete — ${order.length} script(s) succeeded.`));
   }
 }
-var command41 = new Command().description("inspect asset-driven pipelines (scripts marked `// pipeline`, wired by `// on <spec>` annotations)").command("list", "list pipeline folders in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list18).command("show", "render a pipeline folder's DAG (sources, lineage, subscriptions) in the terminal").arguments("<folder:string>").option("--json", "Output the raw asset graph as JSON").action(show2).command("run", "run a bounded cascade: from a schedule/manual root, fan downstream up to the --to end node(s)").arguments("<folder:string>").option("--from <script:string>", "Start script (short name or path). Defaults to the folder's sole schedule/manual root.").option("--to <node:string>", "End node(s) to stop at — script names/paths or asset URIs (e.g. datatable://main/staged). Repeatable or comma-separated. Omit to run the full downstream.", { collect: true }).option("--dry-run", "Print the topological run plan without executing.").option("--json", "Output the plan as JSON (for piping to jq).").action(run5);
-var pipeline_default = command41;
+var command42 = new Command().description("inspect asset-driven pipelines (scripts marked `// pipeline`, wired by `// on <spec>` annotations)").command("list", "list pipeline folders in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list18).command("show", "render a pipeline folder's DAG (sources, lineage, subscriptions) in the terminal").arguments("<folder:string>").option("--json", "Output the raw asset graph as JSON").option("--local", "Build the graph from local working-tree files (// pipeline scripts) instead of the deployed workspace — no deploy needed.").action(show2).command("run", "run a bounded cascade: from a schedule/manual root, fan downstream up to the --to end node(s)").arguments("<folder:string>").option("--from <script:string>", "Start script (short name or path). Defaults to the folder's sole schedule/manual root.").option("--to <node:string>", "End node(s) to stop at — script names/paths or asset URIs (e.g. datatable://main/staged). Repeatable or comma-separated. Omit to run the full downstream.", { collect: true }).option("--dry-run", "Print the topological run plan without executing.").option("--json", "Output the plan as JSON (for piping to jq).").option("--local", "Run the local working-tree scripts via preview (no deploy) instead of the deployed versions; the graph is built from local files.").option("--upload <binding:string>", "Bind an object to a data_upload/webhook entry point so it runs in the cascade, as SCRIPT[:PARAM]=SOURCE (SOURCE is a local file or an s3://key). Local files are uploaded to the workspace store; the S3Object param is inferred when the script has exactly one. Repeatable.", { collect: true }).action(run5).command("docs", "generate PIPELINE.md (+ AGENTS.md pointer) describing a folder's pipeline graph and datatable schemas, for an editor / agentic loop").arguments("<folder:string>").option("--local", "Build the graph from local working-tree files instead of the deployed workspace.").action(generatePipelineDocs).command("dev", dev_default3);
+var pipeline_default = command42;
 
 // src/commands/ducklake/ducklake.ts
 init_mod3();
@@ -95246,8 +96228,8 @@ async function run6(opts, sql) {
   const name = opts.name ?? DEFAULT_DUCKLAKE_NAME;
   await runCatalogQuery(opts, "ducklake", name, sql);
 }
-var command42 = new Command().description("ducklake related commands").command("list", "list all ducklakes in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list19).command("run", "run a SQL query on a ducklake").arguments("<sql:string>").option("-n --name <name:string>", "Ducklake name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run6);
-var ducklake_default = command42;
+var command43 = new Command().description("ducklake related commands").command("list", "list all ducklakes in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list19).command("run", "run a SQL query on a ducklake").arguments("<sql:string>").option("-n --name <name:string>", "Ducklake name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run6);
+var ducklake_default = command43;
 
 // src/commands/object-storage/object-storage.ts
 init_mod3();
@@ -95262,8 +96244,8 @@ await __promiseAll([
   init_utils()
 ]);
 import { Buffer as Buffer5 } from "node:buffer";
-import { readFile as readFile3, writeFile as writeFile25 } from "node:fs/promises";
-import { basename as basename10 } from "node:path";
+import { readFile as readFile4, writeFile as writeFile26 } from "node:fs/promises";
+import { basename as basename11 } from "node:path";
 function formatBytes(n2) {
   if (n2 == null)
     return "-";
@@ -95326,7 +96308,7 @@ More results available. Use --marker '${result2.next_marker}' to paginate.`);
 async function upload(opts, localPath, fileKey) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const buf = await readFile3(localPath);
+  const buf = await readFile4(localPath);
   const blob = new Blob([buf], { type: opts.contentType ?? "application/octet-stream" });
   await fileUpload({
     workspace: workspace.workspaceId,
@@ -95364,8 +96346,8 @@ async function download(opts, fileKey, outputPath) {
     process.stdout.write(buf);
     return;
   }
-  const dest = outputPath ?? basename10(fileKey);
-  await writeFile25(dest, buf);
+  const dest = outputPath ?? basename11(fileKey);
+  await writeFile26(dest, buf);
   info(colors.green(`Downloaded ${fileKey} -> ${dest}`));
 }
 async function del(opts, fileKey) {
@@ -95448,8 +96430,8 @@ async function preview3(opts, fileKey) {
 `);
   }
 }
-var command43 = new Command().alias("s3").description("Object storage (S3) related commands. Operates on the workspace's default object storage; use --storage to target a configured secondary storage.").action(listStorages).command("list", "List configured object storages for the workspace (default + secondary).").option("--json", "Output as JSON (for piping to jq)").action(listStorages).command("files", "List files in an object storage. Optionally filter by prefix.").alias("ls").arguments("[prefix:string]").option("--json", "Output as JSON (for piping to jq)").option("--max-keys <maxKeys:number>", "Page size (default 100)").option("--marker <marker:string>", "Pagination marker from a previous response").option("--storage <storage:string>", "Secondary storage name (omit for the workspace default)").action(listFiles).command("upload", "Upload a local file to object storage at the given file key.").arguments("<local_path:string> <file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--content-type <contentType:string>", "Content-Type header to set on the object").option("--content-disposition <contentDisposition:string>", "Content-Disposition header to set on the object").action(upload).command("download", "Download an object to a local file (or stdout). Default output path is the basename of the file key in the current directory.").arguments("<file_key:string> [output_path:string]").option("--storage <storage:string>", "Secondary storage name").option("--stdout", "Write file contents to stdout instead of a file").action(download).command("delete", "Delete an object from object storage. Prompts for confirmation unless --yes is set.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--yes", "Skip the confirmation prompt").action(del).command("move", "Move an object within the same storage (rename or relocate by key).").arguments("<src_file_key:string> <dest_file_key:string>").option("--storage <storage:string>", "Secondary storage name").action(move).command("info", "Show metadata (size, mime, last-modified) for an object.").arguments("<file_key:string>").option("--json", "Output as JSON (for piping to jq)").option("--storage <storage:string>", "Secondary storage name").action(info2).command("preview", "Preview the contents of an object (text/CSV). Use --bytes-from / --bytes-length to peek at a slice of binary files.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--mime <mime:string>", "Override the detected mime type (e.g. text/csv)").option("--bytes-from <bytesFrom:number>", "Start offset in bytes").option("--bytes-length <bytesLength:number>", "Number of bytes to read").option("--csv-separator <csvSeparator:string>", "CSV column separator (default ,)").option("--csv-header", "Treat the first CSV row as a header").action(preview3);
-var object_storage_default = command43;
+var command44 = new Command().alias("s3").description("Object storage (S3) related commands. Operates on the workspace's default object storage; use --storage to target a configured secondary storage.").action(listStorages).command("list", "List configured object storages for the workspace (default + secondary).").option("--json", "Output as JSON (for piping to jq)").action(listStorages).command("files", "List files in an object storage. Optionally filter by prefix.").alias("ls").arguments("[prefix:string]").option("--json", "Output as JSON (for piping to jq)").option("--max-keys <maxKeys:number>", "Page size (default 100)").option("--marker <marker:string>", "Pagination marker from a previous response").option("--storage <storage:string>", "Secondary storage name (omit for the workspace default)").action(listFiles).command("upload", "Upload a local file to object storage at the given file key.").arguments("<local_path:string> <file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--content-type <contentType:string>", "Content-Type header to set on the object").option("--content-disposition <contentDisposition:string>", "Content-Disposition header to set on the object").action(upload).command("download", "Download an object to a local file (or stdout). Default output path is the basename of the file key in the current directory.").arguments("<file_key:string> [output_path:string]").option("--storage <storage:string>", "Secondary storage name").option("--stdout", "Write file contents to stdout instead of a file").action(download).command("delete", "Delete an object from object storage. Prompts for confirmation unless --yes is set.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--yes", "Skip the confirmation prompt").action(del).command("move", "Move an object within the same storage (rename or relocate by key).").arguments("<src_file_key:string> <dest_file_key:string>").option("--storage <storage:string>", "Secondary storage name").action(move).command("info", "Show metadata (size, mime, last-modified) for an object.").arguments("<file_key:string>").option("--json", "Output as JSON (for piping to jq)").option("--storage <storage:string>", "Secondary storage name").action(info2).command("preview", "Preview the contents of an object (text/CSV). Use --bytes-from / --bytes-length to peek at a slice of binary files.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--mime <mime:string>", "Override the detected mime type (e.g. text/csv)").option("--bytes-from <bytesFrom:number>", "Start offset in bytes").option("--bytes-length <bytesLength:number>", "Number of bytes to read").option("--csv-separator <csvSeparator:string>", "CSV column separator (default ,)").option("--csv-header", "Treat the first CSV row as a header").action(preview3);
+var object_storage_default = command44;
 
 // src/main.ts
 await init_context();
@@ -95469,7 +96451,7 @@ async function checkVersionSafe(cmd) {
   }
   mainCommand.version(`${currentVersion}  (New version available: ${latestVersion}. Run '${mainCommand.getName()} upgrade' to upgrade to the latest version!)`);
 }
-var command44 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).helpOption("-h, --help", "Show this help.", {
+var command45 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).helpOption("-h, --help", "Show this help.", {
   action: async function() {
     const self2 = this;
     const long = self2.getRawArgs().includes(`--${self2.getHelpOption()?.name}`);
@@ -95511,20 +96493,20 @@ var command44 = new Command().name("wmill").action(() => info(`Welcome to Windmi
   error(e2);
   info("Try running with sudo and otherwise check the result of the command: npm uninstall windmill-cli && npm install -g windmill-cli");
 })).command("completions", new Command().description("Generate shell completions.").command("bash", new Command().description("Generate bash completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command44, "bash") + `
+  process.stdout.write(generateShellCompletions(command45, "bash") + `
 `);
 })).command("zsh", new Command().description("Generate zsh completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command44, "zsh") + `
+  process.stdout.write(generateShellCompletions(command45, "zsh") + `
 `);
 })).command("fish", new Command().description("Generate fish completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command44, "fish") + `
+  process.stdout.write(generateShellCompletions(command45, "fish") + `
 `);
 })));
 async function main2() {
   try {
     const args = process.argv.slice(2);
     if (args.length === 0) {
-      command44.showHelp();
+      command45.showHelp();
     }
     const LOG_LEVEL = args.includes("--verbose") || args.includes("--debug") ? "DEBUG" : "INFO";
     setShowDiffs(args.includes("--show-diffs"));
@@ -95544,7 +96526,7 @@ async function main2() {
       const { warnIfTsconfigStale: warnIfTsconfigStale2 } = await init_tsconfig().then(() => exports_tsconfig);
       await warnIfTsconfigStale2().catch(() => {});
     }
-    await command44.parse(args);
+    await command45.parse(args);
   } catch (e2) {
     if (e2 && typeof e2 === "object" && "name" in e2 && e2.name === "ApiError") {
       const body = e2.body;
@@ -95580,7 +96562,7 @@ if (isMain()) {
     process.stdin.destroy();
   });
 }
-var main_default = command44;
+var main_default = command45;
 export {
   add as workspaceAdd,
   workspace_default as workspace,