windmill-cli 1.783.0 → 1.784.0

package/esm/main.js

@@ -16784,7 +16784,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.783.0",
+    VERSION: "1.784.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17210,6 +17210,7 @@ __export(exports_services_gen, {
   resumeSuspendedFlowAsOwner: () => resumeSuspendedFlowAsOwner,
   resumeSuspended: () => resumeSuspended,
   resultById: () => resultById,
+  restoreResourceVersion: () => restoreResourceVersion,
   restartWorkerGroup: () => restartWorkerGroup,
   restartFlowAtStep: () => restartFlowAtStep,
   resolveNpmPackageVersion: () => resolveNpmPackageVersion,
@@ -17487,9 +17488,11 @@ __export(exports_services_gen, {
   getRuffConfig: () => getRuffConfig,
   getRootJobId: () => getRootJobId,
   getResumeUrls: () => getResumeUrls,
+  getResourceVersion: () => getResourceVersion,
   getResourceValueInterpolated: () => getResourceValueInterpolated,
   getResourceValue: () => getResourceValue,
   getResourceType: () => getResourceType,
+  getResourceHistory: () => getResourceHistory,
   getResource: () => getResource,
   getRawAppData: () => getRawAppData,
   getQueuePosition: () => getQueuePosition,
@@ -17833,6 +17836,7 @@ __export(exports_services_gen, {
   compareWorkspaces: () => compareWorkspaces,
   commitKafkaOffsets: () => commitKafkaOffsets,
   closeDeploymentRequestMerged: () => closeDeploymentRequestMerged,
+  clearResourceHistory: () => clearResourceHistory,
   clearIndex: () => clearIndex,
   checkSchemaContracts: () => checkSchemaContracts,
   checkS3FolderExists: () => checkS3FolderExists,
@@ -20335,6 +20339,42 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, getResourceHistory = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/resources/history/p/{path}",
+    path: {
+      workspace: data3.workspace,
+      path: data3.path
+    }
+  });
+}, clearResourceHistory = (data3) => {
+  return request(OpenAPI, {
+    method: "DELETE",
+    url: "/w/{workspace}/resources/history/p/{path}",
+    path: {
+      workspace: data3.workspace,
+      path: data3.path
+    }
+  });
+}, getResourceVersion = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/resources/history/v/{version}",
+    path: {
+      workspace: data3.workspace,
+      version: data3.version
+    }
+  });
+}, restoreResourceVersion = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/resources/history/restore/v/{version}",
+    path: {
+      workspace: data3.workspace,
+      version: data3.version
+    }
+  });
 }, getResource = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -26598,6 +26638,7 @@ __export(exports_gen, {
   resumeSuspendedFlowAsOwner: () => resumeSuspendedFlowAsOwner,
   resumeSuspended: () => resumeSuspended,
   resultById: () => resultById,
+  restoreResourceVersion: () => restoreResourceVersion,
   restartWorkerGroup: () => restartWorkerGroup,
   restartFlowAtStep: () => restartFlowAtStep,
   resolveNpmPackageVersion: () => resolveNpmPackageVersion,
@@ -26875,9 +26916,11 @@ __export(exports_gen, {
   getRuffConfig: () => getRuffConfig,
   getRootJobId: () => getRootJobId,
   getResumeUrls: () => getResumeUrls,
+  getResourceVersion: () => getResourceVersion,
   getResourceValueInterpolated: () => getResourceValueInterpolated,
   getResourceValue: () => getResourceValue,
   getResourceType: () => getResourceType,
+  getResourceHistory: () => getResourceHistory,
   getResource: () => getResource,
   getRawAppData: () => getRawAppData,
   getQueuePosition: () => getQueuePosition,
@@ -27221,6 +27264,7 @@ __export(exports_gen, {
   compareWorkspaces: () => compareWorkspaces,
   commitKafkaOffsets: () => commitKafkaOffsets,
   closeDeploymentRequestMerged: () => closeDeploymentRequestMerged,
+  clearResourceHistory: () => clearResourceHistory,
   clearIndex: () => clearIndex,
   checkSchemaContracts: () => checkSchemaContracts,
   checkS3FolderExists: () => checkS3FolderExists,
@@ -27383,7 +27427,7 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.783.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.784.0";
 
 // src/utils/git.ts
 var exports_git = {};
@@ -31056,9 +31100,13 @@ __export(exports_context, {
   validatePath: () => validatePath,
   tryResolveVersion: () => tryResolveVersion,
   tryResolveBranchWorkspace: () => tryResolveBranchWorkspace,
+  toSyncRootRelativePath: () => toSyncRootRelativePath,
   resolveWorkspace: () => resolveWorkspace,
-  fetchVersion: () => fetchVersion
+  fetchVersion: () => fetchVersion,
+  assertRemotePath: () => assertRemotePath
 });
+import { existsSync as existsSync5, realpathSync } from "node:fs";
+import { basename as basename4, dirname as dirname7, isAbsolute as isAbsolute3, join as join9, relative as relative6, resolve as resolve6 } from "node:path";
 async function selectFromMultipleProfiles(profiles, baseUrl2, workspaceId, context, configDir) {
   if (profiles.length === 1) {
     return profiles[0];
@@ -31465,6 +31513,34 @@ async function tryResolveVersion(opts) {
     return;
   }
 }
+function syncRoot() {
+  const wmillYaml = getWmillYamlPath();
+  return wmillYaml ? dirname7(wmillYaml) : process.cwd();
+}
+function toSyncRootRelativePath(arg, cwdBeforeConfig) {
+  const root = syncRoot();
+  const candidates = isAbsolute3(arg) ? [arg] : [resolve6(cwdBeforeConfig, arg), resolve6(root, arg)];
+  const abs = candidates.find((c) => existsSync5(c)) ?? candidates.find((c) => existsSync5(dirname7(c))) ?? candidates.at(-1);
+  const rel = relative6(root, abs);
+  if (rel === "")
+    return ".";
+  if (!rel.startsWith(".."))
+    return rel;
+  try {
+    const resolved = relative6(realpathSync(root), realpathOfNamed(abs));
+    return resolved === "" ? "." : resolved;
+  } catch {
+    return rel;
+  }
+}
+function realpathOfNamed(p) {
+  return existsSync5(p) ? realpathSync(p) : join9(realpathSync(dirname7(p)), basename4(p));
+}
+function assertRemotePath(remotePath, arg) {
+  if (REMOTE_PATH_RE.test(remotePath))
+    return;
+  throw new Error(`Cannot derive a Windmill path from '${arg}'` + (remotePath ? ` (it maps to '${remotePath}')` : "") + `: a preview runs under the path of the file it previews, which must sit inside the wmill.yaml root and be of the form <u|g|f>/<username|group|folder>/<name>.`);
+}
 function validatePath(path5) {
   if (!(path5.startsWith("g") || path5.startsWith("u") || path5.startsWith("f"))) {
     infoStderr(colors.red("Given remote path looks invalid. Remote paths are typically of the form <u|g|f>/<username|group|folder>/..."));
@@ -31472,6 +31548,7 @@ function validatePath(path5) {
   }
   return true;
 }
+var REMOTE_PATH_RE;
 var init_context = __esm(async () => {
   init_colors2();
   init_log();
@@ -31489,6 +31566,7 @@ var init_context = __esm(async () => {
     init_branch_profiles(),
     init_conf()
   ]);
+  REMOTE_PATH_RE = /^[ufg](\/[^/]+){2,}$/;
 });
 
 // src/commands/sync/global.ts
@@ -33697,13 +33775,13 @@ return schema
 import { createServer as createServer2 } from "node:net";
 import { execSync as execSync3 } from "node:child_process";
 function isPortFree(port, host) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const s = createServer2();
     s.once("error", (err) => {
       const code2 = err.code ?? "";
-      resolve6(code2 !== "EADDRINUSE" && code2 !== "EACCES");
+      resolve7(code2 !== "EADDRINUSE" && code2 !== "EACCES");
     });
-    s.once("listening", () => s.close(() => resolve6(true)));
+    s.once("listening", () => s.close(() => resolve7(true)));
     s.listen(port, host);
   });
 }
@@ -37832,8 +37910,8 @@ var require_streamx = __commonJS((exports, module) => {
           return this;
         },
         next() {
-          return new Promise(function(resolve6, reject) {
-            promiseResolve = resolve6;
+          return new Promise(function(resolve7, reject) {
+            promiseResolve = resolve7;
             promiseReject = reject;
             const data3 = stream.read();
             if (data3 !== null)
@@ -37870,14 +37948,14 @@ var require_streamx = __commonJS((exports, module) => {
       }
       function destroy(err) {
         stream.destroy(err);
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve7, reject) => {
           if (stream._duplexState & DESTROYED)
-            return resolve6({ value: undefined, done: true });
+            return resolve7({ value: undefined, done: true });
           stream.once("close", function() {
             if (err)
               reject(err);
             else
-              resolve6({ value: undefined, done: true });
+              resolve7({ value: undefined, done: true });
           });
         });
       }
@@ -37929,8 +38007,8 @@ var require_streamx = __commonJS((exports, module) => {
         return Promise.resolve(true);
       if (state.drains === null)
         state.drains = [];
-      return new Promise((resolve6) => {
-        state.drains.push({ writes, resolve: resolve6 });
+      return new Promise((resolve7) => {
+        state.drains.push({ writes, resolve: resolve7 });
       });
     }
     write(data3) {
@@ -38044,11 +38122,11 @@ var require_streamx = __commonJS((exports, module) => {
     cb(null);
   }
   function pipelinePromise(...streams) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       return pipeline(...streams, (err) => {
         if (err)
           return reject(err);
-        resolve6();
+        resolve7();
       });
     });
   }
@@ -38754,16 +38832,16 @@ var require_extract = __commonJS((exports, module) => {
         entryCallback = null;
         cb(err);
       }
-      function onnext(resolve6, reject) {
+      function onnext(resolve7, reject) {
         if (error2) {
           return reject(error2);
         }
         if (entryStream) {
-          resolve6({ value: entryStream, done: false });
+          resolve7({ value: entryStream, done: false });
           entryStream = null;
           return;
         }
-        promiseResolve = resolve6;
+        promiseResolve = resolve7;
         promiseReject = reject;
         consumeCallback(null);
         if (extract._finished && promiseResolve) {
@@ -38794,14 +38872,14 @@ var require_extract = __commonJS((exports, module) => {
       function destroy(err) {
         extract.destroy(err);
         consumeCallback(err);
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve7, reject) => {
           if (extract.destroyed)
-            return resolve6({ value: undefined, done: true });
+            return resolve7({ value: undefined, done: true });
           extract.once("close", function() {
             if (err)
               reject(err);
             else
-              resolve6({ value: undefined, done: true });
+              resolve7({ value: undefined, done: true });
           });
         });
       }
@@ -39210,8 +39288,8 @@ async function extractTarball(body, destDir) {
     ws.on("error", next);
     stream.on("error", next);
   });
-  await new Promise((resolve7, reject) => {
-    extract.on("finish", resolve7);
+  await new Promise((resolve8, reject) => {
+    extract.on("finish", resolve8);
     extract.on("error", reject);
     Readable.fromWeb(body).pipe(createGunzip()).on("error", reject).pipe(extract).on("error", reject);
   });
@@ -39264,14 +39342,43 @@ function detectFrameworks(appDir) {
     return { svelte: false, vue: false };
   }
 }
+function esmConditionTarget(subpath) {
+  if (typeof subpath === "string")
+    return subpath;
+  if (!subpath || typeof subpath !== "object" || Array.isArray(subpath)) {
+    return;
+  }
+  for (const [condition, target] of Object.entries(subpath)) {
+    if (!ESM_CONDITIONS.includes(condition))
+      continue;
+    const entry = esmConditionTarget(target);
+    if (entry)
+      return entry;
+  }
+  return;
+}
+function resolveAppSvelteCompiler(appDir) {
+  const requireFromApp = createRequire2(path6.join(path6.resolve(appDir), "package.json"));
+  try {
+    const pkgPath = requireFromApp.resolve("svelte/package.json");
+    const exportsMap = JSON.parse(readTextFileSync(pkgPath))?.exports;
+    const target = esmConditionTarget(exportsMap?.["./compiler"]);
+    if (target?.startsWith(".")) {
+      const entry = path6.resolve(path6.dirname(pkgPath), target);
+      if (fs9.existsSync(entry))
+        return entry;
+    }
+  } catch {}
+  return requireFromApp.resolve("svelte/compiler");
+}
 async function loadSvelteCompiler(appDir) {
+  let mod;
   try {
-    const requireFromApp = createRequire2(path6.join(path6.resolve(appDir), "package.json"));
-    const entry = requireFromApp.resolve("svelte/compiler");
-    return await import(pathToFileURL2(entry).href);
+    mod = await import(pathToFileURL2(resolveAppSvelteCompiler(appDir)).href);
   } catch {
-    return await import("svelte/compiler");
+    mod = await import("svelte/compiler");
   }
+  return typeof mod?.compile === "function" ? mod : mod?.default ?? mod;
 }
 function createSveltePlugin(appDir) {
   let compilerPromise;
@@ -39349,13 +39456,13 @@ async function ensureNodeModules(appDir) {
   const nodeModulesPath = path6.join(targetDir, "node_modules");
   if (!fs9.existsSync(nodeModulesPath)) {
     info(colors.yellow("\uD83D\uDCE6 node_modules not found, running npm install..."));
-    const code2 = await new Promise((resolve8, reject) => {
+    const code2 = await new Promise((resolve9, reject) => {
       const npmInstall = spawn("npm", ["install"], {
         cwd: targetDir,
         stdio: "inherit",
         shell: true
       });
-      npmInstall.on("close", (code3) => resolve8(code3 ?? 0));
+      npmInstall.on("close", (code3) => resolve9(code3 ?? 0));
       npmInstall.on("error", reject);
     });
     if (code2 !== 0) {
@@ -39483,7 +39590,7 @@ function getDevBuildOptions(entryPoint = "index.tsx", svelte = false) {
     }
   };
 }
-var DEFAULT_BUILD_OPTIONS;
+var DEFAULT_BUILD_OPTIONS, ESM_CONDITIONS;
 var init_bundle = __esm(async () => {
   init_log();
   init_colors2();
@@ -39503,6 +39610,7 @@ var init_bundle = __esm(async () => {
     logLevel: "info",
     write: true
   };
+  ESM_CONDITIONS = ["node", "import", "default"];
 });
 
 // src/commands/app/wmillTsDev.ts
@@ -39750,7 +39858,7 @@ async function pollJobWithQueueLogging(workspace, jobId, options) {
       info(colors.gray(`${label}${jobId}: still polling, queue status unavailable...`));
     }
     const delayMs = Date.now() - startedAt < fastPollDurationMs ? fastPollIntervalMs : slowPollIntervalMs;
-    await new Promise((resolve8) => setTimeout(resolve8, delayMs));
+    await new Promise((resolve9) => setTimeout(resolve9, delayMs));
   }
 }
 var DEFAULT_FAST_POLL_INTERVAL_MS = 100, DEFAULT_FAST_POLL_DURATION_MS = 2000, DEFAULT_SLOW_POLL_INTERVAL_MS = 2000, QUEUE_LOG_INTERVAL_MS = 5000, HEARTBEAT_INTERVAL_MS = 60000, MAX_CONSECUTIVE_POLL_ERRORS = 10;
@@ -41698,7 +41806,7 @@ var require_BufferList = __commonJS((exports, module) => {
       this.head = this.tail = null;
       this.length = 0;
     };
-    BufferList.prototype.join = function join11(s) {
+    BufferList.prototype.join = function join12(s) {
       if (this.length === 0)
         return "";
       var p = this.head;
@@ -43710,8 +43818,8 @@ var require_lib2 = __commonJS((exports, module) => {
       return this;
     }
     var p = this.constructor;
-    return this.then(resolve9, reject2);
-    function resolve9(value) {
+    return this.then(resolve10, reject2);
+    function resolve10(value) {
       function yes() {
         return value;
       }
@@ -43864,8 +43972,8 @@ var require_lib2 = __commonJS((exports, module) => {
     }
     return out;
   }
-  Promise2.resolve = resolve8;
-  function resolve8(value) {
+  Promise2.resolve = resolve9;
+  function resolve9(value) {
     if (value instanceof this) {
       return value;
     }
@@ -44219,10 +44327,10 @@ var require_utils = __commonJS((exports) => {
     var promise = external.Promise.resolve(inputData).then(function(data3) {
       var isBlob2 = support.blob && (data3 instanceof Blob || ["[object File]", "[object Blob]"].indexOf(Object.prototype.toString.call(data3)) !== -1);
       if (isBlob2 && typeof FileReader !== "undefined") {
-        return new external.Promise(function(resolve8, reject) {
+        return new external.Promise(function(resolve9, reject) {
           var reader = new FileReader;
           reader.onload = function(e) {
-            resolve8(e.target.result);
+            resolve9(e.target.result);
           };
           reader.onerror = function(e) {
             reject(e.target.error);
@@ -44686,7 +44794,7 @@ var require_StreamHelper = __commonJS((exports, module) => {
     }
   }
   function accumulate(helper, updateCallback) {
-    return new external.Promise(function(resolve8, reject) {
+    return new external.Promise(function(resolve9, reject) {
       var dataArray = [];
       var { _internalType: chunkType, _outputType: resultType, _mimeType: mimeType } = helper;
       helper.on("data", function(data3, meta) {
@@ -44700,7 +44808,7 @@ var require_StreamHelper = __commonJS((exports, module) => {
       }).on("end", function() {
         try {
           var result = transformZipOutput(resultType, concat(chunkType, dataArray), mimeType);
-          resolve8(result);
+          resolve9(result);
         } catch (e) {
           reject(e);
         }
@@ -50277,7 +50385,7 @@ var require_load = __commonJS((exports, module) => {
   var Crc32Probe = require_Crc32Probe();
   var nodejsUtils = require_nodejsUtils();
   function checkEntryCRC32(zipEntry) {
-    return new external.Promise(function(resolve8, reject) {
+    return new external.Promise(function(resolve9, reject) {
       var worker = zipEntry.decompressed.getContentWorker().pipe(new Crc32Probe);
       worker.on("error", function(e) {
         reject(e);
@@ -50285,7 +50393,7 @@ var require_load = __commonJS((exports, module) => {
         if (worker.streamInfo.crc32 !== zipEntry.decompressed.crc32) {
           reject(new Error("Corrupted zip : CRC32 mismatch"));
         } else {
-          resolve8();
+          resolve9();
         }
       }).resume();
     });
@@ -50400,9 +50508,9 @@ class TarAsZip {
     const sub = new TarAsZip(new Map);
     for (const [name, file] of Object.entries(this.files)) {
       if (name.startsWith(normalized)) {
-        const relative7 = name.slice(normalized.length);
-        if (relative7) {
-          sub.files[relative7] = { ...file, name: relative7 };
+        const relative8 = name.slice(normalized.length);
+        if (relative8) {
+          sub.files[relative8] = { ...file, name: relative8 };
         }
       }
     }
@@ -50413,7 +50521,7 @@ async function parseTarResponse(response) {
   const buffer = Buffer.from(await response.arrayBuffer());
   const entries = new Map;
   const ex = $extract();
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     ex.on("entry", (header, stream, next) => {
       const chunks = [];
       stream.on("data", (chunk) => chunks.push(chunk));
@@ -50427,7 +50535,7 @@ async function parseTarResponse(response) {
       stream.on("error", reject);
       stream.resume();
     });
-    ex.on("finish", () => resolve8(new TarAsZip(entries)));
+    ex.on("finish", () => resolve9(new TarAsZip(entries)));
     ex.on("error", reject);
     Readable2.from(buffer).pipe(ex);
   });
@@ -53379,7 +53487,7 @@ var require_compile = __commonJS((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve8.call(this, root, ref);
+    let _sch = resolve9.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -53406,7 +53514,7 @@ var require_compile = __commonJS((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve8(root, ref) {
+  function resolve9(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -53914,54 +54022,54 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return uri;
   }
-  function resolve8(baseURI, relativeURI, options) {
+  function resolve9(baseURI, relativeURI, options) {
     const schemelessOptions = Object.assign({ scheme: "null" }, options);
     const resolved = resolveComponents(parse7(baseURI, schemelessOptions), parse7(relativeURI, schemelessOptions), schemelessOptions, true);
     return serialize(resolved, { ...schemelessOptions, skipEscape: true });
   }
-  function resolveComponents(base, relative7, options, skipNormalization) {
+  function resolveComponents(base, relative8, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse7(serialize(base, options), options);
-      relative7 = parse7(serialize(relative7, options), options);
+      relative8 = parse7(serialize(relative8, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative7.scheme) {
-      target.scheme = relative7.scheme;
-      target.userinfo = relative7.userinfo;
-      target.host = relative7.host;
-      target.port = relative7.port;
-      target.path = removeDotSegments(relative7.path || "");
-      target.query = relative7.query;
+    if (!options.tolerant && relative8.scheme) {
+      target.scheme = relative8.scheme;
+      target.userinfo = relative8.userinfo;
+      target.host = relative8.host;
+      target.port = relative8.port;
+      target.path = removeDotSegments(relative8.path || "");
+      target.query = relative8.query;
     } else {
-      if (relative7.userinfo !== undefined || relative7.host !== undefined || relative7.port !== undefined) {
-        target.userinfo = relative7.userinfo;
-        target.host = relative7.host;
-        target.port = relative7.port;
-        target.path = removeDotSegments(relative7.path || "");
-        target.query = relative7.query;
+      if (relative8.userinfo !== undefined || relative8.host !== undefined || relative8.port !== undefined) {
+        target.userinfo = relative8.userinfo;
+        target.host = relative8.host;
+        target.port = relative8.port;
+        target.path = removeDotSegments(relative8.path || "");
+        target.query = relative8.query;
       } else {
-        if (!relative7.path) {
+        if (!relative8.path) {
           target.path = base.path;
-          if (relative7.query !== undefined) {
-            target.query = relative7.query;
+          if (relative8.query !== undefined) {
+            target.query = relative8.query;
           } else {
             target.query = base.query;
           }
         } else {
-          if (relative7.path.charAt(0) === "/") {
-            target.path = removeDotSegments(relative7.path);
+          if (relative8.path.charAt(0) === "/") {
+            target.path = removeDotSegments(relative8.path);
           } else {
             if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
-              target.path = "/" + relative7.path;
+              target.path = "/" + relative8.path;
             } else if (!base.path) {
-              target.path = relative7.path;
+              target.path = relative8.path;
             } else {
-              target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative7.path;
+              target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative8.path;
             }
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative7.query;
+          target.query = relative8.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -53969,7 +54077,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative7.fragment;
+    target.fragment = relative8.fragment;
     return target;
   }
   function equal2(uriA, uriB, options) {
@@ -54147,7 +54255,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   var fastUri = {
     SCHEMES,
     normalize: normalize5,
-    resolve: resolve8,
+    resolve: resolve9,
     resolveComponents,
     equal: equal2,
     serialize,
@@ -56829,11 +56937,11 @@ var require_tslib = __commonJS((exports, module) => {
     };
     __awaiter2 = function(thisArg, _arguments, P, generator) {
       function adopt(value) {
-        return value instanceof P ? value : new P(function(resolve8) {
-          resolve8(value);
+        return value instanceof P ? value : new P(function(resolve9) {
+          resolve9(value);
         });
       }
-      return new (P || (P = Promise))(function(resolve8, reject) {
+      return new (P || (P = Promise))(function(resolve9, reject) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
@@ -56849,7 +56957,7 @@ var require_tslib = __commonJS((exports, module) => {
           }
         }
         function step(result) {
-          result.done ? resolve8(result.value) : adopt(result.value).then(fulfilled, rejected);
+          result.done ? resolve9(result.value) : adopt(result.value).then(fulfilled, rejected);
         }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
       });
@@ -57078,14 +57186,14 @@ var require_tslib = __commonJS((exports, module) => {
       }, i);
       function verb(n) {
         i[n] = o[n] && function(v) {
-          return new Promise(function(resolve8, reject) {
-            v = o[n](v), settle(resolve8, reject, v.done, v.value);
+          return new Promise(function(resolve9, reject) {
+            v = o[n](v), settle(resolve9, reject, v.done, v.value);
           });
         };
       }
-      function settle(resolve8, reject, d, v) {
+      function settle(resolve9, reject, d, v) {
         Promise.resolve(v).then(function(v2) {
-          resolve8({ value: v2, done: d });
+          resolve9({ value: v2, done: d });
         }, reject);
       }
     };
@@ -61600,7 +61708,7 @@ var init_openflow = __esm(() => {
   openflow_default = {
     openapi: "3.0.3",
     info: {
-      version: "1.783.0",
+      version: "1.784.0",
       title: "OpenFlow Spec",
       contact: {
         name: "Ruben Fiszel",
@@ -65624,11 +65732,11 @@ var init_specific_items = __esm(async () => {
 
 // src/utils/tar.ts
 function createTarBlob(entries) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const p = $pack();
     const chunks = [];
     p.on("data", (chunk) => chunks.push(new Uint8Array(chunk)));
-    p.on("end", () => resolve8(new Blob(chunks)));
+    p.on("end", () => resolve9(new Blob(chunks)));
     p.on("error", reject);
     for (const entry of entries) {
       p.entry({ name: entry.name }, Buffer.from(entry.content));
@@ -66369,7 +66477,7 @@ function collectPathScriptPaths(flowValue) {
 }
 
 // src/commands/flow/flow_metadata.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { rm } from "node:fs/promises";
 import * as path8 from "node:path";
 import { sep as SEP4 } from "node:path";
@@ -66538,7 +66646,7 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
       if (inlineScripts.some((other) => other.path === legacyRelPath))
         continue;
       const legacyAbsPath = process.cwd() + SEP4 + folder + SEP4 + legacyRelPath;
-      if (existsSync7(legacyAbsPath)) {
+      if (existsSync8(legacyAbsPath)) {
         try {
           await rm(legacyAbsPath);
           info(colors.gray(`Removed legacy lock file ${legacyRelPath} (renamed to canonical name)`));
@@ -67700,7 +67808,7 @@ async function list4(opts) {
     new Table2().header(["path", "summary", "language", "created by"]).padding(2).border(true).body(total.map((x) => [x.path, x.summary, x.language, x.created_by])).render();
   }
 }
-async function resolve8(input) {
+async function resolve9(input) {
   if (!input) {
     throw new Error("No data given");
   }
@@ -67726,7 +67834,7 @@ async function run2(opts, path10) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   if (!opts.data) {
     try {
       const script = await getScriptByPath({
@@ -67792,7 +67900,7 @@ ${script.lock_error_logs}`);
       break;
     } catch {
       retries++;
-      await new Promise((resolve9) => setTimeout(resolve9, 100));
+      await new Promise((resolve10) => setTimeout(resolve10, 100));
     }
   }
   if (retries >= MAX_RETRIES) {
@@ -67829,7 +67937,7 @@ async function track_job(workspace, id) {
         info("failed to get job updated. skipping log streaming.");
         break;
       }
-      await new Promise((resolve9) => setTimeout(resolve9, 500));
+      await new Promise((resolve10) => setTimeout(resolve10, 500));
       continue;
     }
     if (!running && updates.running === true) {
@@ -67849,7 +67957,7 @@ async function track_job(workspace, id) {
       info(colors.yellow("Job suspended. Waiting for it to continue..."));
     }
   }
-  await new Promise((resolve9, _) => setTimeout(() => resolve9(undefined), 1000));
+  await new Promise((resolve10, _) => setTimeout(() => resolve10(undefined), 1000));
   try {
     const final_job = await getCompletedJob({ workspace, id });
     if ((final_job.logs?.length ?? -1) > logOffset) {
@@ -68018,12 +68126,14 @@ async function preview(opts, filePath) {
   if (opts.silent) {
     setSilent(true);
   }
+  const cwdBeforeConfig = process.cwd();
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  if (!validatePath(filePath)) {
-    return;
-  }
+  const argPath = filePath;
+  filePath = toSyncRootRelativePath(filePath, cwdBeforeConfig);
+  const remotePath = scriptPathToRemotePath(filePath);
+  assertRemotePath(remotePath, argPath);
   const absentDescriptor = await stat4(filePath).then(() => false, (e) => isMissingDbtDescriptor(filePath, e));
   if (!absentDescriptor) {
     const fstat = await stat4(filePath);
@@ -68037,7 +68147,7 @@ async function preview(opts, filePath) {
   const codebases = await listSyncCodebases(opts);
   const language = inferContentTypeFromFilePath(filePath, opts?.defaultTs);
   const content = await readScriptContent(filePath);
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   const isFolderLayout = isModuleEntryPoint(filePath);
   const isDbt = language === "dbt";
   const moduleFolderPath = isFolderLayout ? path9.dirname(filePath) : filePath.substring(0, filePath.indexOf(".")) + getModuleFolderSuffix(language);
@@ -68045,7 +68155,7 @@ async function preview(opts, filePath) {
   const codebase = language == "bun" ? findCodebase(filePath, codebases) : undefined;
   let tempScriptRefs = undefined;
   const { extractRelativeImports: extractRelativeImports2 } = await init_relative_imports().then(() => exports_relative_imports);
-  const relImports = await extractRelativeImports2(content, scriptPathToRemotePath(filePath), language);
+  const relImports = await extractRelativeImports2(content, remotePath, language);
   if (relImports.length > 0) {
     const { buildPreviewTempScriptRefs: buildPreviewTempScriptRefs2 } = await init_generate_metadata().then(() => exports_generate_metadata);
     tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, opts, codebases, { kind: "script", path: filePath });
@@ -68127,7 +68237,7 @@ async function preview(opts, filePath) {
     const form = new FormData;
     const previewPayload = {
       content,
-      path: filePath.substring(0, filePath.indexOf(".")).replaceAll(SEP6, "/"),
+      path: remotePath,
       args: input,
       language,
       tag: opts.tag,
@@ -68169,7 +68279,7 @@ async function preview(opts, filePath) {
         }
         break;
       } catch {
-        await new Promise((resolve9) => setTimeout(resolve9, 100));
+        await new Promise((resolve10) => setTimeout(resolve10, 100));
       }
     }
   } else {
@@ -68177,7 +68287,7 @@ async function preview(opts, filePath) {
       workspace: workspace.workspaceId,
       requestBody: {
         content,
-        path: filePath.substring(0, filePath.indexOf(".")).replaceAll(SEP6, "/"),
+        path: remotePath,
         args: input,
         language,
         tag: opts.tag,
@@ -69354,7 +69464,7 @@ import {
   copyFile,
   mkdir as mkdir5
 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import * as path12 from "node:path";
 import { sep as SEP9 } from "node:path";
 function configKeyForItemKind(kind) {
@@ -71136,8 +71246,8 @@ async function pushParentScriptForModule(modulePath, workspace, alreadySynced, m
     return;
   const moduleFolderPath = scriptBasePath + getModuleFolderSuffix(isDbt ? "dbt" : undefined);
   if (isDbt) {
-    const hasMetadata = existsSync9(scriptBasePath + ".script.yaml") || existsSync9(scriptBasePath + ".script.json");
-    if (!existsSync9(moduleFolderPath + "/dbt_project.yml")) {
+    const hasMetadata = existsSync10(scriptBasePath + ".script.yaml") || existsSync10(scriptBasePath + ".script.json");
+    if (!existsSync10(moduleFolderPath + "/dbt_project.yml")) {
       if (hasMetadata) {
         throw new Error(`${moduleFolderPath} has no dbt_project.yml but ${scriptBasePath}.script.yaml ` + `remains, so there is no dbt project left to push. Delete the metadata too to ` + `archive the script, or restore the project.`);
       }
@@ -71967,11 +72077,11 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
         }
         const rules = folderRulesCache.get(folderName2);
         const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|amqp_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
-        const relative7 = remotePath.slice(`f/${folderName2}/`.length);
-        if (!relative7)
+        const relative8 = remotePath.slice(`f/${folderName2}/`.length);
+        if (!relative8)
           continue;
         for (const rule of rules) {
-          if (minimatch(relative7, rule.path_glob)) {
+          if (minimatch(relative8, rule.path_glob)) {
             folderDefaultAnnotations.set(change.path, rule.permissioned_as);
             break;
           }
@@ -72912,7 +73022,7 @@ var init_parse_schema = __esm(() => {
 // src/utils/metadata.ts
 import { sep as SEP10 } from "node:path";
 import { writeFile as writeFile8, stat as stat8, rm as rm3, readdir as readdir5 } from "node:fs/promises";
-import { readFileSync as readFileSync3, existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { readFileSync as readFileSync3, existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import * as path13 from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 function loadParser(pkgName) {
@@ -73016,7 +73126,7 @@ async function generateScriptMetadataInternal(scriptPath, workspace, opts, dryRu
   const metadataContent = await readTextFile(metadataWithType.path);
   const filteredRawWorkspaceDependencies = filterWorkspaceDependencies(rawWorkspaceDependencies, scriptContent, language);
   const moduleFolderPath = isFolderLayout ? path13.dirname(scriptPath) : scriptPath.substring(0, scriptPath.indexOf(".")) + getModuleFolderSuffix(language);
-  const hasModules = existsSync10(moduleFolderPath) && statSync3(moduleFolderPath).isDirectory();
+  const hasModules = existsSync11(moduleFolderPath) && statSync3(moduleFolderPath).isDirectory();
   const depsForHash = tree ? {} : filteredRawWorkspaceDependencies;
   let hash2 = await generateScriptHash(depsForHash, scriptContent, metadataContent);
   let moduleHashes = {};
@@ -73309,7 +73419,7 @@ async function updateScriptLock(workspace, scriptContent, language, remotePath,
   if (!languageNeedsLock(language)) {
     if (language === "dbt") {
       const lockPath2 = lockPathOverride ?? remotePath + ".script.lock";
-      if (existsSync10(lockPath2)) {
+      if (existsSync11(lockPath2)) {
         metadataContent.lock = "!inline " + lockPath2.replaceAll(SEP10, "/");
       }
     }
@@ -73367,7 +73477,7 @@ async function updateModuleLocks(workspace, dirPath, relPrefix, scriptRemotePath
           writeFileSync5(lockPath, lock, "utf-8");
         } else {
           try {
-            if (existsSync10(lockPath)) {
+            if (existsSync11(lockPath)) {
               const { rm: rmAsync } = await import("node:fs/promises");
               await rmAsync(lockPath);
             }
@@ -76045,7 +76155,7 @@ async function waitForJob(workspace, jobId) {
   }
   let syncIteration = 0;
   let lastQueueLogAt = Date.now();
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     async function checkJob() {
       try {
         const maybeJob = await getCompletedJobResultMaybe({
@@ -76057,7 +76167,7 @@ async function waitForJob(workspace, jobId) {
           if (!maybeJob.success && typeof maybeJob.result === "object" && maybeJob.result !== null && "error" in maybeJob.result) {
             reject(maybeJob.result.error);
           } else {
-            resolve10(maybeJob.result);
+            resolve11(maybeJob.result);
           }
           return;
         }
@@ -77087,8 +77197,8 @@ This folder is for SQL migration files that will be applied to datatables during
           process.stdout.write(`\r${colors.gray(`${frames[i++ % frames.length]} Creating Claude session...`)}`);
         }, 80);
         try {
-          await new Promise((resolve11, reject) => {
-            exec(`claude --session-id "${sessionId}" -p "Say: Your app is ready, click on preview to test it!"`, { cwd: absAppDir }, (error2) => error2 ? reject(error2) : resolve11());
+          await new Promise((resolve12, reject) => {
+            exec(`claude --session-id "${sessionId}" -p "Say: Your app is ready, click on preview to test it!"`, { cwd: absAppDir }, (error2) => error2 ? reject(error2) : resolve12());
           });
         } finally {
           clearInterval(spinner);
@@ -77283,7 +77393,7 @@ var init_new = __esm(async () => {
 });
 
 // src/commands/app/app.ts
-import { sep as SEP14, isAbsolute as isAbsolute4, resolve as pathResolve, relative as pathRelative, basename as basename8 } from "node:path";
+import { sep as SEP14, isAbsolute as isAbsolute5, resolve as pathResolve, relative as pathRelative, basename as basename9 } from "node:path";
 import { stat as stat10 } from "node:fs/promises";
 function respecializeFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
@@ -77484,9 +77594,9 @@ async function push5(opts, filePath, remotePath) {
   if (!filePath) {
     filePath = originalCwd;
   }
-  const absoluteFilePath = isAbsolute4(filePath) ? filePath : pathResolve(originalCwd, filePath);
+  const absoluteFilePath = isAbsolute5(filePath) ? filePath : pathResolve(originalCwd, filePath);
   const normalizedPath = absoluteFilePath.endsWith(SEP14) ? absoluteFilePath.slice(0, -1) : absoluteFilePath;
-  const dirName = basename8(normalizedPath);
+  const dirName = basename9(normalizedPath);
   const isRawAppByName = dirName.endsWith("__raw_app") || dirName.endsWith(".raw_app");
   const isAppByName = dirName.endsWith("__app") || dirName.endsWith(".app");
   let hasRawAppYaml = false;
@@ -77513,7 +77623,7 @@ async function push5(opts, filePath, remotePath) {
     }
     const wmillRoot = process.cwd();
     let inferred = pathRelative(wmillRoot, normalizedPath).replaceAll(SEP14, "/");
-    if (inferred.startsWith("..") || isAbsolute4(inferred)) {
+    if (inferred.startsWith("..") || isAbsolute5(inferred)) {
       error(colors.red(`Could not infer remote path: '${filePath}' is outside the wmill.yaml root (${wmillRoot}). Move the folder under the root or pass <remote_path> explicitly.`));
       return;
     }
@@ -77809,24 +77919,24 @@ var init_folder = __esm(async () => {
       error(`Path '${testPath}' is not under folder '${folderName2}' (expected prefix '${prefix}')`);
       return;
     }
-    const relative8 = testPath.slice(prefix.length);
+    const relative9 = testPath.slice(prefix.length);
     const { minimatch: minimatch2 } = await Promise.resolve().then(() => (init_esm2(), exports_esm));
     for (let i = 0;i < rules.length; i++) {
       const rule = rules[i];
-      if (minimatch2(relative8, rule.path_glob)) {
+      if (minimatch2(relative9, rule.path_glob)) {
         if (opts.json) {
-          console.log(JSON.stringify({ matched: true, rule_index: i, rule, relative_path: relative8 }));
+          console.log(JSON.stringify({ matched: true, rule_index: i, rule, relative_path: relative9 }));
         } else {
           info(colors.green(`✓ Rule #${i + 1} matches: path_glob='${rule.path_glob}' → permissioned_as='${rule.permissioned_as}'`));
-          info(colors.gray(`  (relative path tested: '${relative8}')`));
+          info(colors.gray(`  (relative path tested: '${relative9}')`));
         }
         return;
       }
     }
     if (opts.json) {
-      console.log(JSON.stringify({ matched: false, relative_path: relative8 }));
+      console.log(JSON.stringify({ matched: false, relative_path: relative9 }));
     } else {
-      info(colors.yellow(`No rule matches path '${testPath}' (relative: '${relative8}')`));
+      info(colors.yellow(`No rule matches path '${testPath}' (relative: '${relative9}')`));
     }
   });
   folder_default = command15;
@@ -77834,7 +77944,7 @@ var init_folder = __esm(async () => {
 
 // src/commands/variable/variable.ts
 import { mkdir as mkdir9, stat as stat12, writeFile as writeFile12 } from "node:fs/promises";
-import { dirname as dirname15 } from "node:path";
+import { dirname as dirname16 } from "node:path";
 import { sep as SEP16 } from "node:path";
 async function list8(opts) {
   if (opts.json)
@@ -77872,7 +77982,7 @@ async function newVariable(opts, path21) {
     is_secret: false,
     description: ""
   };
-  await mkdir9(dirname15(filePath), { recursive: true });
+  await mkdir9(dirname16(filePath), { recursive: true });
   await writeFile12(filePath, import_yaml26.stringify(template), {
     flag: "wx",
     encoding: "utf-8"
@@ -78057,7 +78167,7 @@ var init_variable = __esm(async () => {
 
 // src/commands/schedule/schedule.ts
 import { mkdir as mkdir10, stat as stat13, writeFile as writeFile13 } from "node:fs/promises";
-import { dirname as dirname16 } from "node:path";
+import { dirname as dirname17 } from "node:path";
 import { sep as SEP17 } from "node:path";
 async function list9(opts) {
   if (opts.json)
@@ -78094,7 +78204,7 @@ async function newSchedule(opts, path21) {
     is_flow: false,
     enabled: false
   };
-  await mkdir10(dirname16(filePath), { recursive: true });
+  await mkdir10(dirname17(filePath), { recursive: true });
   await writeFile13(filePath, import_yaml27.stringify(template), {
     flag: "wx",
     encoding: "utf-8"
@@ -79856,7 +79966,7 @@ var init_dependencies = __esm(async () => {
 
 // src/commands/trigger/trigger.ts
 import { mkdir as mkdir12, stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
-import { dirname as dirname17 } from "node:path";
+import { dirname as dirname18 } from "node:path";
 import { sep as SEP18 } from "node:path";
 async function getTrigger(triggerType, workspace, path22) {
   const triggerFunctions = {
@@ -80057,7 +80167,7 @@ async function newTrigger(opts, path22) {
       throw e;
   }
   const template = triggerTemplates[kind];
-  await mkdir12(dirname17(filePath), { recursive: true });
+  await mkdir12(dirname18(filePath), { recursive: true });
   await writeFile17(filePath, import_yaml34.stringify(template), {
     flag: "wx",
     encoding: "utf-8"
@@ -80789,7 +80899,7 @@ var init_local_path_scripts = __esm(async () => {
 });
 
 // src/commands/flow/flow.ts
-import { dirname as dirname18, sep as SEP20 } from "node:path";
+import { dirname as dirname19, sep as SEP20 } from "node:path";
 import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "node:fs";
 function normalizeOptionalString(value) {
   return typeof value === "string" && value.trim() === "" ? undefined : value ?? undefined;
@@ -81039,7 +81149,7 @@ async function run3(opts, path23) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   if (!opts.data) {
     try {
       const flow = await getFlowByPath({
@@ -81120,7 +81230,7 @@ async function run3(opts, path23) {
             forLoopFailed = refreshedModule.type === "Failure";
             break;
           }
-          await new Promise((resolve11) => setTimeout(resolve11, 200));
+          await new Promise((resolve12) => setTimeout(resolve12, 200));
         }
         if (forLoopFailed)
           break;
@@ -81136,7 +81246,7 @@ async function run3(opts, path23) {
         info(colors.dim(status));
         lastStatus = status;
       }
-      await new Promise((resolve11, _) => setTimeout(() => resolve11(undefined), 100));
+      await new Promise((resolve12, _) => setTimeout(() => resolve12(undefined), 100));
       if (isCompleted)
         break;
       continue;
@@ -81172,7 +81282,7 @@ async function run3(opts, path23) {
       break;
     } catch {
       retries++;
-      await new Promise((resolve11) => setTimeout(resolve11, 100));
+      await new Promise((resolve12) => setTimeout(resolve12, 100));
     }
   }
   if (retries >= MAX_RETRIES) {
@@ -81184,16 +81294,19 @@ async function preview2(opts, flowPath) {
     setSilent(true);
   }
   const useLocalPathScripts = !opts.remote;
+  const cwdBeforeConfig = process.cwd();
   if (useLocalPathScripts) {
     opts = await mergeConfigWithConfigFile(opts);
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const codebases = useLocalPathScripts ? listSyncCodebases(opts) : [];
+  const argPath = flowPath;
+  flowPath = toSyncRootRelativePath(flowPath, cwdBeforeConfig);
   const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP20) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP20);
   if (!isFlowDir) {
     if (flowPath.endsWith("flow.yaml") || flowPath.endsWith("flow.json")) {
-      flowPath = dirname18(flowPath);
+      flowPath = dirname19(flowPath);
     } else {
       throw new Error("Flow path must be a .flow/__flow directory or a flow.yaml file");
     }
@@ -81201,6 +81314,8 @@ async function preview2(opts, flowPath) {
   if (!flowPath.endsWith(SEP20)) {
     flowPath += SEP20;
   }
+  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP20, "/");
+  assertRemotePath(flowWmPath, argPath);
   const localFlow = await yamlParseFile(flowPath + "flow.yaml");
   const fileReader = async (path23) => await readTextFile(flowPath + path23);
   await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, flowPath, SEP20);
@@ -81235,9 +81350,8 @@ async function preview2(opts, flowPath) {
     const resolvedCodebases = await Promise.resolve(codebases);
     tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, opts, resolvedCodebases, { kind: "flow", folder: flowPath });
   }
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   debug(`Flow value: ${JSON.stringify(localFlow.value, null, 2)}`);
-  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP20, "/");
   if (opts.step) {
     await previewStep(opts.step, localFlow, flowWmPath, workspace, input, tempScriptRefs, opts.silent, opts.tag);
     return;
@@ -91935,7 +92049,7 @@ __export(exports_tsconfig, {
 });
 import { execSync as execSync6 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync5, writeFileSync as writeFileSync9 } from "node:fs";
 import path24 from "node:path";
 import process25 from "node:process";
 function buildManagedTsconfig() {
@@ -92062,7 +92176,7 @@ async function refreshManagedDenoImportMap(mode) {
   });
 }
 async function ensureUserReferencesManaged(opts) {
-  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path24.join(process25.cwd(), f)).find((p) => existsSync18(p));
+  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path24.join(process25.cwd(), f)).find((p) => existsSync19(p));
   if (!existing) {
     const userPath = path24.join(process25.cwd(), opts.file);
     writeFileSync9(userPath, JSON.stringify(opts.create, null, 2) + `
@@ -92114,7 +92228,7 @@ async function ensureUserReferencesManaged(opts) {
 }
 function ensureBunTypesAvailable() {
   const cwd = process25.cwd();
-  if (existsSync18(path24.join(cwd, "node_modules", "bun-types"))) {
+  if (existsSync19(path24.join(cwd, "node_modules", "bun-types"))) {
     return true;
   }
   try {
@@ -92137,7 +92251,7 @@ function ensureBunTypesAvailable() {
 async function warnIfTsconfigStale(opts) {
   const cwd = opts?.cwd ?? process25.cwd();
   const managedPath = path24.join(cwd, MANAGED_TSCONFIG);
-  if (!existsSync18(managedPath))
+  if (!existsSync19(managedPath))
     return;
   let managedText;
   try {
@@ -93390,7 +93504,7 @@ await __promiseAll([
   init_user(),
   init_variable()
 ]);
-import { realpathSync } from "node:fs";
+import { realpathSync as realpathSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/hub/hub.ts
@@ -93576,18 +93690,18 @@ await __promiseAll([
   init_context()
 ]);
 var import_yaml40 = __toESM(require_dist(), 1);
-import { existsSync as existsSync15 } from "node:fs";
+import { existsSync as existsSync16 } from "node:fs";
 import { writeFile as writeFile19 } from "node:fs/promises";
-import { dirname as dirname19, join as join21 } from "node:path";
+import { dirname as dirname20, join as join22 } from "node:path";
 var PROTECTION_RULES_FILENAME = "protection-rules.yaml";
 function getProtectionRulesPath() {
   const wmillPath = getWmillYamlPath();
   if (!wmillPath)
     return null;
-  return join21(dirname19(wmillPath), PROTECTION_RULES_FILENAME);
+  return join22(dirname20(wmillPath), PROTECTION_RULES_FILENAME);
 }
 async function readProtectionRulesFile(path23) {
-  if (!existsSync15(path23))
+  if (!existsSync16(path23))
     return {};
   const parsed = await yamlParseFile(path23);
   return parsed ?? {};
@@ -93798,7 +93912,7 @@ await __promiseAll([
   init_conf()
 ]);
 import process24 from "node:process";
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 async function pushProtectionRules(opts, workspaceArg) {
   if (opts.jsonOutput)
     setSilent(true);
@@ -93808,7 +93922,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       error: "No wmill.yaml found. Run 'wmill init' first — protection-rules.yaml lives next to it."
     });
   }
-  if (!existsSync16(prPath)) {
+  if (!existsSync17(prPath)) {
     fail(opts, {
       error: "No protection-rules.yaml found. Run 'wmill protection-rules pull' first."
     });
@@ -94770,7 +94884,7 @@ async function dev2(opts) {
       }
       socket.destroy();
     });
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       proxyServer.listen(proxyPort, BIND_HOST, () => {
         console.log(`Dev proxy listening on http://localhost:${proxyPort}`);
         if (opts.path) {
@@ -94780,7 +94894,7 @@ async function dev2(opts) {
           console.log("(pass --path <path> to skip the picker)");
         }
         maybeOpenBrowser(`http://localhost:${proxyPort}/`);
-        resolve11();
+        resolve12();
       });
     });
   }
@@ -94886,9 +95000,9 @@ class NpmProvider extends Provider {
       if (verbose)
         process.stderr.write(d);
     });
-    const exitCode = await new Promise((resolve11, reject) => {
+    const exitCode = await new Promise((resolve12, reject) => {
       proc.on("error", reject);
-      proc.on("close", resolve11);
+      proc.on("close", resolve12);
     }).catch((e) => {
       throw new Error(`failed to run npm: ${e instanceof Error ? e.message : e}
 
@@ -95584,7 +95698,7 @@ await __promiseAll([
   init_freshness()
 ]);
 import { cp, mkdir as mkdir13, readdir as readdir11, rm as rm6, stat as stat19, writeFile as writeFile21 } from "node:fs/promises";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var WMILL_INIT_AI_SKILLS_SOURCE_ENV = "WMILL_INIT_AI_SKILLS_SOURCE";
 var WMILL_INIT_AI_AGENTS_SOURCE_ENV = "WMILL_INIT_AI_AGENTS_SOURCE";
 var WMILL_INIT_AI_CLAUDE_SOURCE_ENV = "WMILL_INIT_AI_CLAUDE_SOURCE";
@@ -95597,20 +95711,20 @@ async function writeAiGuidanceFiles(options) {
   const skillMetadata = options.skillsSourcePath ? await readSkillMetadataFromDirectory(options.skillsSourcePath) : getGeneratedSkillMetadata();
   const rawAgentsCliContent = options.agentsSourcePath != null ? await readTextFile(options.agentsSourcePath) : generateAgentsCliMdContent(buildSkillsReference(skillMetadata));
   const agentsCliContent = injectPromptsHashMarker(rawAgentsCliContent, currentPromptsHash(nonDottedPaths));
-  const agentsCliPath = join23(options.targetDir, AGENTS_WMILL_FILENAME);
+  const agentsCliPath = join24(options.targetDir, AGENTS_WMILL_FILENAME);
   await writeFile21(agentsCliPath, agentsCliContent, "utf8");
   const agentsCliWritten = true;
   const legacyManagedRemoved = await migrateLegacyManagedFile(options.targetDir);
   const resolveMigration = cacheOnce(options.resolveAgentsMdMigration);
   const agentsMdResult = await reconcileIncludingFile({
-    path: join23(options.targetDir, "AGENTS.md"),
+    path: join24(options.targetDir, "AGENTS.md"),
     includeLine: AGENTS_WMILL_INCLUDE_LINE,
     skeleton: generateAgentsMdSkeleton(),
     resolveMigration
   });
   const claudeSkeleton = options.claudeSourcePath != null ? await readTextFile(options.claudeSourcePath) : CLAUDE_MD_DEFAULT;
   const claudeMdResult = await reconcileIncludingFile({
-    path: join23(options.targetDir, "CLAUDE.md"),
+    path: join24(options.targetDir, "CLAUDE.md"),
     includeLine: CLAUDE_MD_INCLUDE_LINE,
     skeleton: claudeSkeleton,
     resolveMigration
@@ -95632,7 +95746,7 @@ async function writeAiGuidanceFiles(options) {
 }
 async function migrateLegacyManagedFile(targetDir) {
   for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
-    const filePath = join23(targetDir, fileName);
+    const filePath = join24(targetDir, fileName);
     const existing = await readTextFile(filePath).catch(() => null);
     if (existing == null)
       continue;
@@ -95641,7 +95755,7 @@ async function migrateLegacyManagedFile(targetDir) {
       await writeFile21(filePath, rewritten, "utf8");
     }
   }
-  const legacyPath = join23(targetDir, LEGACY_AGENTS_CLI_FILENAME);
+  const legacyPath = join24(targetDir, LEGACY_AGENTS_CLI_FILENAME);
   const legacyExists = await stat19(legacyPath).catch(() => null) != null;
   if (legacyExists) {
     await rm6(legacyPath, { force: true });
@@ -95718,9 +95832,9 @@ async function copySkillsFromSource(targetDir, skillsSourcePath) {
 async function writeGeneratedSkills(targetDir, nonDottedPaths) {
   const skillsDirs = await ensureSkillsDirectories(targetDir);
   await Promise.all(skillsDirs.flatMap((skillsDir) => SKILLS.map(async (skill) => {
-    const skillDir = join23(skillsDir, skill.name);
+    const skillDir = join24(skillsDir, skill.name);
     await mkdir13(skillDir, { recursive: true });
-    await writeFile21(join23(skillDir, "SKILL.md"), renderGeneratedSkillContent(skill.name, nonDottedPaths), "utf8");
+    await writeFile21(join24(skillDir, "SKILL.md"), renderGeneratedSkillContent(skill.name, nonDottedPaths), "utf8");
   })));
   return SKILLS.map((skill) => ({
     ...skill,
@@ -95734,14 +95848,14 @@ function getGeneratedSkillMetadata() {
   }));
 }
 async function ensureSkillsDirectories(targetDir) {
-  const skillsDirs = SKILL_TARGET_ROOTS.map((root) => join23(targetDir, root, "skills"));
+  const skillsDirs = SKILL_TARGET_ROOTS.map((root) => join24(targetDir, root, "skills"));
   await Promise.all(skillsDirs.map((skillsDir) => mkdir13(skillsDir, { recursive: true })));
   return skillsDirs;
 }
 async function copyDirectoryContents(sourceDir, targetDir) {
   const entries = await readdir11(sourceDir, { withFileTypes: true });
   await Promise.all(entries.map(async (entry) => {
-    await cp(join23(sourceDir, entry.name), join23(targetDir, entry.name), {
+    await cp(join24(sourceDir, entry.name), join24(targetDir, entry.name), {
       recursive: true,
       force: true
     });
@@ -95784,7 +95898,7 @@ async function readSkillMetadataFromDirectory(skillsDir) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const skillPath = join23(skillsDir, entry.name, "SKILL.md");
+    const skillPath = join24(skillsDir, entry.name, "SKILL.md");
     if (!await stat19(skillPath).catch(() => null)) {
       continue;
     }
@@ -98376,16 +98490,16 @@ async function startServe(opts) {
     error(`server error: ${err.message}`);
     process.exitCode = 1;
   });
-  await new Promise((resolve11) => server.listen(port, host, () => resolve11()));
+  await new Promise((resolve12) => server.listen(port, host, () => resolve12()));
   return {
     host,
     port,
     user: DEFAULT_USER,
     password,
     connectionString: (datatableName) => `postgresql://${DEFAULT_USER}:${encodeURIComponent(password)}@${host}:${port}/${encodeURIComponent(datatableName)}`,
-    close: () => new Promise((resolve11) => {
-      server.close(() => resolve11());
-      setTimeout(resolve11, 1000).unref();
+    close: () => new Promise((resolve12) => {
+      server.close(() => resolve12());
+      setTimeout(resolve12, 1000).unref();
     })
   };
 }
@@ -98894,13 +99008,13 @@ async function psql(opts) {
     }
     handle.close().finally(() => process.exit(1));
   });
-  const exitCode = await new Promise((resolve11) => {
+  const exitCode = await new Promise((resolve12) => {
     child.on("exit", (code2, signal) => {
       if (signal && typeof signal === "string") {
         const num = signalToNumber(signal);
-        resolve11(num !== undefined ? 128 + num : 1);
+        resolve12(num !== undefined ? 128 + num : 1);
       } else {
-        resolve11(code2 ?? 0);
+        resolve12(code2 ?? 0);
       }
     });
   });
@@ -100303,7 +100417,7 @@ await __promiseAll([
   init_conf()
 ]);
 import { writeFile as writeFile25 } from "node:fs/promises";
-import { existsSync as existsSync20, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync8 } from "node:fs";
 import * as path27 from "node:path";
 var ASSET_KINDS = "s3object,ducklake,datatable,volume,dbt";
 function assetUri(kind, p3) {
@@ -100523,7 +100637,7 @@ async function generatePipelineDocs(opts, folder) {
   ];
   for (const [name, content] of pointers) {
     const p3 = path27.join(folderDir, name);
-    if (existsSync20(p3)) {
+    if (existsSync21(p3)) {
       let existing;
       try {
         existing = readFileSync8(p3, "utf-8");
@@ -100542,7 +100656,7 @@ async function generatePipelineDocs(opts, folder) {
 }
 
 // src/commands/pipeline/pipelineUpload.ts
-import { basename as basename10 } from "node:path";
+import { basename as basename11 } from "node:path";
 function parseUploadBinding(spec) {
   const eq = spec.indexOf("=");
   const left = eq < 0 ? "" : spec.slice(0, eq).trim();
@@ -100584,7 +100698,7 @@ function s3ObjectParams(schema) {
   return Object.keys(props).filter((k2) => isS3Object(props[k2]?.format));
 }
 function devUploadKey(scriptPath, param, source) {
-  return `wmilldev/pipeline/${scriptPath}/${param}/${basename10(source)}`;
+  return `wmilldev/pipeline/${scriptPath}/${param}/${basename11(source)}`;
 }
 function parseS3Uri(source) {
   const m3 = source.match(/^s3:\/\/([^/]*)\/(.*)$/);
@@ -101229,7 +101343,7 @@ await __promiseAll([
 ]);
 import { Buffer as Buffer6 } from "node:buffer";
 import { readFile as readFile4, writeFile as writeFile26 } from "node:fs/promises";
-import { basename as basename11 } from "node:path";
+import { basename as basename12 } from "node:path";
 function formatBytes(n2) {
   if (n2 == null)
     return "-";
@@ -101330,7 +101444,7 @@ async function download(opts, fileKey, outputPath) {
     process.stdout.write(buf);
     return;
   }
-  const dest = outputPath ?? basename11(fileKey);
+  const dest = outputPath ?? basename12(fileKey);
   await writeFile26(dest, buf);
   info(colors.green(`Downloaded ${fileKey} -> ${dest}`));
 }
@@ -101534,7 +101648,7 @@ function isMain() {
     const scriptPath = process.argv[1];
     if (!scriptPath)
       return false;
-    const realScriptPath = realpathSync(scriptPath);
+    const realScriptPath = realpathSync2(scriptPath);
     const modulePath = fileURLToPath2(import.meta.url);
     return realScriptPath === modulePath;
   } catch {