windmill-cli 1.783.0 → 1.785.0

package/esm/main.js

@@ -16784,7 +16784,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.783.0",
+    VERSION: "1.785.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17210,6 +17210,7 @@ __export(exports_services_gen, {
   resumeSuspendedFlowAsOwner: () => resumeSuspendedFlowAsOwner,
   resumeSuspended: () => resumeSuspended,
   resultById: () => resultById,
+  restoreResourceVersion: () => restoreResourceVersion,
   restartWorkerGroup: () => restartWorkerGroup,
   restartFlowAtStep: () => restartFlowAtStep,
   resolveNpmPackageVersion: () => resolveNpmPackageVersion,
@@ -17487,9 +17488,11 @@ __export(exports_services_gen, {
   getRuffConfig: () => getRuffConfig,
   getRootJobId: () => getRootJobId,
   getResumeUrls: () => getResumeUrls,
+  getResourceVersion: () => getResourceVersion,
   getResourceValueInterpolated: () => getResourceValueInterpolated,
   getResourceValue: () => getResourceValue,
   getResourceType: () => getResourceType,
+  getResourceHistory: () => getResourceHistory,
   getResource: () => getResource,
   getRawAppData: () => getRawAppData,
   getQueuePosition: () => getQueuePosition,
@@ -17512,6 +17515,8 @@ __export(exports_services_gen, {
   getOfflineLicenseStatus: () => getOfflineLicenseStatus,
   getObjectStorageUsage: () => getObjectStorageUsage,
   getOauthConnect: () => getOauthConnect,
+  getNpmProxyConfig: () => getNpmProxyConfig,
+  getNpmPackageTarball: () => getNpmPackageTarball,
   getNpmPackageMetadata: () => getNpmPackageMetadata,
   getNpmPackageFiletree: () => getNpmPackageFiletree,
   getNpmPackageFile: () => getNpmPackageFile,
@@ -17833,6 +17838,7 @@ __export(exports_services_gen, {
   compareWorkspaces: () => compareWorkspaces,
   commitKafkaOffsets: () => commitKafkaOffsets,
   closeDeploymentRequestMerged: () => closeDeploymentRequestMerged,
+  clearResourceHistory: () => clearResourceHistory,
   clearIndex: () => clearIndex,
   checkSchemaContracts: () => checkSchemaContracts,
   checkS3FolderExists: () => checkS3FolderExists,
@@ -20335,6 +20341,42 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, getResourceHistory = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/resources/history/p/{path}",
+    path: {
+      workspace: data3.workspace,
+      path: data3.path
+    }
+  });
+}, clearResourceHistory = (data3) => {
+  return request(OpenAPI, {
+    method: "DELETE",
+    url: "/w/{workspace}/resources/history/p/{path}",
+    path: {
+      workspace: data3.workspace,
+      path: data3.path
+    }
+  });
+}, getResourceVersion = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/resources/history/v/{version}",
+    path: {
+      workspace: data3.workspace,
+      version: data3.version
+    }
+  });
+}, restoreResourceVersion = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/resources/history/restore/v/{version}",
+    path: {
+      workspace: data3.workspace,
+      version: data3.version
+    }
+  });
 }, getResource = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -20509,6 +20551,14 @@ var backendVersion = () => {
       workspace: data3.workspace
     }
   });
+}, getNpmProxyConfig = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/npm_proxy/config",
+    path: {
+      workspace: data3.workspace
+    }
+  });
 }, getNpmPackageMetadata = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -20551,6 +20601,16 @@ var backendVersion = () => {
       filepath: data3.filepath
     }
   });
+}, getNpmPackageTarball = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/npm_proxy/tarball/{package}/{version}",
+    path: {
+      workspace: data3.workspace,
+      package: data3._package,
+      version: data3.version
+    }
+  });
 }, queryResourceTypes = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -26598,6 +26658,7 @@ __export(exports_gen, {
   resumeSuspendedFlowAsOwner: () => resumeSuspendedFlowAsOwner,
   resumeSuspended: () => resumeSuspended,
   resultById: () => resultById,
+  restoreResourceVersion: () => restoreResourceVersion,
   restartWorkerGroup: () => restartWorkerGroup,
   restartFlowAtStep: () => restartFlowAtStep,
   resolveNpmPackageVersion: () => resolveNpmPackageVersion,
@@ -26875,9 +26936,11 @@ __export(exports_gen, {
   getRuffConfig: () => getRuffConfig,
   getRootJobId: () => getRootJobId,
   getResumeUrls: () => getResumeUrls,
+  getResourceVersion: () => getResourceVersion,
   getResourceValueInterpolated: () => getResourceValueInterpolated,
   getResourceValue: () => getResourceValue,
   getResourceType: () => getResourceType,
+  getResourceHistory: () => getResourceHistory,
   getResource: () => getResource,
   getRawAppData: () => getRawAppData,
   getQueuePosition: () => getQueuePosition,
@@ -26900,6 +26963,8 @@ __export(exports_gen, {
   getOfflineLicenseStatus: () => getOfflineLicenseStatus,
   getObjectStorageUsage: () => getObjectStorageUsage,
   getOauthConnect: () => getOauthConnect,
+  getNpmProxyConfig: () => getNpmProxyConfig,
+  getNpmPackageTarball: () => getNpmPackageTarball,
   getNpmPackageMetadata: () => getNpmPackageMetadata,
   getNpmPackageFiletree: () => getNpmPackageFiletree,
   getNpmPackageFile: () => getNpmPackageFile,
@@ -27221,6 +27286,7 @@ __export(exports_gen, {
   compareWorkspaces: () => compareWorkspaces,
   commitKafkaOffsets: () => commitKafkaOffsets,
   closeDeploymentRequestMerged: () => closeDeploymentRequestMerged,
+  clearResourceHistory: () => clearResourceHistory,
   clearIndex: () => clearIndex,
   checkSchemaContracts: () => checkSchemaContracts,
   checkS3FolderExists: () => checkS3FolderExists,
@@ -27383,7 +27449,7 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.783.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.785.0";
 
 // src/utils/git.ts
 var exports_git = {};
@@ -31056,9 +31122,13 @@ __export(exports_context, {
   validatePath: () => validatePath,
   tryResolveVersion: () => tryResolveVersion,
   tryResolveBranchWorkspace: () => tryResolveBranchWorkspace,
+  toSyncRootRelativePath: () => toSyncRootRelativePath,
   resolveWorkspace: () => resolveWorkspace,
-  fetchVersion: () => fetchVersion
+  fetchVersion: () => fetchVersion,
+  assertRemotePath: () => assertRemotePath
 });
+import { existsSync as existsSync5, realpathSync } from "node:fs";
+import { basename as basename4, dirname as dirname7, isAbsolute as isAbsolute3, join as join9, relative as relative6, resolve as resolve6 } from "node:path";
 async function selectFromMultipleProfiles(profiles, baseUrl2, workspaceId, context, configDir) {
   if (profiles.length === 1) {
     return profiles[0];
@@ -31465,6 +31535,34 @@ async function tryResolveVersion(opts) {
     return;
   }
 }
+function syncRoot() {
+  const wmillYaml = getWmillYamlPath();
+  return wmillYaml ? dirname7(wmillYaml) : process.cwd();
+}
+function toSyncRootRelativePath(arg, cwdBeforeConfig) {
+  const root = syncRoot();
+  const candidates = isAbsolute3(arg) ? [arg] : [resolve6(cwdBeforeConfig, arg), resolve6(root, arg)];
+  const abs = candidates.find((c) => existsSync5(c)) ?? candidates.find((c) => existsSync5(dirname7(c))) ?? candidates.at(-1);
+  const rel = relative6(root, abs);
+  if (rel === "")
+    return ".";
+  if (!rel.startsWith(".."))
+    return rel;
+  try {
+    const resolved = relative6(realpathSync(root), realpathOfNamed(abs));
+    return resolved === "" ? "." : resolved;
+  } catch {
+    return rel;
+  }
+}
+function realpathOfNamed(p) {
+  return existsSync5(p) ? realpathSync(p) : join9(realpathSync(dirname7(p)), basename4(p));
+}
+function assertRemotePath(remotePath, arg) {
+  if (REMOTE_PATH_RE.test(remotePath))
+    return;
+  throw new Error(`Cannot derive a Windmill path from '${arg}'` + (remotePath ? ` (it maps to '${remotePath}')` : "") + `: a preview runs under the path of the file it previews, which must sit inside the wmill.yaml root and be of the form <u|g|f>/<username|group|folder>/<name>.`);
+}
 function validatePath(path5) {
   if (!(path5.startsWith("g") || path5.startsWith("u") || path5.startsWith("f"))) {
     infoStderr(colors.red("Given remote path looks invalid. Remote paths are typically of the form <u|g|f>/<username|group|folder>/..."));
@@ -31472,6 +31570,7 @@ function validatePath(path5) {
   }
   return true;
 }
+var REMOTE_PATH_RE;
 var init_context = __esm(async () => {
   init_colors2();
   init_log();
@@ -31489,6 +31588,7 @@ var init_context = __esm(async () => {
     init_branch_profiles(),
     init_conf()
   ]);
+  REMOTE_PATH_RE = /^[ufg](\/[^/]+){2,}$/;
 });
 
 // src/commands/sync/global.ts
@@ -31666,6 +31766,12 @@ function isFileResource(path5) {
   const splitPath = path5.split(".");
   return splitPath.length >= 4 && splitPath[splitPath.length - 3] == "resource" && splitPath[splitPath.length - 2] == "file";
 }
+function removeResourceSuffix(path5) {
+  if (isFileResource(path5)) {
+    return path5.split(".").slice(0, -3).join(".");
+  }
+  return path5.replace(/\.resource\.(yaml|json)$/, "");
+}
 function isFilesetResource(path5) {
   return path5.includes(".fileset/") || path5.includes(".fileset\\");
 }
@@ -33697,13 +33803,13 @@ return schema
 import { createServer as createServer2 } from "node:net";
 import { execSync as execSync3 } from "node:child_process";
 function isPortFree(port, host) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const s = createServer2();
     s.once("error", (err) => {
       const code2 = err.code ?? "";
-      resolve6(code2 !== "EADDRINUSE" && code2 !== "EACCES");
+      resolve7(code2 !== "EADDRINUSE" && code2 !== "EACCES");
     });
-    s.once("listening", () => s.close(() => resolve6(true)));
+    s.once("listening", () => s.close(() => resolve7(true)));
     s.listen(port, host);
   });
 }
@@ -37832,8 +37938,8 @@ var require_streamx = __commonJS((exports, module) => {
           return this;
         },
         next() {
-          return new Promise(function(resolve6, reject) {
-            promiseResolve = resolve6;
+          return new Promise(function(resolve7, reject) {
+            promiseResolve = resolve7;
             promiseReject = reject;
             const data3 = stream.read();
             if (data3 !== null)
@@ -37870,14 +37976,14 @@ var require_streamx = __commonJS((exports, module) => {
       }
       function destroy(err) {
         stream.destroy(err);
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve7, reject) => {
           if (stream._duplexState & DESTROYED)
-            return resolve6({ value: undefined, done: true });
+            return resolve7({ value: undefined, done: true });
           stream.once("close", function() {
             if (err)
               reject(err);
             else
-              resolve6({ value: undefined, done: true });
+              resolve7({ value: undefined, done: true });
           });
         });
       }
@@ -37929,8 +38035,8 @@ var require_streamx = __commonJS((exports, module) => {
         return Promise.resolve(true);
       if (state.drains === null)
         state.drains = [];
-      return new Promise((resolve6) => {
-        state.drains.push({ writes, resolve: resolve6 });
+      return new Promise((resolve7) => {
+        state.drains.push({ writes, resolve: resolve7 });
       });
     }
     write(data3) {
@@ -38044,11 +38150,11 @@ var require_streamx = __commonJS((exports, module) => {
     cb(null);
   }
   function pipelinePromise(...streams) {
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       return pipeline(...streams, (err) => {
         if (err)
           return reject(err);
-        resolve6();
+        resolve7();
       });
     });
   }
@@ -38754,16 +38860,16 @@ var require_extract = __commonJS((exports, module) => {
         entryCallback = null;
         cb(err);
       }
-      function onnext(resolve6, reject) {
+      function onnext(resolve7, reject) {
         if (error2) {
           return reject(error2);
         }
         if (entryStream) {
-          resolve6({ value: entryStream, done: false });
+          resolve7({ value: entryStream, done: false });
           entryStream = null;
           return;
         }
-        promiseResolve = resolve6;
+        promiseResolve = resolve7;
         promiseReject = reject;
         consumeCallback(null);
         if (extract._finished && promiseResolve) {
@@ -38794,14 +38900,14 @@ var require_extract = __commonJS((exports, module) => {
       function destroy(err) {
         extract.destroy(err);
         consumeCallback(err);
-        return new Promise((resolve6, reject) => {
+        return new Promise((resolve7, reject) => {
           if (extract.destroyed)
-            return resolve6({ value: undefined, done: true });
+            return resolve7({ value: undefined, done: true });
           extract.once("close", function() {
             if (err)
               reject(err);
             else
-              resolve6({ value: undefined, done: true });
+              resolve7({ value: undefined, done: true });
           });
         });
       }
@@ -39210,8 +39316,8 @@ async function extractTarball(body, destDir) {
     ws.on("error", next);
     stream.on("error", next);
   });
-  await new Promise((resolve7, reject) => {
-    extract.on("finish", resolve7);
+  await new Promise((resolve8, reject) => {
+    extract.on("finish", resolve8);
     extract.on("error", reject);
     Readable.fromWeb(body).pipe(createGunzip()).on("error", reject).pipe(extract).on("error", reject);
   });
@@ -39264,14 +39370,43 @@ function detectFrameworks(appDir) {
     return { svelte: false, vue: false };
   }
 }
+function esmConditionTarget(subpath) {
+  if (typeof subpath === "string")
+    return subpath;
+  if (!subpath || typeof subpath !== "object" || Array.isArray(subpath)) {
+    return;
+  }
+  for (const [condition, target] of Object.entries(subpath)) {
+    if (!ESM_CONDITIONS.includes(condition))
+      continue;
+    const entry = esmConditionTarget(target);
+    if (entry)
+      return entry;
+  }
+  return;
+}
+function resolveAppSvelteCompiler(appDir) {
+  const requireFromApp = createRequire2(path6.join(path6.resolve(appDir), "package.json"));
+  try {
+    const pkgPath = requireFromApp.resolve("svelte/package.json");
+    const exportsMap = JSON.parse(readTextFileSync(pkgPath))?.exports;
+    const target = esmConditionTarget(exportsMap?.["./compiler"]);
+    if (target?.startsWith(".")) {
+      const entry = path6.resolve(path6.dirname(pkgPath), target);
+      if (fs9.existsSync(entry))
+        return entry;
+    }
+  } catch {}
+  return requireFromApp.resolve("svelte/compiler");
+}
 async function loadSvelteCompiler(appDir) {
+  let mod;
   try {
-    const requireFromApp = createRequire2(path6.join(path6.resolve(appDir), "package.json"));
-    const entry = requireFromApp.resolve("svelte/compiler");
-    return await import(pathToFileURL2(entry).href);
+    mod = await import(pathToFileURL2(resolveAppSvelteCompiler(appDir)).href);
   } catch {
-    return await import("svelte/compiler");
+    mod = await import("svelte/compiler");
   }
+  return typeof mod?.compile === "function" ? mod : mod?.default ?? mod;
 }
 function createSveltePlugin(appDir) {
   let compilerPromise;
@@ -39349,13 +39484,13 @@ async function ensureNodeModules(appDir) {
   const nodeModulesPath = path6.join(targetDir, "node_modules");
   if (!fs9.existsSync(nodeModulesPath)) {
     info(colors.yellow("\uD83D\uDCE6 node_modules not found, running npm install..."));
-    const code2 = await new Promise((resolve8, reject) => {
+    const code2 = await new Promise((resolve9, reject) => {
       const npmInstall = spawn("npm", ["install"], {
         cwd: targetDir,
         stdio: "inherit",
         shell: true
       });
-      npmInstall.on("close", (code3) => resolve8(code3 ?? 0));
+      npmInstall.on("close", (code3) => resolve9(code3 ?? 0));
       npmInstall.on("error", reject);
     });
     if (code2 !== 0) {
@@ -39483,7 +39618,7 @@ function getDevBuildOptions(entryPoint = "index.tsx", svelte = false) {
     }
   };
 }
-var DEFAULT_BUILD_OPTIONS;
+var DEFAULT_BUILD_OPTIONS, ESM_CONDITIONS;
 var init_bundle = __esm(async () => {
   init_log();
   init_colors2();
@@ -39503,6 +39638,7 @@ var init_bundle = __esm(async () => {
     logLevel: "info",
     write: true
   };
+  ESM_CONDITIONS = ["node", "import", "default"];
 });
 
 // src/commands/app/wmillTsDev.ts
@@ -39750,7 +39886,7 @@ async function pollJobWithQueueLogging(workspace, jobId, options) {
       info(colors.gray(`${label}${jobId}: still polling, queue status unavailable...`));
     }
     const delayMs = Date.now() - startedAt < fastPollDurationMs ? fastPollIntervalMs : slowPollIntervalMs;
-    await new Promise((resolve8) => setTimeout(resolve8, delayMs));
+    await new Promise((resolve9) => setTimeout(resolve9, delayMs));
   }
 }
 var DEFAULT_FAST_POLL_INTERVAL_MS = 100, DEFAULT_FAST_POLL_DURATION_MS = 2000, DEFAULT_SLOW_POLL_INTERVAL_MS = 2000, QUEUE_LOG_INTERVAL_MS = 5000, HEARTBEAT_INTERVAL_MS = 60000, MAX_CONSECUTIVE_POLL_ERRORS = 10;
@@ -41698,7 +41834,7 @@ var require_BufferList = __commonJS((exports, module) => {
       this.head = this.tail = null;
       this.length = 0;
     };
-    BufferList.prototype.join = function join11(s) {
+    BufferList.prototype.join = function join12(s) {
       if (this.length === 0)
         return "";
       var p = this.head;
@@ -43710,8 +43846,8 @@ var require_lib2 = __commonJS((exports, module) => {
       return this;
     }
     var p = this.constructor;
-    return this.then(resolve9, reject2);
-    function resolve9(value) {
+    return this.then(resolve10, reject2);
+    function resolve10(value) {
       function yes() {
         return value;
       }
@@ -43864,8 +44000,8 @@ var require_lib2 = __commonJS((exports, module) => {
     }
     return out;
   }
-  Promise2.resolve = resolve8;
-  function resolve8(value) {
+  Promise2.resolve = resolve9;
+  function resolve9(value) {
     if (value instanceof this) {
       return value;
     }
@@ -44219,10 +44355,10 @@ var require_utils = __commonJS((exports) => {
     var promise = external.Promise.resolve(inputData).then(function(data3) {
       var isBlob2 = support.blob && (data3 instanceof Blob || ["[object File]", "[object Blob]"].indexOf(Object.prototype.toString.call(data3)) !== -1);
       if (isBlob2 && typeof FileReader !== "undefined") {
-        return new external.Promise(function(resolve8, reject) {
+        return new external.Promise(function(resolve9, reject) {
           var reader = new FileReader;
           reader.onload = function(e) {
-            resolve8(e.target.result);
+            resolve9(e.target.result);
           };
           reader.onerror = function(e) {
             reject(e.target.error);
@@ -44686,7 +44822,7 @@ var require_StreamHelper = __commonJS((exports, module) => {
     }
   }
   function accumulate(helper, updateCallback) {
-    return new external.Promise(function(resolve8, reject) {
+    return new external.Promise(function(resolve9, reject) {
       var dataArray = [];
       var { _internalType: chunkType, _outputType: resultType, _mimeType: mimeType } = helper;
       helper.on("data", function(data3, meta) {
@@ -44700,7 +44836,7 @@ var require_StreamHelper = __commonJS((exports, module) => {
       }).on("end", function() {
         try {
           var result = transformZipOutput(resultType, concat(chunkType, dataArray), mimeType);
-          resolve8(result);
+          resolve9(result);
         } catch (e) {
           reject(e);
         }
@@ -50277,7 +50413,7 @@ var require_load = __commonJS((exports, module) => {
   var Crc32Probe = require_Crc32Probe();
   var nodejsUtils = require_nodejsUtils();
   function checkEntryCRC32(zipEntry) {
-    return new external.Promise(function(resolve8, reject) {
+    return new external.Promise(function(resolve9, reject) {
       var worker = zipEntry.decompressed.getContentWorker().pipe(new Crc32Probe);
       worker.on("error", function(e) {
         reject(e);
@@ -50285,7 +50421,7 @@ var require_load = __commonJS((exports, module) => {
         if (worker.streamInfo.crc32 !== zipEntry.decompressed.crc32) {
           reject(new Error("Corrupted zip : CRC32 mismatch"));
         } else {
-          resolve8();
+          resolve9();
         }
       }).resume();
     });
@@ -50400,9 +50536,9 @@ class TarAsZip {
     const sub = new TarAsZip(new Map);
     for (const [name, file] of Object.entries(this.files)) {
       if (name.startsWith(normalized)) {
-        const relative7 = name.slice(normalized.length);
-        if (relative7) {
-          sub.files[relative7] = { ...file, name: relative7 };
+        const relative8 = name.slice(normalized.length);
+        if (relative8) {
+          sub.files[relative8] = { ...file, name: relative8 };
         }
       }
     }
@@ -50413,7 +50549,7 @@ async function parseTarResponse(response) {
   const buffer = Buffer.from(await response.arrayBuffer());
   const entries = new Map;
   const ex = $extract();
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     ex.on("entry", (header, stream, next) => {
       const chunks = [];
       stream.on("data", (chunk) => chunks.push(chunk));
@@ -50427,7 +50563,7 @@ async function parseTarResponse(response) {
       stream.on("error", reject);
       stream.resume();
     });
-    ex.on("finish", () => resolve8(new TarAsZip(entries)));
+    ex.on("finish", () => resolve9(new TarAsZip(entries)));
     ex.on("error", reject);
     Readable2.from(buffer).pipe(ex);
   });
@@ -53379,7 +53515,7 @@ var require_compile = __commonJS((exports) => {
     const schOrFunc = root.refs[ref];
     if (schOrFunc)
       return schOrFunc;
-    let _sch = resolve8.call(this, root, ref);
+    let _sch = resolve9.call(this, root, ref);
     if (_sch === undefined) {
       const schema = (_a = root.localRefs) === null || _a === undefined ? undefined : _a[ref];
       const { schemaId } = this.opts;
@@ -53406,7 +53542,7 @@ var require_compile = __commonJS((exports) => {
   function sameSchemaEnv(s1, s2) {
     return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
   }
-  function resolve8(root, ref) {
+  function resolve9(root, ref) {
     let sch;
     while (typeof (sch = this.refs[ref]) == "string")
       ref = sch;
@@ -53914,54 +54050,54 @@ var require_fast_uri = __commonJS((exports, module) => {
     }
     return uri;
   }
-  function resolve8(baseURI, relativeURI, options) {
+  function resolve9(baseURI, relativeURI, options) {
     const schemelessOptions = Object.assign({ scheme: "null" }, options);
     const resolved = resolveComponents(parse7(baseURI, schemelessOptions), parse7(relativeURI, schemelessOptions), schemelessOptions, true);
     return serialize(resolved, { ...schemelessOptions, skipEscape: true });
   }
-  function resolveComponents(base, relative7, options, skipNormalization) {
+  function resolveComponents(base, relative8, options, skipNormalization) {
     const target = {};
     if (!skipNormalization) {
       base = parse7(serialize(base, options), options);
-      relative7 = parse7(serialize(relative7, options), options);
+      relative8 = parse7(serialize(relative8, options), options);
     }
     options = options || {};
-    if (!options.tolerant && relative7.scheme) {
-      target.scheme = relative7.scheme;
-      target.userinfo = relative7.userinfo;
-      target.host = relative7.host;
-      target.port = relative7.port;
-      target.path = removeDotSegments(relative7.path || "");
-      target.query = relative7.query;
+    if (!options.tolerant && relative8.scheme) {
+      target.scheme = relative8.scheme;
+      target.userinfo = relative8.userinfo;
+      target.host = relative8.host;
+      target.port = relative8.port;
+      target.path = removeDotSegments(relative8.path || "");
+      target.query = relative8.query;
     } else {
-      if (relative7.userinfo !== undefined || relative7.host !== undefined || relative7.port !== undefined) {
-        target.userinfo = relative7.userinfo;
-        target.host = relative7.host;
-        target.port = relative7.port;
-        target.path = removeDotSegments(relative7.path || "");
-        target.query = relative7.query;
+      if (relative8.userinfo !== undefined || relative8.host !== undefined || relative8.port !== undefined) {
+        target.userinfo = relative8.userinfo;
+        target.host = relative8.host;
+        target.port = relative8.port;
+        target.path = removeDotSegments(relative8.path || "");
+        target.query = relative8.query;
       } else {
-        if (!relative7.path) {
+        if (!relative8.path) {
           target.path = base.path;
-          if (relative7.query !== undefined) {
-            target.query = relative7.query;
+          if (relative8.query !== undefined) {
+            target.query = relative8.query;
           } else {
             target.query = base.query;
           }
         } else {
-          if (relative7.path.charAt(0) === "/") {
-            target.path = removeDotSegments(relative7.path);
+          if (relative8.path.charAt(0) === "/") {
+            target.path = removeDotSegments(relative8.path);
           } else {
             if ((base.userinfo !== undefined || base.host !== undefined || base.port !== undefined) && !base.path) {
-              target.path = "/" + relative7.path;
+              target.path = "/" + relative8.path;
             } else if (!base.path) {
-              target.path = relative7.path;
+              target.path = relative8.path;
             } else {
-              target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative7.path;
+              target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative8.path;
             }
             target.path = removeDotSegments(target.path);
           }
-          target.query = relative7.query;
+          target.query = relative8.query;
         }
         target.userinfo = base.userinfo;
         target.host = base.host;
@@ -53969,7 +54105,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       }
       target.scheme = base.scheme;
     }
-    target.fragment = relative7.fragment;
+    target.fragment = relative8.fragment;
     return target;
   }
   function equal2(uriA, uriB, options) {
@@ -54147,7 +54283,7 @@ var require_fast_uri = __commonJS((exports, module) => {
   var fastUri = {
     SCHEMES,
     normalize: normalize5,
-    resolve: resolve8,
+    resolve: resolve9,
     resolveComponents,
     equal: equal2,
     serialize,
@@ -56829,11 +56965,11 @@ var require_tslib = __commonJS((exports, module) => {
     };
     __awaiter2 = function(thisArg, _arguments, P, generator) {
       function adopt(value) {
-        return value instanceof P ? value : new P(function(resolve8) {
-          resolve8(value);
+        return value instanceof P ? value : new P(function(resolve9) {
+          resolve9(value);
         });
       }
-      return new (P || (P = Promise))(function(resolve8, reject) {
+      return new (P || (P = Promise))(function(resolve9, reject) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
@@ -56849,7 +56985,7 @@ var require_tslib = __commonJS((exports, module) => {
           }
         }
         function step(result) {
-          result.done ? resolve8(result.value) : adopt(result.value).then(fulfilled, rejected);
+          result.done ? resolve9(result.value) : adopt(result.value).then(fulfilled, rejected);
         }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
       });
@@ -57078,14 +57214,14 @@ var require_tslib = __commonJS((exports, module) => {
       }, i);
       function verb(n) {
         i[n] = o[n] && function(v) {
-          return new Promise(function(resolve8, reject) {
-            v = o[n](v), settle(resolve8, reject, v.done, v.value);
+          return new Promise(function(resolve9, reject) {
+            v = o[n](v), settle(resolve9, reject, v.done, v.value);
           });
         };
       }
-      function settle(resolve8, reject, d, v) {
+      function settle(resolve9, reject, d, v) {
         Promise.resolve(v).then(function(v2) {
-          resolve8({ value: v2, done: d });
+          resolve9({ value: v2, done: d });
         }, reject);
       }
     };
@@ -61600,7 +61736,7 @@ var init_openflow = __esm(() => {
   openflow_default = {
     openapi: "3.0.3",
     info: {
-      version: "1.783.0",
+      version: "1.785.0",
       title: "OpenFlow Spec",
       contact: {
         name: "Ruben Fiszel",
@@ -64070,17 +64206,73 @@ Frontend appends a \`*\` to the displayed name.
       },
       filters: {
         type: "array",
+        description: "Filters to match incoming messages (only matching messages trigger the script). Each entry is either a leaf `{key, value}` (top-level field) or `{path, value}` (dotted path into nested objects), or a group `{any_of: [...]}` / `{all_of: [...]}` / `{none_of: [...]}` nesting more entries. Entries at the top level are combined with `filter_logic`.",
         items: {
-          type: "object",
-          properties: {
-            key: {
-              type: "string"
+          description: "Either a leaf filter, matching a field of the message (parsed as JSON) against a value by equality (or superset, when the value is an object or array) — addressed by `key` for a top-level field or `path` for a dotted path into nested objects — or a group nesting sub-filters under a boolean operator (`none_of` matches when none of its sub-filters do).\n",
+          oneOf: [
+            {
+              type: "object",
+              properties: {
+                key: {
+                  type: "string"
+                },
+                value: {}
+              },
+              required: [
+                "key",
+                "value"
+              ]
             },
-            value: {}
-          },
-          required: [
-            "key",
-            "value"
+            {
+              type: "object",
+              properties: {
+                path: {
+                  type: "string",
+                  description: "Dotted path into nested objects, e.g. `a.b.c`. Does not traverse arrays."
+                },
+                value: {}
+              },
+              required: [
+                "path",
+                "value"
+              ]
+            },
+            {
+              type: "object",
+              properties: {
+                any_of: {
+                  type: "array",
+                  items: {}
+                }
+              },
+              required: [
+                "any_of"
+              ]
+            },
+            {
+              type: "object",
+              properties: {
+                all_of: {
+                  type: "array",
+                  items: {}
+                }
+              },
+              required: [
+                "all_of"
+              ]
+            },
+            {
+              type: "object",
+              properties: {
+                none_of: {
+                  type: "array",
+                  items: {}
+                }
+              },
+              required: [
+                "none_of"
+              ]
+            }
           ]
         }
       },
@@ -64091,7 +64283,7 @@ Frontend appends a \`*\` to the displayed name.
           "or"
         ],
         default: "and",
-        description: "Logic to apply when evaluating filters. 'and' requires all filters to match, 'or' requires any filter to match."
+        description: "Logic to apply when evaluating the top-level filters. 'and' requires all of them to match, 'or' requires any of them to match. Nested `any_of`/`all_of`/`none_of` groups carry their own logic."
       },
       auto_offset_reset: {
         type: "string",
@@ -64813,18 +65005,73 @@ Frontend appends a \`*\` to the displayed name.
       },
       filters: {
         type: "array",
-        description: "Array of key-value filters to match incoming messages (only matching messages trigger the script)",
+        description: "Filters to match incoming messages (only matching messages trigger the script). Each entry is either a leaf `{key, value}` (top-level field) or `{path, value}` (dotted path into nested objects), or a group `{any_of: [...]}` / `{all_of: [...]}` / `{none_of: [...]}` nesting more entries. Entries at the top level are combined with `filter_logic`.",
         items: {
-          type: "object",
-          properties: {
-            key: {
-              type: "string"
+          description: "Either a leaf filter, matching a field of the message (parsed as JSON) against a value by equality (or superset, when the value is an object or array) — addressed by `key` for a top-level field or `path` for a dotted path into nested objects — or a group nesting sub-filters under a boolean operator (`none_of` matches when none of its sub-filters do).\n",
+          oneOf: [
+            {
+              type: "object",
+              properties: {
+                key: {
+                  type: "string"
+                },
+                value: {}
+              },
+              required: [
+                "key",
+                "value"
+              ]
             },
-            value: {}
-          },
-          required: [
-            "key",
-            "value"
+            {
+              type: "object",
+              properties: {
+                path: {
+                  type: "string",
+                  description: "Dotted path into nested objects, e.g. `a.b.c`. Does not traverse arrays."
+                },
+                value: {}
+              },
+              required: [
+                "path",
+                "value"
+              ]
+            },
+            {
+              type: "object",
+              properties: {
+                any_of: {
+                  type: "array",
+                  items: {}
+                }
+              },
+              required: [
+                "any_of"
+              ]
+            },
+            {
+              type: "object",
+              properties: {
+                all_of: {
+                  type: "array",
+                  items: {}
+                }
+              },
+              required: [
+                "all_of"
+              ]
+            },
+            {
+              type: "object",
+              properties: {
+                none_of: {
+                  type: "array",
+                  items: {}
+                }
+              },
+              required: [
+                "none_of"
+              ]
+            }
           ]
         }
       },
@@ -64835,7 +65082,7 @@ Frontend appends a \`*\` to the displayed name.
           "or"
         ],
         default: "and",
-        description: "Logic to apply when evaluating filters. 'and' requires all filters to match, 'or' requires any filter to match."
+        description: "Logic to apply when evaluating the top-level filters. 'and' requires all of them to match, 'or' requires any of them to match. Nested `any_of`/`all_of`/`none_of` groups carry their own logic."
       },
       initial_messages: {
         type: "array",
@@ -65588,6 +65835,9 @@ function getWorkspaceSpecificPath(basePath, specificItems, workspaceNameOverride
   return;
 }
 function isCurrentWorkspaceFile(path8, workspaceNameOverride) {
+  if (isFilesetResource(path8)) {
+    return false;
+  }
   let currentWorkspace = null;
   if (workspaceNameOverride) {
     currentWorkspace = workspaceNameOverride;
@@ -65607,6 +65857,9 @@ function isCurrentWorkspaceFile(path8, workspaceNameOverride) {
   return pattern.test(path8);
 }
 function isWorkspaceSpecificFile(path8) {
+  if (isFilesetResource(path8)) {
+    return false;
+  }
   const typePattern = buildItemTypePattern();
   return new RegExp(`\\.[^.]+\\.${typePattern}\\.(yaml|json)$|` + `\\.[^.]+\\.resource\\.file\\..+$|` + `/folder\\.[^.]+\\.meta\\.(yaml|json)$|` + `^settings\\.[^.]+\\.(yaml|json)$`).test(path8);
 }
@@ -65624,11 +65877,11 @@ var init_specific_items = __esm(async () => {
 
 // src/utils/tar.ts
 function createTarBlob(entries) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve9, reject) => {
     const p = $pack();
     const chunks = [];
     p.on("data", (chunk) => chunks.push(new Uint8Array(chunk)));
-    p.on("end", () => resolve8(new Blob(chunks)));
+    p.on("end", () => resolve9(new Blob(chunks)));
     p.on("error", reject);
     for (const entry of entries) {
       p.entry({ name: entry.name }, Buffer.from(entry.content));
@@ -66369,7 +66622,7 @@ function collectPathScriptPaths(flowValue) {
 }
 
 // src/commands/flow/flow_metadata.ts
-import { existsSync as existsSync7 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { rm } from "node:fs/promises";
 import * as path8 from "node:path";
 import { sep as SEP4 } from "node:path";
@@ -66538,7 +66791,7 @@ async function generateFlowLockInternal(folder, dryRun, workspace, opts, justUpd
       if (inlineScripts.some((other) => other.path === legacyRelPath))
         continue;
       const legacyAbsPath = process.cwd() + SEP4 + folder + SEP4 + legacyRelPath;
-      if (existsSync7(legacyAbsPath)) {
+      if (existsSync8(legacyAbsPath)) {
         try {
           await rm(legacyAbsPath);
           info(colors.gray(`Removed legacy lock file ${legacyRelPath} (renamed to canonical name)`));
@@ -66661,7 +66914,7 @@ __export(exports_generate_metadata, {
 });
 import { sep as SEP5 } from "node:path";
 async function walkLocalScripts(codebases, ignore) {
-  const elems = await elementsToMap(await FSFSElement(process.cwd(), codebases, false), (p, isD) => !isD && !hasScriptExt(p) || ignore(p, isD) || isFolderResourcePathAnyFormat(p) || isDatatableMigrationPath(p) || isScriptModulePath(p) && !isModuleEntryPoint(p), false, {});
+  const elems = await elementsToMap(await FSFSElement(process.cwd(), codebases, false), (p, isD) => !isD && !hasScriptExt(p) || ignore(p, isD) || isFolderResourcePathAnyFormat(p) || isDatatableMigrationPath(p) || isFileResource(p) || isFilesetResource(p) || isScriptModulePath(p) && !isModuleEntryPoint(p), false, {});
   return Object.keys(elems);
 }
 async function walkLocalFlowFolders(ignore) {
@@ -66720,7 +66973,7 @@ function categorizeLocalFiles(paths) {
       flowFolderSet.add(p.substring(0, p.lastIndexOf(SEP5)));
     } else if (p.endsWith(SEP5 + "raw_app.yaml") || p.endsWith(SEP5 + "app.yaml")) {
       appPaths.push(p);
-    } else if (hasScriptExt(p) && !isFolderResourcePathAnyFormat(p) && !isDatatableMigrationPath(p) && !(isScriptModulePath(p) && !isModuleEntryPoint(p))) {
+    } else if (hasScriptExt(p) && !isFolderResourcePathAnyFormat(p) && !isDatatableMigrationPath(p) && !isFileResource(p) && !isFilesetResource(p) && !(isScriptModulePath(p) && !isModuleEntryPoint(p))) {
       scripts.push(p);
     }
   }
@@ -67112,6 +67365,7 @@ var init_generate_metadata = __esm(async () => {
   await __promiseAll([
     init_confirm(),
     init_types(),
+    init_utils(),
     init_conf(),
     init_context(),
     init_auth(),
@@ -67170,6 +67424,9 @@ async function push2(opts, filePath) {
   if (filePath.endsWith(".script.json") || filePath.endsWith(".script.yaml")) {
     throw Error("Cannot push a script metadata file, point to the script content file instead (.py, .ts, .go|.sh)");
   }
+  if (isFileResource(filePath) || isFilesetResource(filePath)) {
+    throw Error("Cannot push a file/fileset resource content file as a script, push its .resource.yaml with 'wmill resource push' instead");
+  }
   await requireLogin(opts);
   try {
     const content = await readScriptContent(filePath);
@@ -67229,6 +67486,9 @@ async function handleScriptMetadata(path10, workspace, alreadySynced, message, r
   }
 }
 async function handleFile(path10, workspace, alreadySynced, message, opts, rawWorkspaceDependencies, codebases, permissionedAsContext) {
+  if (isFileResource(path10) || isFilesetResource(path10)) {
+    return false;
+  }
   const moduleEntryPoint = isModuleEntryPoint(path10);
   if (!isAppInlineScriptPath2(path10) && !isFlowInlineScriptPath2(path10) && !isRawAppPath(path10) && (!isScriptModulePath(path10) || moduleEntryPoint) && hasScriptExt(path10)) {
     if (alreadySynced.includes(path10)) {
@@ -67700,7 +67960,7 @@ async function list4(opts) {
     new Table2().header(["path", "summary", "language", "created by"]).padding(2).border(true).body(total.map((x) => [x.path, x.summary, x.language, x.created_by])).render();
   }
 }
-async function resolve8(input) {
+async function resolve9(input) {
   if (!input) {
     throw new Error("No data given");
   }
@@ -67726,7 +67986,7 @@ async function run2(opts, path10) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   if (!opts.data) {
     try {
       const script = await getScriptByPath({
@@ -67792,7 +68052,7 @@ ${script.lock_error_logs}`);
       break;
     } catch {
       retries++;
-      await new Promise((resolve9) => setTimeout(resolve9, 100));
+      await new Promise((resolve10) => setTimeout(resolve10, 100));
     }
   }
   if (retries >= MAX_RETRIES) {
@@ -67829,7 +68089,7 @@ async function track_job(workspace, id) {
         info("failed to get job updated. skipping log streaming.");
         break;
       }
-      await new Promise((resolve9) => setTimeout(resolve9, 500));
+      await new Promise((resolve10) => setTimeout(resolve10, 500));
       continue;
     }
     if (!running && updates.running === true) {
@@ -67849,7 +68109,7 @@ async function track_job(workspace, id) {
       info(colors.yellow("Job suspended. Waiting for it to continue..."));
     }
   }
-  await new Promise((resolve9, _) => setTimeout(() => resolve9(undefined), 1000));
+  await new Promise((resolve10, _) => setTimeout(() => resolve10(undefined), 1000));
   try {
     const final_job = await getCompletedJob({ workspace, id });
     if ((final_job.logs?.length ?? -1) > logOffset) {
@@ -68018,12 +68278,14 @@ async function preview(opts, filePath) {
   if (opts.silent) {
     setSilent(true);
   }
+  const cwdBeforeConfig = process.cwd();
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  if (!validatePath(filePath)) {
-    return;
-  }
+  const argPath = filePath;
+  filePath = toSyncRootRelativePath(filePath, cwdBeforeConfig);
+  const remotePath = scriptPathToRemotePath(filePath);
+  assertRemotePath(remotePath, argPath);
   const absentDescriptor = await stat4(filePath).then(() => false, (e) => isMissingDbtDescriptor(filePath, e));
   if (!absentDescriptor) {
     const fstat = await stat4(filePath);
@@ -68037,7 +68299,7 @@ async function preview(opts, filePath) {
   const codebases = await listSyncCodebases(opts);
   const language = inferContentTypeFromFilePath(filePath, opts?.defaultTs);
   const content = await readScriptContent(filePath);
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   const isFolderLayout = isModuleEntryPoint(filePath);
   const isDbt = language === "dbt";
   const moduleFolderPath = isFolderLayout ? path9.dirname(filePath) : filePath.substring(0, filePath.indexOf(".")) + getModuleFolderSuffix(language);
@@ -68045,7 +68307,7 @@ async function preview(opts, filePath) {
   const codebase = language == "bun" ? findCodebase(filePath, codebases) : undefined;
   let tempScriptRefs = undefined;
   const { extractRelativeImports: extractRelativeImports2 } = await init_relative_imports().then(() => exports_relative_imports);
-  const relImports = await extractRelativeImports2(content, scriptPathToRemotePath(filePath), language);
+  const relImports = await extractRelativeImports2(content, remotePath, language);
   if (relImports.length > 0) {
     const { buildPreviewTempScriptRefs: buildPreviewTempScriptRefs2 } = await init_generate_metadata().then(() => exports_generate_metadata);
     tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, opts, codebases, { kind: "script", path: filePath });
@@ -68127,7 +68389,7 @@ async function preview(opts, filePath) {
     const form = new FormData;
     const previewPayload = {
       content,
-      path: filePath.substring(0, filePath.indexOf(".")).replaceAll(SEP6, "/"),
+      path: remotePath,
       args: input,
       language,
       tag: opts.tag,
@@ -68169,7 +68431,7 @@ async function preview(opts, filePath) {
         }
         break;
       } catch {
-        await new Promise((resolve9) => setTimeout(resolve9, 100));
+        await new Promise((resolve10) => setTimeout(resolve10, 100));
       }
     }
   } else {
@@ -68177,7 +68439,7 @@ async function preview(opts, filePath) {
       workspace: workspace.workspaceId,
       requestBody: {
         content,
-        path: filePath.substring(0, filePath.indexOf(".")).replaceAll(SEP6, "/"),
+        path: remotePath,
         args: input,
         language,
         tag: opts.tag,
@@ -69158,7 +69420,15 @@ async function readFilesetDirectory(dirPath) {
   await walk(dirPath, "");
   return result;
 }
-async function pushResource(workspace, remotePath, resource, localResource, originalLocalPath, wsSpecific) {
+function validateFilesetPointer(dirPath, remotePath) {
+  const normalize6 = (p) => p.replaceAll("\\", "/").replace(/\/+$/, "");
+  const pointer = normalize6(dirPath);
+  const expected = normalize6(remotePath.replaceAll(SEP8, "/")) + ".fileset";
+  if (pointer !== expected) {
+    throw new Error(`Resource ${remotePath.replaceAll(SEP8, "/")} uses '!inline_fileset ${dirPath}', ` + `but a fileset directory must live next to its resource file, at '${expected}'. ` + `Move the directory there (e.g. 'git mv ${pointer} ${expected}') and update the ` + `'!inline_fileset' value to match.`);
+  }
+}
+async function pushResource(workspace, remotePath, resource, localResource, originalLocalPath, wsSpecific, enforceCanonicalFileset) {
   remotePath = removeType(remotePath, "resource");
   try {
     resource = await getResource({
@@ -69169,6 +69439,9 @@ async function pushResource(workspace, remotePath, resource, localResource, orig
   const resolveInlineContent = async () => {
     if (typeof localResource.value === "string" && localResource.value.startsWith("!inline_fileset ")) {
       const dirPath = localResource.value.split(" ")[1];
+      if (enforceCanonicalFileset) {
+        validateFilesetPointer(dirPath, remotePath);
+      }
       localResource.value = await readFilesetDirectory(dirPath.replaceAll("/", SEP8));
     } else if (localResource.value["content"]?.startsWith("!inline ")) {
       const basePath = localResource.value["content"].split(" ")[1];
@@ -69334,6 +69607,7 @@ __export(exports_sync, {
   gitDeploy: () => gitDeploy,
   generateDatatablesDocumentation: () => generateDatatablesDocumentation,
   generateAgentsDocumentation: () => generateAgentsDocumentation,
+  findFilesetResourceFile: () => findFilesetResourceFile,
   findCodebase: () => findCodebase,
   findCaseInsensitiveCollisions: () => findCaseInsensitiveCollisions,
   extractInlineScriptsForApps: () => extractInlineScriptsForApps,
@@ -69354,7 +69628,7 @@ import {
   copyFile,
   mkdir as mkdir5
 } from "node:fs/promises";
-import { existsSync as existsSync9 } from "node:fs";
+import { existsSync as existsSync10 } from "node:fs";
 import * as path12 from "node:path";
 import { sep as SEP9 } from "node:path";
 function configKeyForItemKind(kind) {
@@ -69810,13 +70084,16 @@ function parseFileResourceTypeMap(raw) {
   }
   return { formatExtMap, filesetMap };
 }
-async function findFilesetResourceFile(changePath) {
+async function findFilesetResourceFile(changePath, wsName) {
   const filesetIdx = changePath.indexOf(".fileset" + SEP9);
   if (filesetIdx === -1) {
     throw new Error(`Not a fileset resource path: ${changePath}`);
   }
   const basePath = changePath.substring(0, filesetIdx);
   const candidates = [basePath + ".resource.json", basePath + ".resource.yaml"];
+  if (wsName) {
+    candidates.unshift(toWorkspaceSpecificPath(basePath + ".resource.json", wsName), toWorkspaceSpecificPath(basePath + ".resource.yaml", wsName));
+  }
   for (const candidate of candidates) {
     try {
       const s = await stat7(candidate);
@@ -69829,7 +70106,7 @@ async function findFilesetResourceFile(changePath) {
 async function pushFilesetParentResource(childPath, workspaceId, alreadySynced, cachedWsName, specificItems) {
   let resourceFilePath;
   try {
-    resourceFilePath = await findFilesetResourceFile(childPath);
+    resourceFilePath = await findFilesetResourceFile(childPath, cachedWsName);
   } catch {
     return { status: "parent-missing" };
   }
@@ -69846,7 +70123,7 @@ async function pushFilesetParentResource(childPath, workspaceId, alreadySynced,
   } else if (specificItems && isSpecificItem(childPath, specificItems)) {
     wsSpecific = true;
   }
-  await pushResource(workspaceId, serverPath, undefined, newObj, resourceFilePath, wsSpecific ? true : undefined);
+  await pushResource(workspaceId, serverPath, undefined, newObj, resourceFilePath, wsSpecific ? true : undefined, true);
   return { status: "pushed", resourceFilePath };
 }
 function ZipFSElement(zip, useYaml, defaultTs, resourceTypeToFormatExtension, resourceTypeToIsFileset, ignoreCodebaseChanges, stripOnBehalfOf) {
@@ -71136,8 +71413,8 @@ async function pushParentScriptForModule(modulePath, workspace, alreadySynced, m
     return;
   const moduleFolderPath = scriptBasePath + getModuleFolderSuffix(isDbt ? "dbt" : undefined);
   if (isDbt) {
-    const hasMetadata = existsSync9(scriptBasePath + ".script.yaml") || existsSync9(scriptBasePath + ".script.json");
-    if (!existsSync9(moduleFolderPath + "/dbt_project.yml")) {
+    const hasMetadata = existsSync10(scriptBasePath + ".script.yaml") || existsSync10(scriptBasePath + ".script.json");
+    if (!existsSync10(moduleFolderPath + "/dbt_project.yml")) {
       if (hasMetadata) {
         throw new Error(`${moduleFolderPath} has no dbt_project.yml but ${scriptBasePath}.script.yaml ` + `remains, so there is no dbt project left to push. Delete the metadata too to ` + `archive the script, or restore the project.`);
       }
@@ -71924,6 +72201,41 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
       warn(msg);
     }
   }
+  {
+    const wsNameForPointerCheck = wsNameForFiles || (isGitRepository() ? getCurrentGitBranch() : null);
+    const pointerErrors = [];
+    for (const change of changes) {
+      if (change.name !== "added" && change.name !== "edited") {
+        continue;
+      }
+      const normalizedPath = change.path.replaceAll(SEP9, "/");
+      if (!normalizedPath.endsWith(".resource.yaml") && !normalizedPath.endsWith(".resource.json")) {
+        continue;
+      }
+      if (isFilesetResource(change.path)) {
+        continue;
+      }
+      const content = change.name === "added" ? change.content : change.after;
+      let parsed;
+      try {
+        parsed = parseFromPath(change.path, content);
+      } catch {
+        continue;
+      }
+      if (typeof parsed?.value === "string" && parsed.value.startsWith("!inline_fileset ")) {
+        const serverPath = wsNameForPointerCheck && isWorkspaceSpecificFile(change.path) ? fromWorkspaceSpecificPath(change.path, wsNameForPointerCheck) : change.path;
+        try {
+          validateFilesetPointer(parsed.value.split(" ")[1], removeType(serverPath, "resource"));
+        } catch (e) {
+          pointerErrors.push(e instanceof Error ? e.message : String(e));
+        }
+      }
+    }
+    if (pointerErrors.length > 0) {
+      throw new Error(pointerErrors.join(`
+`));
+    }
+  }
   if (opts.dryRun && opts.jsonOutput) {
     const result = {
       success: true,
@@ -71967,11 +72279,11 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
         }
         const rules = folderRulesCache.get(folderName2);
         const remotePath = change.path.replace(/\.(script|schedule|http_trigger|websocket_trigger|kafka_trigger|nats_trigger|postgres_trigger|mqtt_trigger|amqp_trigger|sqs_trigger|gcp_trigger|azure_trigger|email_trigger)\.(yaml|json)$/, "").replace(/(\.flow|__flow)\/flow\.(yaml|json)$/, "").replace(/\.(app|raw_app)(\/app\.(yaml|json))?$/, "");
-        const relative7 = remotePath.slice(`f/${folderName2}/`.length);
-        if (!relative7)
+        const relative8 = remotePath.slice(`f/${folderName2}/`.length);
+        if (!relative8)
           continue;
         for (const rule of rules) {
-          if (minimatch(relative7, rule.path_glob)) {
+          if (minimatch(relative8, rule.path_glob)) {
             folderDefaultAnnotations.set(change.path, rule.permissioned_as);
             break;
           }
@@ -72108,27 +72420,22 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
               }
             }
             if (change.name === "edited") {
-              if (await handleScriptMetadata(change.path, workspace, alreadySynced, opts.message, rawWorkspaceDependencies, codebases, opts, permissionedAsContext)) {
+              if (isFileResource(change.path) || isFilesetResource(change.path)) {
                 if (stateTarget) {
-                  await writeFile7(stateTarget, change.after, "utf-8");
+                  await mkdir5(path12.dirname(stateTarget), { recursive: true });
+                  info(`Editing ${getTypeStrFromPath(change.path)} ${change.path}`);
                 }
-                continue;
-              } else if (await handleFile(change.path, workspace, alreadySynced, opts.message, opts, rawWorkspaceDependencies, codebases, permissionedAsContext)) {
-                if (stateTarget) {
-                  await writeFile7(stateTarget, change.after, "utf-8");
+              }
+              if (isFilesetResource(change.path)) {
+                const result = await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
+                if (result.status === "parent-missing") {
+                  throw new Error(`No resource metadata file found for fileset resource: ${change.path}`);
                 }
-                continue;
-              } else if (isScriptModulePath(change.path)) {
-                await pushParentScriptForModule(change.path, workspace, alreadySynced, opts.message, opts, rawWorkspaceDependencies, codebases);
                 if (stateTarget) {
                   await writeFile7(stateTarget, change.after, "utf-8");
                 }
                 continue;
               }
-              if (stateTarget) {
-                await mkdir5(path12.dirname(stateTarget), { recursive: true });
-                info(`Editing ${getTypeStrFromPath(change.path)} ${change.path}`);
-              }
               if (isFileResource(change.path)) {
                 const resourceFilePath = await findResourceFile(change.path);
                 if (!alreadySynced.includes(resourceFilePath)) {
@@ -72143,24 +72450,33 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   } else if (specificItems && isSpecificItem(change.path, specificItems)) {
                     isFileResWsSpecific = true;
                   }
-                  await pushResource(workspace.workspaceId, serverPath, undefined, newObj2, resourceFilePath, isFileResWsSpecific ? true : undefined);
-                  if (stateTarget) {
-                    await writeFile7(stateTarget, change.after, "utf-8");
-                  }
-                  continue;
+                  await pushResource(workspace.workspaceId, serverPath, undefined, newObj2, resourceFilePath, isFileResWsSpecific ? true : undefined, true);
+                }
+                if (stateTarget) {
+                  await writeFile7(stateTarget, change.after, "utf-8");
                 }
+                continue;
               }
-              if (isFilesetResource(change.path)) {
-                const result = await pushFilesetParentResource(change.path, workspace.workspaceId, alreadySynced, cachedWsNameForPush, specificItems);
-                if (result.status === "parent-missing") {
-                  throw new Error(`No resource metadata file found for fileset resource: ${change.path}`);
+              if (await handleScriptMetadata(change.path, workspace, alreadySynced, opts.message, rawWorkspaceDependencies, codebases, opts, permissionedAsContext)) {
+                if (stateTarget) {
+                  await writeFile7(stateTarget, change.after, "utf-8");
                 }
-                if (result.status === "pushed") {
-                  if (stateTarget) {
-                    await writeFile7(stateTarget, change.after, "utf-8");
-                  }
-                  continue;
+                continue;
+              } else if (await handleFile(change.path, workspace, alreadySynced, opts.message, opts, rawWorkspaceDependencies, codebases, permissionedAsContext)) {
+                if (stateTarget) {
+                  await writeFile7(stateTarget, change.after, "utf-8");
                 }
+                continue;
+              } else if (isScriptModulePath(change.path)) {
+                await pushParentScriptForModule(change.path, workspace, alreadySynced, opts.message, opts, rawWorkspaceDependencies, codebases);
+                if (stateTarget) {
+                  await writeFile7(stateTarget, change.after, "utf-8");
+                }
+                continue;
+              }
+              if (stateTarget) {
+                await mkdir5(path12.dirname(stateTarget), { recursive: true });
+                info(`Editing ${getTypeStrFromPath(change.path)} ${change.path}`);
               }
               const oldObj = parseFromPath(change.path, change.before);
               const newObj = parseFromPath(change.path, change.after);
@@ -72277,7 +72593,7 @@ Run 'wmill folder add-missing' to create them locally, then push again.`;
                   });
                   break;
                 case "resource": {
-                  const resourcePath = removeSuffix(target, ".resource.json");
+                  const resourcePath = removeResourceSuffix(target);
                   try {
                     await deleteResource({
                       workspace: workspaceId,
@@ -72912,7 +73228,7 @@ var init_parse_schema = __esm(() => {
 // src/utils/metadata.ts
 import { sep as SEP10 } from "node:path";
 import { writeFile as writeFile8, stat as stat8, rm as rm3, readdir as readdir5 } from "node:fs/promises";
-import { readFileSync as readFileSync3, existsSync as existsSync10, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { readFileSync as readFileSync3, existsSync as existsSync11, readdirSync as readdirSync2, statSync as statSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import * as path13 from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 function loadParser(pkgName) {
@@ -73016,7 +73332,7 @@ async function generateScriptMetadataInternal(scriptPath, workspace, opts, dryRu
   const metadataContent = await readTextFile(metadataWithType.path);
   const filteredRawWorkspaceDependencies = filterWorkspaceDependencies(rawWorkspaceDependencies, scriptContent, language);
   const moduleFolderPath = isFolderLayout ? path13.dirname(scriptPath) : scriptPath.substring(0, scriptPath.indexOf(".")) + getModuleFolderSuffix(language);
-  const hasModules = existsSync10(moduleFolderPath) && statSync3(moduleFolderPath).isDirectory();
+  const hasModules = existsSync11(moduleFolderPath) && statSync3(moduleFolderPath).isDirectory();
   const depsForHash = tree ? {} : filteredRawWorkspaceDependencies;
   let hash2 = await generateScriptHash(depsForHash, scriptContent, metadataContent);
   let moduleHashes = {};
@@ -73309,7 +73625,7 @@ async function updateScriptLock(workspace, scriptContent, language, remotePath,
   if (!languageNeedsLock(language)) {
     if (language === "dbt") {
       const lockPath2 = lockPathOverride ?? remotePath + ".script.lock";
-      if (existsSync10(lockPath2)) {
+      if (existsSync11(lockPath2)) {
         metadataContent.lock = "!inline " + lockPath2.replaceAll(SEP10, "/");
       }
     }
@@ -73367,7 +73683,7 @@ async function updateModuleLocks(workspace, dirPath, relPrefix, scriptRemotePath
           writeFileSync5(lockPath, lock, "utf-8");
         } else {
           try {
-            if (existsSync10(lockPath)) {
+            if (existsSync11(lockPath)) {
               const { rm: rmAsync } = await import("node:fs/promises");
               await rmAsync(lockPath);
             }
@@ -76045,7 +76361,7 @@ async function waitForJob(workspace, jobId) {
   }
   let syncIteration = 0;
   let lastQueueLogAt = Date.now();
-  return new Promise((resolve10, reject) => {
+  return new Promise((resolve11, reject) => {
     async function checkJob() {
       try {
         const maybeJob = await getCompletedJobResultMaybe({
@@ -76057,7 +76373,7 @@ async function waitForJob(workspace, jobId) {
           if (!maybeJob.success && typeof maybeJob.result === "object" && maybeJob.result !== null && "error" in maybeJob.result) {
             reject(maybeJob.result.error);
           } else {
-            resolve10(maybeJob.result);
+            resolve11(maybeJob.result);
           }
           return;
         }
@@ -77087,8 +77403,8 @@ This folder is for SQL migration files that will be applied to datatables during
           process.stdout.write(`\r${colors.gray(`${frames[i++ % frames.length]} Creating Claude session...`)}`);
         }, 80);
         try {
-          await new Promise((resolve11, reject) => {
-            exec(`claude --session-id "${sessionId}" -p "Say: Your app is ready, click on preview to test it!"`, { cwd: absAppDir }, (error2) => error2 ? reject(error2) : resolve11());
+          await new Promise((resolve12, reject) => {
+            exec(`claude --session-id "${sessionId}" -p "Say: Your app is ready, click on preview to test it!"`, { cwd: absAppDir }, (error2) => error2 ? reject(error2) : resolve12());
           });
         } finally {
           clearInterval(spinner);
@@ -77283,7 +77599,7 @@ var init_new = __esm(async () => {
 });
 
 // src/commands/app/app.ts
-import { sep as SEP14, isAbsolute as isAbsolute4, resolve as pathResolve, relative as pathRelative, basename as basename8 } from "node:path";
+import { sep as SEP14, isAbsolute as isAbsolute5, resolve as pathResolve, relative as pathRelative, basename as basename9 } from "node:path";
 import { stat as stat10 } from "node:fs/promises";
 function respecializeFields(fields) {
   Object.entries(fields).forEach(([k, v]) => {
@@ -77484,9 +77800,9 @@ async function push5(opts, filePath, remotePath) {
   if (!filePath) {
     filePath = originalCwd;
   }
-  const absoluteFilePath = isAbsolute4(filePath) ? filePath : pathResolve(originalCwd, filePath);
+  const absoluteFilePath = isAbsolute5(filePath) ? filePath : pathResolve(originalCwd, filePath);
   const normalizedPath = absoluteFilePath.endsWith(SEP14) ? absoluteFilePath.slice(0, -1) : absoluteFilePath;
-  const dirName = basename8(normalizedPath);
+  const dirName = basename9(normalizedPath);
   const isRawAppByName = dirName.endsWith("__raw_app") || dirName.endsWith(".raw_app");
   const isAppByName = dirName.endsWith("__app") || dirName.endsWith(".app");
   let hasRawAppYaml = false;
@@ -77513,7 +77829,7 @@ async function push5(opts, filePath, remotePath) {
     }
     const wmillRoot = process.cwd();
     let inferred = pathRelative(wmillRoot, normalizedPath).replaceAll(SEP14, "/");
-    if (inferred.startsWith("..") || isAbsolute4(inferred)) {
+    if (inferred.startsWith("..") || isAbsolute5(inferred)) {
       error(colors.red(`Could not infer remote path: '${filePath}' is outside the wmill.yaml root (${wmillRoot}). Move the folder under the root or pass <remote_path> explicitly.`));
       return;
     }
@@ -77809,24 +78125,24 @@ var init_folder = __esm(async () => {
       error(`Path '${testPath}' is not under folder '${folderName2}' (expected prefix '${prefix}')`);
       return;
     }
-    const relative8 = testPath.slice(prefix.length);
+    const relative9 = testPath.slice(prefix.length);
     const { minimatch: minimatch2 } = await Promise.resolve().then(() => (init_esm2(), exports_esm));
     for (let i = 0;i < rules.length; i++) {
       const rule = rules[i];
-      if (minimatch2(relative8, rule.path_glob)) {
+      if (minimatch2(relative9, rule.path_glob)) {
         if (opts.json) {
-          console.log(JSON.stringify({ matched: true, rule_index: i, rule, relative_path: relative8 }));
+          console.log(JSON.stringify({ matched: true, rule_index: i, rule, relative_path: relative9 }));
         } else {
           info(colors.green(`✓ Rule #${i + 1} matches: path_glob='${rule.path_glob}' → permissioned_as='${rule.permissioned_as}'`));
-          info(colors.gray(`  (relative path tested: '${relative8}')`));
+          info(colors.gray(`  (relative path tested: '${relative9}')`));
         }
         return;
       }
     }
     if (opts.json) {
-      console.log(JSON.stringify({ matched: false, relative_path: relative8 }));
+      console.log(JSON.stringify({ matched: false, relative_path: relative9 }));
     } else {
-      info(colors.yellow(`No rule matches path '${testPath}' (relative: '${relative8}')`));
+      info(colors.yellow(`No rule matches path '${testPath}' (relative: '${relative9}')`));
     }
   });
   folder_default = command15;
@@ -77834,7 +78150,7 @@ var init_folder = __esm(async () => {
 
 // src/commands/variable/variable.ts
 import { mkdir as mkdir9, stat as stat12, writeFile as writeFile12 } from "node:fs/promises";
-import { dirname as dirname15 } from "node:path";
+import { dirname as dirname16 } from "node:path";
 import { sep as SEP16 } from "node:path";
 async function list8(opts) {
   if (opts.json)
@@ -77872,7 +78188,7 @@ async function newVariable(opts, path21) {
     is_secret: false,
     description: ""
   };
-  await mkdir9(dirname15(filePath), { recursive: true });
+  await mkdir9(dirname16(filePath), { recursive: true });
   await writeFile12(filePath, import_yaml26.stringify(template), {
     flag: "wx",
     encoding: "utf-8"
@@ -78057,7 +78373,7 @@ var init_variable = __esm(async () => {
 
 // src/commands/schedule/schedule.ts
 import { mkdir as mkdir10, stat as stat13, writeFile as writeFile13 } from "node:fs/promises";
-import { dirname as dirname16 } from "node:path";
+import { dirname as dirname17 } from "node:path";
 import { sep as SEP17 } from "node:path";
 async function list9(opts) {
   if (opts.json)
@@ -78094,7 +78410,7 @@ async function newSchedule(opts, path21) {
     is_flow: false,
     enabled: false
   };
-  await mkdir10(dirname16(filePath), { recursive: true });
+  await mkdir10(dirname17(filePath), { recursive: true });
   await writeFile13(filePath, import_yaml27.stringify(template), {
     flag: "wx",
     encoding: "utf-8"
@@ -79856,7 +80172,7 @@ var init_dependencies = __esm(async () => {
 
 // src/commands/trigger/trigger.ts
 import { mkdir as mkdir12, stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
-import { dirname as dirname17 } from "node:path";
+import { dirname as dirname18 } from "node:path";
 import { sep as SEP18 } from "node:path";
 async function getTrigger(triggerType, workspace, path22) {
   const triggerFunctions = {
@@ -80057,7 +80373,7 @@ async function newTrigger(opts, path22) {
       throw e;
   }
   const template = triggerTemplates[kind];
-  await mkdir12(dirname17(filePath), { recursive: true });
+  await mkdir12(dirname18(filePath), { recursive: true });
   await writeFile17(filePath, import_yaml34.stringify(template), {
     flag: "wx",
     encoding: "utf-8"
@@ -80470,7 +80786,7 @@ async function pushObj(workspace, p, befObj, newObj, plainSecrets, alreadySynced
   } else if (typeEnding === "resource") {
     if (!alreadySynced3.includes(p)) {
       alreadySynced3.push(p);
-      await pushResource(workspace, p, befObj, newObj, originalLocalPath || p, wsSpecific);
+      await pushResource(workspace, p, befObj, newObj, originalLocalPath || p, wsSpecific, true);
     }
   } else if (typeEnding === "resource-type") {
     await pushResourceType(workspace, p, befObj, newObj);
@@ -80789,7 +81105,7 @@ var init_local_path_scripts = __esm(async () => {
 });
 
 // src/commands/flow/flow.ts
-import { dirname as dirname18, sep as SEP20 } from "node:path";
+import { dirname as dirname19, sep as SEP20 } from "node:path";
 import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "node:fs";
 function normalizeOptionalString(value) {
   return typeof value === "string" && value.trim() === "" ? undefined : value ?? undefined;
@@ -81039,7 +81355,7 @@ async function run3(opts, path23) {
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   if (!opts.data) {
     try {
       const flow = await getFlowByPath({
@@ -81120,7 +81436,7 @@ async function run3(opts, path23) {
             forLoopFailed = refreshedModule.type === "Failure";
             break;
           }
-          await new Promise((resolve11) => setTimeout(resolve11, 200));
+          await new Promise((resolve12) => setTimeout(resolve12, 200));
         }
         if (forLoopFailed)
           break;
@@ -81136,7 +81452,7 @@ async function run3(opts, path23) {
         info(colors.dim(status));
         lastStatus = status;
       }
-      await new Promise((resolve11, _) => setTimeout(() => resolve11(undefined), 100));
+      await new Promise((resolve12, _) => setTimeout(() => resolve12(undefined), 100));
       if (isCompleted)
         break;
       continue;
@@ -81172,7 +81488,7 @@ async function run3(opts, path23) {
       break;
     } catch {
       retries++;
-      await new Promise((resolve11) => setTimeout(resolve11, 100));
+      await new Promise((resolve12) => setTimeout(resolve12, 100));
     }
   }
   if (retries >= MAX_RETRIES) {
@@ -81184,16 +81500,19 @@ async function preview2(opts, flowPath) {
     setSilent(true);
   }
   const useLocalPathScripts = !opts.remote;
+  const cwdBeforeConfig = process.cwd();
   if (useLocalPathScripts) {
     opts = await mergeConfigWithConfigFile(opts);
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const codebases = useLocalPathScripts ? listSyncCodebases(opts) : [];
+  const argPath = flowPath;
+  flowPath = toSyncRootRelativePath(flowPath, cwdBeforeConfig);
   const isFlowDir = flowPath.endsWith(".flow") || flowPath.endsWith(".flow" + SEP20) || flowPath.endsWith("__flow") || flowPath.endsWith("__flow" + SEP20);
   if (!isFlowDir) {
     if (flowPath.endsWith("flow.yaml") || flowPath.endsWith("flow.json")) {
-      flowPath = dirname18(flowPath);
+      flowPath = dirname19(flowPath);
     } else {
       throw new Error("Flow path must be a .flow/__flow directory or a flow.yaml file");
     }
@@ -81201,6 +81520,8 @@ async function preview2(opts, flowPath) {
   if (!flowPath.endsWith(SEP20)) {
     flowPath += SEP20;
   }
+  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP20, "/");
+  assertRemotePath(flowWmPath, argPath);
   const localFlow = await yamlParseFile(flowPath + "flow.yaml");
   const fileReader = async (path23) => await readTextFile(flowPath + path23);
   await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, flowPath, SEP20);
@@ -81235,9 +81556,8 @@ async function preview2(opts, flowPath) {
     const resolvedCodebases = await Promise.resolve(codebases);
     tempScriptRefs = await buildPreviewTempScriptRefs2(workspace, opts, resolvedCodebases, { kind: "flow", folder: flowPath });
   }
-  const input = opts.data ? await resolve8(opts.data) : {};
+  const input = opts.data ? await resolve9(opts.data) : {};
   debug(`Flow value: ${JSON.stringify(localFlow.value, null, 2)}`);
-  const flowWmPath = stripFlowSuffix(flowPath).replaceAll(SEP20, "/");
   if (opts.step) {
     await previewStep(opts.step, localFlow, flowWmPath, workspace, input, tempScriptRefs, opts.silent, opts.tag);
     return;
@@ -83391,6 +83711,14 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
+/**
+ * Cancel a queued or running job by ID.
+ * @param jobId - UUID of the job to cancel
+ * @param reason - Optional reason for cancellation
+ * @returns Response message from the cancel endpoint
+ */
+async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<string>
+
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -84155,6 +84483,14 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
+/**
+ * Cancel a queued or running job by ID.
+ * @param jobId - UUID of the job to cancel
+ * @param reason - Optional reason for cancellation
+ * @returns Response message from the cancel endpoint
+ */
+async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<string>
+
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -85013,6 +85349,14 @@ async getResult(jobId: string): Promise<any>
  */
 async getResultMaybe(jobId: string): Promise<any>
 
+/**
+ * Cancel a queued or running job by ID.
+ * @param jobId - UUID of the job to cancel
+ * @param reason - Optional reason for cancellation
+ * @returns Response message from the cancel endpoint
+ */
+async cancelJob(jobId: string, reason: string | undefined = undefined): Promise<string>
+
 /**
  * Run a script asynchronously by its path
  * @param path - Script path in Windmill
@@ -91006,18 +91350,62 @@ properties:
   filters:
     type: array
     items:
-      type: object
-      properties:
-        key:
-          type: string
-        value: {}
+      oneOf:
+      - type: object
+        properties:
+          key:
+            type: string
+          value: {}
+        required:
+        - key
+        - value
+      - type: object
+        properties:
+          path:
+            type: string
+            description: Dotted path into nested objects, e.g. \`a.b.c\`. Does not traverse
+              arrays.
+          value: {}
+        required:
+        - path
+        - value
+      - type: object
+        properties:
+          any_of:
+            type: array
+            items:
+              type: object
+        required:
+        - any_of
+      - type: object
+        properties:
+          all_of:
+            type: array
+            items:
+              type: object
+        required:
+        - all_of
+      - type: object
+        properties:
+          none_of:
+            type: array
+            items:
+              type: object
+        required:
+        - none_of
+    description: 'Filters to match incoming messages (only matching messages trigger
+      the script). Each entry is either a leaf \`{key, value}\` (top-level field) or
+      \`{path, value}\` (dotted path into nested objects), or a group \`{any_of: [...]}\`
+      / \`{all_of: [...]}\` / \`{none_of: [...]}\` nesting more entries. Entries at the
+      top level are combined with \`filter_logic\`.'
   filter_logic:
     type: string
     enum:
     - and
     - or
-    description: Logic to apply when evaluating filters. 'and' requires all filters
-      to match, 'or' requires any filter to match.
+    description: Logic to apply when evaluating the top-level filters. 'and' requires
+      all of them to match, 'or' requires any of them to match. Nested \`any_of\`/\`all_of\`/\`none_of\`
+      groups carry their own logic.
   auto_offset_reset:
     type: string
     enum:
@@ -91118,6 +91506,18 @@ properties:
     type: array
     items:
       type: object
+      properties:
+        qos:
+          type: string
+          enum:
+          - qos0
+          - qos1
+          - qos2
+        topic:
+          type: string
+      required:
+      - qos
+      - topic
     description: Array of MQTT topics to subscribe to, each with topic name and QoS
       level
   v3_config:
@@ -91662,24 +92062,91 @@ properties:
   filters:
     type: array
     items:
-      type: object
-      properties:
-        key:
-          type: string
-        value: {}
-    description: Array of key-value filters to match incoming messages (only matching
-      messages trigger the script)
+      oneOf:
+      - type: object
+        properties:
+          key:
+            type: string
+          value: {}
+        required:
+        - key
+        - value
+      - type: object
+        properties:
+          path:
+            type: string
+            description: Dotted path into nested objects, e.g. \`a.b.c\`. Does not traverse
+              arrays.
+          value: {}
+        required:
+        - path
+        - value
+      - type: object
+        properties:
+          any_of:
+            type: array
+            items:
+              type: object
+        required:
+        - any_of
+      - type: object
+        properties:
+          all_of:
+            type: array
+            items:
+              type: object
+        required:
+        - all_of
+      - type: object
+        properties:
+          none_of:
+            type: array
+            items:
+              type: object
+        required:
+        - none_of
+    description: 'Filters to match incoming messages (only matching messages trigger
+      the script). Each entry is either a leaf \`{key, value}\` (top-level field) or
+      \`{path, value}\` (dotted path into nested objects), or a group \`{any_of: [...]}\`
+      / \`{all_of: [...]}\` / \`{none_of: [...]}\` nesting more entries. Entries at the
+      top level are combined with \`filter_logic\`.'
   filter_logic:
     type: string
     enum:
     - and
     - or
-    description: Logic to apply when evaluating filters. 'and' requires all filters
-      to match, 'or' requires any filter to match.
+    description: Logic to apply when evaluating the top-level filters. 'and' requires
+      all of them to match, 'or' requires any of them to match. Nested \`any_of\`/\`all_of\`/\`none_of\`
+      groups carry their own logic.
   initial_messages:
     type: array
     items:
-      type: object
+      oneOf:
+      - type: object
+        properties:
+          raw_message:
+            type: string
+        required:
+        - raw_message
+      - type: object
+        properties:
+          runnable_result:
+            type: object
+            properties:
+              path:
+                type: string
+              args:
+                type: object
+                description: The arguments to pass to the script or flow
+                additionalProperties: true
+              is_flow:
+                type: boolean
+            required:
+            - path
+            - args
+            - is_flow
+        required:
+        - runnable_result
     description: Messages to send immediately after connecting (can be raw strings
       or computed by runnables)
   url_runnable_args:
@@ -91935,7 +92402,7 @@ __export(exports_tsconfig, {
 });
 import { execSync as execSync6 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync18, readFileSync as readFileSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import { existsSync as existsSync19, readFileSync as readFileSync5, writeFileSync as writeFileSync9 } from "node:fs";
 import path24 from "node:path";
 import process25 from "node:process";
 function buildManagedTsconfig() {
@@ -92062,7 +92529,7 @@ async function refreshManagedDenoImportMap(mode) {
   });
 }
 async function ensureUserReferencesManaged(opts) {
-  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path24.join(process25.cwd(), f)).find((p) => existsSync18(p));
+  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path24.join(process25.cwd(), f)).find((p) => existsSync19(p));
   if (!existing) {
     const userPath = path24.join(process25.cwd(), opts.file);
     writeFileSync9(userPath, JSON.stringify(opts.create, null, 2) + `
@@ -92114,7 +92581,7 @@ async function ensureUserReferencesManaged(opts) {
 }
 function ensureBunTypesAvailable() {
   const cwd = process25.cwd();
-  if (existsSync18(path24.join(cwd, "node_modules", "bun-types"))) {
+  if (existsSync19(path24.join(cwd, "node_modules", "bun-types"))) {
     return true;
   }
   try {
@@ -92137,7 +92604,7 @@ function ensureBunTypesAvailable() {
 async function warnIfTsconfigStale(opts) {
   const cwd = opts?.cwd ?? process25.cwd();
   const managedPath = path24.join(cwd, MANAGED_TSCONFIG);
-  if (!existsSync18(managedPath))
+  if (!existsSync19(managedPath))
     return;
   let managedText;
   try {
@@ -93390,7 +93857,7 @@ await __promiseAll([
   init_user(),
   init_variable()
 ]);
-import { realpathSync } from "node:fs";
+import { realpathSync as realpathSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/hub/hub.ts
@@ -93576,18 +94043,18 @@ await __promiseAll([
   init_context()
 ]);
 var import_yaml40 = __toESM(require_dist(), 1);
-import { existsSync as existsSync15 } from "node:fs";
+import { existsSync as existsSync16 } from "node:fs";
 import { writeFile as writeFile19 } from "node:fs/promises";
-import { dirname as dirname19, join as join21 } from "node:path";
+import { dirname as dirname20, join as join22 } from "node:path";
 var PROTECTION_RULES_FILENAME = "protection-rules.yaml";
 function getProtectionRulesPath() {
   const wmillPath = getWmillYamlPath();
   if (!wmillPath)
     return null;
-  return join21(dirname19(wmillPath), PROTECTION_RULES_FILENAME);
+  return join22(dirname20(wmillPath), PROTECTION_RULES_FILENAME);
 }
 async function readProtectionRulesFile(path23) {
-  if (!existsSync15(path23))
+  if (!existsSync16(path23))
     return {};
   const parsed = await yamlParseFile(path23);
   return parsed ?? {};
@@ -93798,7 +94265,7 @@ await __promiseAll([
   init_conf()
 ]);
 import process24 from "node:process";
-import { existsSync as existsSync16 } from "node:fs";
+import { existsSync as existsSync17 } from "node:fs";
 async function pushProtectionRules(opts, workspaceArg) {
   if (opts.jsonOutput)
     setSilent(true);
@@ -93808,7 +94275,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       error: "No wmill.yaml found. Run 'wmill init' first — protection-rules.yaml lives next to it."
     });
   }
-  if (!existsSync16(prPath)) {
+  if (!existsSync17(prPath)) {
     fail(opts, {
       error: "No protection-rules.yaml found. Run 'wmill protection-rules pull' first."
     });
@@ -94770,7 +95237,7 @@ async function dev2(opts) {
       }
       socket.destroy();
     });
-    return new Promise((resolve11) => {
+    return new Promise((resolve12) => {
       proxyServer.listen(proxyPort, BIND_HOST, () => {
         console.log(`Dev proxy listening on http://localhost:${proxyPort}`);
         if (opts.path) {
@@ -94780,7 +95247,7 @@ async function dev2(opts) {
           console.log("(pass --path <path> to skip the picker)");
         }
         maybeOpenBrowser(`http://localhost:${proxyPort}/`);
-        resolve11();
+        resolve12();
       });
     });
   }
@@ -94886,9 +95353,9 @@ class NpmProvider extends Provider {
       if (verbose)
         process.stderr.write(d);
     });
-    const exitCode = await new Promise((resolve11, reject) => {
+    const exitCode = await new Promise((resolve12, reject) => {
       proc.on("error", reject);
-      proc.on("close", resolve11);
+      proc.on("close", resolve12);
     }).catch((e) => {
       throw new Error(`failed to run npm: ${e instanceof Error ? e.message : e}
 
@@ -95584,7 +96051,7 @@ await __promiseAll([
   init_freshness()
 ]);
 import { cp, mkdir as mkdir13, readdir as readdir11, rm as rm6, stat as stat19, writeFile as writeFile21 } from "node:fs/promises";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 var WMILL_INIT_AI_SKILLS_SOURCE_ENV = "WMILL_INIT_AI_SKILLS_SOURCE";
 var WMILL_INIT_AI_AGENTS_SOURCE_ENV = "WMILL_INIT_AI_AGENTS_SOURCE";
 var WMILL_INIT_AI_CLAUDE_SOURCE_ENV = "WMILL_INIT_AI_CLAUDE_SOURCE";
@@ -95597,20 +96064,20 @@ async function writeAiGuidanceFiles(options) {
   const skillMetadata = options.skillsSourcePath ? await readSkillMetadataFromDirectory(options.skillsSourcePath) : getGeneratedSkillMetadata();
   const rawAgentsCliContent = options.agentsSourcePath != null ? await readTextFile(options.agentsSourcePath) : generateAgentsCliMdContent(buildSkillsReference(skillMetadata));
   const agentsCliContent = injectPromptsHashMarker(rawAgentsCliContent, currentPromptsHash(nonDottedPaths));
-  const agentsCliPath = join23(options.targetDir, AGENTS_WMILL_FILENAME);
+  const agentsCliPath = join24(options.targetDir, AGENTS_WMILL_FILENAME);
   await writeFile21(agentsCliPath, agentsCliContent, "utf8");
   const agentsCliWritten = true;
   const legacyManagedRemoved = await migrateLegacyManagedFile(options.targetDir);
   const resolveMigration = cacheOnce(options.resolveAgentsMdMigration);
   const agentsMdResult = await reconcileIncludingFile({
-    path: join23(options.targetDir, "AGENTS.md"),
+    path: join24(options.targetDir, "AGENTS.md"),
     includeLine: AGENTS_WMILL_INCLUDE_LINE,
     skeleton: generateAgentsMdSkeleton(),
     resolveMigration
   });
   const claudeSkeleton = options.claudeSourcePath != null ? await readTextFile(options.claudeSourcePath) : CLAUDE_MD_DEFAULT;
   const claudeMdResult = await reconcileIncludingFile({
-    path: join23(options.targetDir, "CLAUDE.md"),
+    path: join24(options.targetDir, "CLAUDE.md"),
     includeLine: CLAUDE_MD_INCLUDE_LINE,
     skeleton: claudeSkeleton,
     resolveMigration
@@ -95632,7 +96099,7 @@ async function writeAiGuidanceFiles(options) {
 }
 async function migrateLegacyManagedFile(targetDir) {
   for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
-    const filePath = join23(targetDir, fileName);
+    const filePath = join24(targetDir, fileName);
     const existing = await readTextFile(filePath).catch(() => null);
     if (existing == null)
       continue;
@@ -95641,7 +96108,7 @@ async function migrateLegacyManagedFile(targetDir) {
       await writeFile21(filePath, rewritten, "utf8");
     }
   }
-  const legacyPath = join23(targetDir, LEGACY_AGENTS_CLI_FILENAME);
+  const legacyPath = join24(targetDir, LEGACY_AGENTS_CLI_FILENAME);
   const legacyExists = await stat19(legacyPath).catch(() => null) != null;
   if (legacyExists) {
     await rm6(legacyPath, { force: true });
@@ -95718,9 +96185,9 @@ async function copySkillsFromSource(targetDir, skillsSourcePath) {
 async function writeGeneratedSkills(targetDir, nonDottedPaths) {
   const skillsDirs = await ensureSkillsDirectories(targetDir);
   await Promise.all(skillsDirs.flatMap((skillsDir) => SKILLS.map(async (skill) => {
-    const skillDir = join23(skillsDir, skill.name);
+    const skillDir = join24(skillsDir, skill.name);
     await mkdir13(skillDir, { recursive: true });
-    await writeFile21(join23(skillDir, "SKILL.md"), renderGeneratedSkillContent(skill.name, nonDottedPaths), "utf8");
+    await writeFile21(join24(skillDir, "SKILL.md"), renderGeneratedSkillContent(skill.name, nonDottedPaths), "utf8");
   })));
   return SKILLS.map((skill) => ({
     ...skill,
@@ -95734,14 +96201,14 @@ function getGeneratedSkillMetadata() {
   }));
 }
 async function ensureSkillsDirectories(targetDir) {
-  const skillsDirs = SKILL_TARGET_ROOTS.map((root) => join23(targetDir, root, "skills"));
+  const skillsDirs = SKILL_TARGET_ROOTS.map((root) => join24(targetDir, root, "skills"));
   await Promise.all(skillsDirs.map((skillsDir) => mkdir13(skillsDir, { recursive: true })));
   return skillsDirs;
 }
 async function copyDirectoryContents(sourceDir, targetDir) {
   const entries = await readdir11(sourceDir, { withFileTypes: true });
   await Promise.all(entries.map(async (entry) => {
-    await cp(join23(sourceDir, entry.name), join23(targetDir, entry.name), {
+    await cp(join24(sourceDir, entry.name), join24(targetDir, entry.name), {
       recursive: true,
       force: true
     });
@@ -95784,7 +96251,7 @@ async function readSkillMetadataFromDirectory(skillsDir) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const skillPath = join23(skillsDir, entry.name, "SKILL.md");
+    const skillPath = join24(skillsDir, entry.name, "SKILL.md");
     if (!await stat19(skillPath).catch(() => null)) {
       continue;
     }
@@ -98376,16 +98843,16 @@ async function startServe(opts) {
     error(`server error: ${err.message}`);
     process.exitCode = 1;
   });
-  await new Promise((resolve11) => server.listen(port, host, () => resolve11()));
+  await new Promise((resolve12) => server.listen(port, host, () => resolve12()));
   return {
     host,
     port,
     user: DEFAULT_USER,
     password,
     connectionString: (datatableName) => `postgresql://${DEFAULT_USER}:${encodeURIComponent(password)}@${host}:${port}/${encodeURIComponent(datatableName)}`,
-    close: () => new Promise((resolve11) => {
-      server.close(() => resolve11());
-      setTimeout(resolve11, 1000).unref();
+    close: () => new Promise((resolve12) => {
+      server.close(() => resolve12());
+      setTimeout(resolve12, 1000).unref();
     })
   };
 }
@@ -98894,13 +99361,13 @@ async function psql(opts) {
     }
     handle.close().finally(() => process.exit(1));
   });
-  const exitCode = await new Promise((resolve11) => {
+  const exitCode = await new Promise((resolve12) => {
     child.on("exit", (code2, signal) => {
       if (signal && typeof signal === "string") {
         const num = signalToNumber(signal);
-        resolve11(num !== undefined ? 128 + num : 1);
+        resolve12(num !== undefined ? 128 + num : 1);
       } else {
-        resolve11(code2 ?? 0);
+        resolve12(code2 ?? 0);
       }
     });
   });
@@ -100303,7 +100770,7 @@ await __promiseAll([
   init_conf()
 ]);
 import { writeFile as writeFile25 } from "node:fs/promises";
-import { existsSync as existsSync20, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync8 } from "node:fs";
 import * as path27 from "node:path";
 var ASSET_KINDS = "s3object,ducklake,datatable,volume,dbt";
 function assetUri(kind, p3) {
@@ -100523,7 +100990,7 @@ async function generatePipelineDocs(opts, folder) {
   ];
   for (const [name, content] of pointers) {
     const p3 = path27.join(folderDir, name);
-    if (existsSync20(p3)) {
+    if (existsSync21(p3)) {
       let existing;
       try {
         existing = readFileSync8(p3, "utf-8");
@@ -100542,7 +101009,7 @@ async function generatePipelineDocs(opts, folder) {
 }
 
 // src/commands/pipeline/pipelineUpload.ts
-import { basename as basename10 } from "node:path";
+import { basename as basename11 } from "node:path";
 function parseUploadBinding(spec) {
   const eq = spec.indexOf("=");
   const left = eq < 0 ? "" : spec.slice(0, eq).trim();
@@ -100584,7 +101051,7 @@ function s3ObjectParams(schema) {
   return Object.keys(props).filter((k2) => isS3Object(props[k2]?.format));
 }
 function devUploadKey(scriptPath, param, source) {
-  return `wmilldev/pipeline/${scriptPath}/${param}/${basename10(source)}`;
+  return `wmilldev/pipeline/${scriptPath}/${param}/${basename11(source)}`;
 }
 function parseS3Uri(source) {
   const m3 = source.match(/^s3:\/\/([^/]*)\/(.*)$/);
@@ -101229,7 +101696,7 @@ await __promiseAll([
 ]);
 import { Buffer as Buffer6 } from "node:buffer";
 import { readFile as readFile4, writeFile as writeFile26 } from "node:fs/promises";
-import { basename as basename11 } from "node:path";
+import { basename as basename12 } from "node:path";
 function formatBytes(n2) {
   if (n2 == null)
     return "-";
@@ -101330,7 +101797,7 @@ async function download(opts, fileKey, outputPath) {
     process.stdout.write(buf);
     return;
   }
-  const dest = outputPath ?? basename11(fileKey);
+  const dest = outputPath ?? basename12(fileKey);
   await writeFile26(dest, buf);
   info(colors.green(`Downloaded ${fileKey} -> ${dest}`));
 }
@@ -101534,7 +102001,7 @@ function isMain() {
     const scriptPath = process.argv[1];
     if (!scriptPath)
       return false;
-    const realScriptPath = realpathSync(scriptPath);
+    const realScriptPath = realpathSync2(scriptPath);
     const modulePath = fileURLToPath2(import.meta.url);
     return realScriptPath === modulePath;
   } catch {