@cube-dev/platform-client 0.19.1 → 0.20.0

package/CHANGELOG.md

@@ -9,6 +9,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- Curate public-facing entries here before the next release. -->
 
+## [0.20.0] - 2026-10-15
+### Added
+
+- `GET /api/v1/users/{id}/roles` (`UsersAdminPublicController.getUserRoles`) lists every role a user holds, built-in and custom, whether assigned directly or through a group. Each role carries `direct` and `groupIds`, so you can tell whether `DELETE /api/v1/roles/{roleId}/users/{userId}` will remove it, and the response reports `isAdmin`. Administrator privileges required. New schemas: `UserRolesResponse`, `UserRoleAssignmentResponse`.
+- `GET /api/v1/roles/{roleId}/users` (`RolesPublicController.getRoleHolders`) lists the users holding a role, directly or through a group, with cursor pagination. It accepts built-in role ids, includes deactivated users, and returns each user's full set of roles, so a combination such as "holds Explorer but not my custom role" is one pass over the pages. Administrator privileges required. New schemas: `RoleHolder`, `RoleHoldersListResponse`.
+- `condition` on scheduled tasks (`CreateScheduledTaskInput`, `UpdateScheduledTaskInput`, `ScheduledTaskResponse`): run the agent only when a measure crosses a `threshold`, moves by a `change` percentage, or turns `anomaly`-ous, instead of on every fire. `ScheduledTaskResponse.lastConditionCheck` reports the latest check. Send `condition: null` on update to remove it. New schemas: `ScheduledTaskCondition`, `ScheduledTaskLastConditionCheck`.
+- `securityContext` on the body of the start-eval-run operation: evaluate under a security context merged over the caller's own.
+- `agentResponse`, `agentSql`, `groundTruthSql`, `analysis` and `scoreReasons` on `EvaluationResultResponse`, so a result explains why a question failed or needs review.
+- `pdf_print` for `notificationFormat` on `CreateNotificationInput` and `UpdateNotificationInput`: deliver the paginated print version of a dashboard.
+- `in_month`, `not_in_month`, `in_quarter`, `not_in_quarter`, `in_year` and `not_in_year` dashboard filter operators.
+- `memory.generateFromChats` on `UserSettingsInput`, and `memoryGenerationEnabled` in the settings response: let a user turn off background memory from their chats.
+
+### Changed
+
+- Searching workspace contents with `search` now also matches a workbook when a report inside it matches, so a dashboard can be found by the name of a chart on it.
+- Dashboard filter and time-grain inputs accept an empty value to render the control cleared: an empty `value` with no `operator`, or an empty `grain`.
+- Moving a report to a different parent through `PUT /reports/{id}` or its upsert requires **manage** access to the report and **edit** access to the destination. Creating a workbook with a destination folder requires **edit** access to that folder.
+- API keys scoped to specific deployments now answer `403` on the role endpoints and on bulk user actions, which have no deployment to check them against.
+
 ## [0.19.1] - 2026-10-12
 
 ### Added

package/dist/schema.d.ts

@@ -427,7 +427,7 @@ export interface paths {
          *
          *     Pass `filters`, `timeGrains` and `memberSwitchers` to render the board with specific control values, exactly as a scheduled notification does; omit them to render its saved defaults.
          *
-         *     Pass `layout: print` with `format: pdf` for the paginated A4 document the dashboard's "Print version" menu item produces — one column, every table row, the filter state as a summary line — instead of the default `screenshot` of the board. `print` with `format: png` returns `400`.
+         *     Pass `layout: print` with `format: pdf` for the paginated A4 document the dashboard's "Download print version" menu item produces — one column, every table row, the filter state as a summary line — instead of the default `screenshot` of the board. `print` with `format: png` returns `400`.
          *
          *     By default the dashboard renders under the calling user's own security context, so the file shows what that user would see. Requires **manage** access to the dashboard's workbook — the same permission the console's own "Download as PNG / PDF" actions require, because a whole-dashboard render is a bulk data export.
          *
@@ -1407,7 +1407,7 @@ export interface paths {
          *
          *     `source` is **create-only**: it is recorded when the report is first created and ignored on subsequent updates (it describes where the report originated, not its current definition).
          *
-         *     Access: updating requires **edit** access to the existing report; creating requires the same access as `POST /reports`.
+         *     Access: updating requires **edit** access to the existing report; moving it to a different parent requires **manage** access to the report and **edit** access to the destination. Creating requires the same access as `POST /reports`.
          */
         put: operations["ReportsPublicController.upsertReportByPublicId"];
         post?: never;
@@ -1434,7 +1434,7 @@ export interface paths {
          *
          *     The id you assign must be one you chose (any distinct 12-character `[0-9A-Za-z]` id). The auto-generated placeholder id shown for a report that has no stable id yet cannot be assigned — it is not unique — and is rejected with `400`.
          *
-         *     Requires **edit** access to the report.
+         *     Requires **edit** access to the report. Moving it to a different parent requires **manage** access to the report and **edit** access to the destination.
          */
         put: operations["ReportsPublicController.updateReport"];
         post?: never;
@@ -1872,7 +1872,7 @@ export interface paths {
          *
          *     If a workbook with this slug exists in the deployment, it is updated: only the fields you send are changed, and `meta` is merged into the existing metadata (a `meta.dashboardDraft` is validated like everywhere else). Otherwise a new workbook is created with this slug. The slug is normalized (trimmed, lowercased) before matching. Re-applying the same request is a no-op.
          *
-         *     Access: updating requires **edit** access to the workbook holding the slug (requests that include `folderId` require **manage** access, plus **edit** access to the destination folder); creating requires the same access as `POST /workbooks` (AI BI User role or higher).
+         *     Access: updating requires **edit** access to the workbook holding the slug (requests that include `folderId` require **manage** access, plus **edit** access to the destination folder); creating requires the same access as `POST /workbooks` (AI BI User role or higher, plus **edit** access to a supplied destination folder).
          *
          *     Whether this request creates or updates is decided — and access-checked — before it is applied. If another writer changes that in between (creates or deletes the workbook holding this slug), the request is rejected with `409` and `code: "upsert_branch_changed"` rather than applied under the wrong permission check. This is **transient: retry the request**. It only happens when two writers target the same slug concurrently — for example two pipeline runs applying the same bundle at once, where one creates the workbook and the other must then retry into the update path.
          *
@@ -2153,7 +2153,7 @@ export interface paths {
          *     Supported query parameters:
          *     - `folderId` — list the contents of this folder (omit for the root).
          *     - `types` — restrict the results to one or more item types (`FOLDER`, `WORKBOOK`, `REPORT`). Repeat the parameter to pass several.
-         *     - `search` — case-insensitive substring match on item names; searches across all folders, not just the current level.
+         *     - `search` — case-insensitive substring match on item names; searches across all folders, not just the current level. A workbook also matches when a report inside it does, so a search finds a dashboard by the name of a chart on it. Use this to find an item by name instead of walking folders.
          *     - `orderByField` / `orderByDirection` — sort the non-folder items (e.g. by `name`, `updated_at`, `created_at`, or `viewer_last_viewed_at`).
          *     - `first` / `after` — cursor-based pagination.
          *
@@ -2242,19 +2242,7 @@ export interface paths {
         put?: never;
         /**
          * Move a workspace item
-         * @description Move any workspace item — a workbook, report, or folder — into a folder, in one unified endpoint. Returns the moved item.
-         *
-         *     Request body:
-         *     - `type` — the item type: `WORKBOOK`, `REPORT`, or `FOLDER`.
-         *     - `id` — the id of the item to move.
-         *     - `folderId` — the destination folder id, or `null` to move the item to the workspace root. For a folder, this becomes its new parent.
-         *
-         *     Access requirements depend on the item type and mirror the per-type rules:
-         *     - **Workbook** — manage access to the workbook, plus edit access to the destination folder when moving into one.
-         *     - **Report** — edit access to the report (with the report-manage permission).
-         *     - **Folder** — manage access to the folder being moved, plus manage or edit access to the destination parent folder.
-         *
-         *     Moving a folder into one of its own descendants, or exceeding the maximum folder depth, is rejected with `400`. Returns `404` if the item does not exist or belongs to a different deployment.
+         * @description Move a workbook, report, or folder to folderId (null for root). Source and destination permissions are checked, and a report's destination must be in the route deployment.
          */
         post: operations["WorkspacePublicController.moveWorkspaceObject"];
         delete?: never;
@@ -3179,6 +3167,8 @@ export interface paths {
          * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
          *
          *     Lists the tenant's custom roles, newest first, cursor-paginated via `first`/`after`. Cube's built-in roles are not included — they are not tenant data.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         get: operations["RolesPublicController.getRoles"];
         put?: never;
@@ -3211,6 +3201,8 @@ export interface paths {
          *     The tier is **not** required and is **not** derived from the deployment actions: a role sent without one is accepted and simply confers no tier, so a user holding only that role gets the deployment grants and still cannot use the product. That is deliberate — a user holds the union of their roles, so a role that only adds a deployment scope beside another role carrying the tier is valid — but it means nothing warns you. Omit the `Global` policy only when some other role supplies the tier. Note the console does require one on every role it writes, so a role created here without a tier shows an unset Base Role when opened in the role builder.
          *
          *     Use `["All"]` as `resources` to cover every deployment, and `"All"` as the single action for full access to the deployments in scope. A policy is rejected when it grants no action, when it names no resource, or when a `Deployment` resource is not a deployment id — pass the numeric id returned by POST /build/api/v1/deployments, not a slug or a name. Ids are checked for shape, not existence, so an id whose deployment was since deleted is kept and simply grants nothing.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         post: operations["RolesPublicController.createRole"];
         delete?: never;
@@ -3231,6 +3223,8 @@ export interface paths {
          * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
          *
          *     Returns one custom role by id, with its policies.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         get: operations["RolesPublicController.getRole"];
         /**
@@ -3238,6 +3232,8 @@ export interface paths {
          * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
          *
          *     Updates the fields present in the body and leaves the rest alone. Sending `policies` replaces the role's policies outright, so read the role first if you mean to add one rather than start over. Renaming to a name another role already holds answers `409`. Built-in roles cannot be updated.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         put: operations["RolesPublicController.updateRole"];
         post?: never;
@@ -3246,6 +3242,8 @@ export interface paths {
          * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
          *
          *     Deletes the role and every assignment of it, from users and from groups. Built-in roles cannot be deleted.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         delete: operations["RolesPublicController.deleteRole"];
         options?: never;
@@ -3253,6 +3251,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/roles/{roleId}/users": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the users holding a role
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Lists every user holding the role, directly or through a group, newest first, cursor-paginated via `first`/`after`. Accepts built-in role ids. Each user carries every role they hold, so a combination such as "holds Explorer but not my custom role" is one pass over these pages. Deactivated users are included.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        get: operations["RolesPublicController.getRoleHolders"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/roles/{roleId}/users/{userId}": {
         parameters: {
             query?: never;
@@ -3268,6 +3290,8 @@ export interface paths {
          *     Gives the user everything the role grants. Idempotent — assigning a role the user already holds changes nothing. Returns `404` if either the user or the role is unknown.
          *
          *     Unlike the other endpoints here, this one is not limited to your custom roles: it also accepts the id of a built-in role, and assigning one grants everything that role confers. **Cube's Admin role is the exception and cannot be granted this way** — it is not among the built-in roles this endpoint resolves, so its id returns `404`. No call to this endpoint can make a user an account-wide administrator.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         put: operations["RolesPublicController.assignRoleToUser"];
         post?: never;
@@ -3276,6 +3300,8 @@ export interface paths {
          * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
          *
          *     Takes the role away from the user. Idempotent — removing a role the user does not hold changes nothing. Returns `404` if the user is unknown.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         delete: operations["RolesPublicController.removeRoleFromUser"];
         options?: never;
@@ -3545,6 +3571,8 @@ export interface paths {
          *     - A tenant must always keep at least one active, direct admin, so the action that would remove the last one fails with `403` while the rest of the batch still applies.
          *
          *     Reapplying an action a user is already in (deactivating a deactivated user) succeeds as a no-op.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
          */
         post: operations["UsersAdminPublicController.bulkUserAction"];
         delete?: never;
@@ -3602,7 +3630,7 @@ export interface paths {
         head?: never;
         /**
          * Update my settings
-         * @description Merge a partial patch into the authenticated user's own settings. Omitted fields are left as they are; `sheets` merges field-by-field, and an explicit `null` clears it.
+         * @description Merge a partial patch into the authenticated user's own settings. Omitted fields are left as they are; `sheets` and `memory` merge field-by-field, and an explicit `null` clears one.
          */
         patch: operations["UsersPublicController.updateMySettings"];
         trace?: never;
@@ -3625,6 +3653,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/users/{id}/roles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List a user's roles
+         * @description **🔒 Admin only.** Requires administrator privileges — the authenticated principal (API key, embed JWT, or any bearer token) must belong to a user with the admin role.
+         *
+         *     Every role the user holds, built-in and custom, whether assigned directly or through a group. Only a direct assignment can be removed with `DELETE /api/v1/roles/{roleId}/users/{userId}`.
+         *
+         *     An API key scoped to specific deployments answers `403` here.
+         */
+        get: operations["UsersAdminPublicController.getUserRoles"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/build/api/v1/deployments/": {
         parameters: {
             query?: never;
@@ -3938,6 +3990,7 @@ export interface components {
             graphqlToken?: string | null;
             hasAgentAccess?: any | null;
             mcpToken?: string | null;
+            memoryGenerationEnabled?: boolean | null;
             resolvedTimezone?: string | null;
             scheduledTaskPolicies?: components["schemas"]["ChatThreadPolicy"][] | null;
             timezoneSettings?: components["schemas"]["TimezoneSettings"] | null;
@@ -4439,7 +4492,7 @@ export interface components {
             timezone?: string | null;
         };
         /** @enum {string} */
-        CreateNotificationInputNotificationFormat: "png" | "pdf";
+        CreateNotificationInputNotificationFormat: "png" | "pdf" | "pdf_print";
         /** @enum {string} */
         CreateNotificationInputScheduleType: "HOURLY" | "DAILY" | "WEEKLY" | "MONTHLY" | "CUSTOM";
         CreateOAuthIntegrationInput: {
@@ -4514,6 +4567,8 @@ export interface components {
         CreateScheduledTaskInput: {
             /** @description The agent that runs the task. Omit for the deployment default. */
             agentId?: number | null;
+            /** @description Notify only when: on each fire the measure is read once, before the agent runs, and the agent runs only when the condition starts to hold, with the crossing facts at the top of its thread; it runs again only after the condition has stopped holding. A `change` or `anomaly` rule needs `timeDimension` and `granularity`. The creator gets an inbox row only with `notificationEnabled: true`. Omit to run the agent on every fire. */
+            condition?: components["schemas"]["ScheduledTaskCondition"] | null;
             /** @description Standard 5-field cron (minute hour day-of-month month day-of-week), e.g. `0 9 * * 1-5` for 9:00 on weekdays. A task runs at most once an hour, so the minute field is a single number. Null or omitted makes the task Manual: it runs only when started with `POST /scheduled-tasks/{taskId}/run`. */
             cronExpression?: string | null;
             description?: string | null;
@@ -4746,17 +4801,17 @@ export interface components {
             endInclusive?: any | null;
             /** @description Dimension path, e.g. "Orders.status" */
             member: string;
-            /** @description Filter operator (defaults to "equals") */
+            /** @description Filter operator (defaults to "equals"; with an empty value, omitting it clears the control instead) */
             operator?: components["schemas"]["DashboardFilterInputOperator"] | null;
             /** @description For between filters: whether the start bound is inclusive */
             startInclusive?: any | null;
-            /** @description Filter value. Omit for is_null / is_not_null / is_empty / is_not_empty; provide a 2-element [start, end] array for between. */
+            /** @description Filter value. Omit for is_null / is_not_null / is_empty / is_not_empty; provide a 2-element [start, end] array for between. An empty array or empty string with no operator renders the filter cleared; with an operator, the filter keeps that operator. */
             value?: (string | number | boolean | unknown[]) | null;
         };
         /** @enum {string} */
-        DashboardFilterInputOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
+        DashboardFilterInputOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "in_month" | "not_in_month" | "in_quarter" | "not_in_quarter" | "in_year" | "not_in_year" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
         /** @enum {string} */
-        DashboardFilterOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
+        DashboardFilterOperator: "equals" | "not_equals" | "greater_than" | "greater_than_or_equal" | "less_than" | "less_than_or_equal" | "contains" | "not_contains" | "starts_with" | "not_starts_with" | "ends_with" | "not_ends_with" | "in_month" | "not_in_month" | "in_quarter" | "not_in_quarter" | "in_year" | "not_in_year" | "is_null" | "is_not_null" | "is_empty" | "is_not_empty" | "between" | "custom";
         DashboardLayout: {
             breakpoints?: components["schemas"]["DashboardBreakpoints"] | null;
             cols?: components["schemas"]["DashboardBreakpointCols"] | null;
@@ -4813,7 +4868,7 @@ export interface components {
             member: string;
         };
         DashboardTimeGrainInput: {
-            /** @description Granularity, e.g. "day", "week", "month" */
+            /** @description Granularity, e.g. "day", "week", "month". An empty string renders the control cleared. */
             grain: string;
             /** @description Time dimension path, e.g. "Orders.created_at" */
             member: string;
@@ -5665,11 +5720,21 @@ export interface components {
             pageInfo?: components["schemas"]["PageInfo"] | null;
         };
         EvaluationResultResponse: {
+            /** @description The agent's text answer, which may be truncated. */
+            agentResponse?: string | null;
+            /** @description The SQL the agent ran to answer the question. */
+            agentSql?: string | null;
+            /** @description The grader's explanation of the verdict: why the question failed or errored, a note for a result that needs review, or the AI check's rationale. */
+            analysis?: string | null;
             createdAt: string;
             evaluationId: number;
+            /** @description The ground-truth SQL the agent result was compared against. */
+            groundTruthSql?: string | null;
             id: number;
             questionTextSnapshot: string;
             score?: number | null;
+            /** @description Short categories for a non-passing verdict, such as "Row count mismatch" or "Query error". Empty when the question passed. */
+            scoreReasons: string[];
             updatedAt: string;
             /** @description Question outcome: pass, fail, review, skipped, or error. */
             verdict?: string | null;
@@ -5934,6 +5999,9 @@ export interface components {
             locale: string;
             value: string;
         };
+        MemoryUserSettingsInput: {
+            generateFromChats?: boolean | null;
+        };
         MergeIntoParentBranchRequest: {
             branchId?: number;
             branchName?: string;
@@ -6792,6 +6860,19 @@ export interface components {
             /** @description What the role grants. Scope a policy to specific deployments by setting `resourceType` to `Deployment` and listing the deployment ids — as returned by POST /build/api/v1/deployments — in `resources`, or `["All"]` for every deployment. An empty `policies` list is accepted and creates a role that grants nothing yet; an individual policy with no actions, or none naming a resource, is rejected. */
             policies: components["schemas"]["Policy"][];
         };
+        RoleHolder: {
+            email: string;
+            firstName?: string | null;
+            id: number;
+            /** @description Set by the user's own Admin flag or by a group granting Admin. */
+            isAdmin: boolean;
+            isDeactivated: boolean;
+            roles: components["schemas"]["UserRoleAssignmentResponse"][];
+        };
+        RoleHoldersListResponse: {
+            items: components["schemas"]["RoleHolder"][];
+            pageInfo: components["schemas"]["PageInfo"];
+        };
         RoleUpdateBody: {
             /** @description Omit to leave the description unchanged; `null` clears it. */
             description?: string | null;
@@ -6835,6 +6916,61 @@ export interface components {
         SaveDatabricksMetricViewIntegrationInputDeletionPolicy: "retain" | "delete-managed";
         /** @enum {string} */
         SaveDatabricksMetricViewIntegrationInputSelectionMode: "all" | "selected" | "pattern";
+        ScheduledTaskCondition: {
+            granularity?: components["schemas"]["ScheduledTaskConditionGranularity"] | null;
+            /** @description Changes whenever the condition does. Read-only. */
+            id?: string | null;
+            /** @description Full measure name, e.g. `orders.revenue`. */
+            measure: string;
+            measureTitle?: string | null;
+            rule: components["schemas"]["ScheduledTaskConditionRule"];
+            /** @description Full time dimension name, e.g. `orders.created_at`. */
+            timeDimension?: string | null;
+            timeDimensionTitle?: string | null;
+        };
+        ScheduledTaskConditionBand: {
+            high: number;
+            low: number;
+            median: number;
+        };
+        /** @enum {string} */
+        ScheduledTaskConditionGranularity: "day" | "week" | "month" | "quarter" | "year";
+        ScheduledTaskConditionRule: {
+            /** @description For `change`: increases, decreases, or changes either way. */
+            direction?: components["schemas"]["ScheduledTaskConditionRuleDirection"] | null;
+            /** @description For `threshold`: above, below or equal to. */
+            operator?: components["schemas"]["ScheduledTaskConditionRuleOperator"] | null;
+            /** @description For `change`: the percentage, greater than 0, e.g. `5` for 5 %. */
+            percent?: number | null;
+            /** @description `threshold`: the last complete period (or the total, with no time dimension) is above, below or equal to `value`. `change`: the last complete period moved by at least `percent` % from the one before it. `anomaly`: the last complete period lies outside median ± 3·MAD of the at least 8 complete periods before it. */
+            type: components["schemas"]["ScheduledTaskConditionRuleType"];
+            /** @description For `threshold`: the number compared with. */
+            value?: number | null;
+        };
+        /** @enum {string} */
+        ScheduledTaskConditionRuleDirection: "up" | "down" | "either";
+        /** @enum {string} */
+        ScheduledTaskConditionRuleOperator: "gt" | "lt" | "eq";
+        /** @enum {string} */
+        ScheduledTaskConditionRuleType: "threshold" | "change" | "anomaly";
+        ScheduledTaskLastConditionCheck: {
+            /** @description When the check ran (ISO 8601). */
+            at: string;
+            band?: components["schemas"]["ScheduledTaskConditionBand"] | null;
+            changePercent?: number | null;
+            conditionId: string;
+            notifiedAt?: string | null;
+            /** @description Start of the period read, `YYYY-MM-DD`. */
+            period?: string | null;
+            previous?: number | null;
+            previousPeriod?: string | null;
+            reason?: string | null;
+            /** @description `held-notified` ran the agent; `held-already-notified` was still holding since an earlier notification; `cannot-evaluate` carries a `reason` code; an `error` carries its text in `reason` to the task's creator only, as do the figures the check read. */
+            status: components["schemas"]["ScheduledTaskLastConditionCheckStatus"];
+            value?: number | null;
+        };
+        /** @enum {string} */
+        ScheduledTaskLastConditionCheckStatus: "not-held" | "held-notified" | "held-already-notified" | "cannot-evaluate" | "error";
         ScheduledTaskListResponse: {
             items: components["schemas"]["ScheduledTaskResponse"][];
             pageInfo: components["schemas"]["PageInfo"];
@@ -6842,6 +6978,8 @@ export interface components {
         ScheduledTaskResponse: {
             /** @description The agent that runs the task; null runs the deployment default. */
             agentId?: number | null;
+            /** @description Notify only when: on each fire the measure is read once, before the agent runs, and the agent runs only when the condition starts to hold, with the crossing facts at the top of its thread; it runs again only after the condition has stopped holding. A `change` or `anomaly` rule needs `timeDimension` and `granularity`. The creator gets an inbox row only with `notificationEnabled: true`. Null runs the agent on every fire. */
+            condition?: components["schemas"]["ScheduledTaskCondition"] | null;
             /** @description Standard 5-field cron (minute hour day-of-month month day-of-week), e.g. `0 9 * * 1-5` for 9:00 on weekdays. Null when the task is Manual: it runs only when started with `POST /scheduled-tasks/{taskId}/run`. */
             cronExpression?: string | null;
             deploymentId: number;
@@ -6849,6 +6987,8 @@ export interface components {
             id: number;
             /** @description False while the schedule is paused. */
             isEnabled: boolean;
+            /** @description The latest condition check; null before the first one. */
+            lastConditionCheck?: components["schemas"]["ScheduledTaskLastConditionCheck"] | null;
             name: string;
             /** @description When the schedule next fires (ISO 8601, UTC); null for a Manual or paused task. */
             nextRunAt?: string | null;
@@ -6954,7 +7094,7 @@ export interface components {
             /** @description Output format: `png` or `pdf`. */
             format: components["schemas"]["StartDashboardExportInputFormat"];
             /**
-             * @description How the dashboard is laid out. `screenshot` (the default) renders the board as it looks on screen. `print` renders the paginated A4 document the dashboard's 'Print version' menu item produces: one column, every table row, and the filter state as a summary line instead of filter controls. `print` is available for `format: 'pdf'` only.
+             * @description How the dashboard is laid out. `screenshot` (the default) renders the board as it looks on screen. `print` renders the paginated A4 document the dashboard's 'Download print version' menu item produces: one column, every table row, and the filter state as a summary line instead of filter controls. `print` is available for `format: 'pdf'` only.
              * @default screenshot
              */
             layout?: components["schemas"]["StartDashboardExportInputLayout"] | null;
@@ -7000,6 +7140,10 @@ export interface components {
             branchName: string;
             /** @description Path of one eval-question YAML file to run, relative to the agents directory. Omit to run the complete eval set. */
             questionFile?: string | null;
+            /** @description Security context to evaluate under, merged over the caller's own. Applies to the ground-truth queries, and to the agent's queries when the run's agent is defined in the deployment's agent config; the default `auto` agent queries under the caller's own context. Requires deployment edit access; a `cubeCloud` key requires an admin. */
+            securityContext?: {
+                [key: string]: any;
+            } | null;
         };
         StartReportDeliveryRunResponse: {
             /** @description Id of the run, which writes the sheet in the background; poll it for the outcome. */
@@ -7166,7 +7310,7 @@ export interface components {
             timezone?: string | null;
         };
         /** @enum {string} */
-        UpdateNotificationInputNotificationFormat: "png" | "pdf";
+        UpdateNotificationInputNotificationFormat: "png" | "pdf" | "pdf_print";
         /** @enum {string} */
         UpdateNotificationInputScheduleType: "HOURLY" | "DAILY" | "WEEKLY" | "MONTHLY" | "CUSTOM";
         UpdateOAuthIntegrationInput: {
@@ -7264,6 +7408,8 @@ export interface components {
         UpdateScheduledTaskInput: {
             /** @description The agent that runs the task. Omit to leave unchanged; null resets it to the deployment default. */
             agentId?: number | null;
+            /** @description Notify only when: on each fire the measure is read once, before the agent runs, and the agent runs only when the condition starts to hold, with the crossing facts at the top of its thread; it runs again only after the condition has stopped holding. A `change` or `anomaly` rule needs `timeDimension` and `granularity`. The creator gets an inbox row only with `notificationEnabled: true`. Omit to leave unchanged; null removes it. A changed condition starts its breach state fresh. */
+            condition?: components["schemas"]["ScheduledTaskCondition"] | null;
             /** @description New standard 5-field cron, at most hourly (the minute field is a single number). Omit it to keep the current schedule; send null to make the task Manual. */
             cronExpression?: string | null;
             /** @description Omit to leave unchanged. Send null to clear the description. */
@@ -7450,6 +7596,22 @@ export interface components {
             updatedAt: string;
             userId: number;
         };
+        UserRoleAssignmentResponse: {
+            builtIn: boolean;
+            description?: string | null;
+            /** @description Assigned to the user directly — the assignment `DELETE /api/v1/roles/{roleId}/users/{userId}` removes. */
+            direct: boolean;
+            /** @description Groups that grant the role. Removing it from the user does not touch these; change the group instead. */
+            groupIds: number[];
+            /** @description Role id. Built-in roles have fixed negative ids. */
+            id: number;
+            name: string;
+        };
+        UserRolesResponse: {
+            /** @description Set by the user's own Admin flag or by a group granting Admin. */
+            isAdmin: boolean;
+            roles: components["schemas"]["UserRoleAssignmentResponse"][];
+        };
         UserSettingsInput: {
             alternatingRowColors?: boolean | null;
             defaultDeploymentId?: number | null;
@@ -7459,6 +7621,7 @@ export interface components {
              */
             lastSeenChangelogId?: number | null;
             locale?: string | null;
+            memory?: components["schemas"]["MemoryUserSettingsInput"] | null;
             sheets?: components["schemas"]["SheetsUserSettingsInput"] | null;
             theme?: string | null;
             timezone?: string | null;
@@ -12930,6 +13093,37 @@ export interface operations {
             };
         };
     };
+    "RolesPublicController.getRoleHolders": {
+        parameters: {
+            query?: {
+                after?: string | null;
+                first?: number | null;
+            };
+            header?: never;
+            path: {
+                roleId: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["RoleHoldersListResponse"];
+                };
+            };
+            /** @description No role has that id. Cube's Admin role answers `404` too. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
     "RolesPublicController.assignRoleToUser": {
         parameters: {
             query?: never;
@@ -13519,6 +13713,34 @@ export interface operations {
             };
         };
     };
+    "UsersAdminPublicController.getUserRoles": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                id: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            200: {
+                headers: {
+                    [name: string]: any;
+                };
+                content: {
+                    "application/json": components["schemas"]["UserRolesResponse"];
+                };
+            };
+            /** @description The user is unknown. */
+            404: {
+                headers: {
+                    [name: string]: any;
+                };
+                content?: never;
+            };
+        };
+    };
     "DeploymentsBuildPublicController.createDeployment": {
         parameters: {
             query?: never;