windmill-cli 1.769.1 → 1.771.0

package/esm/main.js

@@ -16784,7 +16784,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.769.0",
+    VERSION: "1.771.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17103,6 +17103,7 @@ __export(exports_services_gen, {
   updateApp: () => updateApp,
   updateAmqpTrigger: () => updateAmqpTrigger,
   unstar: () => unstar,
+  unresolveCompletedJobs: () => unresolveCompletedJobs,
   unassignGhesInstallation: () => unassignGhesInstallation,
   unarchiveWorkspace: () => unarchiveWorkspace,
   toggleWorkspaceErrorHandlerForScript: () => toggleWorkspaceErrorHandlerForScript,
@@ -17209,6 +17210,7 @@ __export(exports_services_gen, {
   restartWorkerGroup: () => restartWorkerGroup,
   restartFlowAtStep: () => restartFlowAtStep,
   resolveNpmPackageVersion: () => resolveNpmPackageVersion,
+  resolveCompletedJobs: () => resolveCompletedJobs,
   resetPassword: () => resetPassword,
   resetKafkaOffsets: () => resetKafkaOffsets,
   resetDiffTally: () => resetDiffTally,
@@ -17234,8 +17236,10 @@ __export(exports_services_gen, {
   publishHubScript: () => publishHubScript,
   publishHubResources: () => publishHubResources,
   publishHubResourceType: () => publishHubResourceType,
+  publishHubRawAppRecording: () => publishHubRawAppRecording,
   publishHubRawAppEmbed: () => publishHubRawAppEmbed,
   publishHubRawApp: () => publishHubRawApp,
+  publishHubProjectLogo: () => publishHubProjectLogo,
   publishHubPipelineRecording: () => publishHubPipelineRecording,
   publishHubMigrations: () => publishHubMigrations,
   publishHubFlowRecording: () => publishHubFlowRecording,
@@ -17309,6 +17313,7 @@ __export(exports_services_gen, {
   listScriptPaths: () => listScriptPaths,
   listSchedulesWithJobs: () => listSchedulesWithJobs,
   listSchedules: () => listSchedules,
+  listRunnables: () => listRunnables,
   listResourceTypeNames: () => listResourceTypeNames,
   listResourceType: () => listResourceType,
   listResourceNames: () => listResourceNames,
@@ -17437,6 +17442,7 @@ __export(exports_services_gen, {
   getWorkspaceDefaultApp: () => getWorkspaceDefaultApp,
   getWorkspaceAsSuperAdmin: () => getWorkspaceAsSuperAdmin,
   getWebsocketTrigger: () => getWebsocketTrigger,
+  getWacApprovalUrls: () => getWacApprovalUrls,
   getVolumeStorage: () => getVolumeStorage,
   getVariableValue: () => getVariableValue,
   getVariable: () => getVariable,
@@ -21328,6 +21334,26 @@ var backendVersion = () => {
       workspace: data3.workspace
     }
   });
+}, listRunnables = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/runnables/list",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      order_by: data3.orderBy,
+      order_desc: data3.orderDesc,
+      kinds: data3.kinds,
+      show_archived: data3.showArchived,
+      include_without_main: data3.includeWithoutMain,
+      path_start: data3.pathStart,
+      label: data3.label,
+      search: data3.search,
+      per_page: data3.perPage,
+      cursor: data3.cursor
+    }
+  });
 }, listFlows = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -22374,6 +22400,7 @@ var backendVersion = () => {
       page: data3.page,
       per_page: data3.perPage,
       is_skipped: data3.isSkipped,
+      resolved: data3.resolved,
       is_flow_step: data3.isFlowStep,
       has_null_parent: data3.hasNullParent,
       success: data3.success,
@@ -22491,6 +22518,7 @@ var backendVersion = () => {
       page: data3.page,
       per_page: data3.perPage,
       is_skipped: data3.isSkipped,
+      resolved: data3.resolved,
       is_flow_step: data3.isFlowStep,
       has_null_parent: data3.hasNullParent,
       is_not_schedule: data3.isNotSchedule
@@ -22585,6 +22613,7 @@ var backendVersion = () => {
       per_page: data3.perPage,
       trigger_kind: data3.triggerKind,
       is_skipped: data3.isSkipped,
+      resolved: data3.resolved,
       is_flow_step: data3.isFlowStep,
       has_null_parent: data3.hasNullParent,
       success: data3.success,
@@ -22817,6 +22846,26 @@ var backendVersion = () => {
       id: data3.id
     }
   });
+}, resolveCompletedJobs = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/jobs/completed/resolve",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
+}, unresolveCompletedJobs = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/jobs/completed/unresolve",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
 }, cancelQueuedJob = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -22895,6 +22944,19 @@ var backendVersion = () => {
       flow_level: data3.flowLevel
     }
   });
+}, getWacApprovalUrls = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/jobs/wac_approval_urls/{id}/{step_key}",
+    path: {
+      workspace: data3.workspace,
+      id: data3.id,
+      step_key: data3.stepKey
+    },
+    query: {
+      approver: data3.approver
+    }
+  });
 }, getSlackApprovalPayload = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -24818,6 +24880,8 @@ var backendVersion = () => {
       workspace: data3.workspace
     },
     query: {
+      page: data3.page,
+      per_page: data3.perPage,
       only_member_of: data3.onlyMemberOf
     }
   });
@@ -25321,7 +25385,8 @@ var backendVersion = () => {
       workspace: data3.workspace
     },
     query: {
-      storage: data3.storage
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
     }
   });
 }, getStorageUsage = (data3) => {
@@ -25346,7 +25411,8 @@ var backendVersion = () => {
       max_keys: data3.maxKeys,
       marker: data3.marker,
       prefix: data3.prefix,
-      storage: data3.storage
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
     }
   });
 }, loadFileMetadata = (data3) => {
@@ -25358,7 +25424,8 @@ var backendVersion = () => {
     },
     query: {
       file_key: data3.fileKey,
-      storage: data3.storage
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
     }
   });
 }, loadFilePreview = (data3) => {
@@ -25376,7 +25443,8 @@ var backendVersion = () => {
       csv_has_header: data3.csvHasHeader,
       read_bytes_from: data3.readBytesFrom,
       read_bytes_length: data3.readBytesLength,
-      storage: data3.storage
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
     }
   });
 }, listGitRepoFiles = (data3) => {
@@ -25495,7 +25563,8 @@ var backendVersion = () => {
     },
     query: {
       file_key: data3.fileKey,
-      storage: data3.storage
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
     }
   });
 }, moveS3File = (data3) => {
@@ -25508,7 +25577,8 @@ var backendVersion = () => {
     query: {
       src_file_key: data3.srcFileKey,
       dest_file_key: data3.destFileKey,
-      storage: data3.storage
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
     }
   });
 }, fileUpload = (data3) => {
@@ -25680,6 +25750,7 @@ var backendVersion = () => {
       per_page: data3.perPage,
       trigger_kind: data3.triggerKind,
       is_skipped: data3.isSkipped,
+      resolved: data3.resolved,
       is_flow_step: data3.isFlowStep,
       has_null_parent: data3.hasNullParent,
       success: data3.success,
@@ -25996,6 +26067,20 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, publishHubRawAppRecording = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/hub/raw_apps/{id}/recording",
+    path: {
+      workspace: data3.workspace,
+      id: data3.id
+    },
+    query: {
+      folder: data3.folder
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
 }, publishHubScriptRecording = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -26102,6 +26187,20 @@ var backendVersion = () => {
       folder: data3.folder
     }
   });
+}, publishHubProjectLogo = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/hub/projects/{slug}/logo",
+    path: {
+      workspace: data3.workspace,
+      slug: data3.slug
+    },
+    query: {
+      folder: data3.folder
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
 }, submitHubProject = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -26181,6 +26280,7 @@ __export(exports_gen, {
   updateApp: () => updateApp,
   updateAmqpTrigger: () => updateAmqpTrigger,
   unstar: () => unstar,
+  unresolveCompletedJobs: () => unresolveCompletedJobs,
   unassignGhesInstallation: () => unassignGhesInstallation,
   unarchiveWorkspace: () => unarchiveWorkspace,
   toggleWorkspaceErrorHandlerForScript: () => toggleWorkspaceErrorHandlerForScript,
@@ -26287,6 +26387,7 @@ __export(exports_gen, {
   restartWorkerGroup: () => restartWorkerGroup,
   restartFlowAtStep: () => restartFlowAtStep,
   resolveNpmPackageVersion: () => resolveNpmPackageVersion,
+  resolveCompletedJobs: () => resolveCompletedJobs,
   resetPassword: () => resetPassword,
   resetKafkaOffsets: () => resetKafkaOffsets,
   resetDiffTally: () => resetDiffTally,
@@ -26312,8 +26413,10 @@ __export(exports_gen, {
   publishHubScript: () => publishHubScript,
   publishHubResources: () => publishHubResources,
   publishHubResourceType: () => publishHubResourceType,
+  publishHubRawAppRecording: () => publishHubRawAppRecording,
   publishHubRawAppEmbed: () => publishHubRawAppEmbed,
   publishHubRawApp: () => publishHubRawApp,
+  publishHubProjectLogo: () => publishHubProjectLogo,
   publishHubPipelineRecording: () => publishHubPipelineRecording,
   publishHubMigrations: () => publishHubMigrations,
   publishHubFlowRecording: () => publishHubFlowRecording,
@@ -26387,6 +26490,7 @@ __export(exports_gen, {
   listScriptPaths: () => listScriptPaths,
   listSchedulesWithJobs: () => listSchedulesWithJobs,
   listSchedules: () => listSchedules,
+  listRunnables: () => listRunnables,
   listResourceTypeNames: () => listResourceTypeNames,
   listResourceType: () => listResourceType,
   listResourceNames: () => listResourceNames,
@@ -26515,6 +26619,7 @@ __export(exports_gen, {
   getWorkspaceDefaultApp: () => getWorkspaceDefaultApp,
   getWorkspaceAsSuperAdmin: () => getWorkspaceAsSuperAdmin,
   getWebsocketTrigger: () => getWebsocketTrigger,
+  getWacApprovalUrls: () => getWacApprovalUrls,
   getVolumeStorage: () => getVolumeStorage,
   getVariableValue: () => getVariableValue,
   getVariable: () => getVariable,
@@ -27044,7 +27149,7 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.769.0-gitsync.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.771.0";
 
 // src/utils/git.ts
 var exports_git = {};
@@ -49576,7 +49681,7 @@ var require_zipEntries = __commonJS((exports, module) => {
       if (this.centralDirRecords !== this.files.length) {
         if (this.centralDirRecords !== 0 && this.files.length === 0) {
           throw new Error("Corrupted zip or bug: expected " + this.centralDirRecords + " records in central dir, got " + this.files.length);
-        } else {}
+        }
       }
     },
     readEndOfCentral: function() {
@@ -58010,7 +58115,7 @@ var require_loader = __commonJS((exports, module) => {
     var error2 = generateError(state, message);
     if (state.onWarning) {
       state.onWarning.call(null, error2);
-    } else {}
+    }
   }
   var directiveHandlers = {
     YAML: function handleYamlDirective(state, name, args) {
@@ -58548,7 +58653,7 @@ var require_loader = __commonJS((exports, module) => {
       } else if (detectedIndent) {
         sc.value += common3.repeat(`
 `, emptyLines + 1);
-      } else {}
+      }
       detectedIndent = true;
       emptyLines = 0;
       captureStart = state.position;
@@ -82066,15 +82171,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -82830,15 +82963,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -83688,15 +83849,43 @@ workflow<T>(fn: (...args: any[]) => Promise<T>): void
 /**
  * Suspend the workflow and wait for an external approval.
  * 
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
  * 
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
  */
-waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ * 
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ * 
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ * 
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
+ * 
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
+ */
+async getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{
+  approvalPage: string;
+  resume: string;
+  cancel: string;
+}>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -85282,6 +85471,17 @@ def get_shared_state(path: str = 'state.json') -> None
 #     Dictionary with approvalPage, resume, and cancel URLs
 def get_resume_urls(approver: str = None, flow_level: bool = None) -> dict
 
+# Get the resume URLs bound to one \`\`wait_for_approval\`\` step of this workflow.
+# 
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         \`\`wait_for_approval(key=...)\`\`
+#     approver: Optional approver name
+# 
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
+
 # Sends an interactive approval request via Slack, allowing optional customization of the message, approver, and form fields.
 # 
 # **[Enterprise Edition Only]** To include form fields in the Slack approval request, use the "Advanced -> Suspend -> Form" functionality.
@@ -85558,8 +85758,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 # 
-# Use \`\`get_resume_urls()\`\` (wrapped in \`\`step()\`\`) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass \`\`key\`\` to name the step, then \`\`get_approval_urls(key)\`\` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named \`\`approval\`\`, \`\`approval_2\`\`, ...
 # 
 # Returns a dict with \`\`value\`\` (form data), \`\`approver\`\`, and \`\`approved\`\`.
 # 
@@ -85567,13 +85768,14 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 # 
 # Example::
 # 
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 # 
@@ -86650,6 +86852,18 @@ const user = await backend.get_user({ user_id: '123' });
 
 The frontend cannot reach datatables, workspace items, or external services on its own — it goes through \`backend.<key>(args)\` for everything server-side.
 
+### Keeping data out of recorded demos
+
+An app can be demoed by recording a session: every interaction becomes a step carrying a snapshot of the page, replayed publicly or on the Hub. Password inputs are masked automatically. Mark anything else that must not appear with \`data-wm-no-record\` — the whole marked subtree is dropped from every snapshot, along with its values and the step's own metadata:
+
+\`\`\`tsx
+<label data-wm-no-record>
+  Customer SSN <input value={ssn} onChange={onSsn} />
+</label>
+\`\`\`
+
+Apply it to customer data, internal notes and anything else a viewer of the demo should not see. It costs nothing when the app is never recorded.
+
 ## Backend runnables
 
 Each runnable has a unique key (used to call it from the frontend) and one of four types:
@@ -86752,6 +86966,7 @@ def main(user_id: str):
 3. **Keep runnables focused** — one function per runnable; small surface area.
 4. **Use descriptive keys** — \`get_user\`, not \`a\`.
 5. **Always whitelist tables** — adding a runnable that queries a new table requires the table to be in \`data.tables\` first.
+6. **Mark sensitive UI with \`data-wm-no-record\`** — it is what keeps that data out of a recorded demo; passwords are handled for you.
 `,
     triggers: `---
 name: triggers
@@ -87205,7 +87420,7 @@ import {
   step,
   sleep,
   waitForApproval,
-  getResumeUrls,
+  getApprovalUrls,
   parallel,
   workflow,
 } from "windmill-client";
@@ -87223,7 +87438,7 @@ export const main = workflow(async (x: string) => {
 Python:
 
 \`\`\`python
-from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, workflow
+from wmill import task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, parallel, workflow
 
 @task()
 async def process(x: str) -> str:
@@ -87307,12 +87522,13 @@ output = await pipeline(input=data)
 Use \`step()\` for lightweight inline values that must not change during replay:
 
 \`\`\`typescript
-const urls = await step("get_urls", () => getResumeUrls());
 const startedAt = await step("started_at", () => new Date().toISOString());
 \`\`\`
 
 \`\`\`python
-urls = await step("get_urls", lambda: get_resume_urls())
+from datetime import datetime
+
+started_at = await step("started_at", lambda: datetime.now().isoformat())
 \`\`\`
 
 Use stable, descriptive step names. Do not generate step names dynamically.
@@ -87337,20 +87553,28 @@ Only parallelize independent steps. Do not read the result of a task before it i
 
 ## Approvals
 
-Generate resume URLs inside \`step()\` before sending them:
+Name the approval step and generate its URLs inside \`step()\` before sending them.
+\`getApprovalUrls\` / \`get_approval_urls\` returns the URLs bound to that step, the same
+ones its built-in approve/reject buttons use:
 
 \`\`\`typescript
-const urls = await step("get_urls", () => getResumeUrls());
-await step("notify", () => sendApprovalEmail(urls.approvalPage));
-const approval = await waitForApproval({ timeout: 3600 });
+const urls = await step("urls", () => getApprovalUrls("manager"));
+await step("notify", () => sendApprovalEmail(urls.resume, urls.cancel));
+const approval = await waitForApproval({ key: "manager", timeout: 3600 });
 \`\`\`
 
 \`\`\`python
-urls = await step("get_urls", lambda: get_resume_urls())
-await step("notify", lambda: send_approval_email(urls["approvalPage"]))
-approval = await wait_for_approval(timeout=3600)
+urls = await step("urls", lambda: get_approval_urls("manager"))
+await step("notify", lambda: send_approval_email(urls["resume"], urls["cancel"]))
+approval = await wait_for_approval(key="manager", timeout=3600)
 \`\`\`
 
+With several approvals in one workflow, give each its own key so each notification
+resumes its own step. Keys must be unique — reusing one raises an error rather than
+silently renaming the step. A minted URL only resumes while its own step is awaiting
+approval; used at any other moment it is rejected rather than resuming the wrong one. \`getResumeUrls()\` / \`get_resume_urls()\` still works but signs a
+random nonce, so its URLs are not tied to any particular approval step.
+
 \`selfApproval: false\` and \`self_approval=False\` are Enterprise-only approval behavior. Do not use them unless the user asks for that behavior.
 
 ## Error Handling
@@ -87364,7 +87588,7 @@ TypeScript: avoid broad \`try/catch\` around WAC SDK calls. The SDK uses an inte
 
 ## TypeScript Workflow-as-Code API (windmill-client)
 
-Import: \`import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getResumeUrls, parallel } from "windmill-client"\`
+Import: \`import { workflow, task, taskScript, taskFlow, step, sleep, waitForApproval, getApprovalUrls, getResumeUrls, parallel } from "windmill-client"\`
 
 \`\`\`typescript
 export interface TaskOptions {
@@ -87434,15 +87658,39 @@ export async function sleep(seconds: number): Promise<void>
 /**
  * Suspend the workflow and wait for an external approval.
  *
- * Use \`getResumeUrls()\` (wrapped in \`step()\`) to obtain resume/cancel/approvalPage
- * URLs before calling this function.
+ * Pass \`key\` to name the step, then \`getApprovalUrls(key)\` yields the URLs that
+ * resume exactly this approval — route them through your own channel. Without a
+ * key the steps are named \`approval\`, \`approval_2\`, ...
+ *
+ * @example
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * const { value, approver } = await waitForApproval({ key: "manager", timeout: 3600 });
+ */
+export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; key?: string; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+
+/**
+ * Resume/cancel/approval-page URLs bound to one \`waitForApproval\` step.
+ *
+ * Unlike \`getResumeUrls()\`, which signs a random nonce, these address the very
+ * \`resume_job\` record the step's built-in approval buttons use, so they are
+ * stable across replays and safe to embed in a custom notification.
+ *
+ * \`stepKey\` must match the \`key\` given to \`waitForApproval\`. Keys must be unique
+ * within a workflow; reusing one throws rather than silently renaming it. The URL
+ * only resumes while that step is awaiting approval; used at any other moment it is
+ * rejected rather than banking a row a different approval would consume. Send it
+ * ahead of time — approvers just cannot act before the workflow reaches the step.
+ *
+ * \`resume\` and \`cancel\` are step-bound; \`approvalPage\` is not — it opens the job's
+ * approval page, which acts on whichever approval is pending when it is used.
  *
  * @example
- * const urls = await step("urls", () => getResumeUrls());
- * await step("notify", () => sendEmail(urls.approvalPage));
- * const { value, approver } = await waitForApproval({ timeout: 3600 });
+ * const urls = await step("urls", () => getApprovalUrls("manager"));
+ * await step("notify", () => sendEmail(urls.resume, urls.cancel));
+ * await waitForApproval({ key: "manager" });
  */
-export function waitForApproval(options?: { timeout?: number; form?: object; selfApproval?: boolean; }): PromiseLike<{ value: any; approver: string; approved: boolean }>
+export async function getApprovalUrls(stepKey: string = "approval", approver?: string): Promise<{ approvalPage: string; resume: string; cancel: string; }>
 
 /**
  * Process items in parallel with optional concurrency control.
@@ -87460,7 +87708,7 @@ export async function parallel<T, R>(items: T[], fn: (item: T) => PromiseLike<R>
 
 ## Python Workflow-as-Code API (wmill)
 
-Import: \`from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_resume_urls, parallel, TaskError\`
+Import: \`from wmill import workflow, task, task_script, task_flow, step, sleep, wait_for_approval, get_approval_urls, get_resume_urls, parallel, TaskError\`
 
 \`\`\`python
 # Raised when a WAC task step failed.
@@ -87548,8 +87796,9 @@ async def sleep(seconds: int)
 
 # Suspend the workflow and wait for an external approval.
 #
-# Use \`\`get_resume_urls()\`\` (wrapped in \`\`step()\`\`) to obtain
-# resume/cancel/approval URLs before calling this function.
+# Pass \`\`key\`\` to name the step, then \`\`get_approval_urls(key)\`\` yields the URLs
+# that resume exactly this approval — route them through your own channel.
+# Without a key the steps are named \`\`approval\`\`, \`\`approval_2\`\`, ...
 #
 # Returns a dict with \`\`value\`\` (form data), \`\`approver\`\`, and \`\`approved\`\`.
 #
@@ -87557,13 +87806,37 @@ async def sleep(seconds: int)
 #     timeout: Approval timeout in seconds (default 1800).
 #     form: Optional form schema for the approval page.
 #     self_approval: Whether the user who triggered the flow can approve it (default True).
+#     key: Optional checkpoint key naming this approval step.
 #
 # Example::
 #
-#     urls = await step("urls", lambda: get_resume_urls())
-#     await step("notify", lambda: send_email(urls["approvalPage"]))
-#     result = await wait_for_approval(timeout=3600)
-async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True) -> dict
+#     urls = await step("urls", lambda: get_approval_urls("manager"))
+#     await step("notify", lambda: send_email(urls["resume"], urls["cancel"]))
+#     result = await wait_for_approval(key="manager", timeout=3600)
+async def wait_for_approval(timeout: int = 1800, form: dict | None = None, self_approval: bool = True, key: str | None = None) -> dict
+
+# Get the resume/cancel/approval-page URLs bound to one \`\`wait_for_approval\`\` step.
+#
+# Unlike :func:\`get_resume_urls\`, which signs a random nonce, these address the
+# very \`\`resume_job\`\` record the step's built-in approval buttons use, so they
+# are stable across replays and safe to embed in a custom notification.
+#
+# Args:
+#     step_key: Checkpoint key of the approval step, as passed to
+#         \`\`wait_for_approval(key=...)\`\`. Keys must be unique within a workflow;
+#         reusing one raises rather than silently renaming it. The URL only
+#         resumes while that step is awaiting approval; used at any other moment
+#         it is rejected rather than banking a row a different approval would
+#         consume. Send it ahead of time — approvers just cannot act before the
+#         workflow reaches the step.
+#         \`\`resume\`\` and \`\`cancel\`\` are step-bound; \`\`approvalPage\`\` is not — it
+#         opens the job's approval page, which acts on whichever approval is
+#         pending when it is used.
+#     approver: Optional approver name
+#
+# Returns:
+#     Dictionary with approvalPage, resume, and cancel URLs
+def get_approval_urls(step_key: str = 'approval', approver: str = None) -> dict
 
 # Process items in parallel with optional concurrency control.
 #

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "windmill-cli",
-  "version": "1.769.1",
+  "version": "1.771.0",
   "description": "CLI for Windmill",
   "license": "Apache 2.0",
   "type": "module",