windmill-client 1.777.1 → 1.779.0

package/dist/types.gen.d.ts

@@ -5027,6 +5027,15 @@ export type Workspace = {
     domain?: string;
     color?: string;
     parent_workspace_id?: string | null;
+    /**
+     * Archived (soft-deleted) workspace
+     */
+    deleted?: boolean;
+    is_dev_workspace?: boolean;
+    /**
+     * Cosmetic display label of the dev workspace ('dev' | 'staging'); null defaults to 'dev'
+     */
+    dev_workspace_label?: string | null;
 };
 export type DependencyMap = {
     workspace_id?: string | null;
@@ -5201,6 +5210,11 @@ export type Policy = {
      *
      */
     sandbox?: boolean;
+    /**
+     * Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).
+     *
+     */
+    frontend_sdk_scopes?: Array<(string)>;
 };
 export type ListableApp = {
     id: number;
@@ -5302,7 +5316,8 @@ export type AppHistory = {
 };
 export type EmbedTokenResponse = {
     /**
-     * Narrowly-scoped embed token for the iframe. Absent for fully anonymous or raw apps, which load without a scoped token.
+     * Scoped token for the app. For sandboxed low-code apps this is the embed token handed to the opaque iframe. For a raw app it is the viewer-scoped frontend SDK token, returned only when the app is sandboxed, its policy declares frontend_sdk_scopes, and the request carries sdk_consent=true. Absent for anonymous viewers and whenever no token is needed.
+     *
      */
     token?: string | null;
     /**
@@ -5310,7 +5325,8 @@ export type EmbedTokenResponse = {
      */
     expiration?: string | null;
     /**
-     * Raw apps render single-iframe and skip the opaque-viewer indirection and the embed token entirely.
+     * Raw apps render single-iframe and skip the opaque-viewer indirection and the embed token entirely. A sandboxed one may still carry a token here: the viewer-scoped frontend SDK token, which is a different credential from the low-code embed token.
+     *
      */
     raw_app: boolean;
     /**
@@ -5325,6 +5341,16 @@ export type EmbedTokenResponse = {
      * The resolved workspace; pairs with app_path so apps at the same path in different workspaces don't share a localStorage store.
      */
     workspace_id?: string | null;
+    /**
+     * Sandboxed raw apps: scopes the app policy declares for the frontend SDK token. Null when the app is unsandboxed, however the policy reads. The viewer renders these in the permission prompt; token stays absent until the endpoint is re-called with sdk_consent=true.
+     *
+     */
+    sdk_scopes?: Array<(string)> | null;
+    /**
+     * The caller's own email, returned alongside sdk_scopes so the viewer can key its stored "do not ask again" per person.
+     *
+     */
+    viewer_email?: string | null;
 };
 export type FlowVersion = {
     id: number;
@@ -5527,6 +5553,22 @@ export type DynamicInputData = {
 export type WindmillLargeFile = {
     s3: string;
 };
+export type StorageFolder = {
+    /**
+     * Full key prefix of the folder, ending with '/'
+     */
+    prefix: string;
+    /**
+     * Last path segment, without the trailing '/'
+     */
+    name: string;
+};
+export type StorageFile = {
+    key: string;
+    name: string;
+    size?: number;
+    last_modified?: string;
+};
 export type WindmillFileMetadata = {
     mime_type?: string;
     size_in_bytes?: number;
@@ -5875,7 +5917,27 @@ export type WorkspaceItemDiff = {
      * If the item exists in the fork workspace
      */
     exists_in_fork: boolean;
+    fork_last_event_kind?: DeployEventKind;
+    fork_last_event_origin?: DeployEventOrigin;
+    source_last_event_kind?: DeployEventKind;
+    source_last_event_origin?: DeployEventOrigin;
 };
+/**
+ * What a deploy event did to the path it is recorded against: `write` (the path holds an item
+ * after the event), `delete` (it does not), or `rename_from` (the path was vacated by a rename
+ * to another path). Create and update are not distinguished. Omitted when no such event has
+ * been recorded for that side, which counts as no evidence.
+ *
+ */
+export type DeployEventKind = 'write' | 'delete' | 'rename_from';
+/**
+ * Who caused a deploy event: `authored` (written in that workspace by the requester) or `sync`
+ * (applied there by a git-sync pull or a workspace-to-workspace deploy). Only an authored
+ * removal is evidence that the workspace dropped the item on purpose. Omitted when no such
+ * event has been recorded for that side.
+ *
+ */
+export type DeployEventOrigin = 'authored' | 'sync';
 export type CompareSummary = {
     /**
      * Total number of items with differences
@@ -6256,11 +6318,15 @@ export type NativeTriggerWithExternal = {
      */
     summary?: string | null;
     /**
-     * Configuration data from the external service
+     * Configuration data from the external service. Null when the service has no such API, or when it could not be read — see external_error.
      */
     external_data: {
         [key: string]: unknown;
-    };
+    } | null;
+    /**
+     * Why the external service configuration could not be read. When set, external_data is null and the configuration Windmill stored is returned instead.
+     */
+    external_error?: string | null;
 };
 export type WorkspaceIntegrations = {
     service_name: NativeServiceName;
@@ -6546,6 +6612,11 @@ export type ParameterS3Sig = string;
  */
 export type ParameterS3Exp = string;
 export type ParameterCustomPath = string;
+/**
+ * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+ *
+ */
+export type ParameterSdkConsent = boolean;
 export type ParameterPathId = number;
 export type ParameterPathVersion = number;
 export type ParameterName = string;
@@ -7120,6 +7191,21 @@ export type ListUsersData = {
     workspace: string;
 };
 export type ListUsersResponse = Array<User>;
+export type ListAddableInstanceUsersData = {
+    /**
+     * number of users to return (default 10, max 100)
+     */
+    perPage?: number;
+    /**
+     * filter users whose email or username contains this string
+     */
+    search?: string;
+    workspace: string;
+};
+export type ListAddableInstanceUsersResponse = Array<{
+    email: string;
+    username?: string;
+}>;
 export type ListUsersUsageData = {
     workspace: string;
 };
@@ -8322,6 +8408,10 @@ export type UpdateProtectionRuleData = {
      * Updated protection rule configuration
      */
     requestBody: {
+        /**
+         * New name for the rule. Omit, or pass the current name, to leave it unchanged. The reserved `dev_workspace_lock` rule cannot be renamed, nor can another rule be renamed onto it.
+         */
+        name?: string;
         rules: ProtectionRules;
         bypass_groups: RuleBypasserGroups;
         bypass_users: RuleBypasserUsers;
@@ -9855,6 +9945,11 @@ export type GetPublicAppByCustomPathResponse = AppWithLastVersion & {
 };
 export type GetAppEmbedTokenByCustomPathData = {
     customPath: string;
+    /**
+     * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+     *
+     */
+    sdkConsent?: boolean;
 };
 export type GetAppEmbedTokenByCustomPathResponse = EmbedTokenResponse;
 export type GetRawAppDataData = {
@@ -9996,8 +10091,28 @@ export type GetAppByPathData = {
     workspace: string;
 };
 export type GetAppByPathResponse = AppWithLastVersion & UserDraftOverlay;
+export type MintPreviewSdkTokenData = {
+    requestBody: {
+        /**
+         * App being edited; may not be deployed yet.
+         */
+        path: string;
+        /**
+         * Scopes from the policy being edited. Capped by the curated allowlist and by the caller's own scopes, and minted as the caller, so it grants nothing they could not mint themselves.
+         *
+         */
+        scopes: Array<(string)>;
+    };
+    workspace: string;
+};
+export type MintPreviewSdkTokenResponse = string;
 export type GetAppEmbedTokenByPathData = {
     path: string;
+    /**
+     * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+     *
+     */
+    sdkConsent?: boolean;
     workspace: string;
 };
 export type GetAppEmbedTokenByPathResponse = EmbedTokenResponse;
@@ -10040,6 +10155,11 @@ export type GetPublicAppBySecretData = {
 };
 export type GetPublicAppBySecretResponse = AppWithLastVersion;
 export type GetAppEmbedTokenBySecretData = {
+    /**
+     * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+     *
+     */
+    sdkConsent?: boolean;
     secret: string;
     workspace: string;
 };
@@ -10090,10 +10210,93 @@ export type UpdateAppData = {
          * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
          */
         skip_draft_deletion?: boolean;
+        /**
+         * When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident.
+         */
+        allow_kind_change?: boolean;
     };
     workspace: string;
 };
 export type UpdateAppResponse = string;
+export type CreateAppRawSourceData = {
+    /**
+     * raw app sources to bundle and deploy
+     */
+    requestBody: {
+        path: string;
+        summary: string;
+        /**
+         * The raw app's value. `files` maps each source path to its content and must contain an entry point; `runnables` and `data` are carried through unchanged.
+         */
+        value: {
+            files: {
+                [key: string]: (string);
+            };
+            runnables?: {
+                [key: string]: unknown;
+            };
+            data?: {
+                [key: string]: unknown;
+            };
+        };
+        policy: Policy;
+        deployment_message?: string;
+        custom_path?: string;
+        /**
+         * When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it.
+         */
+        preserve_on_behalf_of?: boolean;
+        labels?: Array<(string)>;
+        /**
+         * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
+         */
+        skip_draft_deletion?: boolean;
+    };
+    workspace: string;
+};
+export type CreateAppRawSourceResponse = string;
+export type UpdateAppRawSourceData = {
+    path: string;
+    /**
+     * raw app sources to bundle and deploy
+     */
+    requestBody: {
+        path?: string;
+        summary?: string;
+        /**
+         * The raw app's value. `files` maps each source path (e.g. `/index.tsx`, `/App.tsx`, `/package.json`) to its content and must contain an entry point (`/index.tsx`, `/index.ts` or `/index.js`); `runnables` and `data` are carried through unchanged.
+         */
+        value: {
+            files: {
+                [key: string]: (string);
+            };
+            runnables?: {
+                [key: string]: unknown;
+            };
+            data?: {
+                [key: string]: unknown;
+            };
+        };
+        policy?: Policy;
+        deployment_message?: string;
+        custom_path?: string;
+        /**
+         * When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it.
+         */
+        preserve_on_behalf_of?: boolean;
+        labels?: Array<(string)>;
+        /**
+         * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
+         */
+        skip_draft_deletion?: boolean;
+        /**
+         * When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident.
+         */
+        allow_kind_change?: boolean;
+    };
+    workspace: string;
+};
+export type UpdateAppRawSourceResponse = string;
 export type UpdateAppRawData = {
     /**
      * update app
@@ -10115,6 +10318,10 @@ export type UpdateAppRawData = {
              * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
              */
             skip_draft_deletion?: boolean;
+            /**
+             * When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident.
+             */
+            allow_kind_change?: boolean;
         };
         js?: string;
         css?: string;
@@ -15823,6 +16030,10 @@ export type ListStoredFilesData = {
      * When set, list the files of this object storage resource instead of the workspace storage
      */
     s3ResourcePath?: string;
+    /**
+     * Match keys by path prefix, case-sensitively, on the raw key rather than per path segment (so "a/file1" matches "a/file1000"). Pushed down to the storage provider as a seek; resume with the returned next_marker.
+     */
+    search?: string;
     storage?: string;
     workspace: string;
 };
@@ -15831,6 +16042,35 @@ export type ListStoredFilesResponse = {
     windmill_large_files: Array<WindmillLargeFile>;
     restricted_access?: boolean;
 };
+export type ListStoredFilesPagedData = {
+    /**
+     * Maximum number of folders and files combined
+     */
+    maxKeys?: number;
+    /**
+     * Opaque token from a previous response, to continue listing the same folder
+     */
+    pageToken?: string;
+    /**
+     * Folder to list; empty for the bucket root, otherwise must end with '/'
+     */
+    prefix?: string;
+    /**
+     * When set, list the files of this object storage resource instead of the workspace storage
+     */
+    s3ResourcePath?: string;
+    storage?: string;
+    workspace: string;
+};
+export type ListStoredFilesPagedResponse = {
+    folders: Array<StorageFolder>;
+    files: Array<StorageFile>;
+    /**
+     * When set, more entries remain at this level
+     */
+    next_page_token?: string;
+    restricted_access: boolean;
+};
 export type LoadFileMetadataData = {
     fileKey: string;
     /**
@@ -17585,6 +17825,30 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/users/list_addable': {
+        get: {
+            req: {
+                /**
+                 * number of users to return (default 10, max 100)
+                 */
+                perPage?: number;
+                /**
+                 * filter users whose email or username contains this string
+                 */
+                search?: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * addable instance users
+                 */
+                200: Array<{
+                    email: string;
+                    username?: string;
+                }>;
+            };
+        };
+    };
     '/w/{workspace}/users/list_usage': {
         get: {
             req: {
@@ -19916,6 +20180,10 @@ export type $OpenApiTs = {
                  * Updated protection rule configuration
                  */
                 requestBody: {
+                    /**
+                     * New name for the rule. Omit, or pass the current name, to leave it unchanged. The reserved `dev_workspace_lock` rule cannot be renamed, nor can another rule be renamed onto it.
+                     */
+                    name?: string;
                     rules: ProtectionRules;
                     bypass_groups: RuleBypasserGroups;
                     bypass_users: RuleBypasserUsers;
@@ -22865,6 +23133,11 @@ export type $OpenApiTs = {
         get: {
             req: {
                 customPath: string;
+                /**
+                 * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+                 *
+                 */
+                sdkConsent?: boolean;
             };
             res: {
                 /**
@@ -23076,10 +23349,39 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/apps/preview_sdk_token': {
+        post: {
+            req: {
+                requestBody: {
+                    /**
+                     * App being edited; may not be deployed yet.
+                     */
+                    path: string;
+                    /**
+                     * Scopes from the policy being edited. Capped by the curated allowlist and by the caller's own scopes, and minted as the caller, so it grants nothing they could not mint themselves.
+                     *
+                     */
+                    scopes: Array<(string)>;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the token
+                 */
+                200: string;
+            };
+        };
+    };
     '/w/{workspace}/apps/embed_token/p/{path}': {
         get: {
             req: {
                 path: string;
+                /**
+                 * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+                 *
+                 */
+                sdkConsent?: boolean;
                 workspace: string;
             };
             res: {
@@ -23185,6 +23487,11 @@ export type $OpenApiTs = {
     '/w/{workspace}/apps_u/embed_token/{secret}': {
         get: {
             req: {
+                /**
+                 * Raw apps: the viewer confirmed the frontend-SDK permissions consent banner, so the viewer-scoped SDK token may actually be minted. Without it the response only advertises the declared sdk_scopes.
+                 *
+                 */
+                sdkConsent?: boolean;
                 secret: string;
                 workspace: string;
             };
@@ -23289,6 +23596,107 @@ export type $OpenApiTs = {
                      * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
                      */
                     skip_draft_deletion?: boolean;
+                    /**
+                     * When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident.
+                     */
+                    allow_kind_change?: boolean;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * app updated
+                 */
+                200: string;
+            };
+        };
+    };
+    '/w/{workspace}/apps/create_raw_source': {
+        post: {
+            req: {
+                /**
+                 * raw app sources to bundle and deploy
+                 */
+                requestBody: {
+                    path: string;
+                    summary: string;
+                    /**
+                     * The raw app's value. `files` maps each source path to its content and must contain an entry point; `runnables` and `data` are carried through unchanged.
+                     */
+                    value: {
+                        files: {
+                            [key: string]: (string);
+                        };
+                        runnables?: {
+                            [key: string]: unknown;
+                        };
+                        data?: {
+                            [key: string]: unknown;
+                        };
+                    };
+                    policy: Policy;
+                    deployment_message?: string;
+                    custom_path?: string;
+                    /**
+                     * When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it.
+                     */
+                    preserve_on_behalf_of?: boolean;
+                    labels?: Array<(string)>;
+                    /**
+                     * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
+                     */
+                    skip_draft_deletion?: boolean;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * app created
+                 */
+                201: string;
+            };
+        };
+    };
+    '/w/{workspace}/apps/update_raw_source/{path}': {
+        post: {
+            req: {
+                path: string;
+                /**
+                 * raw app sources to bundle and deploy
+                 */
+                requestBody: {
+                    path?: string;
+                    summary?: string;
+                    /**
+                     * The raw app's value. `files` maps each source path (e.g. `/index.tsx`, `/App.tsx`, `/package.json`) to its content and must contain an entry point (`/index.tsx`, `/index.ts` or `/index.js`); `runnables` and `data` are carried through unchanged.
+                     */
+                    value: {
+                        files: {
+                            [key: string]: (string);
+                        };
+                        runnables?: {
+                            [key: string]: unknown;
+                        };
+                        data?: {
+                            [key: string]: unknown;
+                        };
+                    };
+                    policy?: Policy;
+                    deployment_message?: string;
+                    custom_path?: string;
+                    /**
+                     * When true and the caller is a member of the 'wm_deployers' group, preserves the original on_behalf_of value in the policy instead of overwriting it.
+                     */
+                    preserve_on_behalf_of?: boolean;
+                    labels?: Array<(string)>;
+                    /**
+                     * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
+                     */
+                    skip_draft_deletion?: boolean;
+                    /**
+                     * When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident.
+                     */
+                    allow_kind_change?: boolean;
                 };
                 workspace: string;
             };
@@ -23323,6 +23731,10 @@ export type $OpenApiTs = {
                          * When true (set by the CLI / git sync), deploying this app does not delete an existing user draft at the same path.
                          */
                         skip_draft_deletion?: boolean;
+                        /**
+                         * When true, this deploy may switch the app between low-code and raw. Without it, deploying a value to an app of the other kind is refused so an app is never converted by accident.
+                         */
+                        allow_kind_change?: boolean;
                     };
                     js?: string;
                     css?: string;
@@ -32500,6 +32912,10 @@ export type $OpenApiTs = {
                  * When set, list the files of this object storage resource instead of the workspace storage
                  */
                 s3ResourcePath?: string;
+                /**
+                 * Match keys by path prefix, case-sensitively, on the raw key rather than per path segment (so "a/file1" matches "a/file1000"). Pushed down to the storage provider as a seek; resume with the returned next_marker.
+                 */
+                search?: string;
                 storage?: string;
                 workspace: string;
             };
@@ -32515,6 +32931,44 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/job_helpers/list_stored_files_paged': {
+        get: {
+            req: {
+                /**
+                 * Maximum number of folders and files combined
+                 */
+                maxKeys?: number;
+                /**
+                 * Opaque token from a previous response, to continue listing the same folder
+                 */
+                pageToken?: string;
+                /**
+                 * Folder to list; empty for the bucket root, otherwise must end with '/'
+                 */
+                prefix?: string;
+                /**
+                 * When set, list the files of this object storage resource instead of the workspace storage
+                 */
+                s3ResourcePath?: string;
+                storage?: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * One page of folders and files at this level
+                 */
+                200: {
+                    folders: Array<StorageFolder>;
+                    files: Array<StorageFile>;
+                    /**
+                     * When set, more entries remain at this level
+                     */
+                    next_page_token?: string;
+                    restricted_access: boolean;
+                };
+            };
+        };
+    };
     '/w/{workspace}/job_helpers/load_file_metadata': {
         get: {
             req: {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.777.1",
+  "version": "1.779.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",