windmill-client 1.805.0 → 1.807.0

package/dist/index.js

@@ -126,7 +126,7 @@ const OpenAPI = {
 	PASSWORD: void 0,
 	TOKEN: getEnv$1("WM_TOKEN"),
 	USERNAME: void 0,
-	VERSION: "1.805.0",
+	VERSION: "1.807.0",
 	WITH_CREDENTIALS: !getEnv$1("WM_RAW_APP"),
 	interceptors: {
 		request: new Interceptors(),
@@ -1655,6 +1655,59 @@ var GitSyncService = class {
 		});
 	}
 	/**
+	* List the GitLab projects a token can sync
+	* Lists the projects the supplied GitLab token can push to, so a git repository resource can be filled in without hand-writing a project path. The token is used for this call only and is never stored. Requires workspace admin.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.requestBody
+	* @returns GitlabProject the projects the token can sync
+	* @throws ApiError
+	*/
+	static listGitlabProjects(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/git_sync/gitlab/projects",
+			path: { workspace: data.workspace },
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* Where a repository's credential comes from
+	* Whether Windmill holds this repository's access token, and which host it talks to. `held` means this workspace stores it, `borrowed` means an ancestor does and it is not this workspace's to replace. Both absent means the repository authenticates with whatever its URL carries. Returns no secret. Requires workspace admin.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.path Path of the git repository resource, with or without the `$res:` prefix. A path rather than a URL, because a resource URL may carry a token and a URL in a query string lands in logs.
+	* @returns unknown where the credential comes from
+	* @throws ApiError
+	*/
+	static getCredentialOrigin(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/git_sync/credential/origin",
+			path: { workspace: data.workspace },
+			query: { path: data.path }
+		});
+	}
+	/**
+	* Store the credential for a git repository
+	* Stores the access token a git repository authenticates with, so it does not have to be written into the repository URL or a workspace variable. The token is write-only: it is served only to a git-sync job that presents its own job token, and a fork of this workspace reads this copy instead of holding one of its own. Requires workspace admin.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.requestBody
+	* @returns string the credential was stored
+	* @throws ApiError
+	*/
+	static setGitCredential(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/git_sync/credential",
+			path: { workspace: data.workspace },
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
 	* GHES installation callback
 	* Register a self-managed GitHub App installation from GitHub Enterprise Server
 	* @param data The data for the request.
@@ -1950,11 +2003,11 @@ var WorkspaceService = class {
 		});
 	}
 	/**
-	* get github app token
+	* get the git credential for a git-sync job (GitHub App token, or the credential stored for the repository)
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.requestBody jwt job token
-	* @returns unknown github app token
+	* @returns unknown git credential
 	* @throws ApiError
 	*/
 	static getGithubAppToken(data) {
@@ -3351,7 +3404,7 @@ var WorkspaceService = class {
 	}
 	/**
 	* enable or disable guest sessions for this workspace
-	* Guests are people the identity provider authenticates who have no Windmill account; the `guest` app execution mode admits them. Off by default. Re-read where a guest session is minted and at the auth door on every guest request, so turning it off takes effect immediately, for sessions already issued and for apps whose policy already says `guest`.
+	* Guests are people the identity provider authenticates who have no Windmill account; the `guest` app execution mode admits them. Off by default. Re-read where a guest session is minted and at the auth door on every guest request, so turning it off takes effect immediately, for sessions already issued and for apps whose policy already says `guest`. Turning it *on* is refused with a 400 where guests are unavailable (the shared cloud); turning it off always works.
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.requestBody Whether guest sessions are admitted
@@ -3369,7 +3422,7 @@ var WorkspaceService = class {
 	}
 	/**
 	* set the key guest JWTs are verified against for this workspace
-	* A guest JWT (`jwt_guest_`) is minted by the embedding customer's own backend and verified against this key: a PEM public key (RS/ES family, HS* refused) or a JWKS URL, at most one. Both empty clears the workspace key; off cloud, verification then falls back to the instance issuer (`JWT_EXT_JWKS_URL`) if one is set, else no guest JWT is accepted (`guest_access_enabled` is the on/off switch). Workspace-admin gated. The key is validated before it is stored.
+	* A guest JWT (`jwt_guest_`) is minted by the embedding customer's own backend and verified against this key: a PEM public key (RS/ES family, HS* refused) or a JWKS URL, at most one. Both empty clears the workspace key; off cloud, verification then falls back to the instance issuer (`JWT_EXT_JWKS_URL`) if one is set, else no guest JWT is accepted (`guest_access_enabled` is the on/off switch). Workspace-admin gated. The key is validated before it is stored. Setting a key is refused with a 400 where guests are unavailable (the shared cloud); clearing one always works.
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.requestBody The guest JWT verification key
@@ -6322,7 +6375,7 @@ var AppService = class {
 	}
 	/**
 	* whether the app behind a custom path admits guests
-	* The custom-path counterpart of `getGuestEntry`. Unauthenticated; 404 unless the app's execution mode is `guest` AND its workspace has `guest_access_enabled` AND the instance has not set `guest_access_disabled`. Returns the workspace too, since a custom URL may not carry it.
+	* The custom-path counterpart of `getGuestEntry`. Unauthenticated; 404 unless the app's execution mode is `guest` AND its workspace has `guest_access_enabled` AND the instance has not set `guest_access_disabled`, and never on a deployment where guests are unavailable (the shared cloud). Returns the workspace too, since a custom URL may not carry it.
 	* @param data The data for the request.
 	* @param data.customPath
 	* @returns GuestEntry the app is open to guests
@@ -6658,7 +6711,7 @@ var AppService = class {
 	}
 	/**
 	* whether the app behind a share secret admits guests
-	* Unauthenticated: what a signed-out visitor reads to learn that signing in would let them in. 404 unless the app's execution mode is `guest` AND the workspace has `guest_access_enabled` AND the instance has not set the `guest_access_disabled` global setting, so it says nothing about apps that are not open to guests. Discloses only the app path, to a caller already holding the share secret.
+	* Unauthenticated: what a signed-out visitor reads to learn that signing in would let them in. 404 unless the app's execution mode is `guest` AND the workspace has `guest_access_enabled` AND the instance has not set the `guest_access_disabled` global setting, and never on a deployment where guests are unavailable (the shared cloud), so it says nothing about apps that are not open to guests. Discloses only the app path, to a caller already holding the share secret.
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
@@ -11059,6 +11112,29 @@ var JobService = class {
 		});
 	}
 	/**
+	* Get relations' project column lineage as one run saw it
+	* The same answer as `assets/column_lineage`, for the project version a single job ran — including the dbt editor's parse of its own buffer, whose graph belongs to that job and is reachable no other way. One project answers here, the one the run is of, since the graph this annotates is that project's too. Authorized through the job, the same gate as `dbt_graph`. Reaching the run is not on its own enough to read the project: a caller with no access to the script gets its relations and `ref()` edges from `dbt_graph` and an empty answer here, exactly as that endpoint redacts the model's SQL.
+	*
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.id The job whose graph the lineage is read from
+	* @param data.assetPath The `dbt://` relations whose lineage to return. Repeated, once per relation, and answered as one union. At least one, and at most 1000 — a request naming none, or more than that, is refused rather than answered with an empty component.
+	*
+	* @returns DbtColumnLineage the relations' column-level lineage
+	* @throws ApiError
+	*/
+	static getDbtRunColumnLineage(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/jobs/dbt_column_lineage/{id}",
+			path: {
+				workspace: data.workspace,
+				id: data.id
+			},
+			query: { asset_path: data.assetPath }
+		});
+	}
+	/**
 	* List the per-relation progress one job has recorded so far
 	* Live materialization state for the relations a single job writes, keyed by relation. Polled while a run is in flight so a graph can move a node as its model completes. Authorized through the job, so a caller who may not read it is refused rather than told the run has no progress. An empty list means the job exists and has recorded nothing yet, or is unknown to this workspace.
 	*
@@ -13012,6 +13088,33 @@ var NativeTriggerService = class {
 		});
 	}
 	/**
+	* set enabled state of native trigger
+	* Enables or disables a native trigger. A disabled trigger stays registered on the
+	* external service but starts no job when it fires.
+	* Requires write access to the script or flow that the trigger is associated with.
+	*
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.serviceName
+	* @param data.externalId The external ID of the trigger from the external service
+	* @param data.requestBody updated enabled state
+	* @returns string native trigger enabled state updated
+	* @throws ApiError
+	*/
+	static setNativeTriggerEnabled(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/native_triggers/{service_name}/setenabled/{external_id}",
+			path: {
+				workspace: data.workspace,
+				service_name: data.serviceName,
+				external_id: data.externalId
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
 	* list native triggers
 	* Lists all native triggers for the specified service in the workspace.
 	* @param data The data for the request.
@@ -16797,6 +16900,33 @@ var AssetService = class {
 		});
 	}
 	/**
+	* Column-level lineage of a set of dbt relations
+	* The direct (`copy` / `mod`) column-to-column lineage the given relations' columns sit in — the connected component around them, from the engine's static analysis. Not their own edges, which would stop one hop out since a column trace walks transitively, and not a whole project's, which carries model families the selection cannot reach.
+	* Several relations, answered as one union, because one selection reaches several: a script's output column can derive from columns of several dbt models. Unpinned, the component crosses projects — a relation one project produces is another's source — and the caller's access is decided again for every project it reaches, so a trace ends where their grants do. A pinned answer, by version here or by job on the run route, is one project's.
+	* Its own endpoint rather than a field on the asset graph: the graph is folder-wide and polled by a run page, while this is rendered for one selection at a time. Empty for projects that did not opt into the analysis pass (`column_lineage: true`), which is the ordinary case. The indirect `scan` kind is stored but never served: it reaches every output column of its model.
+	*
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.assetPath The `dbt://` relations whose lineage to return. Repeated, once per relation, and answered as one union. At least one, and at most 1000 — a request naming none, or more than that, is refused rather than answered with an empty component.
+	*
+	* @param data.dbtScriptHash The deployed version a view is drawing, when it is drawing one — the dbt editor, which shows a single project as of a single deploy. A version-pinned answer is that version's project alone, the same as a job-pinned one, and only the unpinned answer crosses projects: a pin says which stored graph is on screen, and another project's live graph is not part of it.
+	* A run's or an editor buffer's own graph is not reachable here: that pins to a job, and costs the job-read gate — see `jobs/dbt_column_lineage/{id}`.
+	*
+	* @returns DbtColumnLineage the relations' column-level lineage
+	* @throws ApiError
+	*/
+	static getDbtColumnLineage(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/assets/column_lineage",
+			path: { workspace: data.workspace },
+			query: {
+				asset_path: data.assetPath,
+				dbt_script_hash: data.dbtScriptHash
+			}
+		});
+	}
+	/**
 	* List every workspace DuckDB macro (deployed `// macros` libraries)
 	* @param data The data for the request.
 	* @param data.workspace
@@ -17513,6 +17643,27 @@ var HubPublishService = class {
 		});
 	}
 	/**
+	* list the hub's published projects
+	* Forwards to the configured Hub's public project catalogue and returns its
+	* status code and raw response body. Readable by any workspace member: the
+	* listing is not workspace-scoped, and it is proxied only because the Hub's
+	* listing endpoint sends no CORS header. Refused with 400 when the instance
+	* has the Hub disabled, in which case no outbound request is made.
+	*
+	* @param data The data for the request.
+	* @param data.workspace
+	* @returns string raw Hub response body (status code is passed through from the Hub)
+	* @throws ApiError
+	*/
+	static listHubProjects(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/hub/projects",
+			path: { workspace: data.workspace },
+			errors: { 400: "the Hub is disabled on this instance" }
+		});
+	}
+	/**
 	* get the hub project linked to a workspace folder
 	* Requires the caller to be a workspace admin. Forwards the request to the
 	* configured Hub scoped to the `{workspace}:{folder}` source and returns
@@ -19021,6 +19172,35 @@ function checkpointableResult(value) {
 function jsonRoundTrip(value) {
 	return JSON.parse(encodeCheckpointPayload({ value: checkpointableResult(value) })).value;
 }
+/** The worker deserializes a sleep into a `u32` of seconds and fails the whole
+*  job on anything wider, so a delay a multiplier has run away with has to be
+*  capped here rather than sent. */
+const MAX_SLEEP_SECONDS = 4294967295;
+/** Every attempt claims its keys before the first one is dispatched, so an
+*  unbounded `attempts` is a workflow that hangs allocating rather than a very
+*  patient one. */
+const MAX_RETRY_ATTEMPTS = 100;
+/** Rejected where the policy is written, so a workflow fails at its first line
+*  rather than mid-run on a replay. */
+function assertUsableRetry(retry) {
+	if (retry === void 0) return;
+	const { attempts } = retry;
+	if (!Number.isInteger(attempts) || attempts < 0 || attempts > MAX_RETRY_ATTEMPTS) throw new Error(`retry.attempts must be a whole number between 0 and ${MAX_RETRY_ATTEMPTS}, got ${attempts}`);
+}
+/** How many retries the policy asks for, defended against a value that reached
+*  `_nextStep` without going through `assertUsableRetry`. */
+function retryAttempts(retry) {
+	const attempts = Math.trunc(retry?.attempts ?? 0) || 0;
+	return Math.min(Math.max(attempts, 0), MAX_RETRY_ATTEMPTS);
+}
+/** Seconds to wait before retry number `attempt` (0 is the first retry). */
+function retryDelaySeconds(retry, attempt) {
+	const base = retry.delay ?? 0;
+	if (!(base > 0)) return 0;
+	const grown = base * Math.pow(retry.multiplier ?? 1, attempt);
+	const seconds = Math.floor(Math.min(retry.max_delay ?? grown, grown, MAX_SLEEP_SECONDS));
+	return seconds > 0 ? seconds : 0;
+}
 /** A step key travels as one path segment when its URLs are minted, so it must be
 *  non-empty and free of `/` and dot segments — otherwise `waitForApproval` would
 *  accept a key `getApprovalUrls` can never address. */
@@ -19052,6 +19232,11 @@ var WorkflowCtx = class {
 	*  into a `complete` — the parent would then record the caught branch's value as
 	*  a successful step. Boxed: the thrown value may be any falsy value. */
 	_pendingStepFailure = null;
+	/** Failed tasks whose rejection nothing has consumed, by step key. An unawaited
+	*  task is still dispatched and still fails, but nothing drives the rejecting
+	*  thenable it returned. The first `.then()` on that thenable drops the entry,
+	*  so what remains is only what the body never looked at. */
+	_unobservedTaskFailures = new Map();
 	/** When set, the task matching this key executes its inner function directly */
 	_executingKey;
 	/** Serializes fast-path POSTs across concurrent step() calls within one
@@ -19085,52 +19270,90 @@ var WorkflowCtx = class {
 	}
 	_nextStep(name, script, args = {}, dispatch_type = "inline", options) {
 		this._rethrowSwallowed();
-		const key = this._allocKey(name || script || "step");
-		if (key in this.completed) {
-			const value = this.completed[key];
-			if (value && typeof value === "object" && value.__wmill_error) {
-				const err = taskErrorFromMarker(value, `Task '${name}' failed`);
-				return { then: (_resolve, reject) => {
-					if (reject) reject(err);
-					else throw err;
-				} };
+		const stepName = name || script || "step";
+		const maxRetries = retryAttempts(options?.retry);
+		const baseKey = this._allocKey(stepName);
+		const attemptKeys = [baseKey];
+		const backoffKeys = [];
+		for (let i = 0; i < maxRetries; i++) {
+			backoffKeys.push(this._allocKey(`${baseKey}#retry${i + 2}`));
+			attemptKeys.push(this._allocKey(`${baseKey}#${i + 2}`));
+		}
+		for (let attempt = 0;; attempt++) {
+			const key = attemptKeys[attempt];
+			if (key in this.completed) {
+				const value = this.completed[key];
+				if (value && typeof value === "object" && value.__wmill_error) {
+					if (attempt < maxRetries) {
+						this._retryBackoff(backoffKeys[attempt], baseKey, options.retry, attempt);
+						continue;
+					}
+					const err = taskErrorFromMarker(value, `Task '${name}' failed`);
+					this._unobservedTaskFailures.set(baseKey, err);
+					return { then: (_resolve, reject) => {
+						this._unobservedTaskFailures.delete(baseKey);
+						if (reject) reject(err);
+						else throw err;
+					} };
+				}
+				return { then: (resolve$1) => resolve$1(value) };
 			}
-			return { then: (resolve$1) => resolve$1(value) };
+			if (this._executingKey === key) return {
+				then: (resolve$1) => resolve$1(null),
+				_execute_directly: true
+			};
+			if (this._executingKey !== null) return { then: () => new Promise(() => {}) };
+			const stepInfo = {
+				name: name || key,
+				script: script || key,
+				args,
+				key,
+				dispatch_type
+			};
+			if (options) {
+				if (options.timeout !== void 0) stepInfo.timeout = options.timeout;
+				if (options.tag !== void 0) stepInfo.tag = options.tag;
+				if (options.cache_ttl !== void 0) stepInfo.cache_ttl = options.cache_ttl;
+				if (options.priority !== void 0) stepInfo.priority = options.priority;
+				if (options.concurrency_limit !== void 0) stepInfo.concurrent_limit = options.concurrency_limit;
+				if (options.concurrency_key !== void 0) stepInfo.concurrency_key = options.concurrency_key;
+				if (options.concurrency_time_window_s !== void 0) stepInfo.concurrency_time_window_s = options.concurrency_time_window_s;
+			}
+			this.pending.push(stepInfo);
+			return { then: () => {
+				if (this._suspended) return new Promise(() => {});
+				this._suspended = true;
+				const steps = [...this.pending];
+				this.pending = [];
+				const names = steps.map((s) => s.name).join(", ");
+				console.log(`\n--- WAC: ${names} ---`);
+				this._raiseSuspend({
+					mode: steps.length > 1 ? "parallel" : "sequential",
+					steps
+				});
+			} };
 		}
-		if (this._executingKey === key) return {
-			then: (resolve$1) => resolve$1(null),
-			_execute_directly: true
-		};
-		if (this._executingKey !== null) return { then: () => new Promise(() => {}) };
-		const stepInfo = {
-			name: name || key,
-			script: script || key,
-			args,
+	}
+	/** Wait out the backoff between two attempts of a retried task, as a durable
+	*  sleep, and return once there is nothing to wait for — no delay configured,
+	*  or the sleep already in the checkpoint.
+	*
+	*  Raises where it stands, the way `_sleep` does, rather than handing back a
+	*  thenable: a task call the body never awaits is still dispatched (the runner
+	*  flushes `pending`), so a backoff that only fired when awaited would drop
+	*  the retry and let the round report the workflow complete. */
+	_retryBackoff(key, baseKey, retry, attempt) {
+		const seconds = retryDelaySeconds(retry, attempt);
+		if (seconds < 1) return;
+		if (key in this.completed) return;
+		if (this._executingKey !== null) return;
+		console.log(`\n--- WAC: sleep(${key}, ${seconds}s) before retrying ${baseKey} ---`);
+		this._raiseSuspend({
+			mode: "sleep",
 			key,
-			dispatch_type
-		};
-		if (options) {
-			if (options.timeout !== void 0) stepInfo.timeout = options.timeout;
-			if (options.tag !== void 0) stepInfo.tag = options.tag;
-			if (options.cache_ttl !== void 0) stepInfo.cache_ttl = options.cache_ttl;
-			if (options.priority !== void 0) stepInfo.priority = options.priority;
-			if (options.concurrency_limit !== void 0) stepInfo.concurrent_limit = options.concurrency_limit;
-			if (options.concurrency_key !== void 0) stepInfo.concurrency_key = options.concurrency_key;
-			if (options.concurrency_time_window_s !== void 0) stepInfo.concurrency_time_window_s = options.concurrency_time_window_s;
-		}
-		this.pending.push(stepInfo);
-		return { then: () => {
-			if (this._suspended) return new Promise(() => {});
-			this._suspended = true;
-			const steps = [...this.pending];
-			this.pending = [];
-			const names = steps.map((s) => s.name).join(", ");
-			console.log(`\n--- WAC: ${names} ---`);
-			this._raiseSuspend({
-				mode: steps.length > 1 ? "parallel" : "sequential",
-				steps
-			});
-		} };
+			seconds,
+			steps: []
+		});
 	}
 	/** Return and clear any pending (unawaited) steps. */
 	_flushPending() {
@@ -19297,6 +19520,13 @@ var WorkflowCtx = class {
 		this._pendingStepFailure = null;
 		return f;
 	}
+	/** Report the task failures the body never looked at, and forget them. Which
+	*  rounds may call this is the runner's constraint, stated where it is enforced. */
+	_warnUnobservedTaskFailures() {
+		if (this._executingKey !== null) return;
+		for (const [key, err] of this._unobservedTaskFailures) console.log(`\n--- WAC: task '${key}' failed but was never awaited, so the workflow result does not reflect it: ${err.message} ---`);
+		this._unobservedTaskFailures.clear();
+	}
 };
 async function sleep(seconds) {
 	const ctx = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
@@ -19322,9 +19552,11 @@ async function step(name, fn) {
 * @example
 * const extract_data = task(async (url: string) => { ... });
 * const run_external = task("f/external_script", async (x: number) => { ... });
+* const call_api = task(fetchOrders, { retry: { attempts: 3, delay: 30, multiplier: 2 } });
 *
 * Inside a `workflow()`, calling a task dispatches it as a step.
-* Outside a workflow, the function body executes directly.
+* Outside a workflow, the function body executes directly and
+* {@link TaskOptions} — retry included — does not apply.
 *
 * A task runs as its own job, so its result is always encoded as JSON and
 * decoded back before the caller sees it: a `Date` comes back as a string, a
@@ -19342,6 +19574,7 @@ function task(fnOrPath, maybeFnOrOptions, maybeOptions) {
 		fn = fnOrPath;
 		taskOptions = maybeFnOrOptions;
 	}
+	assertUsableRetry(taskOptions?.retry);
 	const taskName = fn.name || taskPath || "";
 	const wrapper = function(...args) {
 		const ctx = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
@@ -19400,6 +19633,7 @@ function task(fnOrPath, maybeFnOrOptions, maybeOptions) {
 * // inside workflow: await extract({ url: "https://..." })
 */
 function taskScript(path, options) {
+	assertUsableRetry(options?.retry);
 	const name = path.split("/").pop() || path;
 	const wrapper = function(...args) {
 		const ctx = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");
@@ -19425,6 +19659,7 @@ function taskScript(path, options) {
 * // inside workflow: await pipeline({ input: data })
 */
 function taskFlow(path, options) {
+	assertUsableRetry(options?.retry);
 	const name = path.split("/").pop() || path;
 	const wrapper = function(...args) {
 		const ctx = _workflowCtx ?? Reflect.get(globalThis, "__wmill_wf_ctx");