windmill-client 1.811.0 → 1.812.0

package/dist/types.gen.d.ts

@@ -937,6 +937,18 @@ export type AiAgent = {
          *
          */
         user_attachments?: InputTransform;
+        /**
+         * Array of strings naming which of the tools configured in `tools` the agent may call
+         * this run. Leaving it unset carries every one of them; an empty array carries none.
+         * A tool is named as the model is shown it. An entry the model is shown nothing of is
+         * named by what identifies it instead: an MCP server by its resource path, carrying
+         * every tool it exposes (which of them stays that entry's include_tools/exclude_tools),
+         * and a websearch entry by the reserved name '__wm_web_search', whatever summary it carries
+         * (no tool may take that name).
+         * Example: ['get_user', 'u/admin/github_mcp', '__wm_web_search']
+         *
+         */
+        enabled_tools?: InputTransform;
         /**
          * Integer. Maximum number of tokens the AI will generate in its response.
          * Range: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.
@@ -1011,7 +1023,7 @@ export type AiAgent = {
      * Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain
      * config (provider/model/system prompt/etc.) and tool set are resolved at runtime from
      * that resource; the module's input_transforms then only carry the flow-local inputs
-     * (user_message/user_attachments).
+     * (user_message/user_attachments/enabled_tools).
      *
      */
     agent?: string;
@@ -1946,6 +1958,15 @@ export type AITokenUsageBucket = {
     reported_cost_nano_usd?: number;
     requests: number;
 };
+export type SharedAiArtifactInfo = {
+    id: string;
+    name: string;
+    kind: 'md' | 'html';
+    version: number;
+    created_by: string;
+    shared_at: string;
+    expires_at: string;
+};
 export type InstanceAIProviderSummary = {
     provider: AIProvider;
     models: Array<(string)>;
@@ -2792,6 +2813,30 @@ export type AuditLog = {
     };
     span?: string;
 };
+export type TrashItem = {
+    id: number;
+    workspace_id: string;
+    /**
+     * script, flow, app, schedule, variable, resource, or a trigger kind such as http_trigger
+     */
+    item_kind: string;
+    item_path: string;
+    deleted_by: string;
+    deleted_at: string;
+    /**
+     * when the item is permanently deleted unless restored first
+     */
+    expires_at: string;
+};
+export type TrashItemWithData = TrashItem & {
+    /**
+     * the deleted rows as they were stored; the shape depends on the kind, and a secret variable's value stays encrypted
+     *
+     */
+    item_data: {
+        [key: string]: unknown;
+    };
+};
 export type MainArgSignature = {
     type: 'Valid' | 'Invalid';
     error: string;
@@ -3008,6 +3053,10 @@ export type ResourceType = {
     edited_at?: string;
     format_extension?: string;
     is_fileset?: boolean;
+    /**
+     * The name the product goes by, e.g. "Google Sheets" for gsheets. Absent where nobody named the type.
+     */
+    display_name?: string;
 };
 export type EditResourceType = {
     schema?: unknown;
@@ -3017,6 +3066,10 @@ export type EditResourceType = {
      * File extension for a type whose value is one file rather than a set of fields. Omit to leave it unchanged; send null to clear it.
      */
     format_extension?: string | null;
+    /**
+     * The name the product goes by. Omit to leave it unchanged; send null to clear it.
+     */
+    display_name?: string | null;
 };
 export type TriggerHistoryEntry = {
     id: number;
@@ -3523,6 +3576,10 @@ export type HttpTrigger = TriggerExtraProperty & {
      * If true, passes the request body as a raw string instead of parsing as JSON
      */
     raw_string: boolean;
+    /**
+     * Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.
+     */
+    allowed_origins?: Array<(string)> | null;
     /**
      * Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.
      */
@@ -3615,6 +3672,10 @@ export type NewHttpTrigger = {
      * If true, passes the request body as a raw string instead of parsing as JSON
      */
     raw_string?: boolean;
+    /**
+     * Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.
+     */
+    allowed_origins?: Array<(string)> | null;
     /**
      * Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.
      */
@@ -3715,6 +3776,10 @@ export type EditHttpTrigger = {
      * If true, passes the request body as a raw string instead of parsing as JSON
      */
     raw_string?: boolean;
+    /**
+     * Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.
+     */
+    allowed_origins?: Array<(string)> | null;
     /**
      * Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.
      */
@@ -5489,7 +5554,7 @@ export type WorkspaceInvite = {
 };
 export type GlobalUserInfo = {
     email: string;
-    login_type: 'password' | 'github' | 'service_account';
+    login_type: 'password' | 'github' | 'service_account' | 'pending_oauth';
     super_admin: boolean;
     devops?: boolean;
     verified: boolean;
@@ -5647,7 +5712,7 @@ export type Policy = {
      */
     sandbox?: boolean;
     /**
-     * Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).
+     * Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read, flow_conversations:read, flow_conversations:write).
      *
      */
     frontend_sdk_scopes?: Array<(string)>;
@@ -6118,6 +6183,10 @@ export type AutoPullSettings = {
         [key: string]: (string);
     };
     last_pull_status?: AutoPullStatus;
+    /**
+     * Email of the admin automatic pulls apply changes as. Set by the server when the settings are saved.
+     */
+    enabled_by?: string;
 };
 export type MetricMetadata = {
     id: string;
@@ -7416,6 +7485,42 @@ export type ListAuditLogsData = {
     workspace: string;
 };
 export type ListAuditLogsResponse = Array<AuditLog>;
+export type ListTrashData = {
+    /**
+     * only return items of this kind: script, flow, app, schedule, variable, resource, or a trigger kind such as http_trigger
+     *
+     */
+    itemKind?: string;
+    /**
+     * which page to return (starts at 0, default 0)
+     */
+    page?: number;
+    /**
+     * number of items to return for a given page (default 100, max 1000)
+     */
+    perPage?: number;
+    workspace: string;
+};
+export type ListTrashResponse = Array<TrashItem>;
+export type GetTrashItemData = {
+    id: number;
+    workspace: string;
+};
+export type GetTrashItemResponse = TrashItemWithData;
+export type RestoreTrashItemData = {
+    id: number;
+    workspace: string;
+};
+export type RestoreTrashItemResponse = string;
+export type PermanentlyDeleteTrashItemData = {
+    id: number;
+    workspace: string;
+};
+export type PermanentlyDeleteTrashItemResponse = string;
+export type EmptyTrashData = {
+    workspace: string;
+};
+export type EmptyTrashResponse = string;
 export type LoginData = {
     /**
      * credentials
@@ -7435,6 +7540,10 @@ export type RequestPasswordResetData = {
     };
 };
 export type RequestPasswordResetResponse = PasswordResetResponse;
+export type ConsumeLoginLinkData = {
+    rd?: string;
+    token: string;
+};
 export type ResetPasswordData = {
     /**
      * token and new password
@@ -7499,7 +7608,7 @@ export type CreateUserGloballyData = {
      */
     requestBody: {
         email: string;
-        password: string;
+        password?: string;
         super_admin: boolean;
         name?: string;
         company?: string;
@@ -7507,6 +7616,10 @@ export type CreateUserGloballyData = {
          * Skip sending email notifications to the user
          */
         skip_email?: boolean;
+        /**
+         * password (default, requires `password`), pending_oauth (no credential until the first OAuth login proving the address adopts the account), or a configured OAuth login client key
+         */
+        login_type?: string;
     };
 };
 export type CreateUserGloballyResponse = string;
@@ -7754,6 +7867,67 @@ export type CreateTokenImpersonateData = {
     requestBody: NewTokenImpersonate;
 };
 export type CreateTokenImpersonateResponse = string;
+export type CreateLoginLinkData = {
+    /**
+     * target account and link options
+     */
+    requestBody: {
+        email: string;
+        /**
+         * link lifetime in seconds, at most 900 (default 600)
+         */
+        expires_in_s?: number;
+        /**
+         * same-origin path the browser lands on after login (default /user/workspaces)
+         */
+        rd?: string;
+        /**
+         * mint only while the account still has this login type (for example pending_oauth), so a link stops working once the owner has set a password or signed in with a provider
+         */
+        require_login_type?: string;
+    };
+};
+export type CreateLoginLinkResponse = {
+    url: string;
+    expires_at: string;
+};
+export type SetCloudTrialOfferData = {
+    requestBody: {
+        email: string;
+        /**
+         * mark the offer used (a trial or subscription now exists) instead of recording it
+         */
+        consumed?: boolean;
+    };
+};
+export type SetCloudTrialOfferResponse = string;
+export type GetCloudTrialOfferResponse = {
+    offered: boolean;
+};
+export type GoCloudTrialOfferResponse = {
+    location: string;
+    /**
+     * present when the portal refused (e.g. the account already has a subscription); the offer is then spent
+     */
+    reason?: string;
+};
+export type SetOnboardingProfileData = {
+    requestBody: {
+        email: string;
+        /**
+         * free-form context from the invite, every key optional. The frontend reads `touch_point` (answers onboarding's source question), `company` and `workspace_name` (prefill the first workspace's name), `hub_projects` (slugs surfaced first on an empty workspace), `tools` (integrations, used to pick hub projects when none are named) and `starter_prompts` (`[{label, prompt}]`, replacing the home page's example prompts); unknown keys are kept and ignored
+         */
+        profile: {
+            [key: string]: unknown;
+        };
+    };
+};
+export type SetOnboardingProfileResponse = string;
+export type GetOnboardingProfileResponse = {
+    profile?: {
+        [key: string]: unknown;
+    } | null;
+};
 export type DeleteTokenData = {
     tokenPrefix: string;
 };
@@ -10381,6 +10555,10 @@ export type ListHubIntegrationsResponse = Array<{
      * how often the integration has been picked, absent on a hub that does not count picks
      */
     picks?: number;
+    /**
+     * the label the hub curates for the integration, null or absent where it names none
+     */
+    display_name?: string | null;
 }>;
 export type ListHubFlowsResponse = {
     flows?: Array<{
@@ -14796,6 +14974,44 @@ export type ListAiUsageResponse = {
      */
     truncated: boolean;
 };
+export type ShareAiArtifactData = {
+    requestBody: {
+        /**
+         * the artifact's id in the author's session
+         */
+        artifact_id: string;
+        name: string;
+        kind: 'md' | 'html';
+        version: number;
+        content: string;
+    };
+    workspace: string;
+};
+export type ShareAiArtifactResponse = SharedAiArtifactInfo;
+export type GetAiArtifactShareStatusData = {
+    artifactId: string;
+    workspace: string;
+};
+export type GetAiArtifactShareStatusResponse = {
+    retention_secs: number;
+    share?: SharedAiArtifactInfo;
+};
+export type GetSharedAiArtifactData = {
+    id: string;
+    workspace: string;
+};
+export type GetSharedAiArtifactResponse = SharedAiArtifactInfo & {
+    content: string;
+    /**
+     * whether the caller authored the share or is a workspace admin
+     */
+    can_unshare: boolean;
+};
+export type UnshareAiArtifactData = {
+    id: string;
+    workspace: string;
+};
+export type UnshareAiArtifactResponse = string;
 export type ResumeSuspendedTriggerJobsData = {
     /**
      * Optional list of job IDs to reassign
@@ -18281,6 +18497,87 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/trash/list': {
+        get: {
+            req: {
+                /**
+                 * only return items of this kind: script, flow, app, schedule, variable, resource, or a trigger kind such as http_trigger
+                 *
+                 */
+                itemKind?: string;
+                /**
+                 * which page to return (starts at 0, default 0)
+                 */
+                page?: number;
+                /**
+                 * number of items to return for a given page (default 100, max 1000)
+                 */
+                perPage?: number;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the trashed items, most recently deleted first
+                 */
+                200: Array<TrashItem>;
+            };
+        };
+    };
+    '/w/{workspace}/trash/get/{id}': {
+        get: {
+            req: {
+                id: number;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the trashed item
+                 */
+                200: TrashItemWithData;
+            };
+        };
+    };
+    '/w/{workspace}/trash/restore/{id}': {
+        post: {
+            req: {
+                id: number;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * item restored
+                 */
+                200: string;
+            };
+        };
+    };
+    '/w/{workspace}/trash/delete/{id}': {
+        delete: {
+            req: {
+                id: number;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * item permanently deleted
+                 */
+                200: string;
+            };
+        };
+    };
+    '/w/{workspace}/trash/empty': {
+        post: {
+            req: {
+                workspace: string;
+            };
+            res: {
+                /**
+                 * trashbin emptied
+                 */
+                200: string;
+            };
+        };
+    };
     '/auth/login': {
         post: {
             req: {
@@ -18350,6 +18647,20 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/auth/login_link/{token}': {
+        get: {
+            req: {
+                rd?: string;
+                token: string;
+            };
+            res: {
+                /**
+                 * redirected to the post-login destination, or to /user/login_link_expired when the link is used, expired or unknown
+                 */
+                302: unknown;
+            };
+        };
+    };
     '/auth/reset_password': {
         post: {
             req: {
@@ -18483,7 +18794,7 @@ export type $OpenApiTs = {
                  */
                 requestBody: {
                     email: string;
-                    password: string;
+                    password?: string;
                     super_admin: boolean;
                     name?: string;
                     company?: string;
@@ -18491,6 +18802,10 @@ export type $OpenApiTs = {
                      * Skip sending email notifications to the user
                      */
                     skip_email?: boolean;
+                    /**
+                     * password (default, requires `password`), pending_oauth (no credential until the first OAuth login proving the address adopts the account), or a configured OAuth login client key
+                     */
+                    login_type?: string;
                 };
             };
             res: {
@@ -19103,6 +19418,129 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/users/login_links': {
+        post: {
+            req: {
+                /**
+                 * target account and link options
+                 */
+                requestBody: {
+                    email: string;
+                    /**
+                     * link lifetime in seconds, at most 900 (default 600)
+                     */
+                    expires_in_s?: number;
+                    /**
+                     * same-origin path the browser lands on after login (default /user/workspaces)
+                     */
+                    rd?: string;
+                    /**
+                     * mint only while the account still has this login type (for example pending_oauth), so a link stops working once the owner has set a password or signed in with a provider
+                     */
+                    require_login_type?: string;
+                };
+            };
+            res: {
+                /**
+                 * login link minted
+                 */
+                201: {
+                    url: string;
+                    expires_at: string;
+                };
+                /**
+                 * the account does not have the required login type
+                 */
+                409: unknown;
+            };
+        };
+    };
+    '/users/cloud_trial_offer': {
+        post: {
+            req: {
+                requestBody: {
+                    email: string;
+                    /**
+                     * mark the offer used (a trial or subscription now exists) instead of recording it
+                     */
+                    consumed?: boolean;
+                };
+            };
+            res: {
+                /**
+                 * offer recorded or consumed
+                 */
+                200: string;
+            };
+        };
+        get: {
+            res: {
+                /**
+                 * offer state
+                 */
+                200: {
+                    offered: boolean;
+                };
+            };
+        };
+    };
+    '/users/cloud_trial_offer/go': {
+        post: {
+            res: {
+                /**
+                 * where to go — the customer portal signed in with the trial being started, or the portal home with the reason the offer could not be used
+                 */
+                200: {
+                    location: string;
+                    /**
+                     * present when the portal refused (e.g. the account already has a subscription); the offer is then spent
+                     */
+                    reason?: string;
+                };
+                /**
+                 * called with a job token
+                 */
+                403: unknown;
+                /**
+                 * no offer for this account
+                 */
+                404: unknown;
+            };
+        };
+    };
+    '/users/onboarding_profile': {
+        post: {
+            req: {
+                requestBody: {
+                    email: string;
+                    /**
+                     * free-form context from the invite, every key optional. The frontend reads `touch_point` (answers onboarding's source question), `company` and `workspace_name` (prefill the first workspace's name), `hub_projects` (slugs surfaced first on an empty workspace), `tools` (integrations, used to pick hub projects when none are named) and `starter_prompts` (`[{label, prompt}]`, replacing the home page's example prompts); unknown keys are kept and ignored
+                     */
+                    profile: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            res: {
+                /**
+                 * profile recorded
+                 */
+                200: string;
+            };
+        };
+        get: {
+            res: {
+                /**
+                 * the profile, or null when none was recorded
+                 */
+                200: {
+                    profile?: {
+                        [key: string]: unknown;
+                    } | null;
+                };
+            };
+        };
+    };
     '/users/tokens/delete/{token_prefix}': {
         delete: {
             req: {
@@ -24135,6 +24573,10 @@ export type $OpenApiTs = {
                      * how often the integration has been picked, absent on a hub that does not count picks
                      */
                     picks?: number;
+                    /**
+                     * the label the hub curates for the integration, null or absent where it names none
+                     */
+                    display_name?: string | null;
                 }>;
             };
         };
@@ -30734,6 +31176,80 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/ai/shared_artifacts/share': {
+        post: {
+            req: {
+                requestBody: {
+                    /**
+                     * the artifact's id in the author's session
+                     */
+                    artifact_id: string;
+                    name: string;
+                    kind: 'md' | 'html';
+                    version: number;
+                    content: string;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the shared copy
+                 */
+                200: SharedAiArtifactInfo;
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/status': {
+        get: {
+            req: {
+                artifactId: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the live share, if any, and how long shares last
+                 */
+                200: {
+                    retention_secs: number;
+                    share?: SharedAiArtifactInfo;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/get/{id}': {
+        get: {
+            req: {
+                id: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the shared artifact
+                 */
+                200: SharedAiArtifactInfo & {
+                    content: string;
+                    /**
+                     * whether the caller authored the share or is a workspace admin
+                     */
+                    can_unshare: boolean;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/delete/{id}': {
+        delete: {
+            req: {
+                id: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * share deleted
+                 */
+                200: string;
+            };
+        };
+    };
     '/w/{workspace}/trigger/{trigger_kind}/resume_suspended_trigger_jobs/{trigger_path}': {
         post: {
             req: {