windmill-client 1.811.1 → 1.813.0

package/dist/types.gen.d.ts

@@ -937,6 +937,18 @@ export type AiAgent = {
          *
          */
         user_attachments?: InputTransform;
+        /**
+         * Array of strings naming which of the tools configured in `tools` the agent may call
+         * this run. Leaving it unset carries every one of them; an empty array carries none.
+         * A tool is named as the model is shown it. An entry the model is shown nothing of is
+         * named by what identifies it instead: an MCP server by its resource path, carrying
+         * every tool it exposes (which of them stays that entry's include_tools/exclude_tools),
+         * and a websearch entry by the reserved name '__wm_web_search', whatever summary it carries
+         * (no tool may take that name).
+         * Example: ['get_user', 'u/admin/github_mcp', '__wm_web_search']
+         *
+         */
+        enabled_tools?: InputTransform;
         /**
          * Integer. Maximum number of tokens the AI will generate in its response.
          * Range: 1 to 4,294,967,295. Typical values: 256-4096 for most use cases.
@@ -1011,7 +1023,7 @@ export type AiAgent = {
      * Path of a reusable `ai_agent` resource (hybrid linking). When set, the agent brain
      * config (provider/model/system prompt/etc.) and tool set are resolved at runtime from
      * that resource; the module's input_transforms then only carry the flow-local inputs
-     * (user_message/user_attachments).
+     * (user_message/user_attachments/enabled_tools).
      *
      */
     agent?: string;
@@ -1895,6 +1907,97 @@ export type AIConfig = {
      * Hides the Windmill AI assistant (chat, sessions, code generation, completion, fixes) from the workspace UI. Read from the workspace's own settings even when the providers served fall back to the instance config. AI agent steps and the AI sandbox in flows are unaffected.
      */
     copilot_disabled?: boolean;
+    /**
+     * Stops browsers from backing their AI sessions up to the workspace's object storage. Read from the workspace's own settings like `copilot_disabled`.
+     */
+    sessions_storage_disabled?: boolean;
+    /**
+     * The server deletes the backup of a session no push has reached for this many days. Unset keeps backups until the user deletes the session. Read from the workspace's own settings like `copilot_disabled`.
+     */
+    sessions_retention_days?: number;
+};
+export type AISessionBackupListing = {
+    id: string;
+    updated_at: string;
+    /**
+     * the session's move count when this copy was pushed; of a session two workspaces list, the copy with the higher one is the later
+     */
+    epoch: number;
+};
+export type AISessionBackupImage = {
+    chat_id: string;
+    id: string;
+    data_url: string;
+};
+export type AISessionBackupChat = {
+    id: string;
+    record: {
+        [key: string]: unknown;
+    };
+};
+export type AISessionBackup = {
+    id: string;
+    head: {
+        [key: string]: unknown;
+    };
+    chats: Array<AISessionBackupChat>;
+    images: Array<AISessionBackupImage>;
+    artifacts?: {
+        [key: string]: unknown;
+    };
+    next?: AISessionBackupCursor;
+    /**
+     * a fingerprint of the session's listing; pages of one session whose fingerprints differ do not belong together
+     */
+    listing: string;
+    /**
+     * the backup kept changing while this page was read, so it may mix two versions; the browser starts the session over
+     */
+    moved?: boolean;
+};
+/**
+ * where a pull of a session that did not fit one answer whole picks up; the rest of the session follows a pull naming that session alone with this as `resume`
+ */
+export type AISessionBackupCursor = {
+    id: string;
+    images: boolean;
+    after: string;
+};
+export type AISessionBackupPush = {
+    id: string;
+    head?: {
+        [key: string]: unknown;
+    };
+    chats?: Array<AISessionBackupChat>;
+    images?: Array<AISessionBackupImage>;
+    artifacts?: {
+        [key: string]: unknown;
+    };
+    delete_chats?: Array<(string)>;
+    delete_images?: Array<{
+        chat_id: string;
+        id: string;
+    }>;
+    /**
+     * more parts of this session follow, in this push or a later one; the session is not listed on this one. Such a part names its push (`push`), or it is refused
+     */
+    partial?: boolean;
+    /**
+     * a part of a push of the session whole; the head is on the part that opens it, which replaces whatever the storage holds of the session, and every piece the browser has is on one of them. An incremental part instead rides on a session the storage lists and is refused with needs_whole when it lists none
+     */
+    whole?: boolean;
+    /**
+     * a push split over several parts names itself on each with a token the browser draws; the part that opens it unlists the session and the last part lists it again, and a later part is written only while that token is the one there (refused with needs_whole otherwise)
+     */
+    push?: string;
+    /**
+     * this part opens the push named by `push`
+     */
+    opens?: boolean;
+    /**
+     * the session's move count (its record's `moves`), kept with the marker that lists the session; an incremental part rides on the marker of the same count
+     */
+    epoch?: number;
 };
 /**
  * Read-only. Present when the workspace has no AI provider of its own and is running on Windmill's free tier. Ignored on write.
@@ -1946,6 +2049,15 @@ export type AITokenUsageBucket = {
     reported_cost_nano_usd?: number;
     requests: number;
 };
+export type SharedAiArtifactInfo = {
+    id: string;
+    name: string;
+    kind: 'md' | 'html';
+    version: number;
+    created_by: string;
+    shared_at: string;
+    expires_at: string;
+};
 export type InstanceAIProviderSummary = {
     provider: AIProvider;
     models: Array<(string)>;
@@ -2792,6 +2904,30 @@ export type AuditLog = {
     };
     span?: string;
 };
+export type TrashItem = {
+    id: number;
+    workspace_id: string;
+    /**
+     * script, flow, app, schedule, variable, resource, or a trigger kind such as http_trigger
+     */
+    item_kind: string;
+    item_path: string;
+    deleted_by: string;
+    deleted_at: string;
+    /**
+     * when the item is permanently deleted unless restored first
+     */
+    expires_at: string;
+};
+export type TrashItemWithData = TrashItem & {
+    /**
+     * the deleted rows as they were stored; the shape depends on the kind, and a secret variable's value stays encrypted
+     *
+     */
+    item_data: {
+        [key: string]: unknown;
+    };
+};
 export type MainArgSignature = {
     type: 'Valid' | 'Invalid';
     error: string;
@@ -3008,6 +3144,10 @@ export type ResourceType = {
     edited_at?: string;
     format_extension?: string;
     is_fileset?: boolean;
+    /**
+     * The name the product goes by, e.g. "Google Sheets" for gsheets. Absent where nobody named the type.
+     */
+    display_name?: string;
 };
 export type EditResourceType = {
     schema?: unknown;
@@ -3017,6 +3157,10 @@ export type EditResourceType = {
      * File extension for a type whose value is one file rather than a set of fields. Omit to leave it unchanged; send null to clear it.
      */
     format_extension?: string | null;
+    /**
+     * The name the product goes by. Omit to leave it unchanged; send null to clear it.
+     */
+    display_name?: string | null;
 };
 export type TriggerHistoryEntry = {
     id: number;
@@ -3523,6 +3667,10 @@ export type HttpTrigger = TriggerExtraProperty & {
      * If true, passes the request body as a raw string instead of parsing as JSON
      */
     raw_string: boolean;
+    /**
+     * Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.
+     */
+    allowed_origins?: Array<(string)> | null;
     /**
      * Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.
      */
@@ -3615,6 +3763,10 @@ export type NewHttpTrigger = {
      * If true, passes the request body as a raw string instead of parsing as JSON
      */
     raw_string?: boolean;
+    /**
+     * Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.
+     */
+    allowed_origins?: Array<(string)> | null;
     /**
      * Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.
      */
@@ -3715,6 +3867,10 @@ export type EditHttpTrigger = {
      * If true, passes the request body as a raw string instead of parsing as JSON
      */
     raw_string?: boolean;
+    /**
+     * Origins allowed to call this route cross-origin, matched against the request's Origin header (ignoring case) and echoed back on a match. When set, the list governs both the preflight and the response, overriding any Access-Control-Allow-Origin the runnable returns via wm_headers. Use ['*'] to opt out of any restriction, including the http_route_default_allowed_origins instance setting. An empty list is not a configuration and resolves exactly as null does. When null, the instance setting applies, or Access-Control-Allow-Origin: * if it is unset. Ignored on a static website, which has no authentication of its own and so hands out public files: restricting which browsers may read them protects nothing while breaking cross-origin webfonts and fetches. A single-file static asset is not exempt, since it can carry an authentication_method.
+     */
+    allowed_origins?: Array<(string)> | null;
     /**
      * Path to a script to run when the triggered job fails. A bare path, without the script/ or flow/ prefix a schedule error handler takes; it cannot be a flow.
      */
@@ -5489,7 +5645,7 @@ export type WorkspaceInvite = {
 };
 export type GlobalUserInfo = {
     email: string;
-    login_type: 'password' | 'github' | 'service_account';
+    login_type: 'password' | 'github' | 'service_account' | 'pending_oauth';
     super_admin: boolean;
     devops?: boolean;
     verified: boolean;
@@ -5647,7 +5803,7 @@ export type Policy = {
      */
     sandbox?: boolean;
     /**
-     * Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read).
+     * Raw apps: author-declared scopes for the frontend SDK token. Takes effect only when `sandbox` is also true — an unsandboxed bundle runs with the viewer's own session, so no token is advertised or minted for it and this list stays inert. On a sandboxed app a non-empty list lets viewers mint (after consenting) a short-lived token carrying their own identity restricted to these scopes, handed to the app bundle so `windmill-client` calls run as the viewer. Must be a subset of the server's curated allowlist (jobs:run, jobs:read, users:read, resources:read, variables:read, flow_conversations:read, flow_conversations:write).
      *
      */
     frontend_sdk_scopes?: Array<(string)>;
@@ -6118,6 +6274,10 @@ export type AutoPullSettings = {
         [key: string]: (string);
     };
     last_pull_status?: AutoPullStatus;
+    /**
+     * Email of the admin automatic pulls apply changes as. Set by the server when the settings are saved.
+     */
+    enabled_by?: string;
 };
 export type MetricMetadata = {
     id: string;
@@ -7416,6 +7576,42 @@ export type ListAuditLogsData = {
     workspace: string;
 };
 export type ListAuditLogsResponse = Array<AuditLog>;
+export type ListTrashData = {
+    /**
+     * only return items of this kind: script, flow, app, schedule, variable, resource, or a trigger kind such as http_trigger
+     *
+     */
+    itemKind?: string;
+    /**
+     * which page to return (starts at 0, default 0)
+     */
+    page?: number;
+    /**
+     * number of items to return for a given page (default 100, max 1000)
+     */
+    perPage?: number;
+    workspace: string;
+};
+export type ListTrashResponse = Array<TrashItem>;
+export type GetTrashItemData = {
+    id: number;
+    workspace: string;
+};
+export type GetTrashItemResponse = TrashItemWithData;
+export type RestoreTrashItemData = {
+    id: number;
+    workspace: string;
+};
+export type RestoreTrashItemResponse = string;
+export type PermanentlyDeleteTrashItemData = {
+    id: number;
+    workspace: string;
+};
+export type PermanentlyDeleteTrashItemResponse = string;
+export type EmptyTrashData = {
+    workspace: string;
+};
+export type EmptyTrashResponse = string;
 export type LoginData = {
     /**
      * credentials
@@ -7435,6 +7631,10 @@ export type RequestPasswordResetData = {
     };
 };
 export type RequestPasswordResetResponse = PasswordResetResponse;
+export type ConsumeLoginLinkData = {
+    rd?: string;
+    token: string;
+};
 export type ResetPasswordData = {
     /**
      * token and new password
@@ -7499,7 +7699,7 @@ export type CreateUserGloballyData = {
      */
     requestBody: {
         email: string;
-        password: string;
+        password?: string;
         super_admin: boolean;
         name?: string;
         company?: string;
@@ -7507,6 +7707,10 @@ export type CreateUserGloballyData = {
          * Skip sending email notifications to the user
          */
         skip_email?: boolean;
+        /**
+         * password (default, requires `password`), pending_oauth (no credential until the first OAuth login proving the address adopts the account), or a configured OAuth login client key
+         */
+        login_type?: string;
     };
 };
 export type CreateUserGloballyResponse = string;
@@ -7754,6 +7958,67 @@ export type CreateTokenImpersonateData = {
     requestBody: NewTokenImpersonate;
 };
 export type CreateTokenImpersonateResponse = string;
+export type CreateLoginLinkData = {
+    /**
+     * target account and link options
+     */
+    requestBody: {
+        email: string;
+        /**
+         * link lifetime in seconds, at most 900 (default 600)
+         */
+        expires_in_s?: number;
+        /**
+         * same-origin path the browser lands on after login (default /user/workspaces)
+         */
+        rd?: string;
+        /**
+         * mint only while the account still has this login type (for example pending_oauth), so a link stops working once the owner has set a password or signed in with a provider
+         */
+        require_login_type?: string;
+    };
+};
+export type CreateLoginLinkResponse = {
+    url: string;
+    expires_at: string;
+};
+export type SetCloudTrialOfferData = {
+    requestBody: {
+        email: string;
+        /**
+         * mark the offer used (a trial or subscription now exists) instead of recording it
+         */
+        consumed?: boolean;
+    };
+};
+export type SetCloudTrialOfferResponse = string;
+export type GetCloudTrialOfferResponse = {
+    offered: boolean;
+};
+export type GoCloudTrialOfferResponse = {
+    location: string;
+    /**
+     * present when the portal refused (e.g. the account already has a subscription); the offer is then spent
+     */
+    reason?: string;
+};
+export type SetOnboardingProfileData = {
+    requestBody: {
+        email: string;
+        /**
+         * free-form context from the invite, every key optional. The frontend reads `touch_point` (answers onboarding's source question), `company` and `workspace_name` (prefill the first workspace's name), `hub_projects` (slugs surfaced first on an empty workspace), `tools` (integrations, used to pick hub projects when none are named) and `starter_prompts` (`[{label, prompt}]`, replacing the home page's example prompts); unknown keys are kept and ignored
+         */
+        profile: {
+            [key: string]: unknown;
+        };
+    };
+};
+export type SetOnboardingProfileResponse = string;
+export type GetOnboardingProfileResponse = {
+    profile?: {
+        [key: string]: unknown;
+    } | null;
+};
 export type DeleteTokenData = {
     tokenPrefix: string;
 };
@@ -7937,6 +8202,14 @@ export type GetSessionWorkspaceStatusData = {
 export type GetSessionWorkspaceStatusResponse = {
     [key: string]: ('active' | 'archived' | 'deleted');
 };
+export type GetSessionWorkspaceRetentionData = {
+    requestBody: {
+        workspace_ids: Array<(string)>;
+    };
+};
+export type GetSessionWorkspaceRetentionResponse = {
+    [key: string]: (number);
+};
 export type GetWorkspaceAsSuperAdminData = {
     workspace: string;
 };
@@ -10381,6 +10654,10 @@ export type ListHubIntegrationsResponse = Array<{
      * how often the integration has been picked, absent on a hub that does not count picks
      */
     picks?: number;
+    /**
+     * the label the hub curates for the integration, null or absent where it names none
+     */
+    display_name?: string | null;
 }>;
 export type ListHubFlowsResponse = {
     flows?: Array<{
@@ -10530,6 +10807,11 @@ export type ListFlowPathsFromWorkspaceRunnableData = {
     workspace: string;
 };
 export type ListFlowPathsFromWorkspaceRunnableResponse = Array<(string)>;
+export type ListFlowPathsLinkingAgentData = {
+    path: string;
+    workspace: string;
+};
+export type ListFlowPathsLinkingAgentResponse = Array<(string)>;
 export type GetFlowVersionData = {
     version: number;
     workspace: string;
@@ -14796,6 +15078,110 @@ export type ListAiUsageResponse = {
      */
     truncated: boolean;
 };
+export type ListAiSessionBackupsData = {
+    workspace: string;
+};
+export type ListAiSessionBackupsResponse = {
+    enabled: boolean;
+    /**
+     * names the storage answered from; sync state recorded against another one is void
+     */
+    storage_id?: string;
+    /**
+     * bumped by every workspace key rotation; sync state recorded under another one is void
+     */
+    backup_generation?: number;
+    /**
+     * the storage answered from is the instance object store, standing in for a workspace without storage of its own; a removal owed to it is retired by any answer from the workspace's own storage
+     */
+    fallback?: boolean;
+    /**
+     * the newest 500 at most
+     */
+    sessions: Array<AISessionBackupListing>;
+    /**
+     * the user has more sessions than the answer names
+     */
+    truncated?: boolean;
+};
+export type PullAiSessionBackupsData = {
+    requestBody: {
+        ids: Array<(string)>;
+        resume?: AISessionBackupCursor;
+    };
+    workspace: string;
+};
+export type PullAiSessionBackupsResponse = {
+    enabled: boolean;
+    storage_id?: string;
+    backup_generation?: number;
+    fallback?: boolean;
+    sessions: Array<AISessionBackup>;
+    deferred: Array<(string)>;
+};
+export type PushAiSessionBackupsData = {
+    requestBody: {
+        /**
+         * the email the push was prepared for; refused with a 409 when it is not the caller's
+         */
+        owner: string;
+        sessions?: Array<AISessionBackupPush>;
+        removed?: Array<(string)>;
+    };
+    workspace: string;
+};
+export type PushAiSessionBackupsResponse = {
+    enabled: boolean;
+    storage_id?: string;
+    backup_generation?: number;
+    fallback?: boolean;
+    results: Array<{
+        id: string;
+        error?: string;
+        /**
+         * nothing was written and the session must be pushed whole again; an incremental part found no listed session to ride on (the backup was removed, or a push split over parts is in progress or was abandoned), or a later part of a push split over parts found another push had superseded it
+         */
+        needs_whole?: boolean;
+    }>;
+};
+export type ShareAiArtifactData = {
+    requestBody: {
+        /**
+         * the artifact's id in the author's session
+         */
+        artifact_id: string;
+        name: string;
+        kind: 'md' | 'html';
+        version: number;
+        content: string;
+    };
+    workspace: string;
+};
+export type ShareAiArtifactResponse = SharedAiArtifactInfo;
+export type GetAiArtifactShareStatusData = {
+    artifactId: string;
+    workspace: string;
+};
+export type GetAiArtifactShareStatusResponse = {
+    retention_secs: number;
+    share?: SharedAiArtifactInfo;
+};
+export type GetSharedAiArtifactData = {
+    id: string;
+    workspace: string;
+};
+export type GetSharedAiArtifactResponse = SharedAiArtifactInfo & {
+    content: string;
+    /**
+     * whether the caller authored the share or is a workspace admin
+     */
+    can_unshare: boolean;
+};
+export type UnshareAiArtifactData = {
+    id: string;
+    workspace: string;
+};
+export type UnshareAiArtifactResponse = string;
 export type ResumeSuspendedTriggerJobsData = {
     /**
      * Optional list of job IDs to reassign
@@ -18281,54 +18667,135 @@ export type $OpenApiTs = {
             };
         };
     };
-    '/auth/login': {
-        post: {
+    '/w/{workspace}/trash/list': {
+        get: {
             req: {
                 /**
-                 * credentials
+                 * only return items of this kind: script, flow, app, schedule, variable, resource, or a trigger kind such as http_trigger
+                 *
                  */
-                requestBody: Login;
-            };
-            res: {
+                itemKind?: string;
                 /**
-                 * Successfully authenticated. The session ID is returned in a cookie named `token` and as plaintext response. Preferred method of authorization is through the bearer token. The cookie is only for browser convenience.
-                 *
+                 * which page to return (starts at 0, default 0)
                  */
-                200: string;
+                page?: number;
+                /**
+                 * number of items to return for a given page (default 100, max 1000)
+                 */
+                perPage?: number;
+                workspace: string;
             };
-        };
-    };
-    '/auth/logout': {
-        post: {
             res: {
                 /**
-                 * clear cookies and clear token (if applicable)
+                 * the trashed items, most recently deleted first
                  */
-                200: string;
+                200: Array<TrashItem>;
             };
         };
     };
-    '/auth/is_smtp_configured': {
+    '/w/{workspace}/trash/get/{id}': {
         get: {
+            req: {
+                id: number;
+                workspace: string;
+            };
             res: {
                 /**
-                 * returns true if SMTP is configured
+                 * the trashed item
                  */
-                200: boolean;
+                200: TrashItemWithData;
             };
         };
     };
-    '/auth/is_password_login_disabled': {
-        get: {
+    '/w/{workspace}/trash/restore/{id}': {
+        post: {
+            req: {
+                id: number;
+                workspace: string;
+            };
             res: {
                 /**
-                 * returns true if password login is disabled
+                 * item restored
                  */
-                200: boolean;
+                200: string;
             };
         };
     };
-    '/auth/request_password_reset': {
+    '/w/{workspace}/trash/delete/{id}': {
+        delete: {
+            req: {
+                id: number;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * item permanently deleted
+                 */
+                200: string;
+            };
+        };
+    };
+    '/w/{workspace}/trash/empty': {
+        post: {
+            req: {
+                workspace: string;
+            };
+            res: {
+                /**
+                 * trashbin emptied
+                 */
+                200: string;
+            };
+        };
+    };
+    '/auth/login': {
+        post: {
+            req: {
+                /**
+                 * credentials
+                 */
+                requestBody: Login;
+            };
+            res: {
+                /**
+                 * Successfully authenticated. The session ID is returned in a cookie named `token` and as plaintext response. Preferred method of authorization is through the bearer token. The cookie is only for browser convenience.
+                 *
+                 */
+                200: string;
+            };
+        };
+    };
+    '/auth/logout': {
+        post: {
+            res: {
+                /**
+                 * clear cookies and clear token (if applicable)
+                 */
+                200: string;
+            };
+        };
+    };
+    '/auth/is_smtp_configured': {
+        get: {
+            res: {
+                /**
+                 * returns true if SMTP is configured
+                 */
+                200: boolean;
+            };
+        };
+    };
+    '/auth/is_password_login_disabled': {
+        get: {
+            res: {
+                /**
+                 * returns true if password login is disabled
+                 */
+                200: boolean;
+            };
+        };
+    };
+    '/auth/request_password_reset': {
         post: {
             req: {
                 /**
@@ -18350,6 +18817,20 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/auth/login_link/{token}': {
+        get: {
+            req: {
+                rd?: string;
+                token: string;
+            };
+            res: {
+                /**
+                 * redirected to the post-login destination, or to /user/login_link_expired when the link is used, expired or unknown
+                 */
+                302: unknown;
+            };
+        };
+    };
     '/auth/reset_password': {
         post: {
             req: {
@@ -18483,7 +18964,7 @@ export type $OpenApiTs = {
                  */
                 requestBody: {
                     email: string;
-                    password: string;
+                    password?: string;
                     super_admin: boolean;
                     name?: string;
                     company?: string;
@@ -18491,6 +18972,10 @@ export type $OpenApiTs = {
                      * Skip sending email notifications to the user
                      */
                     skip_email?: boolean;
+                    /**
+                     * password (default, requires `password`), pending_oauth (no credential until the first OAuth login proving the address adopts the account), or a configured OAuth login client key
+                     */
+                    login_type?: string;
                 };
             };
             res: {
@@ -19103,6 +19588,129 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/users/login_links': {
+        post: {
+            req: {
+                /**
+                 * target account and link options
+                 */
+                requestBody: {
+                    email: string;
+                    /**
+                     * link lifetime in seconds, at most 900 (default 600)
+                     */
+                    expires_in_s?: number;
+                    /**
+                     * same-origin path the browser lands on after login (default /user/workspaces)
+                     */
+                    rd?: string;
+                    /**
+                     * mint only while the account still has this login type (for example pending_oauth), so a link stops working once the owner has set a password or signed in with a provider
+                     */
+                    require_login_type?: string;
+                };
+            };
+            res: {
+                /**
+                 * login link minted
+                 */
+                201: {
+                    url: string;
+                    expires_at: string;
+                };
+                /**
+                 * the account does not have the required login type
+                 */
+                409: unknown;
+            };
+        };
+    };
+    '/users/cloud_trial_offer': {
+        post: {
+            req: {
+                requestBody: {
+                    email: string;
+                    /**
+                     * mark the offer used (a trial or subscription now exists) instead of recording it
+                     */
+                    consumed?: boolean;
+                };
+            };
+            res: {
+                /**
+                 * offer recorded or consumed
+                 */
+                200: string;
+            };
+        };
+        get: {
+            res: {
+                /**
+                 * offer state
+                 */
+                200: {
+                    offered: boolean;
+                };
+            };
+        };
+    };
+    '/users/cloud_trial_offer/go': {
+        post: {
+            res: {
+                /**
+                 * where to go — the customer portal signed in with the trial being started, or the portal home with the reason the offer could not be used
+                 */
+                200: {
+                    location: string;
+                    /**
+                     * present when the portal refused (e.g. the account already has a subscription); the offer is then spent
+                     */
+                    reason?: string;
+                };
+                /**
+                 * called with a job token
+                 */
+                403: unknown;
+                /**
+                 * no offer for this account
+                 */
+                404: unknown;
+            };
+        };
+    };
+    '/users/onboarding_profile': {
+        post: {
+            req: {
+                requestBody: {
+                    email: string;
+                    /**
+                     * free-form context from the invite, every key optional. The frontend reads `touch_point` (answers onboarding's source question), `company` and `workspace_name` (prefill the first workspace's name), `hub_projects` (slugs surfaced first on an empty workspace), `tools` (integrations, used to pick hub projects when none are named) and `starter_prompts` (`[{label, prompt}]`, replacing the home page's example prompts); unknown keys are kept and ignored
+                     */
+                    profile: {
+                        [key: string]: unknown;
+                    };
+                };
+            };
+            res: {
+                /**
+                 * profile recorded
+                 */
+                200: string;
+            };
+        };
+        get: {
+            res: {
+                /**
+                 * the profile, or null when none was recorded
+                 */
+                200: {
+                    profile?: {
+                        [key: string]: unknown;
+                    } | null;
+                };
+            };
+        };
+    };
     '/users/tokens/delete/{token_prefix}': {
         delete: {
             req: {
@@ -19485,6 +20093,23 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/workspaces/session_workspace_retention': {
+        post: {
+            req: {
+                requestBody: {
+                    workspace_ids: Array<(string)>;
+                };
+            };
+            res: {
+                /**
+                 * map of workspace id to its `ai_config.sessions_retention_days`; a workspace without a retention, or one the caller cannot be authenticated into, is absent
+                 */
+                200: {
+                    [key: string]: (number);
+                };
+            };
+        };
+    };
     '/w/{workspace}/workspaces/get_as_superadmin': {
         get: {
             req: {
@@ -24135,6 +24760,10 @@ export type $OpenApiTs = {
                      * how often the integration has been picked, absent on a hub that does not count picks
                      */
                     picks?: number;
+                    /**
+                     * the label the hub curates for the integration, null or absent where it names none
+                     */
+                    display_name?: string | null;
                 }>;
             };
         };
@@ -24359,6 +24988,20 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/flows/list_paths_linking_agent/{path}': {
+        get: {
+            req: {
+                path: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * paths of the flows linking the `ai_agent` resource, as of their last deploy
+                 */
+                200: Array<(string)>;
+            };
+        };
+    };
     '/w/{workspace}/flows/get/v/{version}': {
         get: {
             req: {
@@ -30734,6 +31377,173 @@ export type $OpenApiTs = {
             };
         };
     };
+    '/w/{workspace}/ai/sessions/list': {
+        get: {
+            req: {
+                workspace: string;
+            };
+            res: {
+                /**
+                 * backups, newest first; `enabled` is false when the workspace has no storage for them
+                 */
+                200: {
+                    enabled: boolean;
+                    /**
+                     * names the storage answered from; sync state recorded against another one is void
+                     */
+                    storage_id?: string;
+                    /**
+                     * bumped by every workspace key rotation; sync state recorded under another one is void
+                     */
+                    backup_generation?: number;
+                    /**
+                     * the storage answered from is the instance object store, standing in for a workspace without storage of its own; a removal owed to it is retired by any answer from the workspace's own storage
+                     */
+                    fallback?: boolean;
+                    /**
+                     * the newest 500 at most
+                     */
+                    sessions: Array<AISessionBackupListing>;
+                    /**
+                     * the user has more sessions than the answer names
+                     */
+                    truncated?: boolean;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/sessions/pull': {
+        post: {
+            req: {
+                requestBody: {
+                    ids: Array<(string)>;
+                    resume?: AISessionBackupCursor;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the backups found; `deferred` lists ids that did not fit the response budget
+                 */
+                200: {
+                    enabled: boolean;
+                    storage_id?: string;
+                    backup_generation?: number;
+                    fallback?: boolean;
+                    sessions: Array<AISessionBackup>;
+                    deferred: Array<(string)>;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/sessions/push': {
+        post: {
+            req: {
+                requestBody: {
+                    /**
+                     * the email the push was prepared for; refused with a 409 when it is not the caller's
+                     */
+                    owner: string;
+                    sessions?: Array<AISessionBackupPush>;
+                    removed?: Array<(string)>;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * one result per session written or removed, in request order
+                 */
+                200: {
+                    enabled: boolean;
+                    storage_id?: string;
+                    backup_generation?: number;
+                    fallback?: boolean;
+                    results: Array<{
+                        id: string;
+                        error?: string;
+                        /**
+                         * nothing was written and the session must be pushed whole again; an incremental part found no listed session to ride on (the backup was removed, or a push split over parts is in progress or was abandoned), or a later part of a push split over parts found another push had superseded it
+                         */
+                        needs_whole?: boolean;
+                    }>;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/share': {
+        post: {
+            req: {
+                requestBody: {
+                    /**
+                     * the artifact's id in the author's session
+                     */
+                    artifact_id: string;
+                    name: string;
+                    kind: 'md' | 'html';
+                    version: number;
+                    content: string;
+                };
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the shared copy
+                 */
+                200: SharedAiArtifactInfo;
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/status': {
+        get: {
+            req: {
+                artifactId: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the live share, if any, and how long shares last
+                 */
+                200: {
+                    retention_secs: number;
+                    share?: SharedAiArtifactInfo;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/get/{id}': {
+        get: {
+            req: {
+                id: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * the shared artifact
+                 */
+                200: SharedAiArtifactInfo & {
+                    content: string;
+                    /**
+                     * whether the caller authored the share or is a workspace admin
+                     */
+                    can_unshare: boolean;
+                };
+            };
+        };
+    };
+    '/w/{workspace}/ai/shared_artifacts/delete/{id}': {
+        delete: {
+            req: {
+                id: string;
+                workspace: string;
+            };
+            res: {
+                /**
+                 * share deleted
+                 */
+                200: string;
+            };
+        };
+    };
     '/w/{workspace}/trigger/{trigger_kind}/resume_suspended_trigger_jobs/{trigger_path}': {
         post: {
             req: {