windmill-client 1.814.0 → 1.816.0

package/dist/core/OpenAPI.mjs

@@ -29,7 +29,7 @@ const OpenAPI = {
 	PASSWORD: void 0,
 	TOKEN: getEnv("WM_TOKEN"),
 	USERNAME: void 0,
-	VERSION: "1.814.0",
+	VERSION: "1.816.0",
 	WITH_CREDENTIALS: !getEnv("WM_RAW_APP"),
 	interceptors: {
 		request: new Interceptors(),

package/dist/index.js

@@ -126,7 +126,7 @@ const OpenAPI = {
 	PASSWORD: void 0,
 	TOKEN: getEnv$1("WM_TOKEN"),
 	USERNAME: void 0,
-	VERSION: "1.814.0",
+	VERSION: "1.816.0",
 	WITH_CREDENTIALS: !getEnv$1("WM_RAW_APP"),
 	interceptors: {
 		request: new Interceptors(),
@@ -3102,6 +3102,131 @@ var WorkspaceService = class {
 		});
 	}
 	/**
+	* get who may connect to a data table as which role
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @returns DatatablePermissions the data table's roles and their tenants
+	* @throws ApiError
+	*/
+	static getDatatablePermissions(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/workspaces/datatable_permissions/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			}
+		});
+	}
+	/**
+	* set who may connect to a data table as which role
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.requestBody
+	* @returns string status
+	* @throws ApiError
+	*/
+	static setDatatablePermissions(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/datatable_permissions/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* read the owner and grants of an instance data table's database, schema or table
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.kind
+	* @param data.schema
+	* @param data.table
+	* @returns DatatableAclInfo owner and grants
+	* @throws ApiError
+	*/
+	static getDatatableAcl(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/workspaces/datatable_acl/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			query: {
+				kind: data.kind,
+				schema: data.schema,
+				table: data.table
+			}
+		});
+	}
+	/**
+	* preview the SQL an ownership or grant change would run (data table administrators only)
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.requestBody
+	* @returns AclPlan statements that would run, in a single transaction
+	* @throws ApiError
+	*/
+	static planDatatableAcl(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/datatable_acl/{datatable_name}/plan",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* run an ownership or grant change exactly as planned (data table administrators only)
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @param data.requestBody
+	* @returns string change applied
+	* @throws ApiError
+	*/
+	static applyDatatableAcl(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/datatable_acl/{datatable_name}/apply",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* list the data table roles the caller may connect as
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.datatableName
+	* @returns unknown usable roles
+	* @throws ApiError
+	*/
+	static listUsableDatatableRoles(data) {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/w/{workspace}/workspaces/datatable_usable_roles/{datatable_name}",
+			path: {
+				workspace: data.workspace,
+				datatable_name: data.datatableName
+			}
+		});
+	}
+	/**
 	* list schemas of all connected Datatables
 	* @param data The data for the request.
 	* @param data.workspace
@@ -3137,6 +3262,9 @@ var WorkspaceService = class {
 	* list tables of all connected Datatables
 	* @param data The data for the request.
 	* @param data.workspace
+	* @param data.datatableName list only this data table; each listed data table opens a connection to its database
+	* @param data.roleFor the data table `role` applies to; every other one is listed as its default role
+	* @param data.role the role to list `role_for` as; refused, in that entry's `error`, if the caller may not use it
 	* @returns DataTableTables table metadata of all datatables
 	* @throws ApiError
 	*/
@@ -3144,7 +3272,12 @@ var WorkspaceService = class {
 		return request(OpenAPI, {
 			method: "GET",
 			url: "/w/{workspace}/workspaces/list_datatable_tables",
-			path: { workspace: data.workspace }
+			path: { workspace: data.workspace },
+			query: {
+				datatable_name: data.datatableName,
+				role_for: data.roleFor,
+				role: data.role
+			}
 		});
 	}
 	/**
@@ -3154,6 +3287,7 @@ var WorkspaceService = class {
 	* @param data.datatableName
 	* @param data.schemaName
 	* @param data.tableName
+	* @param data.role the data table role to read the table as; defaults to the data table's default role
 	* @returns DataTableTableSchema schema of one datatable table
 	* @throws ApiError
 	*/
@@ -3165,7 +3299,8 @@ var WorkspaceService = class {
 			query: {
 				datatable_name: data.datatableName,
 				schema_name: data.schemaName,
-				table_name: data.tableName
+				table_name: data.tableName,
+				role: data.role
 			}
 		});
 	}
@@ -3628,6 +3763,24 @@ var WorkspaceService = class {
 		});
 	}
 	/**
+	* choose whether new forks of this workspace start with its admins and developers
+	* When on, every fork created from this workspace gets the workspace's admins and developers as members, with the role they hold here; operators, disabled users and service accounts are left out. The setting is copied into each fork, so forks of a fork follow it too. Off by default. Workspace-admin gated.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.requestBody Whether new forks start with this workspace's admins and developers
+	* @returns string status
+	* @throws ApiError
+	*/
+	static editAddAdminsAndDevelopersToForks(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/workspaces/edit_add_admins_and_developers_to_forks",
+			path: { workspace: data.workspace },
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
 	* set the key guest JWTs are verified against for this workspace
 	* A guest JWT (`jwt_guest_`) is minted by the embedding customer's own backend and verified against this key: a PEM public key (RS/ES family, HS* refused) or a JWKS URL, at most one. Both empty clears the workspace key; off cloud, verification then falls back to the instance issuer (`JWT_EXT_JWKS_URL`) if one is set, else no guest JWT is accepted (`guest_access_enabled` is the on/off switch). Workspace-admin gated. The key is validated before it is stored. Setting a key is refused with a 400 where guests are unavailable (the shared cloud); clearing one always works.
 	* @param data The data for the request.
@@ -4146,6 +4299,63 @@ var SettingService = class {
 		});
 	}
 	/**
+	* list the instance's data table roles
+	* @returns InstanceDatatableRole the instance role catalog
+	* @throws ApiError
+	*/
+	static listInstanceDatatableRoles() {
+		return request(OpenAPI, {
+			method: "GET",
+			url: "/settings/datatable_roles"
+		});
+	}
+	/**
+	* create a data table role on the instance's Postgres cluster
+	* @param data The data for the request.
+	* @param data.requestBody
+	* @returns InstanceDatatableRole the created role
+	* @throws ApiError
+	*/
+	static createInstanceDatatableRole(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/settings/datatable_roles",
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* rename a data table role or turn its login on and off
+	* @param data The data for the request.
+	* @param data.id
+	* @param data.requestBody
+	* @returns InstanceDatatableRole the updated role
+	* @throws ApiError
+	*/
+	static updateInstanceDatatableRole(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/settings/datatable_roles/{id}",
+			path: { id: data.id },
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
+	* drop a data table role from the cluster and from every workspace that named it
+	* @param data The data for the request.
+	* @param data.id
+	* @returns unknown deleted
+	* @throws ApiError
+	*/
+	static deleteInstanceDatatableRole(data) {
+		return request(OpenAPI, {
+			method: "DELETE",
+			url: "/settings/datatable_roles/{id}",
+			path: { id: data.id }
+		});
+	}
+	/**
 	* Runs CREATE DATABASE on the Windmill Postgres and grants access to the custom_instance_user
 	* @param data The data for the request.
 	* @param data.name The name of the database to create
@@ -6251,6 +6461,8 @@ var FlowService = class {
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
+	* @param data.page which page to return (start at 1, default 1)
+	* @param data.perPage number of items to return for a given page (default 30, max 100)
 	* @returns FlowVersion Flow history
 	* @throws ApiError
 	*/
@@ -6261,6 +6473,10 @@ var FlowService = class {
 			path: {
 				workspace: data.workspace,
 				path: data.path
+			},
+			query: {
+				page: data.page,
+				per_page: data.perPage
 			}
 		});
 	}
@@ -6860,6 +7076,8 @@ var AppService = class {
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
+	* @param data.page which page to return (start at 1, default 1)
+	* @param data.perPage number of items to return for a given page (default 30, max 100)
 	* @returns AppHistory app history
 	* @throws ApiError
 	*/
@@ -6870,6 +7088,10 @@ var AppService = class {
 			path: {
 				workspace: data.workspace,
 				path: data.path
+			},
+			query: {
+				page: data.page,
+				per_page: data.perPage
 			}
 		});
 	}
@@ -7088,7 +7310,7 @@ var AppService = class {
 	* @param data.workspace
 	* @param data.path
 	* @param data.requestBody update app
-	* @returns string app updated
+	* @returns AppDeployed app updated
 	* @throws ApiError
 	*/
 	static updateApp(data) {
@@ -7126,7 +7348,7 @@ var AppService = class {
 	* @param data.workspace
 	* @param data.path
 	* @param data.requestBody raw app sources to bundle and deploy
-	* @returns string app updated
+	* @returns AppDeployed app updated
 	* @throws ApiError
 	*/
 	static updateAppRawSource(data) {
@@ -7147,7 +7369,7 @@ var AppService = class {
 	* @param data.workspace
 	* @param data.path
 	* @param data.formData update app
-	* @returns string app updated
+	* @returns AppDeployed app updated
 	* @throws ApiError
 	*/
 	static updateAppRaw(data) {
@@ -7907,6 +8129,8 @@ var ScriptService = class {
 	* @param data The data for the request.
 	* @param data.workspace
 	* @param data.path
+	* @param data.page which page to return (start at 1, default 1)
+	* @param data.perPage number of items to return for a given page (default 30, max 100)
 	* @returns ScriptHistory script history
 	* @throws ApiError
 	*/
@@ -7917,6 +8141,10 @@ var ScriptService = class {
 			path: {
 				workspace: data.workspace,
 				path: data.path
+			},
+			query: {
+				page: data.page,
+				per_page: data.perPage
 			}
 		});
 	}
@@ -8353,6 +8581,30 @@ var DraftService = class {
 		});
 	}
 	/**
+	* move the current user's draft-only item to another path
+	* Relocates the authed user's own draft row, along with both path keys inside its value (the typed path and the mirror the editors keep beside it). Only for draft-only items — a deployed item must be moved through its own deploy endpoint, which carries every draft with it. Restricted to script, flow, app and raw_app; any other kind is rejected with 400, because only these keep their deploy target where this endpoint rewrites it.
+	* @param data The data for the request.
+	* @param data.workspace
+	* @param data.kind script, flow, app or raw_app only.
+	* @param data.path
+	* @param data.requestBody
+	* @returns string move result
+	* @throws ApiError
+	*/
+	static moveDraft(data) {
+		return request(OpenAPI, {
+			method: "POST",
+			url: "/w/{workspace}/drafts/move/{kind}/{path}",
+			path: {
+				workspace: data.workspace,
+				kind: data.kind,
+				path: data.path
+			},
+			body: data.requestBody,
+			mediaType: "application/json"
+		});
+	}
+	/**
 	* resolve a legacy (workspace-level) draft (admin only)
 	* Delete a legacy draft (email NULL) or assign it to the authed admin as a per-user draft. Workspace admins / superadmins only.
 	* @param data The data for the request.
@@ -18216,11 +18468,14 @@ var RawSql = class {
 		this.value = value;
 	}
 };
-function datatableProvider(name, schema) {
+const ROLE_NAME_RE = /^[A-Za-z0-9_-]{1,63}$/;
+function datatableProvider(name, schema, role) {
+	if (role !== void 0 && !ROLE_NAME_RE.test(role)) throw new Error(`Invalid data table role '${role}': only letters, digits, '_' and '-' are allowed`);
 	return {
 		providerName: "datatable",
 		language: "postgresql",
 		extraArgs: { database: `datatable://${name}` },
+		annotations: () => role !== void 0 ? `-- role ${role}\n` : "",
 		formatArgDecl: (argNum) => `-- $${argNum} arg${argNum}`,
 		formatArgUsage: (argNum, explicitType, inferredType) => explicitType !== void 0 ? `$${argNum}` : `$${argNum}::${inferredType}`,
 		preamble: () => schema ? `SET search_path TO "${schema}";\n` : ""
@@ -18231,6 +18486,7 @@ function ducklakeProvider(name, schema) {
 		providerName: "ducklake",
 		language: "duckdb",
 		extraArgs: {},
+		annotations: () => "",
 		formatArgDecl: (argNum, argType) => `-- $arg${argNum} (${argType})`,
 		formatArgUsage: (argNum) => `$arg${argNum}`,
 		preamble: () => `ATTACH 'ducklake://${name}' AS dl;USE dl${schema ? `."${schema}"` : ""};\n`
@@ -18318,7 +18574,8 @@ function buildSqlTemplateFunction(provider) {
 			let argType = parseTypeAnnotation(strings[info.originalIndex], strings[info.originalIndex + 1]) || inferSqlType(info.value);
 			return provider.formatArgDecl(info.argNum, argType);
 		});
-		let content = argDecls.length ? argDecls.join("\n") + "\n" : "";
+		let content = provider.annotations();
+		content += argDecls.length ? argDecls.join("\n") + "\n" : "";
 		content += provider.preamble();
 		let contentBody = "";
 		for (let i = 0; i < strings.length; i++) {
@@ -18346,6 +18603,8 @@ function buildSqlTemplateFunction(provider) {
 /**
 * Create a SQL template function for PostgreSQL/datatable queries
 * @param name - Database/datatable name (default: "main")
+* @param opts.role - Connect as this data table role instead of the data table's default one.
+*   Only meaningful on a data table under roles, and only for a role you are a tenant of.
 * @returns SQL template function for building parameterized queries
 * @example
 * let sql = wmill.datatable()
@@ -18355,15 +18614,18 @@ function buildSqlTemplateFunction(provider) {
 *   SELECT * FROM friends
 *     WHERE name = ${name} AND age = ${age}::int
 * `.fetch()
+* @example
+* // Read through a restricted role
+* let sql = wmill.datatable("main", { role: "analytics" })
 */
-function datatable(name = "main") {
+function datatable(name = "main", opts) {
 	let { name: n, schema } = parseName(name);
-	let provider = datatableProvider(n, schema);
+	let provider = datatableProvider(n, schema, opts?.role);
 	let sqlFn = buildSqlTemplateFunction(provider);
 	sqlFn.query = (sqlString, ...params) => {
 		let argDecls = params.map((v, i) => `-- $${i + 1} arg${i + 1} (${inferSqlType(v)})`).join("\n");
 		let contentBody = sqlString;
-		let content = (argDecls ? argDecls + "\n" : "") + provider.preamble() + sqlString;
+		let content = provider.annotations() + (argDecls ? argDecls + "\n" : "") + provider.preamble() + sqlString;
 		let args = {
 			...Object.fromEntries(params.map((v, i) => [`arg${i + 1}`, serializeArgValue(v)])),
 			...provider.extraArgs