pgbeam 0.3.12 → 0.3.13

package/dist/operations.mjs

@@ -180,6 +180,33 @@
         "responseType": "{ connection_string: string; credential: { auth_method?: \"cleartext\" | \"scram-sha-256\"; created_at: string; expires_at?: string; id: string; last_used_at?: string; name: string; pg_username: string; policy_profile_id: string; principal_type?: \"agent\" | \"human\"; project_id: string; status: \"active\" | \"disabled\" | \"revoked\"; updated_at: string }; mcp_token: string; mcp_url: string }",
         "responseStatus": "200"
     },
+    "recommendAgentPolicy": {
+        "operationId": "recommendAgentPolicy",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/agents/{agent_id}/policy-recommendation",
+        "summary": "Recommend a least-privilege policy from recorded traffic",
+        "description": "Derives the tightest policy that would still pass every statement this agent credential has legitimately run, using its recorded audit history over a lookback window (default 30 days). The candidate's table allowlist is the union of relations actually referenced, its statement-kind allow set is the observed set, it downgrades to read-only when no writes were seen, and its max_rows ceiling comes from an observed high-percentile row count. The candidate is proven safe by replaying it through the data plane's own policy engine against the same history: a good recommendation has replay.summary.newly_blocked == 0. This endpoint is advisory only. It reads the audit log, never connects to the upstream database, and never creates, updates, or mutates any policy or credential; the operator loads the candidate into the editor and saves it themselves.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "agent_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique agent credential identifier (prefixed, e.g. agt_xxx)."
+            }
+        ],
+        "requestBodyType": "{ limit?: number; lookback_days?: number }",
+        "requestBodyRequired": false,
+        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
+        "responseStatus": "200"
+    },
     "listAnomalyAlerts": {
         "operationId": "listAnomalyAlerts",
         "method": "GET",
@@ -1086,6 +1113,141 @@
         "responseType": "{ image_sha: string; status: \"ok\" | \"degraded\"; timestamp?: string; version: string }",
         "responseStatus": "200"
     },
+    "listHoneytokens": {
+        "operationId": "listHoneytokens",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/honeytokens",
+        "summary": "List honeytokens",
+        "description": "Lists the project's honeytokens.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ honeytokens: ({ action: \"audit_only\" | \"kill\"; created_at: string; id: string; project_id: string; relation_name: string; schema_name?: string; updated_at: string })[]; next_page_token?: string }",
+        "responseStatus": "200"
+    },
+    "createHoneytoken": {
+        "operationId": "createHoneytoken",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/honeytokens",
+        "summary": "Register a honeytoken",
+        "description": "Registers a decoy (canary) relation for the project. Any agent statement\nthat references it is blocked and recorded as a canary_tripped audit event.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            }
+        ],
+        "requestBodyType": "{ action: \"audit_only\" | \"kill\"; relation_name: string; schema_name?: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ action: \"audit_only\" | \"kill\"; created_at: string; id: string; project_id: string; relation_name: string; schema_name?: string; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getHoneytoken": {
+        "operationId": "getHoneytoken",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/honeytokens/{honeytoken_id}",
+        "summary": "Get a honeytoken",
+        "description": "Returns a single honeytoken by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "honeytoken_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique honeytoken identifier (prefixed, e.g. hnt_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ action: \"audit_only\" | \"kill\"; created_at: string; id: string; project_id: string; relation_name: string; schema_name?: string; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateHoneytoken": {
+        "operationId": "updateHoneytoken",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/honeytokens/{honeytoken_id}",
+        "summary": "Update a honeytoken",
+        "description": "Updates a honeytoken's relation or action.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "honeytoken_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique honeytoken identifier (prefixed, e.g. hnt_xxx)."
+            }
+        ],
+        "requestBodyType": "{ action: \"audit_only\" | \"kill\"; relation_name: string; schema_name?: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ action: \"audit_only\" | \"kill\"; created_at: string; id: string; project_id: string; relation_name: string; schema_name?: string; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteHoneytoken": {
+        "operationId": "deleteHoneytoken",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/honeytokens/{honeytoken_id}",
+        "summary": "Delete a honeytoken",
+        "description": "Removes a honeytoken from the project.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "honeytoken_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique honeytoken identifier (prefixed, e.g. hnt_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "getProjectInsights": {
         "operationId": "getProjectInsights",
         "method": "GET",
@@ -2140,6 +2302,40 @@
             path: "/v1/projects/{project_id}/audit-logs/verify"
         }
     },
+    policies: {
+        recommendAgentPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/agents/{agent_id}/policy-recommendation"
+        },
+        listPolicyProfiles: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/policies"
+        },
+        createPolicyProfile: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policies"
+        },
+        getPolicyProfile: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/policies/{policy_id}"
+        },
+        updatePolicyProfile: {
+            method: "PUT",
+            path: "/v1/projects/{project_id}/policies/{policy_id}"
+        },
+        deletePolicyProfile: {
+            method: "DELETE",
+            path: "/v1/projects/{project_id}/policies/{policy_id}"
+        },
+        dryEvalPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-evaluations"
+        },
+        replayPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-replays"
+        }
+    },
     anomalies: {
         listAnomalyAlerts: {
             method: "GET",
@@ -2330,40 +2526,32 @@
             path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}/rotate"
         }
     },
-    migrations: {
-        lintMigration: {
-            method: "POST",
-            path: "/v1/projects/{project_id}/migrations:lint"
-        }
-    },
-    policies: {
-        listPolicyProfiles: {
+    honeytokens: {
+        listHoneytokens: {
             method: "GET",
-            path: "/v1/projects/{project_id}/policies"
+            path: "/v1/projects/{project_id}/honeytokens"
         },
-        createPolicyProfile: {
+        createHoneytoken: {
             method: "POST",
-            path: "/v1/projects/{project_id}/policies"
+            path: "/v1/projects/{project_id}/honeytokens"
         },
-        getPolicyProfile: {
+        getHoneytoken: {
             method: "GET",
-            path: "/v1/projects/{project_id}/policies/{policy_id}"
+            path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}"
         },
-        updatePolicyProfile: {
+        updateHoneytoken: {
             method: "PUT",
-            path: "/v1/projects/{project_id}/policies/{policy_id}"
+            path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}"
         },
-        deletePolicyProfile: {
+        deleteHoneytoken: {
             method: "DELETE",
-            path: "/v1/projects/{project_id}/policies/{policy_id}"
-        },
-        dryEvalPolicy: {
-            method: "POST",
-            path: "/v1/projects/{project_id}/policy-evaluations"
-        },
-        replayPolicy: {
+            path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}"
+        }
+    },
+    migrations: {
+        lintMigration: {
             method: "POST",
-            path: "/v1/projects/{project_id}/policy-replays"
+            path: "/v1/projects/{project_id}/migrations:lint"
         }
     },
     support: {
@@ -2457,6 +2645,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/agents/{agent_id}/rotate",
         operationId: "rotateAgentCredential"
     },
+    "POST /v1/projects/{project_id}/agents/{agent_id}/policy-recommendation": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/agents/{agent_id}/policy-recommendation",
+        operationId: "recommendAgentPolicy"
+    },
     "GET /v1/projects/{project_id}/anomalies": {
         method: "GET",
         path: "/v1/projects/{project_id}/anomalies",
@@ -2607,6 +2800,31 @@ const operationsByPath = {
         path: "/v1/health",
         operationId: "getHealth"
     },
+    "GET /v1/projects/{project_id}/honeytokens": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/honeytokens",
+        operationId: "listHoneytokens"
+    },
+    "POST /v1/projects/{project_id}/honeytokens": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/honeytokens",
+        operationId: "createHoneytoken"
+    },
+    "GET /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}",
+        operationId: "getHoneytoken"
+    },
+    "PUT /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        method: "PUT",
+        path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}",
+        operationId: "updateHoneytoken"
+    },
+    "DELETE /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        method: "DELETE",
+        path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}",
+        operationId: "deleteHoneytoken"
+    },
     "GET /v1/projects/{project_id}/insights": {
         method: "GET",
         path: "/v1/projects/{project_id}/insights",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.3.12",
+  "version": "0.3.13",
   "description": "TypeScript SDK for the PgBeam API — globally distributed PostgreSQL proxy platform",
   "type": "module",
   "exports": {