pgbeam 0.3.8 → 0.3.10

package/dist/index.mjs

@@ -48,6 +48,10 @@
         exportAuditLogs: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
+        },
+        verifyAuditChain: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/verify"
         }
     },
     anomalies: {
@@ -266,6 +270,10 @@
         dryEvalPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-evaluations"
+        },
+        replayPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-replays"
         }
     },
     support: {
@@ -394,6 +402,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/verify",
+        operationId: "verifyAuditChain"
+    },
     "GET /v1/plans": {
         method: "GET",
         path: "/v1/plans",
@@ -554,6 +567,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/policy-evaluations",
         operationId: "dryEvalPolicy"
     },
+    "POST /v1/projects/{project_id}/policy-replays": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/policy-replays",
+        operationId: "replayPolicy"
+    },
     "GET /v1/projects": {
         method: "GET",
         path: "/v1/projects",

package/dist/operations.cjs

@@ -288,7 +288,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ approvals: ({ credential_id?: string; decided_at?: string; decided_by?: string; expires_at: string; id: string; normalized_sql?: string; policy_profile_id: string; project_id: string; reason?: string; region?: string; requested_at: string; session_id?: string; sql: string; statement_kind?: string; status: \"pending\" | \"approved\" | \"rejected\" | \"expired\" | \"executed\" | \"failed\" })[]; next_page_token?: string }",
+        "responseType": "{ approvals: ({ credential_id?: string; decided_at?: string; decided_by?: string; estimated_rows?: number; expires_at: string; id: string; normalized_sql?: string; policy_profile_id: string; project_id: string; reason?: string; region?: string; requested_at: string; session_id?: string; sql: string; statement_kind?: string; status: \"pending\" | \"approved\" | \"rejected\" | \"expired\" | \"executed\" | \"failed\"; target_tables?: string[] })[]; next_page_token?: string }",
         "responseStatus": "200"
     },
     "approveApprovalRequest": {
@@ -315,7 +315,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "{ reason?: string }",
         "requestBodyRequired": false,
-        "responseType": "{ credential_id?: string; decided_at?: string; decided_by?: string; expires_at: string; id: string; normalized_sql?: string; policy_profile_id: string; project_id: string; reason?: string; region?: string; requested_at: string; session_id?: string; sql: string; statement_kind?: string; status: \"pending\" | \"approved\" | \"rejected\" | \"expired\" | \"executed\" | \"failed\" }",
+        "responseType": "{ credential_id?: string; decided_at?: string; decided_by?: string; estimated_rows?: number; expires_at: string; id: string; normalized_sql?: string; policy_profile_id: string; project_id: string; reason?: string; region?: string; requested_at: string; session_id?: string; sql: string; statement_kind?: string; status: \"pending\" | \"approved\" | \"rejected\" | \"expired\" | \"executed\" | \"failed\"; target_tables?: string[] }",
         "responseStatus": "200"
     },
     "rejectApprovalRequest": {
@@ -342,7 +342,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "{ reason?: string }",
         "requestBodyRequired": false,
-        "responseType": "{ credential_id?: string; decided_at?: string; decided_by?: string; expires_at: string; id: string; normalized_sql?: string; policy_profile_id: string; project_id: string; reason?: string; region?: string; requested_at: string; session_id?: string; sql: string; statement_kind?: string; status: \"pending\" | \"approved\" | \"rejected\" | \"expired\" | \"executed\" | \"failed\" }",
+        "responseType": "{ credential_id?: string; decided_at?: string; decided_by?: string; estimated_rows?: number; expires_at: string; id: string; normalized_sql?: string; policy_profile_id: string; project_id: string; reason?: string; region?: string; requested_at: string; session_id?: string; sql: string; statement_kind?: string; status: \"pending\" | \"approved\" | \"rejected\" | \"expired\" | \"executed\" | \"failed\"; target_tables?: string[] }",
         "responseStatus": "200"
     },
     "listAuditLogs": {
@@ -384,8 +384,8 @@ Object.defineProperty(exports, '__esModule', { value: true });
                 "name": "source",
                 "in": "query",
                 "required": false,
-                "type": "\"wire\" | \"mcp\" | \"control\"",
-                "description": "Filter by statement origin (wire, mcp, or control)."
+                "type": "\"wire\" | \"mcp\" | \"rest\" | \"control\"",
+                "description": "Filter by statement origin (wire, mcp, rest, or control)."
             },
             {
                 "name": "start",
@@ -418,7 +418,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ entries: ({ bytes_out?: number; cache_status?: string; client_ip?: string; credential_id?: string; decision_rule?: string; event: string; id: string; latency_ms?: number; normalized_sql?: string; project_id: string; query_hash?: string; reason?: string; region?: string; rows_returned?: number; session_id?: string; source?: string; sql?: string; statement_kind?: string; ts: string })[]; next_page_token?: string }",
+        "responseType": "{ entries: ({ bytes_out?: number; cache_status?: string; client_ip?: string; credential_id?: string; decision_rule?: string; entry_hash?: string; event: string; id: string; latency_ms?: number; normalized_sql?: string; prev_hash?: string; project_id: string; query_hash?: string; reason?: string; region?: string; rows_returned?: number; seq?: number; session_id?: string; source?: string; sql?: string; statement_kind?: string; ts: string })[]; next_page_token?: string }",
         "responseStatus": "200"
     },
     "exportAuditLogs": {
@@ -460,8 +460,8 @@ Object.defineProperty(exports, '__esModule', { value: true });
                 "name": "source",
                 "in": "query",
                 "required": false,
-                "type": "\"wire\" | \"mcp\" | \"control\"",
-                "description": "Filter by statement origin (wire, mcp, or control)."
+                "type": "\"wire\" | \"mcp\" | \"rest\" | \"control\"",
+                "description": "Filter by statement origin (wire, mcp, rest, or control)."
             },
             {
                 "name": "start",
@@ -483,6 +483,40 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "responseType": "",
         "responseStatus": "200"
     },
+    "verifyAuditChain": {
+        "operationId": "verifyAuditChain",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/audit-logs/verify",
+        "summary": "Verify the tamper-evident audit chain",
+        "description": "Recomputes the project's audit hash chain over an optional time range and reports whether it is intact. Each audit entry is linked to its predecessor with a SHA-256 hash, so editing or deleting any row breaks the chain. On a break, the response reports the first sequence number where a tampered or deleted entry was detected. Requires the same audit:read permission as the list and export endpoints.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "start",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Return entries at or after this timestamp (inclusive lower bound)."
+            },
+            {
+                "name": "end",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Return entries strictly older than this timestamp (cursor / upper bound)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ chain_end_seq?: number; chain_start_seq?: number; failure_reason?: string; first_broken_seq?: number; ok: boolean; unchained_count: number; verified_at: string; verified_count: number }",
+        "responseStatus": "200"
+    },
     "listPlans": {
         "operationId": "listPlans",
         "method": "GET",
@@ -1303,6 +1337,26 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
+    "replayPolicy": {
+        "operationId": "replayPolicy",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/policy-replays",
+        "summary": "Replay recorded agent traffic against a policy",
+        "description": "Replays the project's recorded agent audit traffic against a candidate policy (either a draft supplied inline or an existing policy referenced by id) and reports what would change: which queries that ran would now be blocked, which blocked queries would now be permitted, and which results would be masked or row-filtered. Traffic is deduplicated by normalized query shape, newest first, and every statement is evaluated through the data plane's own policy engine, so the verdicts match real enforcement. Stateful checks (budgets, approvals, write-mode routing) are reported as informational notes on each result, not verdicts. This endpoint reads only the audit log; it never connects to the upstream database and persists nothing.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseStatus": "200"
+    },
     "listProjects": {
         "operationId": "listProjects",
         "method": "GET",
@@ -2039,6 +2093,10 @@ Object.defineProperty(exports, '__esModule', { value: true });
         exportAuditLogs: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
+        },
+        verifyAuditChain: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/verify"
         }
     },
     anomalies: {
@@ -2257,6 +2315,10 @@ Object.defineProperty(exports, '__esModule', { value: true });
         dryEvalPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-evaluations"
+        },
+        replayPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-replays"
         }
     },
     support: {
@@ -2385,6 +2447,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/verify",
+        operationId: "verifyAuditChain"
+    },
     "GET /v1/plans": {
         method: "GET",
         path: "/v1/plans",
@@ -2545,6 +2612,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/policy-evaluations",
         operationId: "dryEvalPolicy"
     },
+    "POST /v1/projects/{project_id}/policy-replays": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/policy-replays",
+        operationId: "replayPolicy"
+    },
     "GET /v1/projects": {
         method: "GET",
         path: "/v1/projects",