pgbeam 0.3.8 → 0.3.10

package/dist/operations.d.mts

@@ -1102,6 +1102,16 @@ type ApprovalRequest = {
      * @type string | undefined
     */
     statement_kind?: string;
+    /**
+     * @description Best-effort estimate of how many rows the statement would affect, attached by the data plane when the statement was held. Either the planner estimate from EXPLAIN or the exact count observed in a rolled-back trial execution. Null when no estimate could be made; treat it as an estimate, not a guarantee.
+     * @type integer
+    */
+    estimated_rows?: number | null;
+    /**
+     * @description Relations the statement touches, from the gateway\'s parse analysis.
+     * @type array | undefined
+    */
+    target_tables?: string[];
     /**
      * @description Current state of the approval request.
      * @type string
@@ -1347,6 +1357,7 @@ type AuditDecisionKey = (typeof auditDecision)[keyof typeof auditDecision];
 declare const auditSource: {
     readonly wire: "wire";
     readonly mcp: "mcp";
+    readonly rest: "rest";
     readonly control: "control";
 };
 type AuditSourceKey = (typeof auditSource)[keyof typeof auditSource];
@@ -1447,7 +1458,7 @@ type AuditLogEntry = {
     */
     session_id?: string;
     /**
-     * @description Statement origin (wire, mcp, or control for control-plane lifecycle events).
+     * @description Statement origin (wire, mcp, rest, or control for control-plane lifecycle events).
      * @type string | undefined
     */
     source?: string;
@@ -1456,6 +1467,21 @@ type AuditLogEntry = {
      * @type string
     */
     ts: string;
+    /**
+     * @description Monotonic per-project position in the tamper-evident hash chain.
+     * @type integer | undefined
+    */
+    seq?: number;
+    /**
+     * @description Hex SHA-256 of the previous chained entry (a fixed genesis value for the first entry). Empty for pre-chain legacy entries.
+     * @type string | undefined
+    */
+    prev_hash?: string;
+    /**
+     * @description Hex SHA-256 of this entry\'s canonical content chained onto prev_hash. Empty for pre-chain legacy entries.
+     * @type string | undefined
+    */
+    entry_hash?: string;
 };
 
 /**
@@ -1509,7 +1535,7 @@ type ListAuditLogsQueryEvent = string | undefined;
 */
 type ListAuditLogsQueryDecision = AuditDecisionKey | undefined;
 /**
- * @description Filter by statement origin (wire, mcp, or control).
+ * @description Filter by statement origin (wire, mcp, rest, or control).
  * @type string | undefined
 */
 type ListAuditLogsQuerySource = AuditSourceKey | undefined;
@@ -1601,7 +1627,7 @@ type ExportAuditLogsQueryEvent = string | undefined;
 */
 type ExportAuditLogsQueryDecision = AuditDecisionKey | undefined;
 /**
- * @description Filter by statement origin (wire, mcp, or control).
+ * @description Filter by statement origin (wire, mcp, rest, or control).
  * @type string | undefined
 */
 type ExportAuditLogsQuerySource = AuditSourceKey | undefined;
@@ -1648,6 +1674,108 @@ type ExportAuditLogsRequestConfig = {
     url: `/v1/projects/${string}/audit-logs/export`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Result of recomputing the project\'s tamper-evident audit hash chain over a time range. The chain links each entry to its predecessor, so editing or deleting any row breaks it.
+ * @type object
+*/
+type AuditChainVerification = {
+    /**
+     * @description True when every chained entry in the range links correctly and no tampering or deletion was detected.
+     * @type boolean
+    */
+    ok: boolean;
+    /**
+     * @description Number of chained entries checked.
+     * @type integer
+    */
+    verified_count: number;
+    /**
+     * @description Pre-chain (legacy) entries in the range that predate the hash chain and were skipped rather than treated as tampering.
+     * @type integer
+    */
+    unchained_count: number;
+    /**
+     * @description Sequence number of the first chained entry checked. Null when none.
+     * @type integer
+    */
+    chain_start_seq?: number | null;
+    /**
+     * @description Sequence number of the last chained entry checked. Null when none.
+     * @type integer
+    */
+    chain_end_seq?: number | null;
+    /**
+     * @description Sequence number where verification first failed (a tampered or deleted entry). Null when ok.
+     * @type integer
+    */
+    first_broken_seq?: number | null;
+    /**
+     * @description Machine-readable failure kind: hash_mismatch (entry content edited), broken_link (prev_hash does not match the predecessor), or missing_entry (a sequence number was deleted). Null when ok.
+     * @type string
+    */
+    failure_reason?: string | null;
+    /**
+     * @description When verification ran.
+     * @type string
+    */
+    verified_at: string;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type VerifyAuditChainPathProjectId = string;
+/**
+ * @description Return entries at or after this timestamp (inclusive lower bound).
+ * @type string | undefined
+*/
+type VerifyAuditChainQueryStart = string | undefined;
+/**
+ * @description Return entries strictly older than this timestamp (cursor / upper bound).
+ * @type string | undefined
+*/
+type VerifyAuditChainQueryEnd = string | undefined;
+/**
+ * @description Result of recomputing the project\'s tamper-evident audit hash chain over a time range. The chain links each entry to its predecessor, so editing or deleting any row breaks it.
+ * @type object
+*/
+type VerifyAuditChainStatus200 = AuditChainVerification;
+/**
+ * @type object
+*/
+type VerifyAuditChainRequestConfig = {
+    data?: never;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: VerifyAuditChainPathProjectId;
+    };
+    /**
+     * @type object | undefined
+    */
+    queryParams?: {
+        start?: VerifyAuditChainQueryStart;
+        end?: VerifyAuditChainQueryEnd;
+    };
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/audit-logs/verify`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -5406,6 +5534,250 @@ type DryEvalPolicyRequestConfig = {
     url: `/v1/projects/${string}/policy-evaluations`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type PolicyReplayInput = {
+    /**
+     * @description ID of an existing saved policy profile to replay against.
+     * @example pol_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    policy_id?: string;
+    /**
+     * @description Mutable fields of a policy profile (used for create and update).
+     * @type object | undefined
+    */
+    policy?: PolicyProfileInput;
+    /**
+     * @description Restrict the replay to traffic recorded for one agent credential.
+     * @example cred_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    credential_id?: string;
+    /**
+     * @description Start of the traffic window (inclusive). Defaults to 7 days before end_ts.
+     * @type string | undefined
+    */
+    start_ts?: string;
+    /**
+     * @description End of the traffic window (exclusive). Defaults to now.
+     * @type string | undefined
+    */
+    end_ts?: string;
+    /**
+     * @description Maximum number of distinct queries to replay, newest first. Traffic is deduplicated by normalized query hash before evaluation.
+     * @minLength 1
+     * @maxLength 500
+     * @default 200
+     * @type integer | undefined
+    */
+    limit?: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const policyReplayItemChangeEnum: {
+    readonly newly_blocked: "newly_blocked";
+    readonly newly_allowed: "newly_allowed";
+    readonly still_allowed: "still_allowed";
+    readonly still_blocked: "still_blocked";
+};
+type PolicyReplayItemChangeEnumKey = (typeof policyReplayItemChangeEnum)[keyof typeof policyReplayItemChangeEnum];
+/**
+ * @description One distinct recorded query and the decision the candidate policy would reach for it.
+ * @type object
+*/
+type PolicyReplayItem = {
+    /**
+     * @description Normalized query hash identifying this statement shape.
+     * @type string
+    */
+    query_hash: string;
+    /**
+     * @description The recorded statement (normalized, literals replaced with $N placeholders), from its most recent occurrence.
+     * @type string
+    */
+    sql: string;
+    /**
+     * @description Statement kind (select, insert, update, delete, ddl, ...).
+     * @type string | undefined
+    */
+    statement_kind?: string;
+    /**
+     * @description How many recorded entries share this query shape in the window.
+     * @type integer
+    */
+    occurrences: number;
+    /**
+     * @description Oldest occurrence in the window.
+     * @type string
+    */
+    first_seen: string;
+    /**
+     * @description Newest occurrence in the window.
+     * @type string
+    */
+    last_seen: string;
+    /**
+     * @description The most recent recorded outcome for this query (query, masked, truncated, or blocked).
+     * @type string
+    */
+    recorded_event: string;
+    /**
+     * @description The decision rule recorded with a blocked outcome.
+     * @type string | undefined
+    */
+    recorded_rule?: string;
+    /**
+     * @description How the candidate decision compares to the recorded outcome. newly_blocked and newly_allowed are the changes worth reviewing before rollout; still_allowed and still_blocked are unchanged.
+     * @type string
+    */
+    change: PolicyReplayItemChangeEnumKey;
+    /**
+     * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+     * @type object
+    */
+    result: DryEvalResult;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregate outcome of a policy replay.
+ * @type object
+*/
+type PolicyReplaySummary = {
+    /**
+     * @description Recorded audit entries covered by the replayed queries.
+     * @type integer
+    */
+    entries_scanned: number;
+    /**
+     * @description Distinct normalized queries found in the window (capped at limit).
+     * @type integer
+    */
+    distinct_queries: number;
+    /**
+     * @description Distinct queries actually evaluated against the candidate policy.
+     * @type integer
+    */
+    evaluated: number;
+    /**
+     * @description Queries the candidate policy would allow unchanged.
+     * @type integer
+    */
+    would_allow: number;
+    /**
+     * @description Queries the candidate policy would block.
+     * @type integer
+    */
+    would_block: number;
+    /**
+     * @description Queries the candidate policy would mask result columns on.
+     * @type integer
+    */
+    would_mask: number;
+    /**
+     * @description Queries the candidate policy would inject a row filter into.
+     * @type integer
+    */
+    would_row_filter: number;
+    /**
+     * @description Queries that executed under the recorded policy but the candidate policy would block.
+     * @type integer
+    */
+    newly_blocked: number;
+    /**
+     * @description Queries that were blocked when recorded but the candidate policy would permit.
+     * @type integer
+    */
+    newly_allowed: number;
+    /**
+     * @description Distinct queries skipped because the stored statement was truncated at record time and can no longer be parsed faithfully.
+     * @type integer
+    */
+    skipped_unparseable: number;
+    /**
+     * @description True when the window contained more distinct queries than limit; only the newest were replayed.
+     * @type boolean
+    */
+    truncated: boolean;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type PolicyReplayResult = {
+    /**
+     * @description Aggregate outcome of a policy replay.
+     * @type object
+    */
+    summary: PolicyReplaySummary;
+    /**
+     * @description Per-query replay decisions, ordered changes first (newly blocked, then newly allowed), then by occurrence count.
+     * @type array
+    */
+    items: PolicyReplayItem[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type ReplayPolicyPathProjectId = string;
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type ReplayPolicyStatus200 = PolicyReplayResult;
+/**
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type ReplayPolicyData = PolicyReplayInput;
+/**
+ * @type object
+*/
+type ReplayPolicyRequestConfig = {
+    data?: ReplayPolicyData;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: ReplayPolicyPathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/policy-replays`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -7947,6 +8319,10 @@ declare const operationsByTag: {
             readonly method: "GET";
             readonly path: "/v1/projects/{project_id}/audit-logs/export";
         };
+        readonly verifyAuditChain: {
+            readonly method: "GET";
+            readonly path: "/v1/projects/{project_id}/audit-logs/verify";
+        };
     };
     readonly anomalies: {
         readonly listAnomalyAlerts: {
@@ -8165,6 +8541,10 @@ declare const operationsByTag: {
             readonly method: "POST";
             readonly path: "/v1/projects/{project_id}/policy-evaluations";
         };
+        readonly replayPolicy: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/policy-replays";
+        };
     };
     readonly support: {
         readonly listSupportCases: {
@@ -8292,6 +8672,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/audit-logs/export";
         readonly operationId: "exportAuditLogs";
     };
+    readonly "GET /v1/projects/{project_id}/audit-logs/verify": {
+        readonly method: "GET";
+        readonly path: "/v1/projects/{project_id}/audit-logs/verify";
+        readonly operationId: "verifyAuditChain";
+    };
     readonly "GET /v1/plans": {
         readonly method: "GET";
         readonly path: "/v1/plans";
@@ -8452,6 +8837,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/policy-evaluations";
         readonly operationId: "dryEvalPolicy";
     };
+    readonly "POST /v1/projects/{project_id}/policy-replays": {
+        readonly method: "POST";
+        readonly path: "/v1/projects/{project_id}/policy-replays";
+        readonly operationId: "replayPolicy";
+    };
     readonly "GET /v1/projects": {
         readonly method: "GET";
         readonly path: "/v1/projects";
@@ -8637,6 +9027,10 @@ type ExportAuditLogsParams = {
     pathParams: NonNullable<ExportAuditLogsRequestConfig["pathParams"]>;
     queryParams?: NonNullable<ExportAuditLogsRequestConfig["queryParams"]>;
 };
+type VerifyAuditChainParams = {
+    pathParams: NonNullable<VerifyAuditChainRequestConfig["pathParams"]>;
+    queryParams?: NonNullable<VerifyAuditChainRequestConfig["queryParams"]>;
+};
 type GetOrganizationPlanParams = {
     pathParams: NonNullable<GetOrganizationPlanRequestConfig["pathParams"]>;
 };
@@ -8744,6 +9138,10 @@ type DryEvalPolicyParams = {
     pathParams: NonNullable<DryEvalPolicyRequestConfig["pathParams"]>;
     body: NonNullable<DryEvalPolicyRequestConfig["data"]>;
 };
+type ReplayPolicyParams = {
+    pathParams: NonNullable<ReplayPolicyRequestConfig["pathParams"]>;
+    body: NonNullable<ReplayPolicyRequestConfig["data"]>;
+};
 type ListProjectsParams = {
     queryParams: NonNullable<ListProjectsRequestConfig["queryParams"]>;
 };
@@ -8850,6 +9248,7 @@ interface ApiOperations {
         rotateAgentCredential(params: RotateAgentCredentialParams): Promise<RotateAgentCredentialStatus200>;
         listAuditLogs(params: ListAuditLogsParams): Promise<ListAuditLogsStatus200>;
         exportAuditLogs(params: ExportAuditLogsParams): Promise<ExportAuditLogsStatus200>;
+        verifyAuditChain(params: VerifyAuditChainParams): Promise<VerifyAuditChainStatus200>;
     };
     anomalies: {
         listAnomalyAlerts(params: ListAnomalyAlertsParams): Promise<ListAnomalyAlertsStatus200>;
@@ -8918,6 +9317,7 @@ interface ApiOperations {
         updatePolicyProfile(params: UpdatePolicyProfileParams): Promise<UpdatePolicyProfileStatus200>;
         deletePolicyProfile(params: DeletePolicyProfileParams): Promise<void>;
         dryEvalPolicy(params: DryEvalPolicyParams): Promise<DryEvalPolicyStatus200>;
+        replayPolicy(params: ReplayPolicyParams): Promise<ReplayPolicyStatus200>;
     };
     support: {
         listSupportCases(params: ListSupportCasesParams): Promise<ListSupportCasesStatus200>;
@@ -8995,6 +9395,10 @@ interface RequestMap {
         params: ExportAuditLogsParams;
         response: ExportAuditLogsStatus200;
     };
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        params: VerifyAuditChainParams;
+        response: VerifyAuditChainStatus200;
+    };
     "GET /v1/plans": {
         params?: undefined;
         response: ListPlansStatus200;
@@ -9123,6 +9527,10 @@ interface RequestMap {
         params: DryEvalPolicyParams;
         response: DryEvalPolicyStatus200;
     };
+    "POST /v1/projects/{project_id}/policy-replays": {
+        params: ReplayPolicyParams;
+        response: ReplayPolicyStatus200;
+    };
     "GET /v1/projects": {
         params: ListProjectsParams;
         response: ListProjectsStatus200;