pgbeam 0.3.8 → 0.3.9

package/dist/operations.d.mts

@@ -1456,6 +1456,21 @@ type AuditLogEntry = {
      * @type string
     */
     ts: string;
+    /**
+     * @description Monotonic per-project position in the tamper-evident hash chain.
+     * @type integer | undefined
+    */
+    seq?: number;
+    /**
+     * @description Hex SHA-256 of the previous chained entry (a fixed genesis value for the first entry). Empty for pre-chain legacy entries.
+     * @type string | undefined
+    */
+    prev_hash?: string;
+    /**
+     * @description Hex SHA-256 of this entry\'s canonical content chained onto prev_hash. Empty for pre-chain legacy entries.
+     * @type string | undefined
+    */
+    entry_hash?: string;
 };
 
 /**
@@ -1648,6 +1663,108 @@ type ExportAuditLogsRequestConfig = {
     url: `/v1/projects/${string}/audit-logs/export`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Result of recomputing the project\'s tamper-evident audit hash chain over a time range. The chain links each entry to its predecessor, so editing or deleting any row breaks it.
+ * @type object
+*/
+type AuditChainVerification = {
+    /**
+     * @description True when every chained entry in the range links correctly and no tampering or deletion was detected.
+     * @type boolean
+    */
+    ok: boolean;
+    /**
+     * @description Number of chained entries checked.
+     * @type integer
+    */
+    verified_count: number;
+    /**
+     * @description Pre-chain (legacy) entries in the range that predate the hash chain and were skipped rather than treated as tampering.
+     * @type integer
+    */
+    unchained_count: number;
+    /**
+     * @description Sequence number of the first chained entry checked. Null when none.
+     * @type integer
+    */
+    chain_start_seq?: number | null;
+    /**
+     * @description Sequence number of the last chained entry checked. Null when none.
+     * @type integer
+    */
+    chain_end_seq?: number | null;
+    /**
+     * @description Sequence number where verification first failed (a tampered or deleted entry). Null when ok.
+     * @type integer
+    */
+    first_broken_seq?: number | null;
+    /**
+     * @description Machine-readable failure kind: hash_mismatch (entry content edited), broken_link (prev_hash does not match the predecessor), or missing_entry (a sequence number was deleted). Null when ok.
+     * @type string
+    */
+    failure_reason?: string | null;
+    /**
+     * @description When verification ran.
+     * @type string
+    */
+    verified_at: string;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type VerifyAuditChainPathProjectId = string;
+/**
+ * @description Return entries at or after this timestamp (inclusive lower bound).
+ * @type string | undefined
+*/
+type VerifyAuditChainQueryStart = string | undefined;
+/**
+ * @description Return entries strictly older than this timestamp (cursor / upper bound).
+ * @type string | undefined
+*/
+type VerifyAuditChainQueryEnd = string | undefined;
+/**
+ * @description Result of recomputing the project\'s tamper-evident audit hash chain over a time range. The chain links each entry to its predecessor, so editing or deleting any row breaks it.
+ * @type object
+*/
+type VerifyAuditChainStatus200 = AuditChainVerification;
+/**
+ * @type object
+*/
+type VerifyAuditChainRequestConfig = {
+    data?: never;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: VerifyAuditChainPathProjectId;
+    };
+    /**
+     * @type object | undefined
+    */
+    queryParams?: {
+        start?: VerifyAuditChainQueryStart;
+        end?: VerifyAuditChainQueryEnd;
+    };
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/audit-logs/verify`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -5406,6 +5523,250 @@ type DryEvalPolicyRequestConfig = {
     url: `/v1/projects/${string}/policy-evaluations`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type PolicyReplayInput = {
+    /**
+     * @description ID of an existing saved policy profile to replay against.
+     * @example pol_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    policy_id?: string;
+    /**
+     * @description Mutable fields of a policy profile (used for create and update).
+     * @type object | undefined
+    */
+    policy?: PolicyProfileInput;
+    /**
+     * @description Restrict the replay to traffic recorded for one agent credential.
+     * @example cred_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    credential_id?: string;
+    /**
+     * @description Start of the traffic window (inclusive). Defaults to 7 days before end_ts.
+     * @type string | undefined
+    */
+    start_ts?: string;
+    /**
+     * @description End of the traffic window (exclusive). Defaults to now.
+     * @type string | undefined
+    */
+    end_ts?: string;
+    /**
+     * @description Maximum number of distinct queries to replay, newest first. Traffic is deduplicated by normalized query hash before evaluation.
+     * @minLength 1
+     * @maxLength 500
+     * @default 200
+     * @type integer | undefined
+    */
+    limit?: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const policyReplayItemChangeEnum: {
+    readonly newly_blocked: "newly_blocked";
+    readonly newly_allowed: "newly_allowed";
+    readonly still_allowed: "still_allowed";
+    readonly still_blocked: "still_blocked";
+};
+type PolicyReplayItemChangeEnumKey = (typeof policyReplayItemChangeEnum)[keyof typeof policyReplayItemChangeEnum];
+/**
+ * @description One distinct recorded query and the decision the candidate policy would reach for it.
+ * @type object
+*/
+type PolicyReplayItem = {
+    /**
+     * @description Normalized query hash identifying this statement shape.
+     * @type string
+    */
+    query_hash: string;
+    /**
+     * @description The recorded statement (normalized, literals replaced with $N placeholders), from its most recent occurrence.
+     * @type string
+    */
+    sql: string;
+    /**
+     * @description Statement kind (select, insert, update, delete, ddl, ...).
+     * @type string | undefined
+    */
+    statement_kind?: string;
+    /**
+     * @description How many recorded entries share this query shape in the window.
+     * @type integer
+    */
+    occurrences: number;
+    /**
+     * @description Oldest occurrence in the window.
+     * @type string
+    */
+    first_seen: string;
+    /**
+     * @description Newest occurrence in the window.
+     * @type string
+    */
+    last_seen: string;
+    /**
+     * @description The most recent recorded outcome for this query (query, masked, truncated, or blocked).
+     * @type string
+    */
+    recorded_event: string;
+    /**
+     * @description The decision rule recorded with a blocked outcome.
+     * @type string | undefined
+    */
+    recorded_rule?: string;
+    /**
+     * @description How the candidate decision compares to the recorded outcome. newly_blocked and newly_allowed are the changes worth reviewing before rollout; still_allowed and still_blocked are unchanged.
+     * @type string
+    */
+    change: PolicyReplayItemChangeEnumKey;
+    /**
+     * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+     * @type object
+    */
+    result: DryEvalResult;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregate outcome of a policy replay.
+ * @type object
+*/
+type PolicyReplaySummary = {
+    /**
+     * @description Recorded audit entries covered by the replayed queries.
+     * @type integer
+    */
+    entries_scanned: number;
+    /**
+     * @description Distinct normalized queries found in the window (capped at limit).
+     * @type integer
+    */
+    distinct_queries: number;
+    /**
+     * @description Distinct queries actually evaluated against the candidate policy.
+     * @type integer
+    */
+    evaluated: number;
+    /**
+     * @description Queries the candidate policy would allow unchanged.
+     * @type integer
+    */
+    would_allow: number;
+    /**
+     * @description Queries the candidate policy would block.
+     * @type integer
+    */
+    would_block: number;
+    /**
+     * @description Queries the candidate policy would mask result columns on.
+     * @type integer
+    */
+    would_mask: number;
+    /**
+     * @description Queries the candidate policy would inject a row filter into.
+     * @type integer
+    */
+    would_row_filter: number;
+    /**
+     * @description Queries that executed under the recorded policy but the candidate policy would block.
+     * @type integer
+    */
+    newly_blocked: number;
+    /**
+     * @description Queries that were blocked when recorded but the candidate policy would permit.
+     * @type integer
+    */
+    newly_allowed: number;
+    /**
+     * @description Distinct queries skipped because the stored statement was truncated at record time and can no longer be parsed faithfully.
+     * @type integer
+    */
+    skipped_unparseable: number;
+    /**
+     * @description True when the window contained more distinct queries than limit; only the newest were replayed.
+     * @type boolean
+    */
+    truncated: boolean;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type PolicyReplayResult = {
+    /**
+     * @description Aggregate outcome of a policy replay.
+     * @type object
+    */
+    summary: PolicyReplaySummary;
+    /**
+     * @description Per-query replay decisions, ordered changes first (newly blocked, then newly allowed), then by occurrence count.
+     * @type array
+    */
+    items: PolicyReplayItem[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type ReplayPolicyPathProjectId = string;
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type ReplayPolicyStatus200 = PolicyReplayResult;
+/**
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type ReplayPolicyData = PolicyReplayInput;
+/**
+ * @type object
+*/
+type ReplayPolicyRequestConfig = {
+    data?: ReplayPolicyData;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: ReplayPolicyPathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/policy-replays`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -7947,6 +8308,10 @@ declare const operationsByTag: {
             readonly method: "GET";
             readonly path: "/v1/projects/{project_id}/audit-logs/export";
         };
+        readonly verifyAuditChain: {
+            readonly method: "GET";
+            readonly path: "/v1/projects/{project_id}/audit-logs/verify";
+        };
     };
     readonly anomalies: {
         readonly listAnomalyAlerts: {
@@ -8165,6 +8530,10 @@ declare const operationsByTag: {
             readonly method: "POST";
             readonly path: "/v1/projects/{project_id}/policy-evaluations";
         };
+        readonly replayPolicy: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/policy-replays";
+        };
     };
     readonly support: {
         readonly listSupportCases: {
@@ -8292,6 +8661,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/audit-logs/export";
         readonly operationId: "exportAuditLogs";
     };
+    readonly "GET /v1/projects/{project_id}/audit-logs/verify": {
+        readonly method: "GET";
+        readonly path: "/v1/projects/{project_id}/audit-logs/verify";
+        readonly operationId: "verifyAuditChain";
+    };
     readonly "GET /v1/plans": {
         readonly method: "GET";
         readonly path: "/v1/plans";
@@ -8452,6 +8826,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/policy-evaluations";
         readonly operationId: "dryEvalPolicy";
     };
+    readonly "POST /v1/projects/{project_id}/policy-replays": {
+        readonly method: "POST";
+        readonly path: "/v1/projects/{project_id}/policy-replays";
+        readonly operationId: "replayPolicy";
+    };
     readonly "GET /v1/projects": {
         readonly method: "GET";
         readonly path: "/v1/projects";
@@ -8637,6 +9016,10 @@ type ExportAuditLogsParams = {
     pathParams: NonNullable<ExportAuditLogsRequestConfig["pathParams"]>;
     queryParams?: NonNullable<ExportAuditLogsRequestConfig["queryParams"]>;
 };
+type VerifyAuditChainParams = {
+    pathParams: NonNullable<VerifyAuditChainRequestConfig["pathParams"]>;
+    queryParams?: NonNullable<VerifyAuditChainRequestConfig["queryParams"]>;
+};
 type GetOrganizationPlanParams = {
     pathParams: NonNullable<GetOrganizationPlanRequestConfig["pathParams"]>;
 };
@@ -8744,6 +9127,10 @@ type DryEvalPolicyParams = {
     pathParams: NonNullable<DryEvalPolicyRequestConfig["pathParams"]>;
     body: NonNullable<DryEvalPolicyRequestConfig["data"]>;
 };
+type ReplayPolicyParams = {
+    pathParams: NonNullable<ReplayPolicyRequestConfig["pathParams"]>;
+    body: NonNullable<ReplayPolicyRequestConfig["data"]>;
+};
 type ListProjectsParams = {
     queryParams: NonNullable<ListProjectsRequestConfig["queryParams"]>;
 };
@@ -8850,6 +9237,7 @@ interface ApiOperations {
         rotateAgentCredential(params: RotateAgentCredentialParams): Promise<RotateAgentCredentialStatus200>;
         listAuditLogs(params: ListAuditLogsParams): Promise<ListAuditLogsStatus200>;
         exportAuditLogs(params: ExportAuditLogsParams): Promise<ExportAuditLogsStatus200>;
+        verifyAuditChain(params: VerifyAuditChainParams): Promise<VerifyAuditChainStatus200>;
     };
     anomalies: {
         listAnomalyAlerts(params: ListAnomalyAlertsParams): Promise<ListAnomalyAlertsStatus200>;
@@ -8918,6 +9306,7 @@ interface ApiOperations {
         updatePolicyProfile(params: UpdatePolicyProfileParams): Promise<UpdatePolicyProfileStatus200>;
         deletePolicyProfile(params: DeletePolicyProfileParams): Promise<void>;
         dryEvalPolicy(params: DryEvalPolicyParams): Promise<DryEvalPolicyStatus200>;
+        replayPolicy(params: ReplayPolicyParams): Promise<ReplayPolicyStatus200>;
     };
     support: {
         listSupportCases(params: ListSupportCasesParams): Promise<ListSupportCasesStatus200>;
@@ -8995,6 +9384,10 @@ interface RequestMap {
         params: ExportAuditLogsParams;
         response: ExportAuditLogsStatus200;
     };
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        params: VerifyAuditChainParams;
+        response: VerifyAuditChainStatus200;
+    };
     "GET /v1/plans": {
         params?: undefined;
         response: ListPlansStatus200;
@@ -9123,6 +9516,10 @@ interface RequestMap {
         params: DryEvalPolicyParams;
         response: DryEvalPolicyStatus200;
     };
+    "POST /v1/projects/{project_id}/policy-replays": {
+        params: ReplayPolicyParams;
+        response: ReplayPolicyStatus200;
+    };
     "GET /v1/projects": {
         params: ListProjectsParams;
         response: ListProjectsStatus200;

package/dist/operations.mjs

@@ -416,7 +416,7 @@
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ entries: ({ bytes_out?: number; cache_status?: string; client_ip?: string; credential_id?: string; decision_rule?: string; event: string; id: string; latency_ms?: number; normalized_sql?: string; project_id: string; query_hash?: string; reason?: string; region?: string; rows_returned?: number; session_id?: string; source?: string; sql?: string; statement_kind?: string; ts: string })[]; next_page_token?: string }",
+        "responseType": "{ entries: ({ bytes_out?: number; cache_status?: string; client_ip?: string; credential_id?: string; decision_rule?: string; entry_hash?: string; event: string; id: string; latency_ms?: number; normalized_sql?: string; prev_hash?: string; project_id: string; query_hash?: string; reason?: string; region?: string; rows_returned?: number; seq?: number; session_id?: string; source?: string; sql?: string; statement_kind?: string; ts: string })[]; next_page_token?: string }",
         "responseStatus": "200"
     },
     "exportAuditLogs": {
@@ -481,6 +481,40 @@
         "responseType": "",
         "responseStatus": "200"
     },
+    "verifyAuditChain": {
+        "operationId": "verifyAuditChain",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/audit-logs/verify",
+        "summary": "Verify the tamper-evident audit chain",
+        "description": "Recomputes the project's audit hash chain over an optional time range and reports whether it is intact. Each audit entry is linked to its predecessor with a SHA-256 hash, so editing or deleting any row breaks the chain. On a break, the response reports the first sequence number where a tampered or deleted entry was detected. Requires the same audit:read permission as the list and export endpoints.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "start",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Return entries at or after this timestamp (inclusive lower bound)."
+            },
+            {
+                "name": "end",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Return entries strictly older than this timestamp (cursor / upper bound)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ chain_end_seq?: number; chain_start_seq?: number; failure_reason?: string; first_broken_seq?: number; ok: boolean; unchained_count: number; verified_at: string; verified_count: number }",
+        "responseStatus": "200"
+    },
     "listPlans": {
         "operationId": "listPlans",
         "method": "GET",
@@ -1301,6 +1335,26 @@
         "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
+    "replayPolicy": {
+        "operationId": "replayPolicy",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/policy-replays",
+        "summary": "Replay recorded agent traffic against a policy",
+        "description": "Replays the project's recorded agent audit traffic against a candidate policy (either a draft supplied inline or an existing policy referenced by id) and reports what would change: which queries that ran would now be blocked, which blocked queries would now be permitted, and which results would be masked or row-filtered. Traffic is deduplicated by normalized query shape, newest first, and every statement is evaluated through the data plane's own policy engine, so the verdicts match real enforcement. Stateful checks (budgets, approvals, write-mode routing) are reported as informational notes on each result, not verdicts. This endpoint reads only the audit log; it never connects to the upstream database and persists nothing.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseStatus": "200"
+    },
     "listProjects": {
         "operationId": "listProjects",
         "method": "GET",
@@ -2037,6 +2091,10 @@
         exportAuditLogs: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
+        },
+        verifyAuditChain: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/verify"
         }
     },
     anomalies: {
@@ -2255,6 +2313,10 @@
         dryEvalPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-evaluations"
+        },
+        replayPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-replays"
         }
     },
     support: {
@@ -2383,6 +2445,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/verify",
+        operationId: "verifyAuditChain"
+    },
     "GET /v1/plans": {
         method: "GET",
         path: "/v1/plans",
@@ -2543,6 +2610,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/policy-evaluations",
         operationId: "dryEvalPolicy"
     },
+    "POST /v1/projects/{project_id}/policy-replays": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/policy-replays",
+        operationId: "replayPolicy"
+    },
     "GET /v1/projects": {
         method: "GET",
         path: "/v1/projects",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "TypeScript SDK for the PgBeam API — globally distributed PostgreSQL proxy platform",
   "type": "module",
   "exports": {