pgbeam 0.4.16 → 0.4.18

package/dist/operations.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var operationsMap_gen = require('./operations-map.gen-mwk22v4l.cjs');
+var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -329,6 +329,169 @@ var operationsMap_gen = require('./operations-map.gen-mwk22v4l.cjs');
         "responseType": "{ acknowledged_at?: string; acknowledged_by?: string; created_at: string; credential_id?: string; details?: Record<string, unknown>; id: string; kind: string; project_id: string; severity: \"info\" | \"warning\" | \"critical\"; status: \"open\" | \"acknowledged\" | \"resolved\"; title: string; window_end?: string; window_start?: string }",
         "responseStatus": "200"
     },
+    "listAnomalyRules": {
+        "operationId": "listAnomalyRules",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/anomaly-rules",
+        "summary": "List anomaly rules",
+        "description": "Lists the project's anomaly rules, including silenced ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ anomaly_rules: ({ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string })[]; next_page_token?: string }",
+        "responseStatus": "200"
+    },
+    "createAnomalyRule": {
+        "operationId": "createAnomalyRule",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/anomaly-rules",
+        "summary": "Create an anomaly rule",
+        "description": "Retunes one detection metric for this project, or for one agent credential\nin it. Without a rule every metric resolves to the deployment default.\n\nA rule adds no detection algorithm and no alert kind: it changes how\nsensitive one of the five existing metrics is. enabled=false silences that\nmetric for that scope; the baseline keeps advancing, so re-enabling\nresumes from the existing history rather than a cold warm-up.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; enabled?: boolean; floor?: number; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; sigma_threshold?: number }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getAnomalyRule": {
+        "operationId": "getAnomalyRule",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
+        "summary": "Get an anomaly rule",
+        "description": "Returns a single anomaly rule by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "anomaly_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique anomaly rule identifier (prefixed, e.g. anr_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateAnomalyRule": {
+        "operationId": "updateAnomalyRule",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
+        "summary": "Update an anomaly rule",
+        "description": "Replaces the rule's scope, metric and sensitivity. A rule whose enabled\nflag is turned off silences its metric for its scope rather than being\ndeactivated.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "anomaly_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique anomaly rule identifier (prefixed, e.g. anr_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; enabled?: boolean; floor?: number; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; sigma_threshold?: number }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteAnomalyRule": {
+        "operationId": "deleteAnomalyRule",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
+        "summary": "Delete an anomaly rule",
+        "description": "Removes the rule, so its metric returns to the deployment default for that\nscope. Deleting a rule that was silencing a metric turns that metric's\nalerts back on.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "anomaly_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique anomaly rule identifier (prefixed, e.g. anr_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listApprovalRequests": {
         "operationId": "listApprovalRequests",
         "method": "GET",
@@ -3021,7 +3184,7 @@ var operationsMap_gen = require('./operations-map.gen-mwk22v4l.cjs');
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ next_page_token?: string; webhooks: ({ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string })[] }",
+        "responseType": "{ next_page_token?: string; webhooks: ({ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string })[] }",
         "responseStatus": "200"
     },
     "createWebhookEndpoint": {
@@ -3046,9 +3209,9 @@ var operationsMap_gen = require('./operations-map.gen-mwk22v4l.cjs');
                 "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
-        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
+        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
         "requestBodyRequired": true,
-        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
+        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
         "responseStatus": "201"
     },
     "getWebhookEndpoint": {
@@ -3082,7 +3245,7 @@ var operationsMap_gen = require('./operations-map.gen-mwk22v4l.cjs');
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
+        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
         "responseStatus": "200"
     },
     "updateWebhookEndpoint": {
@@ -3114,9 +3277,9 @@ var operationsMap_gen = require('./operations-map.gen-mwk22v4l.cjs');
                 "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
             }
         ],
-        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
+        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
         "requestBodyRequired": true,
-        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
+        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
         "responseStatus": "200"
     },
     "deleteWebhookEndpoint": {

package/dist/operations.d.cts

@@ -1,4 +1,4 @@
-export { xU as ApiOperations, xV as ApiTag, xW as RequestMap, xX as Route, xY as operationsByPath, xZ as operationsByTag } from './operations-map.gen-gsmkoqb5.js';
+export { z0 as ApiOperations, z1 as ApiTag, z2 as RequestMap, z3 as Route, z4 as operationsByPath, z5 as operationsByTag } from './operations-map.gen-jrixe5ek.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.d.mts

@@ -1,4 +1,4 @@
-export { xU as ApiOperations, xV as ApiTag, xW as RequestMap, xX as Route, xY as operationsByPath, xZ as operationsByTag } from './operations-map.gen-gsmkoqb5.js';
+export { z0 as ApiOperations, z1 as ApiTag, z2 as RequestMap, z3 as Route, z4 as operationsByPath, z5 as operationsByTag } from './operations-map.gen-jrixe5ek.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.mjs

@@ -1,4 +1,4 @@
-export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-cr323vpc.js';
+export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-gmrf5uyf.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -327,6 +327,169 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "responseType": "{ acknowledged_at?: string; acknowledged_by?: string; created_at: string; credential_id?: string; details?: Record<string, unknown>; id: string; kind: string; project_id: string; severity: \"info\" | \"warning\" | \"critical\"; status: \"open\" | \"acknowledged\" | \"resolved\"; title: string; window_end?: string; window_start?: string }",
         "responseStatus": "200"
     },
+    "listAnomalyRules": {
+        "operationId": "listAnomalyRules",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/anomaly-rules",
+        "summary": "List anomaly rules",
+        "description": "Lists the project's anomaly rules, including silenced ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ anomaly_rules: ({ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string })[]; next_page_token?: string }",
+        "responseStatus": "200"
+    },
+    "createAnomalyRule": {
+        "operationId": "createAnomalyRule",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/anomaly-rules",
+        "summary": "Create an anomaly rule",
+        "description": "Retunes one detection metric for this project, or for one agent credential\nin it. Without a rule every metric resolves to the deployment default.\n\nA rule adds no detection algorithm and no alert kind: it changes how\nsensitive one of the five existing metrics is. enabled=false silences that\nmetric for that scope; the baseline keeps advancing, so re-enabling\nresumes from the existing history rather than a cold warm-up.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; enabled?: boolean; floor?: number; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; sigma_threshold?: number }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getAnomalyRule": {
+        "operationId": "getAnomalyRule",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
+        "summary": "Get an anomaly rule",
+        "description": "Returns a single anomaly rule by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "anomaly_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique anomaly rule identifier (prefixed, e.g. anr_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateAnomalyRule": {
+        "operationId": "updateAnomalyRule",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
+        "summary": "Update an anomaly rule",
+        "description": "Replaces the rule's scope, metric and sensitivity. A rule whose enabled\nflag is turned off silences its metric for its scope rather than being\ndeactivated.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "anomaly_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique anomaly rule identifier (prefixed, e.g. anr_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; enabled?: boolean; floor?: number; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; sigma_threshold?: number }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; credential_id?: string; enabled: boolean; floor?: number; id: string; metric: \"queries_per_hour\" | \"bytes_per_hour\" | \"distinct_shapes\" | \"errors_per_hour\" | \"active_hours\"; project_id: string; sigma_threshold?: number; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteAnomalyRule": {
+        "operationId": "deleteAnomalyRule",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
+        "summary": "Delete an anomaly rule",
+        "description": "Removes the rule, so its metric returns to the deployment default for that\nscope. Deleting a rule that was silencing a metric turns that metric's\nalerts back on.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "anomaly_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique anomaly rule identifier (prefixed, e.g. anr_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listApprovalRequests": {
         "operationId": "listApprovalRequests",
         "method": "GET",
@@ -3019,7 +3182,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ next_page_token?: string; webhooks: ({ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string })[] }",
+        "responseType": "{ next_page_token?: string; webhooks: ({ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string })[] }",
         "responseStatus": "200"
     },
     "createWebhookEndpoint": {
@@ -3044,9 +3207,9 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
-        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
+        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
         "requestBodyRequired": true,
-        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
+        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
         "responseStatus": "201"
     },
     "getWebhookEndpoint": {
@@ -3080,7 +3243,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
+        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
         "responseStatus": "200"
     },
     "updateWebhookEndpoint": {
@@ -3112,9 +3275,9 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
             }
         ],
-        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
+        "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",
         "requestBodyRequired": true,
-        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
+        "responseType": "{ created_at: string; description?: string; enabled: boolean; event_types?: (\"query_blocked\" | \"budget_exhausted\" | \"kill_switch\" | \"masked\" | \"migration_flagged\" | \"approval_requested\" | \"anomaly_alert\" | \"canary_tripped\" | \"content_flagged\" | \"audit_checkpoint\" | \"webhook.test\")[]; format: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; id: string; project_id: string; updated_at: string; url: string }",
         "responseStatus": "200"
     },
     "deleteWebhookEndpoint": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "description": "TypeScript SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol",
   "type": "module",
   "exports": {
@@ -47,13 +47,13 @@
   ],
   "homepage": "https://pgbeam.com",
   "devDependencies": {
-    "@kubb/adapter-oas": "5.2.5",
+    "@kubb/adapter-oas": "5.3.10",
     "@kubb/middleware-barrel": "5.0.0-beta.35",
     "@kubb/plugin-ts": "5.0.2",
     "@pgbeam/config": "0.0.1",
     "@typescript/typescript6": "6.0.2",
     "bunchee": "7.0.1",
-    "kubb": "5.2.5",
+    "kubb": "5.3.10",
     "typescript": "7.0.2"
   },
   "scripts": {