pgbeam 0.4.19 → 0.4.21

package/dist/operations.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
+var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -259,7 +259,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "method": "GET",
         "path": "/v1/projects/{project_id}/anomalies",
         "summary": "List anomaly alerts",
-        "description": "Lists anomaly alerts for the project, newest first, optionally filtered by status.",
+        "description": "Lists anomaly alerts for the project, newest first, optionally filtered by status and kind.",
         "parameters": [
             {
                 "name": "project_id",
@@ -275,6 +275,13 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
                 "type": "\"open\" | \"acknowledged\" | \"resolved\"",
                 "description": "Filter to a single status."
             },
+            {
+                "name": "kind",
+                "in": "query",
+                "required": false,
+                "type": "\"volume_spike\" | \"egress_spike\" | \"new_query_shape\" | \"off_hours\" | \"error_spike\" | \"canary_tripped\" | \"content_flagged\"",
+                "description": "Filter to a single anomaly kind."
+            },
             {
                 "name": "page_size",
                 "in": "query",
@@ -492,6 +499,169 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "responseType": "",
         "responseStatus": "204"
     },
+    "listApprovalRules": {
+        "operationId": "listApprovalRules",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/approval-rules",
+        "summary": "List approval rules",
+        "description": "Lists the project's approval rules, including disabled ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ approval_rules: ({ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string })[]; next_page_token?: string }",
+        "responseStatus": "200"
+    },
+    "createApprovalRule": {
+        "operationId": "createApprovalRule",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/approval-rules",
+        "summary": "Create an approval rule",
+        "description": "Sends the agent statements the rule matches to a human for approval,\nwhatever the policy profile's approval_mode says. A rule can only add\napproval; nothing here can exempt a statement from approval_mode.\n\nThe rule is pushed to connected data planes when it is written. A\nreviewer sees its name on every approval request it holds.\n\nReturns 409 for an enabled rule while the organization has a live\nself-hosted data plane enrollment, because PgBeam cannot yet confirm\nthat a self-hosted proxy runs a build that enforces approval rules. A\nrule with enabled set to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ enabled?: boolean; min_affected_rows?: number; name: string; relation_name?: string; schema_name?: string; statement_kinds?: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[] }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getApprovalRule": {
+        "operationId": "getApprovalRule",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Get an approval rule",
+        "description": "Returns a single approval rule by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateApprovalRule": {
+        "operationId": "updateApprovalRule",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Update an approval rule",
+        "description": "Replaces the rule's name, statement kinds, scope, row threshold and\nenabled flag. An approval request already held keeps the name it was\nheld under.\n\nReturns 409 when the update leaves the rule enabled while the\norganization has a live self-hosted data plane enrollment, for the same\nreason as create. Setting enabled to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ enabled?: boolean; min_affected_rows?: number; name: string; relation_name?: string; schema_name?: string; statement_kinds?: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[] }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteApprovalRule": {
+        "operationId": "deleteApprovalRule",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Delete an approval rule",
+        "description": "Removes the rule, so the statements it matched are held only if the\npolicy profile's approval_mode holds them. Approval requests it already\nheld are not affected.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listApprovalRequests": {
         "operationId": "listApprovalRequests",
         "method": "GET",
@@ -791,7 +961,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ allowed: number; blocked: number; bytes_out: number; credential_ids: string[]; duration_ms: number; ended_at: string; entries_scanned: number; latency_ms_total: number; masked: number; other: number; project_id: string; rows_returned: number; scan_truncated: boolean; session_id: string; sources: string[]; started_at: string; statements: number; tables_blocked: string[]; tables_read: string[]; tables_written: string[]; truncated: number; unparsed_statements: number }",
+        "responseType": "{ allowed: number; anomalies?: { credential_window_alerts: ({ acknowledged_at?: string; acknowledged_by?: string; created_at: string; credential_id?: string; details?: Record<string, unknown>; id: string; kind: string; project_id: string; severity: \"info\" | \"warning\" | \"critical\"; status: \"open\" | \"acknowledged\" | \"resolved\"; title: string; window_end?: string; window_start?: string })[]; session_alerts: ({ acknowledged_at?: string; acknowledged_by?: string; created_at: string; credential_id?: string; details?: Record<string, unknown>; id: string; kind: string; project_id: string; severity: \"info\" | \"warning\" | \"critical\"; status: \"open\" | \"acknowledged\" | \"resolved\"; title: string; window_end?: string; window_start?: string })[]; truncated: boolean }; blocked: number; bytes_out: number; credential_ids: string[]; duration_ms: number; ended_at: string; entries_scanned: number; latency_ms_total: number; masked: number; other: number; project_id: string; rows_returned: number; scan_truncated: boolean; session_id: string; sources: string[]; started_at: string; statements: number; tables_blocked: string[]; tables_read: string[]; tables_written: string[]; truncated: number; unparsed_statements: number }",
         "responseStatus": "200"
     },
     "verifyAuditChain": {
@@ -1321,7 +1491,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "method": "POST",
         "path": "/v1/projects/{project_id}/databases/{database_id}/scan-pii",
         "summary": "Scan a database for likely-PII columns",
-        "description": "Connects to the upstream database read-only, inspects information_schema and samples column values against PII heuristics, and returns ranked masking suggestions. Suggestions are advisory — the operator reviews them and applies the ones they want into a policy profile's masking rules. Nothing is auto-applied.",
+        "description": "Connects to the upstream database read-only, inspects information_schema and samples column values against PII heuristics, and returns ranked masking suggestions. Suggestions are advisory: the operator reviews them and applies the ones they want into a policy profile's masking rules. Nothing is auto-applied.",
         "parameters": [
             {
                 "name": "project_id",
@@ -1348,7 +1518,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "method": "GET",
         "path": "/v1/projects/{project_id}/databases/{database_id}/schema-catalog",
         "summary": "Read a database's schema catalog",
-        "description": "Connects to the upstream database read-only and returns its user relations (tables and views) and columns. Powers table/column autocomplete and view-aware warnings in the policy editor — relation kind distinguishes a view (whose masking/row-filters apply to the view itself, not its base tables) from a base table, and a per-column is_binary flag flags columns that mask to NULL. System schemas are excluded; nothing is persisted.",
+        "description": "Connects to the upstream database read-only and returns its user relations (tables and views) and columns. Powers table/column autocomplete and view-aware warnings in the policy editor. Relation kind distinguishes a view (whose masking/row-filters apply to the view itself, not its base tables) from a base table, and a per-column is_binary flag flags columns that mask to NULL. System schemas are excluded; nothing is persisted.",
         "parameters": [
             {
                 "name": "project_id",
@@ -2732,7 +2902,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "method": "POST",
         "path": "/v1/organizations/{org_id}/self-host-enrollments",
         "summary": "Issue a self-host enrollment token",
-        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.",
+        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.\nReturns 409 while any project in the organization has an enabled approval rule, because PgBeam cannot yet confirm that a self-hosted proxy runs a build that enforces approval rules. Disable those rules first; they can be saved with enabled set to false.",
         "parameters": [
             {
                 "name": "org_id",

package/dist/operations.d.cts

@@ -1,4 +1,4 @@
-export { z0 as ApiOperations, z1 as ApiTag, z2 as RequestMap, z3 as Route, z4 as operationsByPath, z5 as operationsByTag } from './operations-map.gen-k9bt41ua.js';
+export { Ab as ApiOperations, Ac as ApiTag, Ad as RequestMap, Ae as Route, Af as operationsByPath, Ag as operationsByTag } from './operations-map.gen-le9c2b3b.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.d.mts

@@ -1,4 +1,4 @@
-export { z0 as ApiOperations, z1 as ApiTag, z2 as RequestMap, z3 as Route, z4 as operationsByPath, z5 as operationsByTag } from './operations-map.gen-k9bt41ua.js';
+export { Ab as ApiOperations, Ac as ApiTag, Ad as RequestMap, Ae as Route, Af as operationsByPath, Ag as operationsByTag } from './operations-map.gen-le9c2b3b.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.mjs

@@ -1,4 +1,4 @@
-export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-gmrf5uyf.js';
+export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-jqwfh8a6.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -257,7 +257,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "method": "GET",
         "path": "/v1/projects/{project_id}/anomalies",
         "summary": "List anomaly alerts",
-        "description": "Lists anomaly alerts for the project, newest first, optionally filtered by status.",
+        "description": "Lists anomaly alerts for the project, newest first, optionally filtered by status and kind.",
         "parameters": [
             {
                 "name": "project_id",
@@ -273,6 +273,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "type": "\"open\" | \"acknowledged\" | \"resolved\"",
                 "description": "Filter to a single status."
             },
+            {
+                "name": "kind",
+                "in": "query",
+                "required": false,
+                "type": "\"volume_spike\" | \"egress_spike\" | \"new_query_shape\" | \"off_hours\" | \"error_spike\" | \"canary_tripped\" | \"content_flagged\"",
+                "description": "Filter to a single anomaly kind."
+            },
             {
                 "name": "page_size",
                 "in": "query",
@@ -490,6 +497,169 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "responseType": "",
         "responseStatus": "204"
     },
+    "listApprovalRules": {
+        "operationId": "listApprovalRules",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/approval-rules",
+        "summary": "List approval rules",
+        "description": "Lists the project's approval rules, including disabled ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ approval_rules: ({ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string })[]; next_page_token?: string }",
+        "responseStatus": "200"
+    },
+    "createApprovalRule": {
+        "operationId": "createApprovalRule",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/approval-rules",
+        "summary": "Create an approval rule",
+        "description": "Sends the agent statements the rule matches to a human for approval,\nwhatever the policy profile's approval_mode says. A rule can only add\napproval; nothing here can exempt a statement from approval_mode.\n\nThe rule is pushed to connected data planes when it is written. A\nreviewer sees its name on every approval request it holds.\n\nReturns 409 for an enabled rule while the organization has a live\nself-hosted data plane enrollment, because PgBeam cannot yet confirm\nthat a self-hosted proxy runs a build that enforces approval rules. A\nrule with enabled set to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ enabled?: boolean; min_affected_rows?: number; name: string; relation_name?: string; schema_name?: string; statement_kinds?: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[] }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getApprovalRule": {
+        "operationId": "getApprovalRule",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Get an approval rule",
+        "description": "Returns a single approval rule by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateApprovalRule": {
+        "operationId": "updateApprovalRule",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Update an approval rule",
+        "description": "Replaces the rule's name, statement kinds, scope, row threshold and\nenabled flag. An approval request already held keeps the name it was\nheld under.\n\nReturns 409 when the update leaves the rule enabled while the\norganization has a live self-hosted data plane enrollment, for the same\nreason as create. Setting enabled to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ enabled?: boolean; min_affected_rows?: number; name: string; relation_name?: string; schema_name?: string; statement_kinds?: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[] }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteApprovalRule": {
+        "operationId": "deleteApprovalRule",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Delete an approval rule",
+        "description": "Removes the rule, so the statements it matched are held only if the\npolicy profile's approval_mode holds them. Approval requests it already\nheld are not affected.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listApprovalRequests": {
         "operationId": "listApprovalRequests",
         "method": "GET",
@@ -789,7 +959,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ allowed: number; blocked: number; bytes_out: number; credential_ids: string[]; duration_ms: number; ended_at: string; entries_scanned: number; latency_ms_total: number; masked: number; other: number; project_id: string; rows_returned: number; scan_truncated: boolean; session_id: string; sources: string[]; started_at: string; statements: number; tables_blocked: string[]; tables_read: string[]; tables_written: string[]; truncated: number; unparsed_statements: number }",
+        "responseType": "{ allowed: number; anomalies?: { credential_window_alerts: ({ acknowledged_at?: string; acknowledged_by?: string; created_at: string; credential_id?: string; details?: Record<string, unknown>; id: string; kind: string; project_id: string; severity: \"info\" | \"warning\" | \"critical\"; status: \"open\" | \"acknowledged\" | \"resolved\"; title: string; window_end?: string; window_start?: string })[]; session_alerts: ({ acknowledged_at?: string; acknowledged_by?: string; created_at: string; credential_id?: string; details?: Record<string, unknown>; id: string; kind: string; project_id: string; severity: \"info\" | \"warning\" | \"critical\"; status: \"open\" | \"acknowledged\" | \"resolved\"; title: string; window_end?: string; window_start?: string })[]; truncated: boolean }; blocked: number; bytes_out: number; credential_ids: string[]; duration_ms: number; ended_at: string; entries_scanned: number; latency_ms_total: number; masked: number; other: number; project_id: string; rows_returned: number; scan_truncated: boolean; session_id: string; sources: string[]; started_at: string; statements: number; tables_blocked: string[]; tables_read: string[]; tables_written: string[]; truncated: number; unparsed_statements: number }",
         "responseStatus": "200"
     },
     "verifyAuditChain": {
@@ -1319,7 +1489,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "method": "POST",
         "path": "/v1/projects/{project_id}/databases/{database_id}/scan-pii",
         "summary": "Scan a database for likely-PII columns",
-        "description": "Connects to the upstream database read-only, inspects information_schema and samples column values against PII heuristics, and returns ranked masking suggestions. Suggestions are advisory — the operator reviews them and applies the ones they want into a policy profile's masking rules. Nothing is auto-applied.",
+        "description": "Connects to the upstream database read-only, inspects information_schema and samples column values against PII heuristics, and returns ranked masking suggestions. Suggestions are advisory: the operator reviews them and applies the ones they want into a policy profile's masking rules. Nothing is auto-applied.",
         "parameters": [
             {
                 "name": "project_id",
@@ -1346,7 +1516,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "method": "GET",
         "path": "/v1/projects/{project_id}/databases/{database_id}/schema-catalog",
         "summary": "Read a database's schema catalog",
-        "description": "Connects to the upstream database read-only and returns its user relations (tables and views) and columns. Powers table/column autocomplete and view-aware warnings in the policy editor — relation kind distinguishes a view (whose masking/row-filters apply to the view itself, not its base tables) from a base table, and a per-column is_binary flag flags columns that mask to NULL. System schemas are excluded; nothing is persisted.",
+        "description": "Connects to the upstream database read-only and returns its user relations (tables and views) and columns. Powers table/column autocomplete and view-aware warnings in the policy editor. Relation kind distinguishes a view (whose masking/row-filters apply to the view itself, not its base tables) from a base table, and a per-column is_binary flag flags columns that mask to NULL. System schemas are excluded; nothing is persisted.",
         "parameters": [
             {
                 "name": "project_id",
@@ -2730,7 +2900,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "method": "POST",
         "path": "/v1/organizations/{org_id}/self-host-enrollments",
         "summary": "Issue a self-host enrollment token",
-        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.",
+        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.\nReturns 409 while any project in the organization has an enabled approval rule, because PgBeam cannot yet confirm that a self-hosted proxy runs a build that enforces approval rules. Disable those rules first; they can be saved with enabled set to false.",
         "parameters": [
             {
                 "name": "org_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "description": "TypeScript SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol",
   "type": "module",
   "exports": {