pgbeam 0.4.20 → 0.5.0

package/dist/{operations-map.gen-gmrf5uyf.js → operations-map.gen-ir66wlzb.js}

@@ -122,6 +122,26 @@
         replayPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-replays"
+        },
+        listQueryTemplates: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/query-templates"
+        },
+        createQueryTemplate: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/query-templates"
+        },
+        getQueryTemplate: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/query-templates/{query_template_id}"
+        },
+        updateQueryTemplate: {
+            method: "PUT",
+            path: "/v1/projects/{project_id}/query-templates/{query_template_id}"
+        },
+        deleteQueryTemplate: {
+            method: "DELETE",
+            path: "/v1/projects/{project_id}/query-templates/{query_template_id}"
         }
     },
     anomalies: {
@@ -155,6 +175,26 @@
         }
     },
     approvals: {
+        listApprovalRules: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/approval-rules"
+        },
+        createApprovalRule: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/approval-rules"
+        },
+        getApprovalRule: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/approval-rules/{approval_rule_id}"
+        },
+        updateApprovalRule: {
+            method: "PUT",
+            path: "/v1/projects/{project_id}/approval-rules/{approval_rule_id}"
+        },
+        deleteApprovalRule: {
+            method: "DELETE",
+            path: "/v1/projects/{project_id}/approval-rules/{approval_rule_id}"
+        },
         listApprovalRequests: {
             method: "GET",
             path: "/v1/projects/{project_id}/approvals"
@@ -355,7 +395,8 @@
         },
         scanText: {
             method: "POST",
-            path: "/v1/scan/text"
+            path: "/v1/scan/text",
+            refusesIdempotencyKey: true
         }
     },
     honeytokens: {
@@ -432,12 +473,6 @@
             path: "/v1/organizations/{org_id}/support/cases/{case_id}/messages"
         }
     },
-    internal: {
-        handleSlackSupportEvent: {
-            method: "POST",
-            path: "/v1/internal/support/slack-event"
-        }
-    },
     webhooks: {
         listWebhookEndpoints: {
             method: "GET",
@@ -541,6 +576,31 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/anomaly-rules/{anomaly_rule_id}",
         operationId: "deleteAnomalyRule"
     },
+    "GET /v1/projects/{project_id}/approval-rules": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/approval-rules",
+        operationId: "listApprovalRules"
+    },
+    "POST /v1/projects/{project_id}/approval-rules": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/approval-rules",
+        operationId: "createApprovalRule"
+    },
+    "GET /v1/projects/{project_id}/approval-rules/{approval_rule_id}": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        operationId: "getApprovalRule"
+    },
+    "PUT /v1/projects/{project_id}/approval-rules/{approval_rule_id}": {
+        method: "PUT",
+        path: "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        operationId: "updateApprovalRule"
+    },
+    "DELETE /v1/projects/{project_id}/approval-rules/{approval_rule_id}": {
+        method: "DELETE",
+        path: "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        operationId: "deleteApprovalRule"
+    },
     "GET /v1/projects/{project_id}/approvals": {
         method: "GET",
         path: "/v1/projects/{project_id}/approvals",
@@ -861,6 +921,31 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/metrics",
         operationId: "getProjectMetrics"
     },
+    "GET /v1/projects/{project_id}/query-templates": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/query-templates",
+        operationId: "listQueryTemplates"
+    },
+    "POST /v1/projects/{project_id}/query-templates": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/query-templates",
+        operationId: "createQueryTemplate"
+    },
+    "GET /v1/projects/{project_id}/query-templates/{query_template_id}": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        operationId: "getQueryTemplate"
+    },
+    "PUT /v1/projects/{project_id}/query-templates/{query_template_id}": {
+        method: "PUT",
+        path: "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        operationId: "updateQueryTemplate"
+    },
+    "DELETE /v1/projects/{project_id}/query-templates/{query_template_id}": {
+        method: "DELETE",
+        path: "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        operationId: "deleteQueryTemplate"
+    },
     "GET /v1/regions": {
         method: "GET",
         path: "/v1/regions",
@@ -941,15 +1026,11 @@ const operationsByPath = {
         path: "/v1/organizations/{org_id}/support/cases/{case_id}/messages",
         operationId: "createSupportMessage"
     },
-    "POST /v1/internal/support/slack-event": {
-        method: "POST",
-        path: "/v1/internal/support/slack-event",
-        operationId: "handleSlackSupportEvent"
-    },
     "POST /v1/scan/text": {
         method: "POST",
         path: "/v1/scan/text",
-        operationId: "scanText"
+        operationId: "scanText",
+        refusesIdempotencyKey: true
     },
     "GET /v1/organizations/{org_id}/usage": {
         method: "GET",

package/dist/operations.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
+var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -251,7 +251,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         ],
         "requestBodyType": "{ limit?: number; lookback_days?: number }",
         "requestBodyRequired": false,
-        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
+        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
         "responseStatus": "200"
     },
     "listAnomalyAlerts": {
@@ -499,6 +499,169 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "responseType": "",
         "responseStatus": "204"
     },
+    "listApprovalRules": {
+        "operationId": "listApprovalRules",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/approval-rules",
+        "summary": "List approval rules",
+        "description": "Lists the project's approval rules, including disabled ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ approval_rules: ({ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string })[]; next_page_token?: string }",
+        "responseStatus": "200"
+    },
+    "createApprovalRule": {
+        "operationId": "createApprovalRule",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/approval-rules",
+        "summary": "Create an approval rule",
+        "description": "Sends the agent statements the rule matches to a human for approval,\nwhatever the policy profile's approval_mode says. A rule can only add\napproval; nothing here can exempt a statement from approval_mode.\n\nThe rule is pushed to connected data planes when it is written. A\nreviewer sees its name on every approval request it holds.\n\nReturns 409 for an enabled rule while the organization has a live\nself-hosted data plane enrollment, because PgBeam cannot yet confirm\nthat a self-hosted proxy runs a build that enforces approval rules. A\nrule with enabled set to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ enabled?: boolean; min_affected_rows?: number; name: string; relation_name?: string; schema_name?: string; statement_kinds?: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[] }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getApprovalRule": {
+        "operationId": "getApprovalRule",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Get an approval rule",
+        "description": "Returns a single approval rule by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateApprovalRule": {
+        "operationId": "updateApprovalRule",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Update an approval rule",
+        "description": "Replaces the rule's name, statement kinds, scope, row threshold and\nenabled flag. An approval request already held keeps the name it was\nheld under.\n\nReturns 409 when the update leaves the rule enabled while the\norganization has a live self-hosted data plane enrollment, for the same\nreason as create. Setting enabled to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ enabled?: boolean; min_affected_rows?: number; name: string; relation_name?: string; schema_name?: string; statement_kinds?: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[] }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; enabled: boolean; id: string; min_affected_rows?: number; name: string; project_id: string; relation_name?: string; schema_name?: string; statement_kinds: (\"insert\" | \"update\" | \"delete\" | \"ddl\")[]; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteApprovalRule": {
+        "operationId": "deleteApprovalRule",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/approval-rules/{approval_rule_id}",
+        "summary": "Delete an approval rule",
+        "description": "Removes the rule, so the statements it matched are held only if the\npolicy profile's approval_mode holds them. Approval requests it already\nheld are not affected.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "approval_rule_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique approval rule identifier (prefixed, e.g. apl_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listApprovalRequests": {
         "operationId": "listApprovalRequests",
         "method": "GET",
@@ -2270,7 +2433,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         ],
         "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
         "requestBodyRequired": true,
-        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
+        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
     "replayPolicy": {
@@ -2290,7 +2453,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         ],
         "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
         "requestBodyRequired": true,
-        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
         "responseStatus": "200"
     },
     "listProjects": {
@@ -2476,6 +2639,169 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "responseType": "{ snapshots: ({ active_connections: number; avg_connect_ms?: number; avg_latency_ms: number; avg_query_ms?: number; cache_hits: number; cache_misses: number; created_at: string; id: string; p99_latency_ms: number; project_id: string; queries_total: number; region: string })[] }",
         "responseStatus": "200"
     },
+    "listQueryTemplates": {
+        "operationId": "listQueryTemplates",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/query-templates",
+        "summary": "List query templates",
+        "description": "Lists the project's query templates, including disabled ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ next_page_token?: string; query_templates: ({ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string })[] }",
+        "responseStatus": "200"
+    },
+    "createQueryTemplate": {
+        "operationId": "createQueryTemplate",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/query-templates",
+        "summary": "Create a query template",
+        "description": "Adds a named, parameterized statement to the project. A template admits\na statement for a policy profile that runs templates only; it never\ngrants access, and the statement still meets the credential's whole\npolicy.\n\nThe SQL is parsed and checked when it is written: exactly one SELECT,\nINSERT, UPDATE or DELETE, placeholders $1 to $n, one declared parameter\nfor each. A template that fails is refused with 400 and a message\nnaming the problem. Returns 409 when the project already has a template\nof that name.\n\nThe template is pushed to connected data planes when it is written.\n\nReturns 409 for an enabled template while the organization has a live\nself-hosted data plane enrollment, because PgBeam cannot yet confirm\nthat a self-hosted proxy runs a build that enforces templates. A\ntemplate with enabled set to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ description?: string; enabled?: boolean; include_sql?: boolean; name: string; params?: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; sql: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getQueryTemplate": {
+        "operationId": "getQueryTemplate",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Get a query template",
+        "description": "Returns a single query template by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateQueryTemplate": {
+        "operationId": "updateQueryTemplate",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Update a query template",
+        "description": "Replaces the template's name, description, SQL, parameters, include_sql\nand enabled flag. The SQL is checked as on create. A statement already\nadmitted under the old template is not affected; the next one is\nmatched against the new text.\n\nReturns 409 on a rename to a name the project already uses, and when\nthe update leaves the template enabled while the organization has a\nlive self-hosted data plane enrollment, for the same reason as create.\nSetting enabled to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ description?: string; enabled?: boolean; include_sql?: boolean; name: string; params?: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; sql: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteQueryTemplate": {
+        "operationId": "deleteQueryTemplate",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Delete a query template",
+        "description": "Removes the template, so a profile that runs templates only stops\nadmitting its statement. Deleting the last template is allowed: such a\nprofile then admits nothing, which is the intended way to withdraw\naccess in an incident.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listRegions": {
         "operationId": "listRegions",
         "method": "GET",
@@ -2739,7 +3065,7 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "method": "POST",
         "path": "/v1/organizations/{org_id}/self-host-enrollments",
         "summary": "Issue a self-host enrollment token",
-        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.",
+        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.\nReturns 409 while any project in the organization has an enabled approval rule, because PgBeam cannot yet confirm that a self-hosted proxy runs a build that enforces approval rules. Disable those rules first; they can be saved with enabled set to false.",
         "parameters": [
             {
                 "name": "org_id",
@@ -3006,18 +3332,6 @@ var operationsMap_gen = require('./operations-map.gen-j3jalb8e.cjs');
         "responseType": "{ author_image?: string; author_name: string; body: string; case_id: string; created_at: string; id: string; slack_user_id?: string; source: \"user\" | \"slack\" }",
         "responseStatus": "201"
     },
-    "handleSlackSupportEvent": {
-        "operationId": "handleSlackSupportEvent",
-        "method": "POST",
-        "path": "/v1/internal/support/slack-event",
-        "summary": "Handle a Slack support event",
-        "description": "Receives a forwarded Slack event from the dashboard webhook handler and creates a support message.",
-        "parameters": [],
-        "requestBodyType": "{ channel_id: string; text: string; thread_ts: string; user_id: string }",
-        "requestBodyRequired": true,
-        "responseType": "",
-        "responseStatus": "200"
-    },
     "scanText": {
         "operationId": "scanText",
         "method": "POST",

package/dist/operations.d.cts

@@ -1,4 +1,4 @@
-export { z3 as ApiOperations, z4 as ApiTag, z5 as RequestMap, z6 as Route, z7 as operationsByPath, z8 as operationsByTag } from './operations-map.gen-hnc5e145.js';
+export { Ba as ApiOperations, Bb as ApiTag, Bc as RequestMap, Bd as Route, Be as operationsByPath, Bf as operationsByTag } from './operations-map.gen-g8h39ajx.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.d.mts

@@ -1,4 +1,4 @@
-export { z3 as ApiOperations, z4 as ApiTag, z5 as RequestMap, z6 as Route, z7 as operationsByPath, z8 as operationsByTag } from './operations-map.gen-hnc5e145.js';
+export { Ba as ApiOperations, Bb as ApiTag, Bc as RequestMap, Bd as Route, Be as operationsByPath, Bf as operationsByTag } from './operations-map.gen-g8h39ajx.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.