pgbeam 0.4.21 → 0.5.0

package/dist/{operations-map.gen-jqwfh8a6.js → operations-map.gen-ir66wlzb.js}

@@ -122,6 +122,26 @@
         replayPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-replays"
+        },
+        listQueryTemplates: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/query-templates"
+        },
+        createQueryTemplate: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/query-templates"
+        },
+        getQueryTemplate: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/query-templates/{query_template_id}"
+        },
+        updateQueryTemplate: {
+            method: "PUT",
+            path: "/v1/projects/{project_id}/query-templates/{query_template_id}"
+        },
+        deleteQueryTemplate: {
+            method: "DELETE",
+            path: "/v1/projects/{project_id}/query-templates/{query_template_id}"
         }
     },
     anomalies: {
@@ -375,7 +395,8 @@
         },
         scanText: {
             method: "POST",
-            path: "/v1/scan/text"
+            path: "/v1/scan/text",
+            refusesIdempotencyKey: true
         }
     },
     honeytokens: {
@@ -452,12 +473,6 @@
             path: "/v1/organizations/{org_id}/support/cases/{case_id}/messages"
         }
     },
-    internal: {
-        handleSlackSupportEvent: {
-            method: "POST",
-            path: "/v1/internal/support/slack-event"
-        }
-    },
     webhooks: {
         listWebhookEndpoints: {
             method: "GET",
@@ -906,6 +921,31 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/metrics",
         operationId: "getProjectMetrics"
     },
+    "GET /v1/projects/{project_id}/query-templates": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/query-templates",
+        operationId: "listQueryTemplates"
+    },
+    "POST /v1/projects/{project_id}/query-templates": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/query-templates",
+        operationId: "createQueryTemplate"
+    },
+    "GET /v1/projects/{project_id}/query-templates/{query_template_id}": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        operationId: "getQueryTemplate"
+    },
+    "PUT /v1/projects/{project_id}/query-templates/{query_template_id}": {
+        method: "PUT",
+        path: "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        operationId: "updateQueryTemplate"
+    },
+    "DELETE /v1/projects/{project_id}/query-templates/{query_template_id}": {
+        method: "DELETE",
+        path: "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        operationId: "deleteQueryTemplate"
+    },
     "GET /v1/regions": {
         method: "GET",
         path: "/v1/regions",
@@ -986,15 +1026,11 @@ const operationsByPath = {
         path: "/v1/organizations/{org_id}/support/cases/{case_id}/messages",
         operationId: "createSupportMessage"
     },
-    "POST /v1/internal/support/slack-event": {
-        method: "POST",
-        path: "/v1/internal/support/slack-event",
-        operationId: "handleSlackSupportEvent"
-    },
     "POST /v1/scan/text": {
         method: "POST",
         path: "/v1/scan/text",
-        operationId: "scanText"
+        operationId: "scanText",
+        refusesIdempotencyKey: true
     },
     "GET /v1/organizations/{org_id}/usage": {
         method: "GET",

package/dist/operations.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
+var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -251,7 +251,7 @@ var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
         ],
         "requestBodyType": "{ limit?: number; lookback_days?: number }",
         "requestBodyRequired": false,
-        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
+        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
         "responseStatus": "200"
     },
     "listAnomalyAlerts": {
@@ -2433,7 +2433,7 @@ var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
         ],
         "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
         "requestBodyRequired": true,
-        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
+        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
     "replayPolicy": {
@@ -2453,7 +2453,7 @@ var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
         ],
         "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
         "requestBodyRequired": true,
-        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
         "responseStatus": "200"
     },
     "listProjects": {
@@ -2639,6 +2639,169 @@ var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
         "responseType": "{ snapshots: ({ active_connections: number; avg_connect_ms?: number; avg_latency_ms: number; avg_query_ms?: number; cache_hits: number; cache_misses: number; created_at: string; id: string; p99_latency_ms: number; project_id: string; queries_total: number; region: string })[] }",
         "responseStatus": "200"
     },
+    "listQueryTemplates": {
+        "operationId": "listQueryTemplates",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/query-templates",
+        "summary": "List query templates",
+        "description": "Lists the project's query templates, including disabled ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ next_page_token?: string; query_templates: ({ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string })[] }",
+        "responseStatus": "200"
+    },
+    "createQueryTemplate": {
+        "operationId": "createQueryTemplate",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/query-templates",
+        "summary": "Create a query template",
+        "description": "Adds a named, parameterized statement to the project. A template admits\na statement for a policy profile that runs templates only; it never\ngrants access, and the statement still meets the credential's whole\npolicy.\n\nThe SQL is parsed and checked when it is written: exactly one SELECT,\nINSERT, UPDATE or DELETE, placeholders $1 to $n, one declared parameter\nfor each. A template that fails is refused with 400 and a message\nnaming the problem. Returns 409 when the project already has a template\nof that name.\n\nThe template is pushed to connected data planes when it is written.\n\nReturns 409 for an enabled template while the organization has a live\nself-hosted data plane enrollment, because PgBeam cannot yet confirm\nthat a self-hosted proxy runs a build that enforces templates. A\ntemplate with enabled set to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ description?: string; enabled?: boolean; include_sql?: boolean; name: string; params?: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; sql: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getQueryTemplate": {
+        "operationId": "getQueryTemplate",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Get a query template",
+        "description": "Returns a single query template by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateQueryTemplate": {
+        "operationId": "updateQueryTemplate",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Update a query template",
+        "description": "Replaces the template's name, description, SQL, parameters, include_sql\nand enabled flag. The SQL is checked as on create. A statement already\nadmitted under the old template is not affected; the next one is\nmatched against the new text.\n\nReturns 409 on a rename to a name the project already uses, and when\nthe update leaves the template enabled while the organization has a\nlive self-hosted data plane enrollment, for the same reason as create.\nSetting enabled to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ description?: string; enabled?: boolean; include_sql?: boolean; name: string; params?: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; sql: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteQueryTemplate": {
+        "operationId": "deleteQueryTemplate",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Delete a query template",
+        "description": "Removes the template, so a profile that runs templates only stops\nadmitting its statement. Deleting the last template is allowed: such a\nprofile then admits nothing, which is the intended way to withdraw\naccess in an incident.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listRegions": {
         "operationId": "listRegions",
         "method": "GET",
@@ -3169,18 +3332,6 @@ var operationsMap_gen = require('./operations-map.gen-l4ihw4c3.cjs');
         "responseType": "{ author_image?: string; author_name: string; body: string; case_id: string; created_at: string; id: string; slack_user_id?: string; source: \"user\" | \"slack\" }",
         "responseStatus": "201"
     },
-    "handleSlackSupportEvent": {
-        "operationId": "handleSlackSupportEvent",
-        "method": "POST",
-        "path": "/v1/internal/support/slack-event",
-        "summary": "Handle a Slack support event",
-        "description": "Receives a forwarded Slack event from the dashboard webhook handler and creates a support message.",
-        "parameters": [],
-        "requestBodyType": "{ channel_id: string; text: string; thread_ts: string; user_id: string }",
-        "requestBodyRequired": true,
-        "responseType": "",
-        "responseStatus": "200"
-    },
     "scanText": {
         "operationId": "scanText",
         "method": "POST",

package/dist/operations.d.cts

@@ -1,4 +1,4 @@
-export { Ab as ApiOperations, Ac as ApiTag, Ad as RequestMap, Ae as Route, Af as operationsByPath, Ag as operationsByTag } from './operations-map.gen-le9c2b3b.js';
+export { Ba as ApiOperations, Bb as ApiTag, Bc as RequestMap, Bd as Route, Be as operationsByPath, Bf as operationsByTag } from './operations-map.gen-g8h39ajx.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.d.mts

@@ -1,4 +1,4 @@
-export { Ab as ApiOperations, Ac as ApiTag, Ad as RequestMap, Ae as Route, Af as operationsByPath, Ag as operationsByTag } from './operations-map.gen-le9c2b3b.js';
+export { Ba as ApiOperations, Bb as ApiTag, Bc as RequestMap, Bd as Route, Be as operationsByPath, Bf as operationsByTag } from './operations-map.gen-g8h39ajx.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.mjs

@@ -1,4 +1,4 @@
-export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-jqwfh8a6.js';
+export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-ir66wlzb.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -249,7 +249,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "{ limit?: number; lookback_days?: number }",
         "requestBodyRequired": false,
-        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
+        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
         "responseStatus": "200"
     },
     "listAnomalyAlerts": {
@@ -2431,7 +2431,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
         "requestBodyRequired": true,
-        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
+        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
     "replayPolicy": {
@@ -2451,7 +2451,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
         "requestBodyRequired": true,
-        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
         "responseStatus": "200"
     },
     "listProjects": {
@@ -2637,6 +2637,169 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "responseType": "{ snapshots: ({ active_connections: number; avg_connect_ms?: number; avg_latency_ms: number; avg_query_ms?: number; cache_hits: number; cache_misses: number; created_at: string; id: string; p99_latency_ms: number; project_id: string; queries_total: number; region: string })[] }",
         "responseStatus": "200"
     },
+    "listQueryTemplates": {
+        "operationId": "listQueryTemplates",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/query-templates",
+        "summary": "List query templates",
+        "description": "Lists the project's query templates, including disabled ones.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "page_size",
+                "in": "query",
+                "required": false,
+                "type": "number",
+                "description": "Maximum number of items to return (1-100, default 20)."
+            },
+            {
+                "name": "page_token",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Opaque token for cursor-based pagination."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ next_page_token?: string; query_templates: ({ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string })[] }",
+        "responseStatus": "200"
+    },
+    "createQueryTemplate": {
+        "operationId": "createQueryTemplate",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/query-templates",
+        "summary": "Create a query template",
+        "description": "Adds a named, parameterized statement to the project. A template admits\na statement for a policy profile that runs templates only; it never\ngrants access, and the statement still meets the credential's whole\npolicy.\n\nThe SQL is parsed and checked when it is written: exactly one SELECT,\nINSERT, UPDATE or DELETE, placeholders $1 to $n, one declared parameter\nfor each. A template that fails is refused with 400 and a message\nnaming the problem. Returns 409 when the project already has a template\nof that name.\n\nThe template is pushed to connected data planes when it is written.\n\nReturns 409 for an enabled template while the organization has a live\nself-hosted data plane enrollment, because PgBeam cannot yet confirm\nthat a self-hosted proxy runs a build that enforces templates. A\ntemplate with enabled set to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
+        "requestBodyType": "{ description?: string; enabled?: boolean; include_sql?: boolean; name: string; params?: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; sql: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "201"
+    },
+    "getQueryTemplate": {
+        "operationId": "getQueryTemplate",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Get a query template",
+        "description": "Returns a single query template by ID.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            },
+            {
+                "name": "If-None-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the client already holds, taken from the `ETag` of an earlier response. When it still matches the current representation the server answers `304 Not Modified` with no body, so a poll that finds nothing changed costs a round trip rather than a transfer.\n\nA comma-separated list is accepted, and `*` matches any current representation."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "updateQueryTemplate": {
+        "operationId": "updateQueryTemplate",
+        "method": "PUT",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Update a query template",
+        "description": "Replaces the template's name, description, SQL, parameters, include_sql\nand enabled flag. The SQL is checked as on create. A statement already\nadmitted under the old template is not affected; the next one is\nmatched against the new text.\n\nReturns 409 on a rename to a name the project already uses, and when\nthe update leaves the template enabled while the organization has a\nlive self-hosted data plane enrollment, for the same reason as create.\nSetting enabled to false is still accepted.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            },
+            {
+                "name": "If-Match",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
+            }
+        ],
+        "requestBodyType": "{ description?: string; enabled?: boolean; include_sql?: boolean; name: string; params?: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; sql: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ created_at: string; description: string; enabled: boolean; id: string; include_sql: boolean; name: string; params: ({ name: string; nullable?: boolean; type: \"text\" | \"integer\" | \"bigint\" | \"double precision\" | \"numeric\" | \"boolean\" | \"uuid\" | \"date\" | \"timestamptz\" | \"jsonb\" })[]; project_id: string; sql: string; statement_kind?: \"select\" | \"insert\" | \"update\" | \"delete\"; updated_at: string }",
+        "responseStatus": "200"
+    },
+    "deleteQueryTemplate": {
+        "operationId": "deleteQueryTemplate",
+        "method": "DELETE",
+        "path": "/v1/projects/{project_id}/query-templates/{query_template_id}",
+        "summary": "Delete a query template",
+        "description": "Removes the template, so a profile that runs templates only stops\nadmitting its statement. Deleting the last template is allowed: such a\nprofile then admits nothing, which is the intended way to withdraw\naccess in an incident.\n",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "query_template_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique query template identifier (prefixed, e.g. qtp_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listRegions": {
         "operationId": "listRegions",
         "method": "GET",
@@ -3167,18 +3330,6 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "responseType": "{ author_image?: string; author_name: string; body: string; case_id: string; created_at: string; id: string; slack_user_id?: string; source: \"user\" | \"slack\" }",
         "responseStatus": "201"
     },
-    "handleSlackSupportEvent": {
-        "operationId": "handleSlackSupportEvent",
-        "method": "POST",
-        "path": "/v1/internal/support/slack-event",
-        "summary": "Handle a Slack support event",
-        "description": "Receives a forwarded Slack event from the dashboard webhook handler and creates a support message.",
-        "parameters": [],
-        "requestBodyType": "{ channel_id: string; text: string; thread_ts: string; user_id: string }",
-        "requestBodyRequired": true,
-        "responseType": "",
-        "responseStatus": "200"
-    },
     "scanText": {
         "operationId": "scanText",
         "method": "POST",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.4.21",
+  "version": "0.5.0",
   "description": "TypeScript SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol",
   "type": "module",
   "exports": {
@@ -47,17 +47,18 @@
   ],
   "homepage": "https://pgbeam.com",
   "devDependencies": {
-    "@kubb/adapter-oas": "5.3.19",
+    "@kubb/adapter-oas": "5.11.1",
     "@kubb/middleware-barrel": "5.0.0-beta.35",
-    "@kubb/plugin-ts": "5.0.2",
+    "@kubb/plugin-ts": "5.0.14",
     "@pgbeam/config": "0.0.1",
     "@typescript/typescript6": "6.0.2",
-    "bunchee": "7.0.1",
-    "kubb": "5.3.19",
+    "bunchee": "7.0.2",
+    "kubb": "5.11.1",
     "typescript": "7.0.2"
   },
   "scripts": {
     "build": "bunchee",
-    "generate": "kubb generate"
+    "generate": "kubb generate",
+    "typecheck": "tsc --noEmit"
   }
 }