pgbeam 0.4.8 → 0.4.10

package/dist/operations.cjs

@@ -69,6 +69,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ expires_at?: string; name: string; policy_profile_id: string; principal_type?: \"agent\" | \"human\" }",
@@ -177,6 +184,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique agent credential identifier (prefixed, e.g. agt_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "",
@@ -407,7 +421,7 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "in": "query",
                 "required": false,
                 "type": "\"allow\" | \"block\" | \"mask\" | \"truncate\"",
-                "description": "Coarse outcome filter that groups events. `allow` = query; `block` = blocked, budget_exhausted, auth_failed, credential_expired; `mask` = masked; `truncate` = truncated."
+                "description": "Coarse outcome filter that groups events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated."
             },
             {
                 "name": "source",
@@ -483,7 +497,7 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "in": "query",
                 "required": false,
                 "type": "\"allow\" | \"block\" | \"mask\" | \"truncate\"",
-                "description": "Coarse outcome filter that groups events. `allow` = query; `block` = blocked, budget_exhausted, auth_failed, credential_expired; `mask` = masked; `truncate` = truncated."
+                "description": "Coarse outcome filter that groups events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated."
             },
             {
                 "name": "source",
@@ -869,6 +883,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ auto_read_routing?: boolean; cache_config?: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; host: string; name: string; password: string; pool_config?: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; username: string }",
@@ -1085,6 +1106,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ domain: string }",
@@ -1205,6 +1233,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ action: \"audit_only\" | \"kill\"; relation_name: string; schema_name?: string }",
@@ -1446,6 +1481,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
@@ -1621,7 +1663,15 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
         "path": "/v1/projects",
         "summary": "Create a project",
         "description": "Creates a new project within the specified organization.",
-        "parameters": [],
+        "parameters": [
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
         "requestBodyType": "{ cloud?: \"aws\" | \"azure\" | \"gcp\"; database: { auto_read_routing?: boolean; cache_config?: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; host: string; name: string; password: string; pool_config?: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; username: string }; description?: string; name: string; org_id: string; self_hosted?: boolean; tags?: string[] }",
         "requestBodyRequired": true,
         "responseType": "{ database?: { auto_read_routing?: boolean; cache_config: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; connection_string?: string; created_at: string; host: string; id: string; name: string; pool_config: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; project_id: string; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; updated_at: string; username: string }; project: { active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; residency?: \"any\" | \"us\" | \"eu\"; self_hosted?: boolean; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string } }",
@@ -1766,6 +1816,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique database identifier (prefixed, e.g. db_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ host: string; port: number; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\" }",
@@ -1928,6 +1985,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique organization identifier."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ description?: string; expires_at?: string; region_label?: string }",
@@ -1982,6 +2046,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique enrollment identifier."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "",
@@ -2050,6 +2121,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique organization identifier."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ body: string; org_id: string; severity?: number; title: string }",
@@ -2131,6 +2209,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique support case identifier (prefixed, e.g. sc_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ body: string }",
@@ -2299,6 +2384,13 @@ var operationsMap_gen = require('./operations-map.gen-gco09oqg.cjs');
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: string[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",

package/dist/operations.d.cts

@@ -1,4 +1,4 @@
-export { qd as ApiOperations, qe as ApiTag, qf as RequestMap, qg as Route, qh as operationsByPath, qi as operationsByTag } from './operations-map.gen-oqab3wi9.js';
+export { qx as ApiOperations, qy as ApiTag, qz as RequestMap, qA as Route, qB as operationsByPath, qC as operationsByTag } from './operations-map.gen-d7lzb0ad.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.d.mts

@@ -1,4 +1,4 @@
-export { qd as ApiOperations, qe as ApiTag, qf as RequestMap, qg as Route, qh as operationsByPath, qi as operationsByTag } from './operations-map.gen-oqab3wi9.js';
+export { qx as ApiOperations, qy as ApiTag, qz as RequestMap, qA as Route, qB as operationsByPath, qC as operationsByTag } from './operations-map.gen-d7lzb0ad.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.mjs

@@ -67,6 +67,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ expires_at?: string; name: string; policy_profile_id: string; principal_type?: \"agent\" | \"human\" }",
@@ -175,6 +182,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique agent credential identifier (prefixed, e.g. agt_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "",
@@ -405,7 +419,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "in": "query",
                 "required": false,
                 "type": "\"allow\" | \"block\" | \"mask\" | \"truncate\"",
-                "description": "Coarse outcome filter that groups events. `allow` = query; `block` = blocked, budget_exhausted, auth_failed, credential_expired; `mask` = masked; `truncate` = truncated."
+                "description": "Coarse outcome filter that groups events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated."
             },
             {
                 "name": "source",
@@ -481,7 +495,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "in": "query",
                 "required": false,
                 "type": "\"allow\" | \"block\" | \"mask\" | \"truncate\"",
-                "description": "Coarse outcome filter that groups events. `allow` = query; `block` = blocked, budget_exhausted, auth_failed, credential_expired; `mask` = masked; `truncate` = truncated."
+                "description": "Coarse outcome filter that groups events. `allow` = query, auto_approved; `block` = blocked, budget_exhausted, auth_failed, credential_expired, canary_tripped, rejected, approval_expired; `mask` = masked; `truncate` = truncated."
             },
             {
                 "name": "source",
@@ -867,6 +881,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ auto_read_routing?: boolean; cache_config?: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; host: string; name: string; password: string; pool_config?: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; username: string }",
@@ -1083,6 +1104,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ domain: string }",
@@ -1203,6 +1231,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ action: \"audit_only\" | \"kill\"; relation_name: string; schema_name?: string }",
@@ -1444,6 +1479,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
@@ -1619,7 +1661,15 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "path": "/v1/projects",
         "summary": "Create a project",
         "description": "Creates a new project within the specified organization.",
-        "parameters": [],
+        "parameters": [
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
+            }
+        ],
         "requestBodyType": "{ cloud?: \"aws\" | \"azure\" | \"gcp\"; database: { auto_read_routing?: boolean; cache_config?: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; host: string; name: string; password: string; pool_config?: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; username: string }; description?: string; name: string; org_id: string; self_hosted?: boolean; tags?: string[] }",
         "requestBodyRequired": true,
         "responseType": "{ database?: { auto_read_routing?: boolean; cache_config: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; connection_string?: string; created_at: string; host: string; id: string; name: string; pool_config: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; project_id: string; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; updated_at: string; username: string }; project: { active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; residency?: \"any\" | \"us\" | \"eu\"; self_hosted?: boolean; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string } }",
@@ -1764,6 +1814,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique database identifier (prefixed, e.g. db_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ host: string; port: number; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\" }",
@@ -1926,6 +1983,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique organization identifier."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ description?: string; expires_at?: string; region_label?: string }",
@@ -1980,6 +2044,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique enrollment identifier."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "",
@@ -2048,6 +2119,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique organization identifier."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ body: string; org_id: string; severity?: number; title: string }",
@@ -2129,6 +2207,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique support case identifier (prefixed, e.g. sc_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ body: string }",
@@ -2297,6 +2382,13 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "required": true,
                 "type": "string",
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "Idempotency-Key",
+                "in": "header",
+                "required": false,
+                "type": "string",
+                "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
         "requestBodyType": "{ description?: string; enabled?: boolean; event_types?: string[]; format?: \"json\" | \"splunk_hec\" | \"datadog\" | \"elastic\"; secret?: string; url: string }",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.4.8",
+  "version": "0.4.10",
   "description": "TypeScript SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol",
   "type": "module",
   "exports": {