from typing import Any, Dict, List, Optional

def pull_policy_exec_histories(
    api,
    type: str,
    days: int,
    policy_name: Optional[str] = None,
) -> str:
    """
    Pull execution history for policies.

    Parameters
    ----------
    api : AirlockAPIWrapper
        The API wrapper instance
    policy_name : Optional[str]
        Name of the policy to query. If None, returns history for all policies.
    type : str
        JSON-style string list of execution types, e.g., "[1,2,3]"
    days : int
        Number of days to look back

    Returns
    -------
    str
        JSON string containing execution history response with structure:
        {"response": {"exechistories": [...]}}
    """
    ...

def history_logging(
    api,
    exec_types: str,
    checkpoint_number: str,
    policy_names: Optional[str] = None,
) -> List[Dict[str, Any]]:
    """
    Query execution history logs from the Airlock API.

    Parameters
    ----------
    api : AirlockAPIWrapper
        The API wrapper instance

    exec_types : str
        A JSON-style string list of execution types to retrieve.
        Example: "[3,5,8]"
        - 0 = Trusted Execution
        - 1 = Blocked Execution
        - 2 = Untrusted Execution [Audit]
        - 3 = Untrusted Execution [OTP]
        - 4 = Trusted Path Execution
        - 5 = Trusted Publisher Execution
        - 6 = Blocklist Execution
        - 7 = Blocklist Execution [Audit]
        - 8 = Trusted Process Execution
        - 9 = Constrained Execution
        - 10 = Trusted Metadata Execution
        - 11 = Trusted Browser Execution
        - 12 = Blocked Browser Execution
        - 13 = Untrusted Browser Execution [Audit]
        - 14 = Untrusted Browser Execution [OTP]
        - 15 = Blocklist Browser Execution [Audit]
        - 16 = Blocklist Browser Execution
        - 17 = Trusted Installer Execution
        - 18 = Trusted Browser Metadata Execution

    checkpoint_number : str
        The checkpoint ID. Used to fetch results after a certain event.
        Example: "601d275487bacb01e3470713"

    policy_names : Optional[str], default None
        A comma-separated or JSON-style list of policy group names.
        If None or not provided, retrieves execution history for ALL policies.
        Example: "Apple Mac" or '["Apple Mac", "Servers London"]'

    Returns
    -------
    List[Dict[str, Any]]
        A list of dictionaries, where each dictionary represents an
        execution history record. Each record can include fields like:

        - checkpoint: str
        - type: int
        - username: str
        - hostname: str
        - filename: str
        - ppolicy: str
        - policyname: str
        - policyver: str
        - commandline: str
        - publisher: str
        - pprocess: str
        - gprocess: str
        - sha256: str
        - datetime: str
        - ip: str
        - localip: str

    Raises
    ------
    RuntimeError
        If the request fails or the response cannot be parsed.

    Examples
    --------
    >>> # Get execution history for ALL policies
    >>> histories = airlock_libs.history_logging(
    ...     api,
    ...     "[1,2,3]",
    ...     "601d275487bacb01e3470713",
    ...     None  # or omit this parameter
    ... )
    >>>
    >>> # Get execution history for a specific policy
    >>> histories = airlock_libs.history_logging(
    ...     api,
    ...     "[3,5,8]",
    ...     "601d275487bacb01e3470713",
    ...     "Apple Mac"
    ... )
    >>> print(histories[0]["filename"])
    'chrome.exe'
    """
    ...