pgbeam 0.3.11 → 0.3.13

package/dist/operations.d.mts

@@ -796,6 +796,609 @@ type RotateAgentCredentialRequestConfig = {
     url: `/v1/projects/${string}/agents/${string}/rotate`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+declare const maskingRuleKindEnum: {
+    readonly redact: "redact";
+    readonly null: "null";
+    readonly hash: "hash";
+};
+type MaskingRuleKindEnumKey = (typeof maskingRuleKindEnum)[keyof typeof maskingRuleKindEnum];
+/**
+ * @description A column masking rule applied to agent query results.
+ * @type object
+*/
+type MaskingRule = {
+    /**
+     * @description Relation name, optionally schema-qualified (e.g. \"public.users\" or \"users\").
+     * @example users
+     * @type string
+    */
+    table: string;
+    /**
+     * @description Column to mask.
+     * @example email
+     * @type string
+    */
+    column: string;
+    /**
+     * @description How to mask. redact replaces with a token, null returns NULL, hash returns a SHA-256 hex.
+     * @type string
+    */
+    kind: MaskingRuleKindEnumKey;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description A per-relation row filter. The predicate is a raw SQL boolean expression ANDed into the WHERE clause for the matching relation.
+ * @type object
+*/
+type RowFilter = {
+    /**
+     * @description Relation name, optionally schema-qualified (e.g. \"public.orders\").
+     * @example orders
+     * @type string
+    */
+    table: string;
+    /**
+     * @description Raw SQL boolean expression ANDed into WHERE for this relation.
+     * @example tenant_id = current_setting('pgbeam.tenant')
+     * @type string
+    */
+    predicate: string;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Per-statement-kind allow/deny lists. Empty allow means all kinds permitted by the access mode.
+ * @type object
+*/
+type StatementRules = {
+    /**
+     * @description Allowed statement kinds (select, insert, update, delete, ddl, copy, set, show, explain, transaction).
+     * @type array | undefined
+    */
+    allow?: string[];
+    /**
+     * @description Denied statement kinds (takes precedence over allow).
+     * @type array | undefined
+    */
+    deny?: string[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const policyProfileInputAccessModeEnum: {
+    readonly read_only: "read_only";
+    readonly read_write: "read_write";
+};
+type PolicyProfileInputAccessModeEnumKey = (typeof policyProfileInputAccessModeEnum)[keyof typeof policyProfileInputAccessModeEnum];
+declare const policyProfileInputWriteModeEnum: {
+    readonly normal: "normal";
+    readonly rollback: "rollback";
+    readonly sandbox: "sandbox";
+};
+type PolicyProfileInputWriteModeEnumKey = (typeof policyProfileInputWriteModeEnum)[keyof typeof policyProfileInputWriteModeEnum];
+declare const policyProfileInputApprovalModeEnum: {
+    readonly off: "off";
+    readonly writes: "writes";
+    readonly ddl: "ddl";
+    readonly all: "all";
+};
+type PolicyProfileInputApprovalModeEnumKey = (typeof policyProfileInputApprovalModeEnum)[keyof typeof policyProfileInputApprovalModeEnum];
+declare const policyProfileInputMigrationSafetyEnum: {
+    readonly off: "off";
+    readonly warn: "warn";
+    readonly block: "block";
+};
+type PolicyProfileInputMigrationSafetyEnumKey = (typeof policyProfileInputMigrationSafetyEnum)[keyof typeof policyProfileInputMigrationSafetyEnum];
+/**
+ * @description Mutable fields of a policy profile (used for create and update).
+ * @type object
+*/
+type PolicyProfileInput = {
+    /**
+     * @description Human-readable name for the policy profile.
+     * @minLength 1
+     * @maxLength 128
+     * @type string
+    */
+    name: string;
+    /**
+     * @description read_only blocks all data and schema mutations.
+     * @default "read_only"
+     * @type string | undefined
+    */
+    access_mode?: PolicyProfileInputAccessModeEnumKey;
+    /**
+     * @description Per-statement-kind allow/deny lists. Empty allow means all kinds permitted by the access mode.
+     * @type object | undefined
+    */
+    statement_rules?: StatementRules;
+    /**
+     * @description If non-empty, only these relations are reachable.
+     * @type array | undefined
+    */
+    table_allowlist?: string[];
+    /**
+     * @description Relations explicitly blocked.
+     * @type array | undefined
+    */
+    table_denylist?: string[];
+    /**
+     * @description Column masking rules applied to query results.
+     * @type array | undefined
+    */
+    masking_rules?: MaskingRule[];
+    /**
+     * @description Max queries per rolling hour window. 0 means unlimited.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    budget_queries_per_hour?: number;
+    /**
+     * @description Max queries per day window. 0 means unlimited.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    budget_queries_per_day?: number;
+    /**
+     * @description Max rows returned per query. 0 means unlimited.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    max_rows?: number;
+    /**
+     * @description Upstream statement timeout for agent sessions. 0 uses the project default.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    statement_timeout_ms?: number;
+    /**
+     * @description Per-relation row filters ANDed into agent reads.
+     * @type array | undefined
+    */
+    row_filters?: RowFilter[];
+    /**
+     * @description How writes are handled. normal commits, rollback auto-rolls back, sandbox routes to an ephemeral branch.
+     * @default "normal"
+     * @type string | undefined
+    */
+    write_mode?: PolicyProfileInputWriteModeEnumKey;
+    /**
+     * @description Which statement classes require human approval before execution.
+     * @default "off"
+     * @type string | undefined
+    */
+    approval_mode?: PolicyProfileInputApprovalModeEnumKey;
+    /**
+     * @description Statements touching at most this many rows are auto-approved. 0 means none.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    approval_auto_max_rows?: number;
+    /**
+     * @description How long a held statement waits for a decision before expiring.
+     * @minLength 0
+     * @default 300
+     * @type integer | undefined
+    */
+    approval_timeout_seconds?: number;
+    /**
+     * @description Migration safety mode. warn surfaces findings, block refuses unsafe DDL.
+     * @default "off"
+     * @type string | undefined
+    */
+    migration_safety?: PolicyProfileInputMigrationSafetyEnumKey;
+    /**
+     * @description Per-day egress budget in bytes. 0 means unlimited.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    egress_bytes_per_day?: number;
+    /**
+     * @description Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
+     * @minLength 0
+     * @default 0
+     * @type integer | undefined
+    */
+    max_affected_rows?: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+declare const dryEvalMaskedColumnKindEnum: {
+    readonly redact: "redact";
+    readonly null: "null";
+    readonly hash: "hash";
+};
+type DryEvalMaskedColumnKindEnumKey = (typeof dryEvalMaskedColumnKindEnum)[keyof typeof dryEvalMaskedColumnKindEnum];
+/**
+ * @description One result column that would be masked, with the mask kind applied.
+ * @type object
+*/
+type DryEvalMaskedColumn = {
+    /**
+     * @description The output column name (post-alias) the client would see masked.
+     * @example email
+     * @type string
+    */
+    column: string;
+    /**
+     * @description How the column is masked.
+     * @type string
+    */
+    kind: DryEvalMaskedColumnKindEnumKey;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const dryEvalResultVerdictEnum: {
+    readonly allow: "allow";
+    readonly block: "block";
+    readonly mask: "mask";
+    readonly "row-filter": "row-filter";
+};
+type DryEvalResultVerdictEnumKey = (typeof dryEvalResultVerdictEnum)[keyof typeof dryEvalResultVerdictEnum];
+/**
+ * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+ * @type object
+*/
+type DryEvalResult = {
+    /**
+     * @description allow — permitted unchanged; block — rejected; mask — permitted but listed result columns are masked; row-filter — permitted but a WHERE predicate is injected (and any listed columns are also masked).
+     * @type string
+    */
+    verdict: DryEvalResultVerdictEnumKey;
+    /**
+     * @description Machine-readable decision tag. For a block, the blocking rule (e.g. read_only, table_denied, table_not_allowed, statement_denied, row_filter_unsafe). Otherwise \"ok\".
+     * @example ok
+     * @type string
+    */
+    rule: string;
+    /**
+     * @description Human-readable explanation of the verdict.
+     * @type string
+    */
+    reason: string;
+    /**
+     * @description What the author could do instead (present on block verdicts).
+     * @type string | undefined
+    */
+    hint?: string;
+    /**
+     * @description Result columns that would be masked. Present on mask/row-filter verdicts.
+     * @type array | undefined
+    */
+    masked_columns?: DryEvalMaskedColumn[];
+    /**
+     * @description The row-filter predicate ANDed into the statement\'s WHERE clause.
+     * @example tenant_id = current_setting('pgbeam.tenant')
+     * @type string | undefined
+    */
+    row_filter_predicate?: string;
+    /**
+     * @description The statement as it would be sent upstream after row-filter injection.
+     * @type string | undefined
+    */
+    rewritten_sql?: string;
+    /**
+     * @description Informational caveats about stateful enforcement a single-statement preview cannot model (per-region budgets, approvals, write-mode routing).
+     * @type array | undefined
+    */
+    notes?: string[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const policyReplayItemChangeEnum: {
+    readonly newly_blocked: "newly_blocked";
+    readonly newly_allowed: "newly_allowed";
+    readonly still_allowed: "still_allowed";
+    readonly still_blocked: "still_blocked";
+};
+type PolicyReplayItemChangeEnumKey = (typeof policyReplayItemChangeEnum)[keyof typeof policyReplayItemChangeEnum];
+/**
+ * @description One distinct recorded query and the decision the candidate policy would reach for it.
+ * @type object
+*/
+type PolicyReplayItem = {
+    /**
+     * @description Normalized query hash identifying this statement shape.
+     * @type string
+    */
+    query_hash: string;
+    /**
+     * @description The recorded statement (normalized, literals replaced with $N placeholders), from its most recent occurrence.
+     * @type string
+    */
+    sql: string;
+    /**
+     * @description Statement kind (select, insert, update, delete, ddl, ...).
+     * @type string | undefined
+    */
+    statement_kind?: string;
+    /**
+     * @description How many recorded entries share this query shape in the window.
+     * @type integer
+    */
+    occurrences: number;
+    /**
+     * @description Oldest occurrence in the window.
+     * @type string
+    */
+    first_seen: string;
+    /**
+     * @description Newest occurrence in the window.
+     * @type string
+    */
+    last_seen: string;
+    /**
+     * @description The most recent recorded outcome for this query (query, masked, truncated, or blocked).
+     * @type string
+    */
+    recorded_event: string;
+    /**
+     * @description The decision rule recorded with a blocked outcome.
+     * @type string | undefined
+    */
+    recorded_rule?: string;
+    /**
+     * @description How the candidate decision compares to the recorded outcome. newly_blocked and newly_allowed are the changes worth reviewing before rollout; still_allowed and still_blocked are unchanged.
+     * @type string
+    */
+    change: PolicyReplayItemChangeEnumKey;
+    /**
+     * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+     * @type object
+    */
+    result: DryEvalResult;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregate outcome of a policy replay.
+ * @type object
+*/
+type PolicyReplaySummary = {
+    /**
+     * @description Recorded audit entries covered by the replayed queries.
+     * @type integer
+    */
+    entries_scanned: number;
+    /**
+     * @description Distinct normalized queries found in the window (capped at limit).
+     * @type integer
+    */
+    distinct_queries: number;
+    /**
+     * @description Distinct queries actually evaluated against the candidate policy.
+     * @type integer
+    */
+    evaluated: number;
+    /**
+     * @description Queries the candidate policy would allow unchanged.
+     * @type integer
+    */
+    would_allow: number;
+    /**
+     * @description Queries the candidate policy would block.
+     * @type integer
+    */
+    would_block: number;
+    /**
+     * @description Queries the candidate policy would mask result columns on.
+     * @type integer
+    */
+    would_mask: number;
+    /**
+     * @description Queries the candidate policy would inject a row filter into.
+     * @type integer
+    */
+    would_row_filter: number;
+    /**
+     * @description Queries that executed under the recorded policy but the candidate policy would block.
+     * @type integer
+    */
+    newly_blocked: number;
+    /**
+     * @description Queries that were blocked when recorded but the candidate policy would permit.
+     * @type integer
+    */
+    newly_allowed: number;
+    /**
+     * @description Distinct queries skipped because the stored statement was truncated at record time and can no longer be parsed faithfully.
+     * @type integer
+    */
+    skipped_unparseable: number;
+    /**
+     * @description True when the window contained more distinct queries than limit; only the newest were replayed.
+     * @type boolean
+    */
+    truncated: boolean;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type PolicyReplayResult = {
+    /**
+     * @description Aggregate outcome of a policy replay.
+     * @type object
+    */
+    summary: PolicyReplaySummary;
+    /**
+     * @description Per-query replay decisions, ordered changes first (newly blocked, then newly allowed), then by occurrence count.
+     * @type array
+    */
+    items: PolicyReplayItem[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description A least-privilege policy derived from an agent credential\'s recorded audit history, together with the replay diff that proves the candidate would not newly block any statement the credential legitimately ran. Advisory only: this endpoint never creates, updates, or otherwise mutates a policy or a credential. A good recommendation has replay.summary.newly_blocked == 0.
+ * @type object
+*/
+type PolicyRecommendation = {
+    /**
+     * @description True when there was enough parseable, executed traffic to derive a candidate. When false, candidate and replay are omitted and message explains why no recommendation could be made.
+     * @type boolean
+    */
+    sufficient_history: boolean;
+    /**
+     * @description Present when sufficient_history is false; a clear explanation of why no recommendation could be produced (e.g. no executed traffic in the window).
+     * @type string | undefined
+    */
+    message?: string;
+    /**
+     * @description Mutable fields of a policy profile (used for create and update).
+     * @type object | undefined
+    */
+    candidate?: PolicyProfileInput;
+    /**
+     * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+     * @type object | undefined
+    */
+    replay?: PolicyReplayResult;
+    /**
+     * @description Distinct executed query shapes the candidate was derived from (blocked attempts are excluded from derivation).
+     * @type integer
+    */
+    observed_queries: number;
+    /**
+     * @description Recorded audit entries covered by the analyzed window.
+     * @type integer
+    */
+    observed_entries: number;
+    /**
+     * @description Start of the analyzed traffic window (inclusive).
+     * @type string
+    */
+    window_start: string;
+    /**
+     * @description End of the analyzed traffic window (exclusive).
+     * @type string
+    */
+    window_end: string;
+    /**
+     * @description Human-readable rationale for each tightening decision (e.g. why the candidate was downgraded to read-only, or how max_rows was chosen).
+     * @type array | undefined
+    */
+    notes?: string[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Optional parameters for a least-privilege policy recommendation. Every field is optional; an empty body analyzes the last 30 days of the credential\'s audit history.
+ * @type object
+*/
+type PolicyRecommendationInput = {
+    /**
+     * @description How many days of recorded audit history to analyze.
+     * @minLength 1
+     * @maxLength 365
+     * @default 30
+     * @type integer | undefined
+    */
+    lookback_days?: number;
+    /**
+     * @description Maximum number of distinct query shapes to analyze and replay, newest first. Traffic is deduplicated by normalized query hash.
+     * @minLength 1
+     * @maxLength 500
+     * @default 200
+     * @type integer | undefined
+    */
+    limit?: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type RecommendAgentPolicyPathProjectId = string;
+/**
+ * @description Unique agent credential identifier (prefixed, e.g. agt_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type RecommendAgentPolicyPathAgentId = string;
+/**
+ * @description A least-privilege policy derived from an agent credential\'s recorded audit history, together with the replay diff that proves the candidate would not newly block any statement the credential legitimately ran. Advisory only: this endpoint never creates, updates, or otherwise mutates a policy or a credential. A good recommendation has replay.summary.newly_blocked == 0.
+ * @type object
+*/
+type RecommendAgentPolicyStatus200 = PolicyRecommendation;
+/**
+ * @description Optional parameters for a least-privilege policy recommendation. Every field is optional; an empty body analyzes the last 30 days of the credential\'s audit history.
+ * @type object | undefined
+*/
+type RecommendAgentPolicyData = PolicyRecommendationInput | undefined;
+/**
+ * @type object
+*/
+type RecommendAgentPolicyRequestConfig = {
+    data?: RecommendAgentPolicyData;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: RecommendAgentPolicyPathProjectId;
+        agent_id: RecommendAgentPolicyPathAgentId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/agents/${string}/policy-recommendation`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -4258,93 +4861,55 @@ type GetHealthStatus200 = HealthResponse;
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-/**
- * @description Aggregate cache performance metrics for the selected time range.
- * @type object
-*/
-type CacheSummary = {
-    /**
-     * @description Total number of cache hits in the selected time range.
-     * @type integer
-    */
-    total_hits: number;
-    /**
-     * @description Total number of cache misses in the selected time range.
-     * @type integer
-    */
-    total_misses: number;
-    /**
-     * @description Cache hit rate as a fraction (0.0 to 1.0).
-     * @type number
-    */
-    hit_rate: number;
-};
-
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-/**
- * @description Aggregate latency metrics for the selected time range.
- * @type object
-*/
-type LatencySummary = {
-    /**
-     * @description Average latency in milliseconds across all queries.
-     * @type number
-    */
-    avg_ms: number;
-    /**
-     * @description P99 latency in milliseconds across all queries.
-     * @type number
-    */
-    p99_ms: number;
+declare const honeytokenActionEnum: {
+    readonly audit_only: "audit_only";
+    readonly kill: "kill";
 };
-
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
+type HoneytokenActionEnumKey = (typeof honeytokenActionEnum)[keyof typeof honeytokenActionEnum];
 /**
- * @description Aggregated analytics for a normalized SQL query shape.
+ * @description A decoy (canary) relation. Any agent statement that references it is blocked (fail closed) and recorded as a canary_tripped audit event.\n
  * @type object
 */
-type QueryInsight = {
+type Honeytoken = {
     /**
-     * @description xxhash64 of the normalized SQL pattern (hex).
+     * @description Unique honeytoken identifier.
+     * @example hnt_01j9x8y7z6w5v4u3t2s1r0q9p8
      * @type string
     */
-    query_hash: string;
+    id: string;
     /**
-     * @description Normalized SQL pattern (truncated to 500 chars).
+     * @description Project the honeytoken belongs to.
+     * @example prj_01j9x8y7z6w5v4u3t2s1r0q9p8
      * @type string
     */
-    query_pattern: string;
+    project_id: string;
     /**
-     * @description Total number of executions in the time range.
-     * @type integer
+     * @description Optional schema. Null matches the unqualified/public form, mirroring the relation allowlist normalization.\n
+     * @example public
+     * @type string
     */
-    total_count: number;
+    schema_name?: string | null;
     /**
-     * @description Total cache hits attributed to the query shape.
-     * @type integer
+     * @description Relation (table or view) name of the decoy.
+     * @example customer_ssns
+     * @type string
     */
-    total_cache_hits: number;
+    relation_name: string;
     /**
-     * @description Total cache misses attributed to the query shape.
-     * @type integer
+     * @description Response when tripped. audit_only blocks the statement, records the event, and fires webhooks. kill additionally disables the tripping credential via the kill-switch.\n
+     * @type string
     */
-    total_cache_misses: number;
+    action: HoneytokenActionEnumKey;
     /**
-     * @description Average query latency in milliseconds.
-     * @type number
+     * @description When the honeytoken was registered.
+     * @type string
     */
-    avg_latency_ms: number;
+    created_at: string;
     /**
-     * @description P99 query latency in milliseconds.
-     * @type number
+     * @description When the honeytoken was last updated.
+     * @type string
     */
-    p99_latency_ms: number;
+    updated_at: string;
 };
 
 /**
@@ -4353,25 +4918,20 @@ type QueryInsight = {
 */
 
 /**
- * @description Query insights, cache performance, and latency for a project.
+ * @description Cursor-paginated honeytokens for a project.
  * @type object
 */
-type ProjectInsights = {
+type ListHoneytokensResponse = {
     /**
-     * @description Top query shapes observed for the project.
+     * @description Honeytokens returned for the current page.
      * @type array
     */
-    queries: QueryInsight[];
-    /**
-     * @description Aggregate cache performance metrics for the selected time range.
-     * @type object
-    */
-    cache: CacheSummary;
+    honeytokens: Honeytoken[];
     /**
-     * @description Aggregate latency metrics for the selected time range.
-     * @type object
+     * @description Opaque token for cursor-based pagination.
+     * @type string | undefined
     */
-    latency: LatencySummary;
+    next_page_token?: string;
 };
 
 /**
@@ -4384,115 +4944,125 @@ type ProjectInsights = {
  * @pattern ^[a-zA-Z0-9_.-]+$
  * @type string
 */
-type GetProjectInsightsPathProjectId = string;
-/**
- * @description Time range to query. Defaults to 24h.
- * @default "24h"
- * @example 24h
- * @type string | undefined
-*/
-type GetProjectInsightsQueryRange = ("1h" | "6h" | "24h" | "7d") | undefined;
+type ListHoneytokensPathProjectId = string;
 /**
- * @description Maximum number of top queries to return (1-100).
+ * @description Maximum number of items to return (1-100, default 20).
  * @minLength 1
  * @maxLength 100
  * @default 20
  * @type integer | undefined
 */
-type GetProjectInsightsQueryLimit = number | undefined;
+type ListHoneytokensQueryPageSize = number | undefined;
+/**
+ * @description Opaque token for cursor-based pagination.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string | undefined
+*/
+type ListHoneytokensQueryPageToken = string | undefined;
 /**
- * @description Query insights, cache performance, and latency for a project.
+ * @description Cursor-paginated honeytokens for a project.
  * @type object
 */
-type GetProjectInsightsStatus200 = ProjectInsights;
+type ListHoneytokensStatus200 = ListHoneytokensResponse;
 /**
  * @type object
 */
-type GetProjectInsightsRequestConfig = {
+type ListHoneytokensRequestConfig = {
     data?: never;
     /**
      * @type object
     */
     pathParams: {
-        project_id: GetProjectInsightsPathProjectId;
+        project_id: ListHoneytokensPathProjectId;
     };
     /**
      * @type object | undefined
     */
     queryParams?: {
-        range?: GetProjectInsightsQueryRange;
-        limit?: GetProjectInsightsQueryLimit;
+        page_size?: ListHoneytokensQueryPageSize;
+        page_token?: ListHoneytokensQueryPageToken;
     };
     headerParams?: never;
     /**
      * @type string
     */
-    url: `/v1/projects/${string}/insights`;
+    url: `/v1/projects/${string}/honeytokens`;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+declare const honeytokenInputActionEnum: {
+    readonly audit_only: "audit_only";
+    readonly kill: "kill";
+};
+type HoneytokenInputActionEnumKey = (typeof honeytokenInputActionEnum)[keyof typeof honeytokenInputActionEnum];
 /**
- * @description A migration script to lint for unsafe schema changes.
+ * @description Request body for creating or updating a honeytoken.
  * @type object
 */
-type MigrationLintRequest = {
+type HoneytokenInput = {
     /**
-     * @description The migration SQL to analyze. May contain multiple statements.
+     * @description Optional schema. Null or empty matches the unqualified/public form.
+     * @maxLength 255
+     * @example public
+     * @type string
+    */
+    schema_name?: string | null;
+    /**
+     * @description Relation (table or view) name of the decoy.
      * @minLength 1
-     * @maxLength 1048576
+     * @maxLength 255
+     * @example customer_ssns
      * @type string
     */
-    sql: string;
+    relation_name: string;
     /**
-     * @description Optional database to scope the lint to.
-     * @type string | undefined
+     * @description Response when the honeytoken is tripped.
+     * @type string
     */
-    database_id?: string;
+    action: HoneytokenInputActionEnumKey;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-declare const migrationFindingSeverityEnum: {
-    readonly info: "info";
-    readonly warning: "warning";
-    readonly error: "error";
-};
-type MigrationFindingSeverityEnumKey = (typeof migrationFindingSeverityEnum)[keyof typeof migrationFindingSeverityEnum];
+
 /**
- * @description A single issue found while linting a migration.
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type CreateHoneytokenPathProjectId = string;
+/**
+ * @description A decoy (canary) relation. Any agent statement that references it is blocked (fail closed) and recorded as a canary_tripped audit event.\n
  * @type object
 */
-type MigrationFinding = {
-    /**
-     * @description How serious the finding is. error indicates an unsafe change.
-     * @type string
-    */
-    severity: MigrationFindingSeverityEnumKey;
+type CreateHoneytokenStatus201 = Honeytoken;
+/**
+ * @description Request body for creating or updating a honeytoken.
+ * @type object
+*/
+type CreateHoneytokenData = HoneytokenInput;
+/**
+ * @type object
+*/
+type CreateHoneytokenRequestConfig = {
+    data?: CreateHoneytokenData;
     /**
-     * @description Machine-readable rule identifier (e.g. drop_table, add_not_null_no_default).
-     * @type string
+     * @type object
     */
-    rule: string;
+    pathParams: {
+        project_id: CreateHoneytokenPathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Human-readable description of the issue.
      * @type string
     */
-    message: string;
-    /**
-     * @description The statement that triggered the finding.
-     * @type string | undefined
-    */
-    statement?: string;
-    /**
-     * @description Suggested safer alternative, if any.
-     * @type string | undefined
-    */
-    hint?: string;
+    url: `/v1/projects/${string}/honeytokens`;
 };
 
 /**
@@ -4501,20 +5071,40 @@ type MigrationFinding = {
 */
 
 /**
- * @description Result of linting a migration script.
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type GetHoneytokenPathProjectId = string;
+/**
+ * @description Unique honeytoken identifier (prefixed, e.g. hnt_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type GetHoneytokenPathHoneytokenId = string;
+/**
+ * @description A decoy (canary) relation. Any agent statement that references it is blocked (fail closed) and recorded as a canary_tripped audit event.\n
  * @type object
 */
-type MigrationLintResponse = {
+type GetHoneytokenStatus200 = Honeytoken;
+/**
+ * @type object
+*/
+type GetHoneytokenRequestConfig = {
+    data?: never;
     /**
-     * @description True when no error-severity findings were detected.
-     * @type boolean
+     * @type object
     */
-    safe: boolean;
+    pathParams: {
+        project_id: GetHoneytokenPathProjectId;
+        honeytoken_id: GetHoneytokenPathHoneytokenId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Findings detected across all statements.
-     * @type array
+     * @type string
     */
-    findings: MigrationFinding[];
+    url: `/v1/projects/${string}/honeytokens/${string}`;
 };
 
 /**
@@ -4527,177 +5117,198 @@ type MigrationLintResponse = {
  * @pattern ^[a-zA-Z0-9_.-]+$
  * @type string
 */
-type LintMigrationPathProjectId = string;
+type UpdateHoneytokenPathProjectId = string;
 /**
- * @description Result of linting a migration script.
+ * @description Unique honeytoken identifier (prefixed, e.g. hnt_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type UpdateHoneytokenPathHoneytokenId = string;
+/**
+ * @description A decoy (canary) relation. Any agent statement that references it is blocked (fail closed) and recorded as a canary_tripped audit event.\n
  * @type object
 */
-type LintMigrationStatus200 = MigrationLintResponse;
+type UpdateHoneytokenStatus200 = Honeytoken;
 /**
- * @description A migration script to lint for unsafe schema changes.
+ * @description Request body for creating or updating a honeytoken.
  * @type object
 */
-type LintMigrationData = MigrationLintRequest;
+type UpdateHoneytokenData = HoneytokenInput;
 /**
  * @type object
 */
-type LintMigrationRequestConfig = {
-    data?: LintMigrationData;
+type UpdateHoneytokenRequestConfig = {
+    data?: UpdateHoneytokenData;
     /**
      * @type object
     */
     pathParams: {
-        project_id: LintMigrationPathProjectId;
+        project_id: UpdateHoneytokenPathProjectId;
+        honeytoken_id: UpdateHoneytokenPathHoneytokenId;
     };
     queryParams?: never;
     headerParams?: never;
     /**
      * @type string
     */
-    url: `/v1/projects/${string}/migrations${string}`;
+    url: `/v1/projects/${string}/honeytokens/${string}`;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type DeleteHoneytokenPathProjectId = string;
+/**
+ * @description Unique honeytoken identifier (prefixed, e.g. hnt_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type DeleteHoneytokenPathHoneytokenId = string;
 /**
- * @description Progress state for the dashboard onboarding checklist.
  * @type object
 */
-type OnboardingProgress = {
-    /**
-     * @description Organization ID this onboarding belongs to.
-     * @type string
-    */
-    organization_id: string;
+type DeleteHoneytokenRequestConfig = {
+    data?: never;
     /**
-     * @description Whether the organization has been created.
-     * @type boolean
+     * @type object
     */
-    org_created: boolean;
+    pathParams: {
+        project_id: DeleteHoneytokenPathProjectId;
+        honeytoken_id: DeleteHoneytokenPathHoneytokenId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Whether a project has been created.
-     * @type boolean
+     * @type string
     */
-    project_created: boolean;
+    url: `/v1/projects/${string}/honeytokens/${string}`;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregate cache performance metrics for the selected time range.
+ * @type object
+*/
+type CacheSummary = {
     /**
-     * @description Whether a database has been added.
-     * @type boolean
+     * @description Total number of cache hits in the selected time range.
+     * @type integer
     */
-    database_added: boolean;
+    total_hits: number;
     /**
-     * @description Whether the database connection has been tested.
-     * @type boolean
+     * @description Total number of cache misses in the selected time range.
+     * @type integer
     */
-    connection_tested: boolean;
+    total_misses: number;
     /**
-     * @description Whether the connection string has been copied.
-     * @type boolean
+     * @description Cache hit rate as a fraction (0.0 to 1.0).
+     * @type number
     */
-    connection_string_copied: boolean;
+    hit_rate: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregate latency metrics for the selected time range.
+ * @type object
+*/
+type LatencySummary = {
     /**
-     * @description Whether the first query has been run through PgBeam.
-     * @type boolean
+     * @description Average latency in milliseconds across all queries.
+     * @type number
     */
-    first_query_run: boolean;
+    avg_ms: number;
     /**
-     * @description Whether an agent credential has been issued.
-     * @type boolean
+     * @description P99 latency in milliseconds across all queries.
+     * @type number
     */
-    agent_credential_created: boolean;
+    p99_ms: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregated analytics for a normalized SQL query shape.
+ * @type object
+*/
+type QueryInsight = {
     /**
-     * @description Whether the user has dismissed the onboarding checklist.
-     * @type boolean
+     * @description xxhash64 of the normalized SQL pattern (hex).
+     * @type string
     */
-    dismissed: boolean;
+    query_hash: string;
     /**
-     * @description Whether all onboarding steps are complete.
-     * @type boolean
+     * @description Normalized SQL pattern (truncated to 500 chars).
+     * @type string
     */
-    completed: boolean;
+    query_pattern: string;
     /**
-     * @description Number of completed onboarding steps.
+     * @description Total number of executions in the time range.
      * @type integer
     */
-    steps_completed: number;
+    total_count: number;
     /**
-     * @description Total number of onboarding steps.
+     * @description Total cache hits attributed to the query shape.
      * @type integer
     */
-    steps_total: number;
+    total_cache_hits: number;
     /**
-     * @description When onboarding was completed. Null if not yet completed.
-     * @type string
+     * @description Total cache misses attributed to the query shape.
+     * @type integer
     */
-    completed_at?: string | null;
-};
-
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-
-/**
- * @description Unique organization identifier.
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @example org_abc123
- * @type string
-*/
-type GetOnboardingProgressPathOrgId = string;
-/**
- * @description Progress state for the dashboard onboarding checklist.
- * @type object
-*/
-type GetOnboardingProgressStatus200 = OnboardingProgress;
-/**
- * @type object
-*/
-type GetOnboardingProgressRequestConfig = {
-    data?: never;
+    total_cache_misses: number;
     /**
-     * @type object
+     * @description Average query latency in milliseconds.
+     * @type number
     */
-    pathParams: {
-        org_id: GetOnboardingProgressPathOrgId;
-    };
-    queryParams?: never;
-    headerParams?: never;
+    avg_latency_ms: number;
     /**
-     * @type string
+     * @description P99 query latency in milliseconds.
+     * @type number
     */
-    url: `/v1/organizations/${string}/onboarding`;
+    p99_latency_ms: number;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-declare const updateOnboardingRequestStepEnum: {
-    readonly project_created: "project_created";
-    readonly database_added: "database_added";
-    readonly connection_tested: "connection_tested";
-    readonly connection_string_copied: "connection_string_copied";
-    readonly first_query_run: "first_query_run";
-    readonly agent_credential_created: "agent_credential_created";
-};
-type UpdateOnboardingRequestStepEnumKey = (typeof updateOnboardingRequestStepEnum)[keyof typeof updateOnboardingRequestStepEnum];
+
 /**
- * @description Request body for advancing or dismissing onboarding.
+ * @description Query insights, cache performance, and latency for a project.
  * @type object
 */
-type UpdateOnboardingRequest = {
+type ProjectInsights = {
     /**
-     * @description The onboarding step to mark as complete.
-     * @example project_created
-     * @type string | undefined
+     * @description Top query shapes observed for the project.
+     * @type array
     */
-    step?: UpdateOnboardingRequestStepEnumKey;
+    queries: QueryInsight[];
     /**
-     * @description Set to true to dismiss the onboarding checklist.
-     * @type boolean | undefined
+     * @description Aggregate cache performance metrics for the selected time range.
+     * @type object
     */
-    dismiss?: boolean;
+    cache: CacheSummary;
+    /**
+     * @description Aggregate latency metrics for the selected time range.
+     * @type object
+    */
+    latency: LatencySummary;
 };
 
 /**
@@ -4706,117 +5317,141 @@ type UpdateOnboardingRequest = {
 */
 
 /**
- * @description Unique organization identifier.
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
  * @pattern ^[a-zA-Z0-9_.-]+$
- * @example org_abc123
  * @type string
 */
-type UpdateOnboardingProgressPathOrgId = string;
+type GetProjectInsightsPathProjectId = string;
 /**
- * @description Progress state for the dashboard onboarding checklist.
- * @type object
+ * @description Time range to query. Defaults to 24h.
+ * @default "24h"
+ * @example 24h
+ * @type string | undefined
 */
-type UpdateOnboardingProgressStatus200 = OnboardingProgress;
+type GetProjectInsightsQueryRange = ("1h" | "6h" | "24h" | "7d") | undefined;
 /**
- * @description Request body for advancing or dismissing onboarding.
+ * @description Maximum number of top queries to return (1-100).
+ * @minLength 1
+ * @maxLength 100
+ * @default 20
+ * @type integer | undefined
+*/
+type GetProjectInsightsQueryLimit = number | undefined;
+/**
+ * @description Query insights, cache performance, and latency for a project.
  * @type object
 */
-type UpdateOnboardingProgressData = UpdateOnboardingRequest;
+type GetProjectInsightsStatus200 = ProjectInsights;
 /**
  * @type object
 */
-type UpdateOnboardingProgressRequestConfig = {
-    data?: UpdateOnboardingProgressData;
+type GetProjectInsightsRequestConfig = {
+    data?: never;
     /**
      * @type object
     */
     pathParams: {
-        org_id: UpdateOnboardingProgressPathOrgId;
+        project_id: GetProjectInsightsPathProjectId;
+    };
+    /**
+     * @type object | undefined
+    */
+    queryParams?: {
+        range?: GetProjectInsightsQueryRange;
+        limit?: GetProjectInsightsQueryLimit;
     };
-    queryParams?: never;
     headerParams?: never;
     /**
      * @type string
     */
-    url: `/v1/organizations/${string}/onboarding`;
+    url: `/v1/projects/${string}/insights`;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
-declare const maskingRuleKindEnum: {
-    readonly redact: "redact";
-    readonly null: "null";
-    readonly hash: "hash";
-};
-type MaskingRuleKindEnumKey = (typeof maskingRuleKindEnum)[keyof typeof maskingRuleKindEnum];
 /**
- * @description A column masking rule applied to agent query results.
+ * @description A migration script to lint for unsafe schema changes.
  * @type object
 */
-type MaskingRule = {
-    /**
-     * @description Relation name, optionally schema-qualified (e.g. \"public.users\" or \"users\").
-     * @example users
-     * @type string
-    */
-    table: string;
+type MigrationLintRequest = {
     /**
-     * @description Column to mask.
-     * @example email
+     * @description The migration SQL to analyze. May contain multiple statements.
+     * @minLength 1
+     * @maxLength 1048576
      * @type string
     */
-    column: string;
+    sql: string;
     /**
-     * @description How to mask. redact replaces with a token, null returns NULL, hash returns a SHA-256 hex.
-     * @type string
+     * @description Optional database to scope the lint to.
+     * @type string | undefined
     */
-    kind: MaskingRuleKindEnumKey;
+    database_id?: string;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+declare const migrationFindingSeverityEnum: {
+    readonly info: "info";
+    readonly warning: "warning";
+    readonly error: "error";
+};
+type MigrationFindingSeverityEnumKey = (typeof migrationFindingSeverityEnum)[keyof typeof migrationFindingSeverityEnum];
 /**
- * @description A per-relation row filter. The predicate is a raw SQL boolean expression ANDed into the WHERE clause for the matching relation.
+ * @description A single issue found while linting a migration.
  * @type object
 */
-type RowFilter = {
+type MigrationFinding = {
     /**
-     * @description Relation name, optionally schema-qualified (e.g. \"public.orders\").
-     * @example orders
+     * @description How serious the finding is. error indicates an unsafe change.
      * @type string
     */
-    table: string;
+    severity: MigrationFindingSeverityEnumKey;
     /**
-     * @description Raw SQL boolean expression ANDed into WHERE for this relation.
-     * @example tenant_id = current_setting('pgbeam.tenant')
+     * @description Machine-readable rule identifier (e.g. drop_table, add_not_null_no_default).
      * @type string
     */
-    predicate: string;
+    rule: string;
+    /**
+     * @description Human-readable description of the issue.
+     * @type string
+    */
+    message: string;
+    /**
+     * @description The statement that triggered the finding.
+     * @type string | undefined
+    */
+    statement?: string;
+    /**
+     * @description Suggested safer alternative, if any.
+     * @type string | undefined
+    */
+    hint?: string;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+
 /**
- * @description Per-statement-kind allow/deny lists. Empty allow means all kinds permitted by the access mode.
+ * @description Result of linting a migration script.
  * @type object
 */
-type StatementRules = {
+type MigrationLintResponse = {
     /**
-     * @description Allowed statement kinds (select, insert, update, delete, ddl, copy, set, show, explain, transaction).
-     * @type array | undefined
+     * @description True when no error-severity findings were detected.
+     * @type boolean
     */
-    allow?: string[];
+    safe: boolean;
     /**
-     * @description Denied statement kinds (takes precedence over allow).
-     * @type array | undefined
+     * @description Findings detected across all statements.
+     * @type array
     */
-    deny?: string[];
+    findings: MigrationFinding[];
 };
 
 /**
@@ -4824,163 +5459,115 @@ type StatementRules = {
 * Do not edit manually.
 */
 
-declare const policyProfileAccessModeEnum: {
-    readonly read_only: "read_only";
-    readonly read_write: "read_write";
-};
-type PolicyProfileAccessModeEnumKey = (typeof policyProfileAccessModeEnum)[keyof typeof policyProfileAccessModeEnum];
-declare const policyProfileWriteModeEnum: {
-    readonly normal: "normal";
-    readonly rollback: "rollback";
-    readonly sandbox: "sandbox";
-};
-type PolicyProfileWriteModeEnumKey = (typeof policyProfileWriteModeEnum)[keyof typeof policyProfileWriteModeEnum];
-declare const policyProfileApprovalModeEnum: {
-    readonly off: "off";
-    readonly writes: "writes";
-    readonly ddl: "ddl";
-    readonly all: "all";
-};
-type PolicyProfileApprovalModeEnumKey = (typeof policyProfileApprovalModeEnum)[keyof typeof policyProfileApprovalModeEnum];
-declare const policyProfileMigrationSafetyEnum: {
-    readonly off: "off";
-    readonly warn: "warn";
-    readonly block: "block";
-};
-type PolicyProfileMigrationSafetyEnumKey = (typeof policyProfileMigrationSafetyEnum)[keyof typeof policyProfileMigrationSafetyEnum];
 /**
- * @description A named bundle of rules enforced on agent credentials in the data plane.
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type LintMigrationPathProjectId = string;
+/**
+ * @description Result of linting a migration script.
  * @type object
 */
-type PolicyProfile = {
-    /**
-     * @description Unique policy profile identifier (prefixed).
-     * @example pol_01h455vb4pex5vsknk084sn02q
-     * @type string
-    */
-    id: string;
-    /**
-     * @description Owning project ID.
-     * @example prj_01h455vb4pex5vsknk084sn02q
-     * @type string
-    */
-    project_id: string;
-    /**
-     * @description Human-readable name for the policy profile.
-     * @example Read-only analytics
-     * @type string
-    */
-    name: string;
-    /**
-     * @description read_only blocks all data and schema mutations.
-     * @type string
-    */
-    access_mode: PolicyProfileAccessModeEnumKey;
-    /**
-     * @description Per-statement-kind allow/deny lists. Empty allow means all kinds permitted by the access mode.
-     * @type object | undefined
-    */
-    statement_rules?: StatementRules;
-    /**
-     * @description If non-empty, only these relations are reachable. Schema-qualified or bare names.
-     * @type array
-    */
-    table_allowlist: string[];
-    /**
-     * @description Relations explicitly blocked (takes precedence over the allowlist).
-     * @type array
-    */
-    table_denylist: string[];
+type LintMigrationStatus200 = MigrationLintResponse;
+/**
+ * @description A migration script to lint for unsafe schema changes.
+ * @type object
+*/
+type LintMigrationData = MigrationLintRequest;
+/**
+ * @type object
+*/
+type LintMigrationRequestConfig = {
+    data?: LintMigrationData;
     /**
-     * @description Column masking rules applied to query results.
-     * @type array
+     * @type object
     */
-    masking_rules: MaskingRule[];
+    pathParams: {
+        project_id: LintMigrationPathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Max queries per rolling hour window. 0 means unlimited.
-     * @default 0
-     * @type integer | undefined
+     * @type string
     */
-    budget_queries_per_hour?: number;
+    url: `/v1/projects/${string}/migrations${string}`;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Progress state for the dashboard onboarding checklist.
+ * @type object
+*/
+type OnboardingProgress = {
     /**
-     * @description Max queries per day window. 0 means unlimited.
-     * @default 0
-     * @type integer | undefined
+     * @description Organization ID this onboarding belongs to.
+     * @type string
     */
-    budget_queries_per_day?: number;
+    organization_id: string;
     /**
-     * @description Max rows returned per query. 0 means unlimited.
-     * @default 0
-     * @type integer | undefined
+     * @description Whether the organization has been created.
+     * @type boolean
     */
-    max_rows?: number;
+    org_created: boolean;
     /**
-     * @description Upstream statement timeout for agent sessions. 0 uses the project default.
-     * @default 0
-     * @type integer | undefined
+     * @description Whether a project has been created.
+     * @type boolean
     */
-    statement_timeout_ms?: number;
+    project_created: boolean;
     /**
-     * @description Per-relation row filters ANDed into agent reads.
-     * @type array | undefined
+     * @description Whether a database has been added.
+     * @type boolean
     */
-    row_filters?: RowFilter[];
+    database_added: boolean;
     /**
-     * @description How writes are handled. normal commits, rollback auto-rolls back, sandbox routes to an ephemeral branch.
-     * @default "normal"
-     * @type string | undefined
+     * @description Whether the database connection has been tested.
+     * @type boolean
     */
-    write_mode?: PolicyProfileWriteModeEnumKey;
+    connection_tested: boolean;
     /**
-     * @description Which statement classes require human approval before execution.
-     * @default "off"
-     * @type string | undefined
+     * @description Whether the connection string has been copied.
+     * @type boolean
     */
-    approval_mode?: PolicyProfileApprovalModeEnumKey;
+    connection_string_copied: boolean;
     /**
-     * @description Statements touching at most this many rows are auto-approved. 0 means none.
-     * @minLength 0
-     * @default 0
-     * @type integer | undefined
+     * @description Whether the first query has been run through PgBeam.
+     * @type boolean
     */
-    approval_auto_max_rows?: number;
+    first_query_run: boolean;
     /**
-     * @description How long a held statement waits for a decision before expiring.
-     * @minLength 0
-     * @default 300
-     * @type integer | undefined
+     * @description Whether an agent credential has been issued.
+     * @type boolean
     */
-    approval_timeout_seconds?: number;
+    agent_credential_created: boolean;
     /**
-     * @description Migration safety mode. warn surfaces findings, block refuses unsafe DDL.
-     * @default "off"
-     * @type string | undefined
+     * @description Whether the user has dismissed the onboarding checklist.
+     * @type boolean
     */
-    migration_safety?: PolicyProfileMigrationSafetyEnumKey;
+    dismissed: boolean;
     /**
-     * @description Per-day egress budget in bytes. 0 means unlimited.
-     * @minLength 0
-     * @default 0
-     * @type integer | undefined
+     * @description Whether all onboarding steps are complete.
+     * @type boolean
     */
-    egress_bytes_per_day?: number;
+    completed: boolean;
     /**
-     * @description Hard cap on rows a single write (INSERT/UPDATE/DELETE) may affect. A write whose affected-row count would exceed this is executed inside a transaction, checked, and rolled back so nothing persists, then blocked. Enforced independently of human approval. 0 means unlimited.
-     * @minLength 0
-     * @default 0
-     * @type integer | undefined
+     * @description Number of completed onboarding steps.
+     * @type integer
     */
-    max_affected_rows?: number;
+    steps_completed: number;
     /**
-     * @description When the policy profile was created.
-     * @type string
+     * @description Total number of onboarding steps.
+     * @type integer
     */
-    created_at: string;
+    steps_total: number;
     /**
-     * @description When the policy profile was last updated.
+     * @description When onboarding was completed. Null if not yet completed.
      * @type string
     */
-    updated_at: string;
+    completed_at?: string | null;
 };
 
 /**
@@ -4989,20 +5576,65 @@ type PolicyProfile = {
 */
 
 /**
- * @description Cursor-paginated list of policy profiles for a project.
+ * @description Unique organization identifier.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @example org_abc123
+ * @type string
+*/
+type GetOnboardingProgressPathOrgId = string;
+/**
+ * @description Progress state for the dashboard onboarding checklist.
  * @type object
 */
-type ListPolicyProfilesResponse = {
+type GetOnboardingProgressStatus200 = OnboardingProgress;
+/**
+ * @type object
+*/
+type GetOnboardingProgressRequestConfig = {
+    data?: never;
     /**
-     * @description Policy profiles on the current page.
-     * @type array
+     * @type object
     */
-    policies: PolicyProfile[];
+    pathParams: {
+        org_id: GetOnboardingProgressPathOrgId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Token for the next page. Empty if no more results.
+     * @type string
+    */
+    url: `/v1/organizations/${string}/onboarding`;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+declare const updateOnboardingRequestStepEnum: {
+    readonly project_created: "project_created";
+    readonly database_added: "database_added";
+    readonly connection_tested: "connection_tested";
+    readonly connection_string_copied: "connection_string_copied";
+    readonly first_query_run: "first_query_run";
+    readonly agent_credential_created: "agent_credential_created";
+};
+type UpdateOnboardingRequestStepEnumKey = (typeof updateOnboardingRequestStepEnum)[keyof typeof updateOnboardingRequestStepEnum];
+/**
+ * @description Request body for advancing or dismissing onboarding.
+ * @type object
+*/
+type UpdateOnboardingRequest = {
+    /**
+     * @description The onboarding step to mark as complete.
+     * @example project_created
      * @type string | undefined
     */
-    next_page_token?: string;
+    step?: UpdateOnboardingRequestStepEnumKey;
+    /**
+     * @description Set to true to dismiss the onboarding checklist.
+     * @type boolean | undefined
+    */
+    dismiss?: boolean;
 };
 
 /**
@@ -5011,53 +5643,74 @@ type ListPolicyProfilesResponse = {
 */
 
 /**
- * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @description Unique organization identifier.
  * @pattern ^[a-zA-Z0-9_.-]+$
+ * @example org_abc123
  * @type string
 */
-type ListPolicyProfilesPathProjectId = string;
-/**
- * @description Maximum number of items to return (1-100, default 20).
- * @minLength 1
- * @maxLength 100
- * @default 20
- * @type integer | undefined
-*/
-type ListPolicyProfilesQueryPageSize = number | undefined;
+type UpdateOnboardingProgressPathOrgId = string;
 /**
- * @description Opaque token for cursor-based pagination.
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string | undefined
+ * @description Progress state for the dashboard onboarding checklist.
+ * @type object
 */
-type ListPolicyProfilesQueryPageToken = string | undefined;
+type UpdateOnboardingProgressStatus200 = OnboardingProgress;
 /**
- * @description Cursor-paginated list of policy profiles for a project.
+ * @description Request body for advancing or dismissing onboarding.
  * @type object
 */
-type ListPolicyProfilesStatus200 = ListPolicyProfilesResponse;
+type UpdateOnboardingProgressData = UpdateOnboardingRequest;
 /**
  * @type object
 */
-type ListPolicyProfilesRequestConfig = {
-    data?: never;
+type UpdateOnboardingProgressRequestConfig = {
+    data?: UpdateOnboardingProgressData;
     /**
      * @type object
     */
     pathParams: {
-        project_id: ListPolicyProfilesPathProjectId;
+        org_id: UpdateOnboardingProgressPathOrgId;
     };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @type object | undefined
+     * @type string
     */
-    queryParams?: {
-        page_size?: ListPolicyProfilesQueryPageSize;
-        page_token?: ListPolicyProfilesQueryPageToken;
-    };
-    headerParams?: never;
+    url: `/v1/organizations/${string}/onboarding`;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description An organization visible to the caller\'s credential.
+ * @type object
+*/
+type OrganizationSummary = {
+    /**
+     * @description Organization identifier.
+     * @example org_abc123
+     * @type string
+    */
+    id: string;
     /**
+     * @description Organization display name.
+     * @example Acme Corp
      * @type string
     */
-    url: `/v1/projects/${string}/policies`;
+    name: string;
+    /**
+     * @description Organization slug used in URLs and routing.
+     * @example acme-corp
+     * @type string
+    */
+    slug: string;
+    /**
+     * @description The caller\'s role within the organization. Omitted for organization-scoped API keys, which act as the organization itself rather than as a member.
+     * @example owner
+     * @type string | undefined
+    */
+    role?: string;
 };
 
 /**
@@ -5065,92 +5718,126 @@ type ListPolicyProfilesRequestConfig = {
 * Do not edit manually.
 */
 
-declare const policyProfileInputAccessModeEnum: {
+/**
+ * @description Organizations visible to the caller\'s credential.
+ * @type object
+*/
+type ListOrganizationsResponse = {
+    /**
+     * @description Organizations the caller can access.
+     * @type array
+    */
+    organizations: OrganizationSummary[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Organizations visible to the caller\'s credential.
+ * @type object
+*/
+type ListOrganizationsStatus200 = ListOrganizationsResponse;
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const policyProfileAccessModeEnum: {
     readonly read_only: "read_only";
     readonly read_write: "read_write";
 };
-type PolicyProfileInputAccessModeEnumKey = (typeof policyProfileInputAccessModeEnum)[keyof typeof policyProfileInputAccessModeEnum];
-declare const policyProfileInputWriteModeEnum: {
+type PolicyProfileAccessModeEnumKey = (typeof policyProfileAccessModeEnum)[keyof typeof policyProfileAccessModeEnum];
+declare const policyProfileWriteModeEnum: {
     readonly normal: "normal";
     readonly rollback: "rollback";
     readonly sandbox: "sandbox";
 };
-type PolicyProfileInputWriteModeEnumKey = (typeof policyProfileInputWriteModeEnum)[keyof typeof policyProfileInputWriteModeEnum];
-declare const policyProfileInputApprovalModeEnum: {
+type PolicyProfileWriteModeEnumKey = (typeof policyProfileWriteModeEnum)[keyof typeof policyProfileWriteModeEnum];
+declare const policyProfileApprovalModeEnum: {
     readonly off: "off";
     readonly writes: "writes";
     readonly ddl: "ddl";
     readonly all: "all";
 };
-type PolicyProfileInputApprovalModeEnumKey = (typeof policyProfileInputApprovalModeEnum)[keyof typeof policyProfileInputApprovalModeEnum];
-declare const policyProfileInputMigrationSafetyEnum: {
+type PolicyProfileApprovalModeEnumKey = (typeof policyProfileApprovalModeEnum)[keyof typeof policyProfileApprovalModeEnum];
+declare const policyProfileMigrationSafetyEnum: {
     readonly off: "off";
     readonly warn: "warn";
     readonly block: "block";
 };
-type PolicyProfileInputMigrationSafetyEnumKey = (typeof policyProfileInputMigrationSafetyEnum)[keyof typeof policyProfileInputMigrationSafetyEnum];
+type PolicyProfileMigrationSafetyEnumKey = (typeof policyProfileMigrationSafetyEnum)[keyof typeof policyProfileMigrationSafetyEnum];
 /**
- * @description Mutable fields of a policy profile (used for create and update).
+ * @description A named bundle of rules enforced on agent credentials in the data plane.
  * @type object
 */
-type PolicyProfileInput = {
+type PolicyProfile = {
+    /**
+     * @description Unique policy profile identifier (prefixed).
+     * @example pol_01h455vb4pex5vsknk084sn02q
+     * @type string
+    */
+    id: string;
+    /**
+     * @description Owning project ID.
+     * @example prj_01h455vb4pex5vsknk084sn02q
+     * @type string
+    */
+    project_id: string;
     /**
      * @description Human-readable name for the policy profile.
-     * @minLength 1
-     * @maxLength 128
+     * @example Read-only analytics
      * @type string
     */
     name: string;
     /**
      * @description read_only blocks all data and schema mutations.
-     * @default "read_only"
-     * @type string | undefined
+     * @type string
     */
-    access_mode?: PolicyProfileInputAccessModeEnumKey;
+    access_mode: PolicyProfileAccessModeEnumKey;
     /**
      * @description Per-statement-kind allow/deny lists. Empty allow means all kinds permitted by the access mode.
      * @type object | undefined
     */
     statement_rules?: StatementRules;
     /**
-     * @description If non-empty, only these relations are reachable.
-     * @type array | undefined
+     * @description If non-empty, only these relations are reachable. Schema-qualified or bare names.
+     * @type array
     */
-    table_allowlist?: string[];
+    table_allowlist: string[];
     /**
-     * @description Relations explicitly blocked.
-     * @type array | undefined
+     * @description Relations explicitly blocked (takes precedence over the allowlist).
+     * @type array
     */
-    table_denylist?: string[];
+    table_denylist: string[];
     /**
      * @description Column masking rules applied to query results.
-     * @type array | undefined
+     * @type array
     */
-    masking_rules?: MaskingRule[];
+    masking_rules: MaskingRule[];
     /**
      * @description Max queries per rolling hour window. 0 means unlimited.
-     * @minLength 0
      * @default 0
      * @type integer | undefined
     */
     budget_queries_per_hour?: number;
     /**
      * @description Max queries per day window. 0 means unlimited.
-     * @minLength 0
      * @default 0
      * @type integer | undefined
     */
     budget_queries_per_day?: number;
     /**
      * @description Max rows returned per query. 0 means unlimited.
-     * @minLength 0
      * @default 0
      * @type integer | undefined
     */
     max_rows?: number;
     /**
      * @description Upstream statement timeout for agent sessions. 0 uses the project default.
-     * @minLength 0
      * @default 0
      * @type integer | undefined
     */
@@ -5165,13 +5852,13 @@ type PolicyProfileInput = {
      * @default "normal"
      * @type string | undefined
     */
-    write_mode?: PolicyProfileInputWriteModeEnumKey;
+    write_mode?: PolicyProfileWriteModeEnumKey;
     /**
      * @description Which statement classes require human approval before execution.
      * @default "off"
      * @type string | undefined
     */
-    approval_mode?: PolicyProfileInputApprovalModeEnumKey;
+    approval_mode?: PolicyProfileApprovalModeEnumKey;
     /**
      * @description Statements touching at most this many rows are auto-approved. 0 means none.
      * @minLength 0
@@ -5191,7 +5878,7 @@ type PolicyProfileInput = {
      * @default "off"
      * @type string | undefined
     */
-    migration_safety?: PolicyProfileInputMigrationSafetyEnumKey;
+    migration_safety?: PolicyProfileMigrationSafetyEnumKey;
     /**
      * @description Per-day egress budget in bytes. 0 means unlimited.
      * @minLength 0
@@ -5206,88 +5893,16 @@ type PolicyProfileInput = {
      * @type integer | undefined
     */
     max_affected_rows?: number;
-};
-
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-
-/**
- * @description Unique project identifier (prefixed, e.g. prj_xxx).
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string
-*/
-type CreatePolicyProfilePathProjectId = string;
-/**
- * @description A named bundle of rules enforced on agent credentials in the data plane.
- * @type object
-*/
-type CreatePolicyProfileStatus201 = PolicyProfile;
-/**
- * @description Mutable fields of a policy profile (used for create and update).
- * @type object
-*/
-type CreatePolicyProfileData = PolicyProfileInput;
-/**
- * @type object
-*/
-type CreatePolicyProfileRequestConfig = {
-    data?: CreatePolicyProfileData;
-    /**
-     * @type object
-    */
-    pathParams: {
-        project_id: CreatePolicyProfilePathProjectId;
-    };
-    queryParams?: never;
-    headerParams?: never;
     /**
+     * @description When the policy profile was created.
      * @type string
     */
-    url: `/v1/projects/${string}/policies`;
-};
-
-/**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-
-/**
- * @description Unique project identifier (prefixed, e.g. prj_xxx).
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string
-*/
-type GetPolicyProfilePathProjectId = string;
-/**
- * @description Unique policy profile identifier (prefixed, e.g. pol_xxx).
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string
-*/
-type GetPolicyProfilePathPolicyId = string;
-/**
- * @description A named bundle of rules enforced on agent credentials in the data plane.
- * @type object
-*/
-type GetPolicyProfileStatus200 = PolicyProfile;
-/**
- * @type object
-*/
-type GetPolicyProfileRequestConfig = {
-    data?: never;
-    /**
-     * @type object
-    */
-    pathParams: {
-        project_id: GetPolicyProfilePathProjectId;
-        policy_id: GetPolicyProfilePathPolicyId;
-    };
-    queryParams?: never;
-    headerParams?: never;
+    created_at: string;
     /**
+     * @description When the policy profile was last updated.
      * @type string
     */
-    url: `/v1/projects/${string}/policies/${string}`;
+    updated_at: string;
 };
 
 /**
@@ -5296,45 +5911,20 @@ type GetPolicyProfileRequestConfig = {
 */
 
 /**
- * @description Unique project identifier (prefixed, e.g. prj_xxx).
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string
-*/
-type UpdatePolicyProfilePathProjectId = string;
-/**
- * @description Unique policy profile identifier (prefixed, e.g. pol_xxx).
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string
-*/
-type UpdatePolicyProfilePathPolicyId = string;
-/**
- * @description A named bundle of rules enforced on agent credentials in the data plane.
- * @type object
-*/
-type UpdatePolicyProfileStatus200 = PolicyProfile;
-/**
- * @description Mutable fields of a policy profile (used for create and update).
- * @type object
-*/
-type UpdatePolicyProfileData = PolicyProfileInput;
-/**
+ * @description Cursor-paginated list of policy profiles for a project.
  * @type object
 */
-type UpdatePolicyProfileRequestConfig = {
-    data?: UpdatePolicyProfileData;
+type ListPolicyProfilesResponse = {
     /**
-     * @type object
+     * @description Policy profiles on the current page.
+     * @type array
     */
-    pathParams: {
-        project_id: UpdatePolicyProfilePathProjectId;
-        policy_id: UpdatePolicyProfilePathPolicyId;
-    };
-    queryParams?: never;
-    headerParams?: never;
+    policies: PolicyProfile[];
     /**
-     * @type string
+     * @description Token for the next page. Empty if no more results.
+     * @type string | undefined
     */
-    url: `/v1/projects/${string}/policies/${string}`;
+    next_page_token?: string;
 };
 
 /**
@@ -5347,90 +5937,49 @@ type UpdatePolicyProfileRequestConfig = {
  * @pattern ^[a-zA-Z0-9_.-]+$
  * @type string
 */
-type DeletePolicyProfilePathProjectId = string;
-/**
- * @description Unique policy profile identifier (prefixed, e.g. pol_xxx).
- * @pattern ^[a-zA-Z0-9_.-]+$
- * @type string
-*/
-type DeletePolicyProfilePathPolicyId = string;
-/**
- * @type object
-*/
-type DeletePolicyProfileRequestConfig = {
-    data?: never;
-    /**
-     * @type object
-    */
-    pathParams: {
-        project_id: DeletePolicyProfilePathProjectId;
-        policy_id: DeletePolicyProfilePathPolicyId;
-    };
-    queryParams?: never;
-    headerParams?: never;
-    /**
-     * @type string
-    */
-    url: `/v1/projects/${string}/policies/${string}`;
-};
-
+type ListPolicyProfilesPathProjectId = string;
 /**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
+ * @description Maximum number of items to return (1-100, default 20).
+ * @minLength 1
+ * @maxLength 100
+ * @default 20
+ * @type integer | undefined
 */
-
+type ListPolicyProfilesQueryPageSize = number | undefined;
 /**
- * @description A SQL statement to test plus the policy to test it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
- * @type object
+ * @description Opaque token for cursor-based pagination.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string | undefined
 */
-type DryEvalInput = {
-    /**
-     * @description The single SQL statement to evaluate.
-     * @minLength 1
-     * @maxLength 100000
-     * @example SELECT email FROM users WHERE id = 1
-     * @type string
-    */
-    sql: string;
-    /**
-     * @description ID of an existing saved policy profile to evaluate against.
-     * @example pol_01h455vb4pex5vsknk084sn02q
-     * @type string | undefined
-    */
-    policy_id?: string;
-    /**
-     * @description Mutable fields of a policy profile (used for create and update).
-     * @type object | undefined
-    */
-    policy?: PolicyProfileInput;
-};
-
+type ListPolicyProfilesQueryPageToken = string | undefined;
 /**
-* Generated by Kubb (https://kubb.dev/).
-* Do not edit manually.
-*/
-declare const dryEvalMaskedColumnKindEnum: {
-    readonly redact: "redact";
-    readonly null: "null";
-    readonly hash: "hash";
-};
-type DryEvalMaskedColumnKindEnumKey = (typeof dryEvalMaskedColumnKindEnum)[keyof typeof dryEvalMaskedColumnKindEnum];
+ * @description Cursor-paginated list of policy profiles for a project.
+ * @type object
+*/
+type ListPolicyProfilesStatus200 = ListPolicyProfilesResponse;
 /**
- * @description One result column that would be masked, with the mask kind applied.
  * @type object
 */
-type DryEvalMaskedColumn = {
+type ListPolicyProfilesRequestConfig = {
+    data?: never;
     /**
-     * @description The output column name (post-alias) the client would see masked.
-     * @example email
-     * @type string
+     * @type object
     */
-    column: string;
+    pathParams: {
+        project_id: ListPolicyProfilesPathProjectId;
+    };
+    /**
+     * @type object | undefined
+    */
+    queryParams?: {
+        page_size?: ListPolicyProfilesQueryPageSize;
+        page_token?: ListPolicyProfilesQueryPageToken;
+    };
+    headerParams?: never;
     /**
-     * @description How the column is masked.
      * @type string
     */
-    kind: DryEvalMaskedColumnKindEnumKey;
+    url: `/v1/projects/${string}/policies`;
 };
 
 /**
@@ -5438,60 +5987,39 @@ type DryEvalMaskedColumn = {
 * Do not edit manually.
 */
 
-declare const dryEvalResultVerdictEnum: {
-    readonly allow: "allow";
-    readonly block: "block";
-    readonly mask: "mask";
-    readonly "row-filter": "row-filter";
-};
-type DryEvalResultVerdictEnumKey = (typeof dryEvalResultVerdictEnum)[keyof typeof dryEvalResultVerdictEnum];
 /**
- * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type CreatePolicyProfilePathProjectId = string;
+/**
+ * @description A named bundle of rules enforced on agent credentials in the data plane.
  * @type object
 */
-type DryEvalResult = {
-    /**
-     * @description allow — permitted unchanged; block — rejected; mask — permitted but listed result columns are masked; row-filter — permitted but a WHERE predicate is injected (and any listed columns are also masked).
-     * @type string
-    */
-    verdict: DryEvalResultVerdictEnumKey;
+type CreatePolicyProfileStatus201 = PolicyProfile;
+/**
+ * @description Mutable fields of a policy profile (used for create and update).
+ * @type object
+*/
+type CreatePolicyProfileData = PolicyProfileInput;
+/**
+ * @type object
+*/
+type CreatePolicyProfileRequestConfig = {
+    data?: CreatePolicyProfileData;
     /**
-     * @description Machine-readable decision tag. For a block, the blocking rule (e.g. read_only, table_denied, table_not_allowed, statement_denied, row_filter_unsafe). Otherwise \"ok\".
-     * @example ok
-     * @type string
+     * @type object
     */
-    rule: string;
+    pathParams: {
+        project_id: CreatePolicyProfilePathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Human-readable explanation of the verdict.
      * @type string
     */
-    reason: string;
-    /**
-     * @description What the author could do instead (present on block verdicts).
-     * @type string | undefined
-    */
-    hint?: string;
-    /**
-     * @description Result columns that would be masked. Present on mask/row-filter verdicts.
-     * @type array | undefined
-    */
-    masked_columns?: DryEvalMaskedColumn[];
-    /**
-     * @description The row-filter predicate ANDed into the statement\'s WHERE clause.
-     * @example tenant_id = current_setting('pgbeam.tenant')
-     * @type string | undefined
-    */
-    row_filter_predicate?: string;
-    /**
-     * @description The statement as it would be sent upstream after row-filter injection.
-     * @type string | undefined
-    */
-    rewritten_sql?: string;
-    /**
-     * @description Informational caveats about stateful enforcement a single-statement preview cannot model (per-region budgets, approvals, write-mode routing).
-     * @type array | undefined
-    */
-    notes?: string[];
+    url: `/v1/projects/${string}/policies`;
 };
 
 /**
@@ -5504,34 +6032,36 @@ type DryEvalResult = {
  * @pattern ^[a-zA-Z0-9_.-]+$
  * @type string
 */
-type DryEvalPolicyPathProjectId = string;
+type GetPolicyProfilePathProjectId = string;
 /**
- * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
- * @type object
+ * @description Unique policy profile identifier (prefixed, e.g. pol_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
 */
-type DryEvalPolicyStatus200 = DryEvalResult;
+type GetPolicyProfilePathPolicyId = string;
 /**
- * @description A SQL statement to test plus the policy to test it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @description A named bundle of rules enforced on agent credentials in the data plane.
  * @type object
 */
-type DryEvalPolicyData = DryEvalInput;
+type GetPolicyProfileStatus200 = PolicyProfile;
 /**
  * @type object
 */
-type DryEvalPolicyRequestConfig = {
-    data?: DryEvalPolicyData;
+type GetPolicyProfileRequestConfig = {
+    data?: never;
     /**
      * @type object
     */
     pathParams: {
-        project_id: DryEvalPolicyPathProjectId;
+        project_id: GetPolicyProfilePathProjectId;
+        policy_id: GetPolicyProfilePathPolicyId;
     };
     queryParams?: never;
     headerParams?: never;
     /**
      * @type string
     */
-    url: `/v1/projects/${string}/policy-evaluations`;
+    url: `/v1/projects/${string}/policies/${string}`;
 };
 
 /**
@@ -5540,45 +6070,45 @@ type DryEvalPolicyRequestConfig = {
 */
 
 /**
- * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type UpdatePolicyProfilePathProjectId = string;
+/**
+ * @description Unique policy profile identifier (prefixed, e.g. pol_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type UpdatePolicyProfilePathPolicyId = string;
+/**
+ * @description A named bundle of rules enforced on agent credentials in the data plane.
  * @type object
 */
-type PolicyReplayInput = {
-    /**
-     * @description ID of an existing saved policy profile to replay against.
-     * @example pol_01h455vb4pex5vsknk084sn02q
-     * @type string | undefined
-    */
-    policy_id?: string;
-    /**
-     * @description Mutable fields of a policy profile (used for create and update).
-     * @type object | undefined
-    */
-    policy?: PolicyProfileInput;
-    /**
-     * @description Restrict the replay to traffic recorded for one agent credential.
-     * @example cred_01h455vb4pex5vsknk084sn02q
-     * @type string | undefined
-    */
-    credential_id?: string;
-    /**
-     * @description Start of the traffic window (inclusive). Defaults to 7 days before end_ts.
-     * @type string | undefined
-    */
-    start_ts?: string;
+type UpdatePolicyProfileStatus200 = PolicyProfile;
+/**
+ * @description Mutable fields of a policy profile (used for create and update).
+ * @type object
+*/
+type UpdatePolicyProfileData = PolicyProfileInput;
+/**
+ * @type object
+*/
+type UpdatePolicyProfileRequestConfig = {
+    data?: UpdatePolicyProfileData;
     /**
-     * @description End of the traffic window (exclusive). Defaults to now.
-     * @type string | undefined
+     * @type object
     */
-    end_ts?: string;
+    pathParams: {
+        project_id: UpdatePolicyProfilePathProjectId;
+        policy_id: UpdatePolicyProfilePathPolicyId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description Maximum number of distinct queries to replay, newest first. Traffic is deduplicated by normalized query hash before evaluation.
-     * @minLength 1
-     * @maxLength 500
-     * @default 200
-     * @type integer | undefined
+     * @type string
     */
-    limit?: number;
+    url: `/v1/projects/${string}/policies/${string}`;
 };
 
 /**
@@ -5586,134 +6116,107 @@ type PolicyReplayInput = {
 * Do not edit manually.
 */
 
-declare const policyReplayItemChangeEnum: {
-    readonly newly_blocked: "newly_blocked";
-    readonly newly_allowed: "newly_allowed";
-    readonly still_allowed: "still_allowed";
-    readonly still_blocked: "still_blocked";
-};
-type PolicyReplayItemChangeEnumKey = (typeof policyReplayItemChangeEnum)[keyof typeof policyReplayItemChangeEnum];
 /**
- * @description One distinct recorded query and the decision the candidate policy would reach for it.
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type DeletePolicyProfilePathProjectId = string;
+/**
+ * @description Unique policy profile identifier (prefixed, e.g. pol_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type DeletePolicyProfilePathPolicyId = string;
+/**
  * @type object
 */
-type PolicyReplayItem = {
-    /**
-     * @description Normalized query hash identifying this statement shape.
-     * @type string
-    */
-    query_hash: string;
-    /**
-     * @description The recorded statement (normalized, literals replaced with $N placeholders), from its most recent occurrence.
-     * @type string
-    */
-    sql: string;
-    /**
-     * @description Statement kind (select, insert, update, delete, ddl, ...).
-     * @type string | undefined
-    */
-    statement_kind?: string;
-    /**
-     * @description How many recorded entries share this query shape in the window.
-     * @type integer
-    */
-    occurrences: number;
-    /**
-     * @description Oldest occurrence in the window.
-     * @type string
-    */
-    first_seen: string;
-    /**
-     * @description Newest occurrence in the window.
-     * @type string
-    */
-    last_seen: string;
-    /**
-     * @description The most recent recorded outcome for this query (query, masked, truncated, or blocked).
-     * @type string
-    */
-    recorded_event: string;
-    /**
-     * @description The decision rule recorded with a blocked outcome.
-     * @type string | undefined
-    */
-    recorded_rule?: string;
+type DeletePolicyProfileRequestConfig = {
+    data?: never;
     /**
-     * @description How the candidate decision compares to the recorded outcome. newly_blocked and newly_allowed are the changes worth reviewing before rollout; still_allowed and still_blocked are unchanged.
-     * @type string
+     * @type object
     */
-    change: PolicyReplayItemChangeEnumKey;
+    pathParams: {
+        project_id: DeletePolicyProfilePathProjectId;
+        policy_id: DeletePolicyProfilePathPolicyId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
-     * @type object
+     * @type string
     */
-    result: DryEvalResult;
+    url: `/v1/projects/${string}/policies/${string}`;
 };
 
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
 */
+
 /**
- * @description Aggregate outcome of a policy replay.
+ * @description A SQL statement to test plus the policy to test it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
  * @type object
 */
-type PolicyReplaySummary = {
-    /**
-     * @description Recorded audit entries covered by the replayed queries.
-     * @type integer
-    */
-    entries_scanned: number;
-    /**
-     * @description Distinct normalized queries found in the window (capped at limit).
-     * @type integer
-    */
-    distinct_queries: number;
-    /**
-     * @description Distinct queries actually evaluated against the candidate policy.
-     * @type integer
-    */
-    evaluated: number;
-    /**
-     * @description Queries the candidate policy would allow unchanged.
-     * @type integer
-    */
-    would_allow: number;
-    /**
-     * @description Queries the candidate policy would block.
-     * @type integer
-    */
-    would_block: number;
-    /**
-     * @description Queries the candidate policy would mask result columns on.
-     * @type integer
-    */
-    would_mask: number;
+type DryEvalInput = {
     /**
-     * @description Queries the candidate policy would inject a row filter into.
-     * @type integer
+     * @description The single SQL statement to evaluate.
+     * @minLength 1
+     * @maxLength 100000
+     * @example SELECT email FROM users WHERE id = 1
+     * @type string
     */
-    would_row_filter: number;
+    sql: string;
     /**
-     * @description Queries that executed under the recorded policy but the candidate policy would block.
-     * @type integer
+     * @description ID of an existing saved policy profile to evaluate against.
+     * @example pol_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
     */
-    newly_blocked: number;
+    policy_id?: string;
     /**
-     * @description Queries that were blocked when recorded but the candidate policy would permit.
-     * @type integer
+     * @description Mutable fields of a policy profile (used for create and update).
+     * @type object | undefined
     */
-    newly_allowed: number;
+    policy?: PolicyProfileInput;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type DryEvalPolicyPathProjectId = string;
+/**
+ * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+ * @type object
+*/
+type DryEvalPolicyStatus200 = DryEvalResult;
+/**
+ * @description A SQL statement to test plus the policy to test it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type DryEvalPolicyData = DryEvalInput;
+/**
+ * @type object
+*/
+type DryEvalPolicyRequestConfig = {
+    data?: DryEvalPolicyData;
     /**
-     * @description Distinct queries skipped because the stored statement was truncated at record time and can no longer be parsed faithfully.
-     * @type integer
+     * @type object
     */
-    skipped_unparseable: number;
+    pathParams: {
+        project_id: DryEvalPolicyPathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
     /**
-     * @description True when the window contained more distinct queries than limit; only the newest were replayed.
-     * @type boolean
+     * @type string
     */
-    truncated: boolean;
+    url: `/v1/projects/${string}/policy-evaluations`;
 };
 
 /**
@@ -5722,20 +6225,45 @@ type PolicyReplaySummary = {
 */
 
 /**
- * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
  * @type object
 */
-type PolicyReplayResult = {
+type PolicyReplayInput = {
     /**
-     * @description Aggregate outcome of a policy replay.
-     * @type object
+     * @description ID of an existing saved policy profile to replay against.
+     * @example pol_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
     */
-    summary: PolicyReplaySummary;
+    policy_id?: string;
     /**
-     * @description Per-query replay decisions, ordered changes first (newly blocked, then newly allowed), then by occurrence count.
-     * @type array
+     * @description Mutable fields of a policy profile (used for create and update).
+     * @type object | undefined
     */
-    items: PolicyReplayItem[];
+    policy?: PolicyProfileInput;
+    /**
+     * @description Restrict the replay to traffic recorded for one agent credential.
+     * @example cred_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    credential_id?: string;
+    /**
+     * @description Start of the traffic window (inclusive). Defaults to 7 days before end_ts.
+     * @type string | undefined
+    */
+    start_ts?: string;
+    /**
+     * @description End of the traffic window (exclusive). Defaults to now.
+     * @type string | undefined
+    */
+    end_ts?: string;
+    /**
+     * @description Maximum number of distinct queries to replay, newest first. Traffic is deduplicated by normalized query hash before evaluation.
+     * @minLength 1
+     * @maxLength 500
+     * @default 200
+     * @type integer | undefined
+    */
+    limit?: number;
 };
 
 /**
@@ -8339,6 +8867,10 @@ declare const operationsByTag: {
             readonly method: "PATCH";
             readonly path: "/v1/organizations/{org_id}/onboarding";
         };
+        readonly listOrganizations: {
+            readonly method: "GET";
+            readonly path: "/v1/organizations";
+        };
     };
     readonly agents: {
         readonly listAgentCredentials: {
@@ -8378,6 +8910,40 @@ declare const operationsByTag: {
             readonly path: "/v1/projects/{project_id}/audit-logs/verify";
         };
     };
+    readonly policies: {
+        readonly recommendAgentPolicy: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/agents/{agent_id}/policy-recommendation";
+        };
+        readonly listPolicyProfiles: {
+            readonly method: "GET";
+            readonly path: "/v1/projects/{project_id}/policies";
+        };
+        readonly createPolicyProfile: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/policies";
+        };
+        readonly getPolicyProfile: {
+            readonly method: "GET";
+            readonly path: "/v1/projects/{project_id}/policies/{policy_id}";
+        };
+        readonly updatePolicyProfile: {
+            readonly method: "PUT";
+            readonly path: "/v1/projects/{project_id}/policies/{policy_id}";
+        };
+        readonly deletePolicyProfile: {
+            readonly method: "DELETE";
+            readonly path: "/v1/projects/{project_id}/policies/{policy_id}";
+        };
+        readonly dryEvalPolicy: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/policy-evaluations";
+        };
+        readonly replayPolicy: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/policy-replays";
+        };
+    };
     readonly anomalies: {
         readonly listAnomalyAlerts: {
             readonly method: "GET";
@@ -8568,40 +9134,32 @@ declare const operationsByTag: {
             readonly path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}/rotate";
         };
     };
-    readonly migrations: {
-        readonly lintMigration: {
-            readonly method: "POST";
-            readonly path: "/v1/projects/{project_id}/migrations:lint";
-        };
-    };
-    readonly policies: {
-        readonly listPolicyProfiles: {
+    readonly honeytokens: {
+        readonly listHoneytokens: {
             readonly method: "GET";
-            readonly path: "/v1/projects/{project_id}/policies";
+            readonly path: "/v1/projects/{project_id}/honeytokens";
         };
-        readonly createPolicyProfile: {
+        readonly createHoneytoken: {
             readonly method: "POST";
-            readonly path: "/v1/projects/{project_id}/policies";
+            readonly path: "/v1/projects/{project_id}/honeytokens";
         };
-        readonly getPolicyProfile: {
+        readonly getHoneytoken: {
             readonly method: "GET";
-            readonly path: "/v1/projects/{project_id}/policies/{policy_id}";
+            readonly path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}";
         };
-        readonly updatePolicyProfile: {
+        readonly updateHoneytoken: {
             readonly method: "PUT";
-            readonly path: "/v1/projects/{project_id}/policies/{policy_id}";
+            readonly path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}";
         };
-        readonly deletePolicyProfile: {
+        readonly deleteHoneytoken: {
             readonly method: "DELETE";
-            readonly path: "/v1/projects/{project_id}/policies/{policy_id}";
-        };
-        readonly dryEvalPolicy: {
-            readonly method: "POST";
-            readonly path: "/v1/projects/{project_id}/policy-evaluations";
+            readonly path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}";
         };
-        readonly replayPolicy: {
+    };
+    readonly migrations: {
+        readonly lintMigration: {
             readonly method: "POST";
-            readonly path: "/v1/projects/{project_id}/policy-replays";
+            readonly path: "/v1/projects/{project_id}/migrations:lint";
         };
     };
     readonly support: {
@@ -8695,6 +9253,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/agents/{agent_id}/rotate";
         readonly operationId: "rotateAgentCredential";
     };
+    readonly "POST /v1/projects/{project_id}/agents/{agent_id}/policy-recommendation": {
+        readonly method: "POST";
+        readonly path: "/v1/projects/{project_id}/agents/{agent_id}/policy-recommendation";
+        readonly operationId: "recommendAgentPolicy";
+    };
     readonly "GET /v1/projects/{project_id}/anomalies": {
         readonly method: "GET";
         readonly path: "/v1/projects/{project_id}/anomalies";
@@ -8845,6 +9408,31 @@ declare const operationsByPath: {
         readonly path: "/v1/health";
         readonly operationId: "getHealth";
     };
+    readonly "GET /v1/projects/{project_id}/honeytokens": {
+        readonly method: "GET";
+        readonly path: "/v1/projects/{project_id}/honeytokens";
+        readonly operationId: "listHoneytokens";
+    };
+    readonly "POST /v1/projects/{project_id}/honeytokens": {
+        readonly method: "POST";
+        readonly path: "/v1/projects/{project_id}/honeytokens";
+        readonly operationId: "createHoneytoken";
+    };
+    readonly "GET /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        readonly method: "GET";
+        readonly path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}";
+        readonly operationId: "getHoneytoken";
+    };
+    readonly "PUT /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        readonly method: "PUT";
+        readonly path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}";
+        readonly operationId: "updateHoneytoken";
+    };
+    readonly "DELETE /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        readonly method: "DELETE";
+        readonly path: "/v1/projects/{project_id}/honeytokens/{honeytoken_id}";
+        readonly operationId: "deleteHoneytoken";
+    };
     readonly "GET /v1/projects/{project_id}/insights": {
         readonly method: "GET";
         readonly path: "/v1/projects/{project_id}/insights";
@@ -8865,6 +9453,11 @@ declare const operationsByPath: {
         readonly path: "/v1/organizations/{org_id}/onboarding";
         readonly operationId: "updateOnboardingProgress";
     };
+    readonly "GET /v1/organizations": {
+        readonly method: "GET";
+        readonly path: "/v1/organizations";
+        readonly operationId: "listOrganizations";
+    };
     readonly "GET /v1/projects/{project_id}/policies": {
         readonly method: "GET";
         readonly path: "/v1/projects/{project_id}/policies";
@@ -9062,6 +9655,10 @@ type RevokeAgentCredentialParams = {
 type RotateAgentCredentialParams = {
     pathParams: NonNullable<RotateAgentCredentialRequestConfig["pathParams"]>;
 };
+type RecommendAgentPolicyParams = {
+    pathParams: NonNullable<RecommendAgentPolicyRequestConfig["pathParams"]>;
+    body: NonNullable<RecommendAgentPolicyRequestConfig["data"]>;
+};
 type ListAnomalyAlertsParams = {
     pathParams: NonNullable<ListAnomalyAlertsRequestConfig["pathParams"]>;
     queryParams?: NonNullable<ListAnomalyAlertsRequestConfig["queryParams"]>;
@@ -9164,6 +9761,24 @@ type DeleteCustomDomainParams = {
 type VerifyCustomDomainParams = {
     pathParams: NonNullable<VerifyCustomDomainRequestConfig["pathParams"]>;
 };
+type ListHoneytokensParams = {
+    pathParams: NonNullable<ListHoneytokensRequestConfig["pathParams"]>;
+    queryParams?: NonNullable<ListHoneytokensRequestConfig["queryParams"]>;
+};
+type CreateHoneytokenParams = {
+    pathParams: NonNullable<CreateHoneytokenRequestConfig["pathParams"]>;
+    body: NonNullable<CreateHoneytokenRequestConfig["data"]>;
+};
+type GetHoneytokenParams = {
+    pathParams: NonNullable<GetHoneytokenRequestConfig["pathParams"]>;
+};
+type UpdateHoneytokenParams = {
+    pathParams: NonNullable<UpdateHoneytokenRequestConfig["pathParams"]>;
+    body: NonNullable<UpdateHoneytokenRequestConfig["data"]>;
+};
+type DeleteHoneytokenParams = {
+    pathParams: NonNullable<DeleteHoneytokenRequestConfig["pathParams"]>;
+};
 type GetProjectInsightsParams = {
     pathParams: NonNullable<GetProjectInsightsRequestConfig["pathParams"]>;
     queryParams?: NonNullable<GetProjectInsightsRequestConfig["queryParams"]>;
@@ -9304,6 +9919,7 @@ interface ApiOperations {
         exportAccountData(): Promise<ExportAccountDataStatus200>;
         getOnboardingProgress(params: GetOnboardingProgressParams): Promise<GetOnboardingProgressStatus200>;
         updateOnboardingProgress(params: UpdateOnboardingProgressParams): Promise<UpdateOnboardingProgressStatus200>;
+        listOrganizations(): Promise<ListOrganizationsStatus200>;
     };
     agents: {
         listAgentCredentials(params: ListAgentCredentialsParams): Promise<ListAgentCredentialsStatus200>;
@@ -9316,6 +9932,16 @@ interface ApiOperations {
         exportAuditLogs(params: ExportAuditLogsParams): Promise<ExportAuditLogsStatus200>;
         verifyAuditChain(params: VerifyAuditChainParams): Promise<VerifyAuditChainStatus200>;
     };
+    policies: {
+        recommendAgentPolicy(params: RecommendAgentPolicyParams): Promise<RecommendAgentPolicyStatus200>;
+        listPolicyProfiles(params: ListPolicyProfilesParams): Promise<ListPolicyProfilesStatus200>;
+        createPolicyProfile(params: CreatePolicyProfileParams): Promise<CreatePolicyProfileStatus201>;
+        getPolicyProfile(params: GetPolicyProfileParams): Promise<GetPolicyProfileStatus200>;
+        updatePolicyProfile(params: UpdatePolicyProfileParams): Promise<UpdatePolicyProfileStatus200>;
+        deletePolicyProfile(params: DeletePolicyProfileParams): Promise<void>;
+        dryEvalPolicy(params: DryEvalPolicyParams): Promise<DryEvalPolicyStatus200>;
+        replayPolicy(params: ReplayPolicyParams): Promise<ReplayPolicyStatus200>;
+    };
     anomalies: {
         listAnomalyAlerts(params: ListAnomalyAlertsParams): Promise<ListAnomalyAlertsStatus200>;
         updateAnomalyAlert(params: UpdateAnomalyAlertParams): Promise<UpdateAnomalyAlertStatus200>;
@@ -9374,18 +10000,16 @@ interface ApiOperations {
         revokeSelfHostEnrollment(params: RevokeSelfHostEnrollmentParams): Promise<void>;
         rotateSelfHostEnrollment(params: RotateSelfHostEnrollmentParams): Promise<RotateSelfHostEnrollmentStatus200>;
     };
+    honeytokens: {
+        listHoneytokens(params: ListHoneytokensParams): Promise<ListHoneytokensStatus200>;
+        createHoneytoken(params: CreateHoneytokenParams): Promise<CreateHoneytokenStatus201>;
+        getHoneytoken(params: GetHoneytokenParams): Promise<GetHoneytokenStatus200>;
+        updateHoneytoken(params: UpdateHoneytokenParams): Promise<UpdateHoneytokenStatus200>;
+        deleteHoneytoken(params: DeleteHoneytokenParams): Promise<void>;
+    };
     migrations: {
         lintMigration(params: LintMigrationParams): Promise<LintMigrationStatus200>;
     };
-    policies: {
-        listPolicyProfiles(params: ListPolicyProfilesParams): Promise<ListPolicyProfilesStatus200>;
-        createPolicyProfile(params: CreatePolicyProfileParams): Promise<CreatePolicyProfileStatus201>;
-        getPolicyProfile(params: GetPolicyProfileParams): Promise<GetPolicyProfileStatus200>;
-        updatePolicyProfile(params: UpdatePolicyProfileParams): Promise<UpdatePolicyProfileStatus200>;
-        deletePolicyProfile(params: DeletePolicyProfileParams): Promise<void>;
-        dryEvalPolicy(params: DryEvalPolicyParams): Promise<DryEvalPolicyStatus200>;
-        replayPolicy(params: ReplayPolicyParams): Promise<ReplayPolicyStatus200>;
-    };
     support: {
         listSupportCases(params: ListSupportCasesParams): Promise<ListSupportCasesStatus200>;
         createSupportCase(params: CreateSupportCaseParams): Promise<CreateSupportCaseStatus201>;
@@ -9434,6 +10058,10 @@ interface RequestMap {
         params: RotateAgentCredentialParams;
         response: RotateAgentCredentialStatus200;
     };
+    "POST /v1/projects/{project_id}/agents/{agent_id}/policy-recommendation": {
+        params: RecommendAgentPolicyParams;
+        response: RecommendAgentPolicyStatus200;
+    };
     "GET /v1/projects/{project_id}/anomalies": {
         params: ListAnomalyAlertsParams;
         response: ListAnomalyAlertsStatus200;
@@ -9554,6 +10182,26 @@ interface RequestMap {
         params?: undefined;
         response: GetHealthStatus200;
     };
+    "GET /v1/projects/{project_id}/honeytokens": {
+        params: ListHoneytokensParams;
+        response: ListHoneytokensStatus200;
+    };
+    "POST /v1/projects/{project_id}/honeytokens": {
+        params: CreateHoneytokenParams;
+        response: CreateHoneytokenStatus201;
+    };
+    "GET /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        params: GetHoneytokenParams;
+        response: GetHoneytokenStatus200;
+    };
+    "PUT /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        params: UpdateHoneytokenParams;
+        response: UpdateHoneytokenStatus200;
+    };
+    "DELETE /v1/projects/{project_id}/honeytokens/{honeytoken_id}": {
+        params: DeleteHoneytokenParams;
+        response: void;
+    };
     "GET /v1/projects/{project_id}/insights": {
         params: GetProjectInsightsParams;
         response: GetProjectInsightsStatus200;
@@ -9570,6 +10218,10 @@ interface RequestMap {
         params: UpdateOnboardingProgressParams;
         response: UpdateOnboardingProgressStatus200;
     };
+    "GET /v1/organizations": {
+        params?: undefined;
+        response: ListOrganizationsStatus200;
+    };
     "GET /v1/projects/{project_id}/policies": {
         params: ListPolicyProfilesParams;
         response: ListPolicyProfilesStatus200;