pgbeam 0.7.0 → 0.8.0

package/dist/{operations-map.gen-ir66wlzb.js → operations-map.gen-olbk6bt4.js}

@@ -115,6 +115,10 @@
             method: "DELETE",
             path: "/v1/projects/{project_id}/policies/{policy_id}"
         },
+        getPolicyStatementKinds: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/policies/{policy_id}/statement-kinds"
+        },
         dryEvalPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-evaluations"
@@ -881,6 +885,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/policies/{policy_id}",
         operationId: "deletePolicyProfile"
     },
+    "GET /v1/projects/{project_id}/policies/{policy_id}/statement-kinds": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/policies/{policy_id}/statement-kinds",
+        operationId: "getPolicyStatementKinds"
+    },
     "POST /v1/projects/{project_id}/policy-evaluations": {
         method: "POST",
         path: "/v1/projects/{project_id}/policy-evaluations",

package/dist/operations.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
-var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
+var operationsMap_gen = require('./operations-map.gen-jsbs5s0c.cjs');
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -251,7 +251,7 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
         ],
         "requestBodyType": "{ limit?: number; lookback_days?: number }",
         "requestBodyRequired": false,
-        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
+        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
         "responseStatus": "200"
     },
     "listAnomalyAlerts": {
@@ -1568,7 +1568,7 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
         "parameters": [],
         "requestBodyType": "{ label?: string; payment_proof?: string; tier?: \"free\" | \"extended\" }",
         "requestBodyRequired": false,
-        "responseType": "{ connection_string: string; dataset: { schema: string; tables: ({ columns: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; description: string; name: string; reachable: boolean })[] }; expires_at: string; mcp_token: string; mcp_url: string; policy_template: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; query_budget: number; session_id: string; tier: string; ttl_seconds: number; upgrade: { description: string; docs_url: string; policy_endpoint: string; signup_url: string }; walkthrough: ({ expect: \"allow\" | \"masked\" | \"blocked\"; expect_columns?: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; expect_rule?: string; sql: string; step: number; title: string; why: string })[] }",
+        "responseType": "{ connection_string: string; dataset: { schema: string; tables: ({ columns: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; description: string; name: string; reachable: boolean })[] }; expires_at: string; mcp_token: string; mcp_url: string; policy_template: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; query_budget: number; session_id: string; tier: string; ttl_seconds: number; upgrade: { description: string; docs_url: string; policy_endpoint: string; signup_url: string }; walkthrough: ({ expect: \"allow\" | \"masked\" | \"blocked\"; expect_columns?: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; expect_rule?: string; sql: string; step: number; title: string; why: string })[] }",
         "responseStatus": "201"
     },
     "releaseDemoCredential": {
@@ -2291,7 +2291,7 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ next_page_token?: string; policies: ({ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" })[] }",
+        "responseType": "{ next_page_token?: string; policies: ({ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" })[] }",
         "responseStatus": "200"
     },
     "createPolicyProfile": {
@@ -2316,9 +2316,9 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
                 "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
-        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "requestBodyRequired": true,
-        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "responseStatus": "201"
     },
     "getPolicyProfile": {
@@ -2352,7 +2352,7 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "responseStatus": "200"
     },
     "updatePolicyProfile": {
@@ -2384,9 +2384,9 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
                 "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
             }
         ],
-        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "requestBodyRequired": true,
-        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "responseStatus": "200"
     },
     "deletePolicyProfile": {
@@ -2416,6 +2416,33 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
         "responseType": "",
         "responseStatus": "204"
     },
+    "getPolicyStatementKinds": {
+        "operationId": "getPolicyStatementKinds",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/policies/{policy_id}/statement-kinds",
+        "summary": "List the statement kinds a policy permits",
+        "description": "Returns, for every statement kind the proxy classifies, whether this policy permits a statement of that kind, and when it does not, the rule and reason the proxy would refuse it with. The answer comes from the data plane's own policy engine rather than from the stored fields, so it resolves them the way enforcement does: COPY is refused whatever the allowlist says, deny beats allow, read_only is a ceiling the allowlist cannot lift, and an unclassified statement fails closed unless \"other\" is allowlisted. Each kind is judged on its own, with no relations and a WHERE clause, so table lists, masking, budgets and the other floors are not part of these verdicts.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "policy_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique policy profile identifier (prefixed, e.g. pol_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; policy_id: string; statement_kinds: ({ allowed: boolean; kind: string; reason?: string; rule?: string })[] }",
+        "responseStatus": "200"
+    },
     "dryEvalPolicy": {
         "operationId": "dryEvalPolicy",
         "method": "POST",
@@ -2431,9 +2458,9 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
             }
         ],
-        "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
+        "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
         "requestBodyRequired": true,
-        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
+        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
     "replayPolicy": {
@@ -2451,9 +2478,9 @@ var operationsMap_gen = require('./operations-map.gen-fayr6b1o.cjs');
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
             }
         ],
-        "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
+        "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
         "requestBodyRequired": true,
-        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
         "responseStatus": "200"
     },
     "listProjects": {

package/dist/operations.d.cts

@@ -1,4 +1,4 @@
-export { Be as ApiOperations, Bf as ApiTag, Bg as RequestMap, Bh as Route, Bi as operationsByPath, Bj as operationsByTag } from './operations-map.gen-e5eiow5k.js';
+export { Bt as ApiOperations, Bu as ApiTag, Bv as RequestMap, Bw as Route, Bx as operationsByPath, By as operationsByTag } from './operations-map.gen-lpry81jh.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.d.mts

@@ -1,4 +1,4 @@
-export { Be as ApiOperations, Bf as ApiTag, Bg as RequestMap, Bh as Route, Bi as operationsByPath, Bj as operationsByTag } from './operations-map.gen-e5eiow5k.js';
+export { Bt as ApiOperations, Bu as ApiTag, Bv as RequestMap, Bw as Route, Bx as operationsByPath, By as operationsByTag } from './operations-map.gen-lpry81jh.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.

package/dist/operations.mjs

@@ -1,4 +1,4 @@
-export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-ir66wlzb.js';
+export { o as operationsByPath, a as operationsByTag } from './operations-map.gen-olbk6bt4.js';
 
 /**
  * Generated by generate-sdk-ts-maps.ts from backend/openapi/bundles/public.yaml — do not edit manually.
@@ -249,7 +249,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "{ limit?: number; lookback_days?: number }",
         "requestBodyRequired": false,
-        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
+        "responseType": "{ candidate?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; message?: string; notes?: string[]; observed_entries: number; observed_queries: number; replay?: { items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }; sufficient_history: boolean; window_end: string; window_start: string }",
         "responseStatus": "200"
     },
     "listAnomalyAlerts": {
@@ -1566,7 +1566,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "parameters": [],
         "requestBodyType": "{ label?: string; payment_proof?: string; tier?: \"free\" | \"extended\" }",
         "requestBodyRequired": false,
-        "responseType": "{ connection_string: string; dataset: { schema: string; tables: ({ columns: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; description: string; name: string; reachable: boolean })[] }; expires_at: string; mcp_token: string; mcp_url: string; policy_template: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; query_budget: number; session_id: string; tier: string; ttl_seconds: number; upgrade: { description: string; docs_url: string; policy_endpoint: string; signup_url: string }; walkthrough: ({ expect: \"allow\" | \"masked\" | \"blocked\"; expect_columns?: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; expect_rule?: string; sql: string; step: number; title: string; why: string })[] }",
+        "responseType": "{ connection_string: string; dataset: { schema: string; tables: ({ columns: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; description: string; name: string; reachable: boolean })[] }; expires_at: string; mcp_token: string; mcp_url: string; policy_template: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; query_budget: number; session_id: string; tier: string; ttl_seconds: number; upgrade: { description: string; docs_url: string; policy_endpoint: string; signup_url: string }; walkthrough: ({ expect: \"allow\" | \"masked\" | \"blocked\"; expect_columns?: ({ name: string; treatment: \"visible\" | \"redacted\" | \"hashed\" | \"nulled\"; type: string })[]; expect_rule?: string; sql: string; step: number; title: string; why: string })[] }",
         "responseStatus": "201"
     },
     "releaseDemoCredential": {
@@ -2289,7 +2289,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ next_page_token?: string; policies: ({ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" })[] }",
+        "responseType": "{ next_page_token?: string; policies: ({ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" })[] }",
         "responseStatus": "200"
     },
     "createPolicyProfile": {
@@ -2314,9 +2314,9 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "description": "Client-generated key that makes a retry of this request safe. The first request carrying a given key executes normally and its response (status, content type and body) is stored for 24 hours; a later request with the same key returns that stored response without running the operation again, so a retry after a lost or timed-out response cannot create a second resource.\n\nReusing a key with a different request body returns `409 Conflict`: a key is a promise about one specific request, so a changed body is a client bug rather than a retry. Keys are scoped to the calling organization (or to the user, for account-scoped tokens), so one tenant can never read another's stored response.\n\nA `5xx`, `408` or `429` is never stored, because those describe a request that produced no settled answer and the next attempt with the same key must run for real. A `4xx` is stored: it is the server's settled answer about this exact request.\n\nUse a fresh UUID per logical operation. The PgBeam SDKs generate one per call and reuse it across their own automatic retries."
             }
         ],
-        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "requestBodyRequired": true,
-        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "responseStatus": "201"
     },
     "getPolicyProfile": {
@@ -2350,7 +2350,7 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "responseStatus": "200"
     },
     "updatePolicyProfile": {
@@ -2382,9 +2382,9 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "description": "Entity tag the write is based on, taken from the `ETag` of the read that produced the values being sent. The write proceeds only if it still matches the current representation; otherwise it is refused with `412 Precondition Failed` and nothing is changed.\n\nThis is what makes a read-modify-write safe. Without it the last writer wins and a concurrent edit is silently discarded, which is the failure an agent is most likely to cause and least likely to notice. The `412` response carries the current `ETag`, so a caller can re-read, re-apply its change and retry.\n\nOmitting the header keeps the old unconditional behaviour. `*` matches any current representation, which asserts only that the resource exists."
             }
         ],
-        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "requestBodyType": "{ access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "requestBodyRequired": true,
-        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; created_at: string; egress_bytes_per_day?: number; id: string; masking_rules: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; project_id: string; query_mode: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist: string[]; table_denylist: string[]; updated_at: string; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }",
         "responseStatus": "200"
     },
     "deletePolicyProfile": {
@@ -2414,6 +2414,33 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
         "responseType": "",
         "responseStatus": "204"
     },
+    "getPolicyStatementKinds": {
+        "operationId": "getPolicyStatementKinds",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/policies/{policy_id}/statement-kinds",
+        "summary": "List the statement kinds a policy permits",
+        "description": "Returns, for every statement kind the proxy classifies, whether this policy permits a statement of that kind, and when it does not, the rule and reason the proxy would refuse it with. The answer comes from the data plane's own policy engine rather than from the stored fields, so it resolves them the way enforcement does: COPY is refused whatever the allowlist says, deny beats allow, read_only is a ceiling the allowlist cannot lift, and an unclassified statement fails closed unless \"other\" is allowlisted. Each kind is judged on its own, with no relations and a WHERE clause, so table lists, masking, budgets and the other floors are not part of these verdicts.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "policy_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique policy profile identifier (prefixed, e.g. pol_xxx)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ access_mode: \"read_only\" | \"read_write\"; policy_id: string; statement_kinds: ({ allowed: boolean; kind: string; reason?: string; rule?: string })[] }",
+        "responseStatus": "200"
+    },
     "dryEvalPolicy": {
         "operationId": "dryEvalPolicy",
         "method": "POST",
@@ -2429,9 +2456,9 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
             }
         ],
-        "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
+        "requestBodyType": "{ policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; sql: string }",
         "requestBodyRequired": true,
-        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
+        "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
     "replayPolicy": {
@@ -2449,9 +2476,9 @@ export { o as operationsByPath, a as operationsByTag } from './operations-map.ge
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
             }
         ],
-        "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
+        "requestBodyType": "{ bound_policy_id?: string; credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; content_scan_max_bytes?: number; content_scan_mode?: \"off\" | \"annotate\" | \"block\"; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; query_mode?: \"sql\" | \"templates\"; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
         "requestBodyRequired": true,
-        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" | \"last4\" | \"email_domain\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; template?: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { bound_credentials?: number; distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; traffic_scope: \"project\" | \"bound_credentials\"; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
         "responseStatus": "200"
     },
     "listProjects": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgbeam",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "TypeScript SDK for the PgBeam API, a Postgres proxy for safe AI agent access with policy enforcement in the wire protocol",
   "type": "module",
   "exports": {
@@ -47,13 +47,13 @@
   ],
   "homepage": "https://pgbeam.com",
   "devDependencies": {
-    "@kubb/adapter-oas": "5.11.1",
+    "@kubb/adapter-oas": "5.14.3",
     "@kubb/middleware-barrel": "5.0.0-beta.35",
-    "@kubb/plugin-ts": "5.0.14",
+    "@kubb/plugin-ts": "5.2.0",
     "@pgbeam/config": "0.0.1",
     "@typescript/typescript6": "6.0.2",
     "bunchee": "7.0.2",
-    "kubb": "5.11.1",
+    "kubb": "5.14.3",
     "typescript": "7.0.2"
   },
   "scripts": {