pgbeam 0.3.7 → 0.3.9

package/dist/index.mjs

@@ -48,6 +48,10 @@
         exportAuditLogs: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
+        },
+        verifyAuditChain: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/verify"
         }
     },
     anomalies: {
@@ -222,6 +226,18 @@
         listRegions: {
             method: "GET",
             path: "/v1/regions"
+        },
+        listSelfHostEnrollments: {
+            method: "GET",
+            path: "/v1/organizations/{org_id}/self-host-enrollments"
+        },
+        createSelfHostEnrollment: {
+            method: "POST",
+            path: "/v1/organizations/{org_id}/self-host-enrollments"
+        },
+        revokeSelfHostEnrollment: {
+            method: "DELETE",
+            path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}"
         }
     },
     migrations: {
@@ -254,6 +270,10 @@
         dryEvalPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-evaluations"
+        },
+        replayPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-replays"
         }
     },
     support: {
@@ -382,6 +402,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/verify",
+        operationId: "verifyAuditChain"
+    },
     "GET /v1/plans": {
         method: "GET",
         path: "/v1/plans",
@@ -542,6 +567,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/policy-evaluations",
         operationId: "dryEvalPolicy"
     },
+    "POST /v1/projects/{project_id}/policy-replays": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/policy-replays",
+        operationId: "replayPolicy"
+    },
     "GET /v1/projects": {
         method: "GET",
         path: "/v1/projects",
@@ -592,6 +622,21 @@ const operationsByPath = {
         path: "/v1/databases/{database_id}/replicas/{replica_id}",
         operationId: "deleteReplica"
     },
+    "GET /v1/organizations/{org_id}/self-host-enrollments": {
+        method: "GET",
+        path: "/v1/organizations/{org_id}/self-host-enrollments",
+        operationId: "listSelfHostEnrollments"
+    },
+    "POST /v1/organizations/{org_id}/self-host-enrollments": {
+        method: "POST",
+        path: "/v1/organizations/{org_id}/self-host-enrollments",
+        operationId: "createSelfHostEnrollment"
+    },
+    "DELETE /v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}": {
+        method: "DELETE",
+        path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}",
+        operationId: "revokeSelfHostEnrollment"
+    },
     "GET /v1/organizations/{org_id}/support/cases": {
         method: "GET",
         path: "/v1/organizations/{org_id}/support/cases",
@@ -817,13 +862,15 @@ async function parseResponseBody(response) {
     if (contentType?.includes("application/json")) {
         return response.json();
     }
-    // Fallback: try JSON, return undefined if body is empty/non-JSON
+    // Non-JSON body (e.g. text/csv from audit-log export). Parse opportunistically
+    // in case the server mislabels JSON, but fall back to the raw text so callers
+    // get the payload instead of undefined. Only an empty body is undefined.
     const text = await response.text();
     if (!text) return undefined;
     try {
         return JSON.parse(text);
     } catch  {
-        return undefined;
+        return text;
     }
 }
 function sleep(ms) {

package/dist/operations.cjs

@@ -418,7 +418,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ entries: ({ bytes_out?: number; cache_status?: string; client_ip?: string; credential_id?: string; decision_rule?: string; event: string; id: string; latency_ms?: number; normalized_sql?: string; project_id: string; query_hash?: string; reason?: string; region?: string; rows_returned?: number; session_id?: string; source?: string; sql?: string; statement_kind?: string; ts: string })[]; next_page_token?: string }",
+        "responseType": "{ entries: ({ bytes_out?: number; cache_status?: string; client_ip?: string; credential_id?: string; decision_rule?: string; entry_hash?: string; event: string; id: string; latency_ms?: number; normalized_sql?: string; prev_hash?: string; project_id: string; query_hash?: string; reason?: string; region?: string; rows_returned?: number; seq?: number; session_id?: string; source?: string; sql?: string; statement_kind?: string; ts: string })[]; next_page_token?: string }",
         "responseStatus": "200"
     },
     "exportAuditLogs": {
@@ -483,6 +483,40 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "responseType": "",
         "responseStatus": "200"
     },
+    "verifyAuditChain": {
+        "operationId": "verifyAuditChain",
+        "method": "GET",
+        "path": "/v1/projects/{project_id}/audit-logs/verify",
+        "summary": "Verify the tamper-evident audit chain",
+        "description": "Recomputes the project's audit hash chain over an optional time range and reports whether it is intact. Each audit entry is linked to its predecessor with a SHA-256 hash, so editing or deleting any row breaks the chain. On a break, the response reports the first sequence number where a tampered or deleted entry was detected. Requires the same audit:read permission as the list and export endpoints.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            },
+            {
+                "name": "start",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Return entries at or after this timestamp (inclusive lower bound)."
+            },
+            {
+                "name": "end",
+                "in": "query",
+                "required": false,
+                "type": "string",
+                "description": "Return entries strictly older than this timestamp (cursor / upper bound)."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ chain_end_seq?: number; chain_start_seq?: number; failure_reason?: string; first_broken_seq?: number; ok: boolean; unchained_count: number; verified_at: string; verified_count: number }",
+        "responseStatus": "200"
+    },
     "listPlans": {
         "operationId": "listPlans",
         "method": "GET",
@@ -492,7 +526,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "parameters": [],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ plans: ({ annual_price?: number; description?: string; label: string; limits: { bytes_per_month: number; included_seats: number; max_connections: number; max_databases: number; max_projects: number; max_query_shapes: number; queries_per_day: number; queries_per_second: number }; monthly_price: number; name: string; overage_text?: string; trial_days?: number })[] }",
+        "responseType": "{ plans: ({ annual_price?: number; description?: string; label: string; limits: { audit_retention_days: number; bytes_per_month: number; included_seats: number; max_agent_credentials: number; max_connections: number; max_databases: number; max_projects: number; max_query_shapes: number; queries_per_day: number; queries_per_second: number; sandbox_idle_seconds: number; sandbox_max_branches: number; sandbox_max_upstream_bytes: number; sandbox_ttl_seconds: number }; monthly_price: number; name: string; overage_text?: string; trial_days?: number })[] }",
         "responseStatus": "200"
     },
     "getOrganizationPlan": {
@@ -512,7 +546,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ billing_provider?: \"stripe\" | \"vercel\" | \"aws\" | \"manual\"; created_at?: string; current_period_end?: string; custom_pricing?: boolean; enabled?: boolean; limits: { bytes_per_month: number; included_seats: number; max_connections: number; max_databases: number; max_projects: number; max_query_shapes: number; queries_per_day: number; queries_per_second: number }; org_id: string; plan: \"starter\" | \"pro\" | \"scale\" | \"enterprise\"; spend_capped?: boolean; spend_capped_at?: string; spend_limit?: number; subscription_status?: \"none\" | \"active\" | \"trialing\" | \"past_due\" | \"canceled\" | \"unpaid\" | \"incomplete\" | \"incomplete_expired\" | \"paused\"; updated_at?: string }",
+        "responseType": "{ billing_provider?: \"stripe\" | \"vercel\" | \"aws\" | \"manual\"; created_at?: string; current_period_end?: string; custom_pricing?: boolean; enabled?: boolean; limits: { audit_retention_days: number; bytes_per_month: number; included_seats: number; max_agent_credentials: number; max_connections: number; max_databases: number; max_projects: number; max_query_shapes: number; queries_per_day: number; queries_per_second: number; sandbox_idle_seconds: number; sandbox_max_branches: number; sandbox_max_upstream_bytes: number; sandbox_ttl_seconds: number }; org_id: string; plan: \"starter\" | \"pro\" | \"scale\" | \"enterprise\"; spend_capped?: boolean; spend_capped_at?: string; spend_limit?: number; subscription_status?: \"none\" | \"active\" | \"trialing\" | \"past_due\" | \"canceled\" | \"unpaid\" | \"incomplete\" | \"incomplete_expired\" | \"paused\"; updated_at?: string }",
         "responseStatus": "200"
     },
     "getVercelInstallation": {
@@ -552,7 +586,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "{ spend_limit?: number }",
         "requestBodyRequired": true,
-        "responseType": "{ billing_provider?: \"stripe\" | \"vercel\" | \"aws\" | \"manual\"; created_at?: string; current_period_end?: string; custom_pricing?: boolean; enabled?: boolean; limits: { bytes_per_month: number; included_seats: number; max_connections: number; max_databases: number; max_projects: number; max_query_shapes: number; queries_per_day: number; queries_per_second: number }; org_id: string; plan: \"starter\" | \"pro\" | \"scale\" | \"enterprise\"; spend_capped?: boolean; spend_capped_at?: string; spend_limit?: number; subscription_status?: \"none\" | \"active\" | \"trialing\" | \"past_due\" | \"canceled\" | \"unpaid\" | \"incomplete\" | \"incomplete_expired\" | \"paused\"; updated_at?: string }",
+        "responseType": "{ billing_provider?: \"stripe\" | \"vercel\" | \"aws\" | \"manual\"; created_at?: string; current_period_end?: string; custom_pricing?: boolean; enabled?: boolean; limits: { audit_retention_days: number; bytes_per_month: number; included_seats: number; max_agent_credentials: number; max_connections: number; max_databases: number; max_projects: number; max_query_shapes: number; queries_per_day: number; queries_per_second: number; sandbox_idle_seconds: number; sandbox_max_branches: number; sandbox_max_upstream_bytes: number; sandbox_ttl_seconds: number }; org_id: string; plan: \"starter\" | \"pro\" | \"scale\" | \"enterprise\"; spend_capped?: boolean; spend_capped_at?: string; spend_limit?: number; subscription_status?: \"none\" | \"active\" | \"trialing\" | \"past_due\" | \"canceled\" | \"unpaid\" | \"incomplete\" | \"incomplete_expired\" | \"paused\"; updated_at?: string }",
         "responseStatus": "200"
     },
     "submitCancellationFeedback": {
@@ -1303,6 +1337,26 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "responseType": "{ hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }",
         "responseStatus": "200"
     },
+    "replayPolicy": {
+        "operationId": "replayPolicy",
+        "method": "POST",
+        "path": "/v1/projects/{project_id}/policy-replays",
+        "summary": "Replay recorded agent traffic against a policy",
+        "description": "Replays the project's recorded agent audit traffic against a candidate policy (either a draft supplied inline or an existing policy referenced by id) and reports what would change: which queries that ran would now be blocked, which blocked queries would now be permitted, and which results would be masked or row-filtered. Traffic is deduplicated by normalized query shape, newest first, and every statement is evaluated through the data plane's own policy engine, so the verdicts match real enforcement. Stateful checks (budgets, approvals, write-mode routing) are reported as informational notes on each result, not verdicts. This endpoint reads only the audit log; it never connects to the upstream database and persists nothing.",
+        "parameters": [
+            {
+                "name": "project_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
+            }
+        ],
+        "requestBodyType": "{ credential_id?: string; end_ts?: string; limit?: number; policy?: { access_mode?: \"read_only\" | \"read_write\"; approval_auto_max_rows?: number; approval_mode?: \"off\" | \"writes\" | \"ddl\" | \"all\"; approval_timeout_seconds?: number; budget_queries_per_day?: number; budget_queries_per_hour?: number; egress_bytes_per_day?: number; masking_rules?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\"; table: string })[]; max_affected_rows?: number; max_rows?: number; migration_safety?: \"off\" | \"warn\" | \"block\"; name: string; row_filters?: ({ predicate: string; table: string })[]; statement_rules?: { allow?: string[]; deny?: string[] }; statement_timeout_ms?: number; table_allowlist?: string[]; table_denylist?: string[]; write_mode?: \"normal\" | \"rollback\" | \"sandbox\" }; policy_id?: string; start_ts?: string }",
+        "requestBodyRequired": true,
+        "responseType": "{ items: ({ change: \"newly_blocked\" | \"newly_allowed\" | \"still_allowed\" | \"still_blocked\"; first_seen: string; last_seen: string; occurrences: number; query_hash: string; recorded_event: string; recorded_rule?: string; result: { hint?: string; masked_columns?: ({ column: string; kind: \"redact\" | \"null\" | \"hash\" })[]; notes?: string[]; reason: string; rewritten_sql?: string; row_filter_predicate?: string; rule: string; verdict: \"allow\" | \"block\" | \"mask\" | \"row-filter\" }; sql: string; statement_kind?: string })[]; summary: { distinct_queries: number; entries_scanned: number; evaluated: number; newly_allowed: number; newly_blocked: number; skipped_unparseable: number; truncated: boolean; would_allow: number; would_block: number; would_mask: number; would_row_filter: number } }",
+        "responseStatus": "200"
+    },
     "listProjects": {
         "operationId": "listProjects",
         "method": "GET",
@@ -1341,7 +1395,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ next_page_token?: string; projects: ({ active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string })[]; total: number }",
+        "responseType": "{ next_page_token?: string; projects: ({ active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; residency?: \"any\" | \"us\" | \"eu\"; self_hosted?: boolean; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string })[]; total: number }",
         "responseStatus": "200"
     },
     "createProject": {
@@ -1351,9 +1405,9 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "summary": "Create a project",
         "description": "Creates a new project within the specified organization.",
         "parameters": [],
-        "requestBodyType": "{ cloud?: \"aws\" | \"azure\" | \"gcp\"; database: { auto_read_routing?: boolean; cache_config?: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; host: string; name: string; password: string; pool_config?: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; username: string }; description?: string; name: string; org_id: string; tags?: string[] }",
+        "requestBodyType": "{ cloud?: \"aws\" | \"azure\" | \"gcp\"; database: { auto_read_routing?: boolean; cache_config?: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; host: string; name: string; password: string; pool_config?: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode?: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; username: string }; description?: string; name: string; org_id: string; self_hosted?: boolean; tags?: string[] }",
         "requestBodyRequired": true,
-        "responseType": "{ database?: { auto_read_routing?: boolean; cache_config: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; connection_string?: string; created_at: string; host: string; id: string; name: string; pool_config: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; project_id: string; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; updated_at: string; username: string }; project: { active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string } }",
+        "responseType": "{ database?: { auto_read_routing?: boolean; cache_config: { enabled: boolean; max_entries: number; swr_seconds: number; ttl_seconds: number }; connection_string?: string; created_at: string; host: string; id: string; name: string; pool_config: { max_active?: number; min_pool_size: number; pool_mode: \"session\" | \"transaction\" | \"statement\"; pool_size: number }; pool_region?: string; port: number; project_id: string; query_timeout_ms?: number; role?: \"primary\" | \"replica\"; ssl_mode: \"disable\" | \"allow\" | \"prefer\" | \"require\" | \"verify-ca\" | \"verify-full\"; updated_at: string; username: string }; project: { active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; residency?: \"any\" | \"us\" | \"eu\"; self_hosted?: boolean; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string } }",
         "responseStatus": "201"
     },
     "getProject": {
@@ -1373,7 +1427,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
         ],
         "requestBodyType": "",
         "requestBodyRequired": false,
-        "responseType": "{ active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string }",
+        "responseType": "{ active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; residency?: \"any\" | \"us\" | \"eu\"; self_hosted?: boolean; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string }",
         "responseStatus": "200"
     },
     "updateProject": {
@@ -1391,9 +1445,9 @@ Object.defineProperty(exports, '__esModule', { value: true });
                 "description": "Unique project identifier (prefixed, e.g. prj_xxx)."
             }
         ],
-        "requestBodyType": "{ agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; default_policy_profile_id?: string; description?: string; name?: string; status?: \"active\" | \"suspended\" | \"deleted\"; tags?: string[] }",
+        "requestBodyType": "{ agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; default_policy_profile_id?: string; description?: string; name?: string; residency?: \"any\" | \"us\" | \"eu\"; status?: \"active\" | \"suspended\" | \"deleted\"; tags?: string[] }",
         "requestBodyRequired": true,
-        "responseType": "{ active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string }",
+        "responseType": "{ active_connections?: number; agents_disabled?: boolean; allowed_cidrs?: ({ cidr: string; label?: string })[]; burst_size?: number; cloud?: \"aws\" | \"azure\" | \"gcp\"; created_at: string; database_count?: number; default_policy_profile_id?: string; description?: string; id: string; max_connections?: number; name: string; org_id: string; proxy_host?: string; queries_per_second?: number; residency?: \"any\" | \"us\" | \"eu\"; self_hosted?: boolean; status: \"active\" | \"suspended\" | \"deleted\"; tags?: string[]; updated_at: string }",
         "responseStatus": "200"
     },
     "deleteProject": {
@@ -1529,6 +1583,73 @@ Object.defineProperty(exports, '__esModule', { value: true });
         "responseType": "",
         "responseStatus": "204"
     },
+    "listSelfHostEnrollments": {
+        "operationId": "listSelfHostEnrollments",
+        "method": "GET",
+        "path": "/v1/organizations/{org_id}/self-host-enrollments",
+        "summary": "List self-host enrollments",
+        "description": "Lists an organization's self-host enrollments. Tokens are never returned.",
+        "parameters": [
+            {
+                "name": "org_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique organization identifier."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "{ enrollments: ({ created_at: string; created_by?: string; description?: string; id: string; last_seen_at?: string; org_id: string; region_label?: string; revoked_at?: string })[] }",
+        "responseStatus": "200"
+    },
+    "createSelfHostEnrollment": {
+        "operationId": "createSelfHostEnrollment",
+        "method": "POST",
+        "path": "/v1/organizations/{org_id}/self-host-enrollments",
+        "summary": "Issue a self-host enrollment token",
+        "description": "Issues an enrollment token a self-hosted (BYOC) proxy uses to authenticate to the control plane's config/audit gRPC stream. The token is returned once and cannot be retrieved again. Requires the Scale or enterprise plan.",
+        "parameters": [
+            {
+                "name": "org_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique organization identifier."
+            }
+        ],
+        "requestBodyType": "{ description?: string; region_label?: string }",
+        "requestBodyRequired": false,
+        "responseType": "{ enrollment: { created_at: string; created_by?: string; description?: string; id: string; last_seen_at?: string; org_id: string; region_label?: string; revoked_at?: string }; token: string }",
+        "responseStatus": "201"
+    },
+    "revokeSelfHostEnrollment": {
+        "operationId": "revokeSelfHostEnrollment",
+        "method": "DELETE",
+        "path": "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}",
+        "summary": "Revoke a self-host enrollment",
+        "description": "Revokes an enrollment so its token can no longer authenticate a proxy. Connected proxies keep their last-known config until they reconnect.",
+        "parameters": [
+            {
+                "name": "org_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique organization identifier."
+            },
+            {
+                "name": "enrollment_id",
+                "in": "path",
+                "required": true,
+                "type": "string",
+                "description": "Unique enrollment identifier."
+            }
+        ],
+        "requestBodyType": "",
+        "requestBodyRequired": false,
+        "responseType": "",
+        "responseStatus": "204"
+    },
     "listSupportCases": {
         "operationId": "listSupportCases",
         "method": "GET",
@@ -1972,6 +2093,10 @@ Object.defineProperty(exports, '__esModule', { value: true });
         exportAuditLogs: {
             method: "GET",
             path: "/v1/projects/{project_id}/audit-logs/export"
+        },
+        verifyAuditChain: {
+            method: "GET",
+            path: "/v1/projects/{project_id}/audit-logs/verify"
         }
     },
     anomalies: {
@@ -2146,6 +2271,18 @@ Object.defineProperty(exports, '__esModule', { value: true });
         listRegions: {
             method: "GET",
             path: "/v1/regions"
+        },
+        listSelfHostEnrollments: {
+            method: "GET",
+            path: "/v1/organizations/{org_id}/self-host-enrollments"
+        },
+        createSelfHostEnrollment: {
+            method: "POST",
+            path: "/v1/organizations/{org_id}/self-host-enrollments"
+        },
+        revokeSelfHostEnrollment: {
+            method: "DELETE",
+            path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}"
         }
     },
     migrations: {
@@ -2178,6 +2315,10 @@ Object.defineProperty(exports, '__esModule', { value: true });
         dryEvalPolicy: {
             method: "POST",
             path: "/v1/projects/{project_id}/policy-evaluations"
+        },
+        replayPolicy: {
+            method: "POST",
+            path: "/v1/projects/{project_id}/policy-replays"
         }
     },
     support: {
@@ -2306,6 +2447,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/audit-logs/export",
         operationId: "exportAuditLogs"
     },
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        method: "GET",
+        path: "/v1/projects/{project_id}/audit-logs/verify",
+        operationId: "verifyAuditChain"
+    },
     "GET /v1/plans": {
         method: "GET",
         path: "/v1/plans",
@@ -2466,6 +2612,11 @@ const operationsByPath = {
         path: "/v1/projects/{project_id}/policy-evaluations",
         operationId: "dryEvalPolicy"
     },
+    "POST /v1/projects/{project_id}/policy-replays": {
+        method: "POST",
+        path: "/v1/projects/{project_id}/policy-replays",
+        operationId: "replayPolicy"
+    },
     "GET /v1/projects": {
         method: "GET",
         path: "/v1/projects",
@@ -2516,6 +2667,21 @@ const operationsByPath = {
         path: "/v1/databases/{database_id}/replicas/{replica_id}",
         operationId: "deleteReplica"
     },
+    "GET /v1/organizations/{org_id}/self-host-enrollments": {
+        method: "GET",
+        path: "/v1/organizations/{org_id}/self-host-enrollments",
+        operationId: "listSelfHostEnrollments"
+    },
+    "POST /v1/organizations/{org_id}/self-host-enrollments": {
+        method: "POST",
+        path: "/v1/organizations/{org_id}/self-host-enrollments",
+        operationId: "createSelfHostEnrollment"
+    },
+    "DELETE /v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}": {
+        method: "DELETE",
+        path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}",
+        operationId: "revokeSelfHostEnrollment"
+    },
     "GET /v1/organizations/{org_id}/support/cases": {
         method: "GET",
         path: "/v1/organizations/{org_id}/support/cases",