pgbeam 0.3.7 → 0.3.9

package/dist/operations.d.mts

@@ -1456,6 +1456,21 @@ type AuditLogEntry = {
      * @type string
     */
     ts: string;
+    /**
+     * @description Monotonic per-project position in the tamper-evident hash chain.
+     * @type integer | undefined
+    */
+    seq?: number;
+    /**
+     * @description Hex SHA-256 of the previous chained entry (a fixed genesis value for the first entry). Empty for pre-chain legacy entries.
+     * @type string | undefined
+    */
+    prev_hash?: string;
+    /**
+     * @description Hex SHA-256 of this entry\'s canonical content chained onto prev_hash. Empty for pre-chain legacy entries.
+     * @type string | undefined
+    */
+    entry_hash?: string;
 };
 
 /**
@@ -1648,6 +1663,108 @@ type ExportAuditLogsRequestConfig = {
     url: `/v1/projects/${string}/audit-logs/export`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Result of recomputing the project\'s tamper-evident audit hash chain over a time range. The chain links each entry to its predecessor, so editing or deleting any row breaks it.
+ * @type object
+*/
+type AuditChainVerification = {
+    /**
+     * @description True when every chained entry in the range links correctly and no tampering or deletion was detected.
+     * @type boolean
+    */
+    ok: boolean;
+    /**
+     * @description Number of chained entries checked.
+     * @type integer
+    */
+    verified_count: number;
+    /**
+     * @description Pre-chain (legacy) entries in the range that predate the hash chain and were skipped rather than treated as tampering.
+     * @type integer
+    */
+    unchained_count: number;
+    /**
+     * @description Sequence number of the first chained entry checked. Null when none.
+     * @type integer
+    */
+    chain_start_seq?: number | null;
+    /**
+     * @description Sequence number of the last chained entry checked. Null when none.
+     * @type integer
+    */
+    chain_end_seq?: number | null;
+    /**
+     * @description Sequence number where verification first failed (a tampered or deleted entry). Null when ok.
+     * @type integer
+    */
+    first_broken_seq?: number | null;
+    /**
+     * @description Machine-readable failure kind: hash_mismatch (entry content edited), broken_link (prev_hash does not match the predecessor), or missing_entry (a sequence number was deleted). Null when ok.
+     * @type string
+    */
+    failure_reason?: string | null;
+    /**
+     * @description When verification ran.
+     * @type string
+    */
+    verified_at: string;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type VerifyAuditChainPathProjectId = string;
+/**
+ * @description Return entries at or after this timestamp (inclusive lower bound).
+ * @type string | undefined
+*/
+type VerifyAuditChainQueryStart = string | undefined;
+/**
+ * @description Return entries strictly older than this timestamp (cursor / upper bound).
+ * @type string | undefined
+*/
+type VerifyAuditChainQueryEnd = string | undefined;
+/**
+ * @description Result of recomputing the project\'s tamper-evident audit hash chain over a time range. The chain links each entry to its predecessor, so editing or deleting any row breaks it.
+ * @type object
+*/
+type VerifyAuditChainStatus200 = AuditChainVerification;
+/**
+ * @type object
+*/
+type VerifyAuditChainRequestConfig = {
+    data?: never;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: VerifyAuditChainPathProjectId;
+    };
+    /**
+     * @type object | undefined
+    */
+    queryParams?: {
+        start?: VerifyAuditChainQueryStart;
+        end?: VerifyAuditChainQueryEnd;
+    };
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/audit-logs/verify`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -1697,6 +1814,36 @@ type PlanLimits = {
      * @type integer
     */
     included_seats: number;
+    /**
+     * @description Maximum agent credentials per organization. 0 means unlimited.
+     * @type integer
+    */
+    max_agent_credentials: number;
+    /**
+     * @description Agent audit-log retention window in days.
+     * @type integer
+    */
+    audit_retention_days: number;
+    /**
+     * @description Maximum concurrently active instant (sandbox) branches. 0 means no limit.
+     * @type integer
+    */
+    sandbox_max_branches: number;
+    /**
+     * @description Maximum upstream source-database size a sandbox base sync accepts, in bytes. 0 means no limit.
+     * @type integer
+    */
+    sandbox_max_upstream_bytes: number;
+    /**
+     * @description Idle time before an instant (sandbox) branch scales to zero, in seconds.
+     * @type integer
+    */
+    sandbox_idle_seconds: number;
+    /**
+     * @description Lifetime of an instant (sandbox) branch before the TTL sweep discards it, in seconds.
+     * @type integer
+    */
+    sandbox_ttl_seconds: number;
 };
 
 /**
@@ -5376,6 +5523,250 @@ type DryEvalPolicyRequestConfig = {
     url: `/v1/projects/${string}/policy-evaluations`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type PolicyReplayInput = {
+    /**
+     * @description ID of an existing saved policy profile to replay against.
+     * @example pol_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    policy_id?: string;
+    /**
+     * @description Mutable fields of a policy profile (used for create and update).
+     * @type object | undefined
+    */
+    policy?: PolicyProfileInput;
+    /**
+     * @description Restrict the replay to traffic recorded for one agent credential.
+     * @example cred_01h455vb4pex5vsknk084sn02q
+     * @type string | undefined
+    */
+    credential_id?: string;
+    /**
+     * @description Start of the traffic window (inclusive). Defaults to 7 days before end_ts.
+     * @type string | undefined
+    */
+    start_ts?: string;
+    /**
+     * @description End of the traffic window (exclusive). Defaults to now.
+     * @type string | undefined
+    */
+    end_ts?: string;
+    /**
+     * @description Maximum number of distinct queries to replay, newest first. Traffic is deduplicated by normalized query hash before evaluation.
+     * @minLength 1
+     * @maxLength 500
+     * @default 200
+     * @type integer | undefined
+    */
+    limit?: number;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+declare const policyReplayItemChangeEnum: {
+    readonly newly_blocked: "newly_blocked";
+    readonly newly_allowed: "newly_allowed";
+    readonly still_allowed: "still_allowed";
+    readonly still_blocked: "still_blocked";
+};
+type PolicyReplayItemChangeEnumKey = (typeof policyReplayItemChangeEnum)[keyof typeof policyReplayItemChangeEnum];
+/**
+ * @description One distinct recorded query and the decision the candidate policy would reach for it.
+ * @type object
+*/
+type PolicyReplayItem = {
+    /**
+     * @description Normalized query hash identifying this statement shape.
+     * @type string
+    */
+    query_hash: string;
+    /**
+     * @description The recorded statement (normalized, literals replaced with $N placeholders), from its most recent occurrence.
+     * @type string
+    */
+    sql: string;
+    /**
+     * @description Statement kind (select, insert, update, delete, ddl, ...).
+     * @type string | undefined
+    */
+    statement_kind?: string;
+    /**
+     * @description How many recorded entries share this query shape in the window.
+     * @type integer
+    */
+    occurrences: number;
+    /**
+     * @description Oldest occurrence in the window.
+     * @type string
+    */
+    first_seen: string;
+    /**
+     * @description Newest occurrence in the window.
+     * @type string
+    */
+    last_seen: string;
+    /**
+     * @description The most recent recorded outcome for this query (query, masked, truncated, or blocked).
+     * @type string
+    */
+    recorded_event: string;
+    /**
+     * @description The decision rule recorded with a blocked outcome.
+     * @type string | undefined
+    */
+    recorded_rule?: string;
+    /**
+     * @description How the candidate decision compares to the recorded outcome. newly_blocked and newly_allowed are the changes worth reviewing before rollout; still_allowed and still_blocked are unchanged.
+     * @type string
+    */
+    change: PolicyReplayItemChangeEnumKey;
+    /**
+     * @description The decision the proxy would reach for the supplied statement under the supplied policy. verdict is the headline outcome; the remaining fields detail why.
+     * @type object
+    */
+    result: DryEvalResult;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Aggregate outcome of a policy replay.
+ * @type object
+*/
+type PolicyReplaySummary = {
+    /**
+     * @description Recorded audit entries covered by the replayed queries.
+     * @type integer
+    */
+    entries_scanned: number;
+    /**
+     * @description Distinct normalized queries found in the window (capped at limit).
+     * @type integer
+    */
+    distinct_queries: number;
+    /**
+     * @description Distinct queries actually evaluated against the candidate policy.
+     * @type integer
+    */
+    evaluated: number;
+    /**
+     * @description Queries the candidate policy would allow unchanged.
+     * @type integer
+    */
+    would_allow: number;
+    /**
+     * @description Queries the candidate policy would block.
+     * @type integer
+    */
+    would_block: number;
+    /**
+     * @description Queries the candidate policy would mask result columns on.
+     * @type integer
+    */
+    would_mask: number;
+    /**
+     * @description Queries the candidate policy would inject a row filter into.
+     * @type integer
+    */
+    would_row_filter: number;
+    /**
+     * @description Queries that executed under the recorded policy but the candidate policy would block.
+     * @type integer
+    */
+    newly_blocked: number;
+    /**
+     * @description Queries that were blocked when recorded but the candidate policy would permit.
+     * @type integer
+    */
+    newly_allowed: number;
+    /**
+     * @description Distinct queries skipped because the stored statement was truncated at record time and can no longer be parsed faithfully.
+     * @type integer
+    */
+    skipped_unparseable: number;
+    /**
+     * @description True when the window contained more distinct queries than limit; only the newest were replayed.
+     * @type boolean
+    */
+    truncated: boolean;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type PolicyReplayResult = {
+    /**
+     * @description Aggregate outcome of a policy replay.
+     * @type object
+    */
+    summary: PolicyReplaySummary;
+    /**
+     * @description Per-query replay decisions, ordered changes first (newly blocked, then newly allowed), then by occurrence count.
+     * @type array
+    */
+    items: PolicyReplayItem[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique project identifier (prefixed, e.g. prj_xxx).
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @type string
+*/
+type ReplayPolicyPathProjectId = string;
+/**
+ * @description The outcome of replaying recorded agent traffic against a candidate policy: an aggregate summary plus per-query decisions, changes first.
+ * @type object
+*/
+type ReplayPolicyStatus200 = PolicyReplayResult;
+/**
+ * @description A window of recorded agent traffic to replay plus the candidate policy to replay it against. Supply exactly one of policy_id (an existing saved policy) or policy (an unsaved draft, e.g. the in-progress editor form).
+ * @type object
+*/
+type ReplayPolicyData = PolicyReplayInput;
+/**
+ * @type object
+*/
+type ReplayPolicyRequestConfig = {
+    data?: ReplayPolicyData;
+    /**
+     * @type object
+    */
+    pathParams: {
+        project_id: ReplayPolicyPathProjectId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/projects/${string}/policy-replays`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -5401,6 +5792,17 @@ type CidrEntry = {
     label?: string;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+declare const dataResidency: {
+    readonly any: "any";
+    readonly us: "us";
+    readonly eu: "eu";
+};
+type DataResidencyKey = (typeof dataResidency)[keyof typeof dataResidency];
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -5466,6 +5868,12 @@ type Project = {
      * @type string | undefined
     */
     readonly cloud?: ProjectCloudEnumKey;
+    /**
+     * @description When true, this project\'s data plane runs in the customer\'s own VPC/cluster (BYOC): the control plane does not provision hosted infra, and a self-hosted proxy dials home over the config/audit gRPC stream. Requires the Scale or enterprise plan.\n
+     * @example false
+     * @type boolean | undefined
+    */
+    readonly self_hosted?: boolean;
     /**
      * @description Proxy hostname for connecting through PgBeam (e.g., myproject.proxy.pgbeam.app).
      * @type string | undefined
@@ -5501,6 +5909,13 @@ type Project = {
      * @type string
     */
     default_policy_profile_id?: string | null;
+    /**
+     * @description Data-residency requirement for the project. \"any\" (default) lets queries be served from the nearest data-plane metro. \"us\" or \"eu\" require the serving metro to be in that jurisdiction; the proxy fails a connection closed when it is served from a metro outside the required jurisdiction, so regulated workloads never process outside their permitted region.\n
+     * @default "any"
+     * @example eu
+     * @type string | undefined
+    */
+    residency?: DataResidencyKey;
     /**
      * @description Project-level kill-switch. When true, ALL agent-credential connections to this project are blocked at the proxy and live agent sessions are dropped within seconds. Passthrough/human connections are unaffected.\n
      * @example false
@@ -5673,6 +6088,12 @@ type CreateProjectRequest = {
      * @type string | undefined
     */
     cloud?: CreateProjectRequestCloudEnumKey;
+    /**
+     * @description Mark this project as running on a self-hosted (BYOC) data plane in the customer\'s own VPC/cluster. Requires the Scale or enterprise plan.\n
+     * @default false
+     * @type boolean | undefined
+    */
+    self_hosted?: boolean;
     /**
      * @description Primary database. Created atomically with the project.
      * @type object
@@ -5815,6 +6236,13 @@ type UpdateProjectRequest = {
      * @type string
     */
     default_policy_profile_id?: string | null;
+    /**
+     * @description Data-residency requirement for the project. \"any\" (default) lets queries be served from the nearest data-plane metro. \"us\" or \"eu\" require the serving metro to be in that jurisdiction; the proxy fails a connection closed when it is served from a metro outside the required jurisdiction, so regulated workloads never process outside their permitted region.\n
+     * @default "any"
+     * @example eu
+     * @type string | undefined
+    */
+    residency?: DataResidencyKey;
     /**
      * @description Project-level kill-switch. Set true to block ALL agent-credential connections to this project (live agent sessions are dropped within seconds); set false to re-enable them. Passthrough/human connections are unaffected. Engaging the kill-switch emits a kill_switch webhook event.\n
      * @example true
@@ -6347,6 +6775,244 @@ type DeleteReplicaRequestConfig = {
     url: `/v1/databases/${string}/replicas/${string}`;
 };
 
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description An enrollment that lets a self-hosted (BYOC) proxy authenticate to the control plane\'s config/audit gRPC stream on behalf of an organization. The token itself is never returned after creation, only its metadata.\n
+ * @type object
+*/
+type SelfHostEnrollment = {
+    /**
+     * @description Unique enrollment identifier.
+     * @example she_01h455vb4pex5vsknk084sn02q
+     * @type string
+    */
+    id: string;
+    /**
+     * @description Organization that owns this enrollment.
+     * @example org_abc123
+     * @type string
+    */
+    org_id: string;
+    /**
+     * @description Operator-supplied label for where the proxy runs (informational).
+     * @example customer-vpc-us-east
+     * @type string | undefined
+    */
+    region_label?: string;
+    /**
+     * @description Optional human-readable note.
+     * @example prod cluster
+     * @type string | undefined
+    */
+    description?: string;
+    /**
+     * @description User ID that created the enrollment.
+     * @type string
+    */
+    created_by?: string | null;
+    /**
+     * @description When the enrollment was created.
+     * @type string
+    */
+    created_at: string;
+    /**
+     * @description Last time a proxy authenticated with this enrollment.
+     * @type string
+    */
+    last_seen_at?: string | null;
+    /**
+     * @description When the enrollment was revoked. Null means active.
+     * @type string
+    */
+    revoked_at?: string | null;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description List of self-host enrollments for an organization.
+ * @type object
+*/
+type ListSelfHostEnrollmentsResponse = {
+    /**
+     * @description The organization\'s self-host enrollments, newest first.
+     * @type array
+    */
+    enrollments: SelfHostEnrollment[];
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique organization identifier.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @example org_abc123
+ * @type string
+*/
+type ListSelfHostEnrollmentsPathOrgId = string;
+/**
+ * @description List of self-host enrollments for an organization.
+ * @type object
+*/
+type ListSelfHostEnrollmentsStatus200 = ListSelfHostEnrollmentsResponse;
+/**
+ * @type object
+*/
+type ListSelfHostEnrollmentsRequestConfig = {
+    data?: never;
+    /**
+     * @type object
+    */
+    pathParams: {
+        org_id: ListSelfHostEnrollmentsPathOrgId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/organizations/${string}/self-host-enrollments`;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+/**
+ * @description Request body for issuing a self-host enrollment token.
+ * @type object
+*/
+type CreateSelfHostEnrollmentRequest = {
+    /**
+     * @description Operator-supplied label for where the proxy runs.
+     * @maxLength 100
+     * @pattern ^[^\x00]*$
+     * @example customer-vpc-us-east
+     * @type string | undefined
+    */
+    region_label?: string;
+    /**
+     * @description Optional human-readable note.
+     * @maxLength 500
+     * @pattern ^[^\x00]*$
+     * @example prod cluster
+     * @type string | undefined
+    */
+    description?: string;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Response returned once when an enrollment is created. The token is shown a single time and cannot be retrieved again; set it as GRPC_AUTH_TOKEN on the self-hosted proxy.\n
+ * @type object
+*/
+type SelfHostEnrollmentSecret = {
+    /**
+     * @description An enrollment that lets a self-hosted (BYOC) proxy authenticate to the control plane\'s config/audit gRPC stream on behalf of an organization. The token itself is never returned after creation, only its metadata.\n
+     * @type object
+    */
+    enrollment: SelfHostEnrollment;
+    /**
+     * @description The plaintext enrollment token (pbh_...). Shown once.
+     * @example pbh_01h455vb4pex5vsknk084sn02q9zk3m7
+     * @type string
+    */
+    token: string;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique organization identifier.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @example org_abc123
+ * @type string
+*/
+type CreateSelfHostEnrollmentPathOrgId = string;
+/**
+ * @description Response returned once when an enrollment is created. The token is shown a single time and cannot be retrieved again; set it as GRPC_AUTH_TOKEN on the self-hosted proxy.\n
+ * @type object
+*/
+type CreateSelfHostEnrollmentStatus201 = SelfHostEnrollmentSecret;
+/**
+ * @description Request body for issuing a self-host enrollment token.
+ * @type object | undefined
+*/
+type CreateSelfHostEnrollmentData = CreateSelfHostEnrollmentRequest | undefined;
+/**
+ * @type object
+*/
+type CreateSelfHostEnrollmentRequestConfig = {
+    data?: CreateSelfHostEnrollmentData;
+    /**
+     * @type object
+    */
+    pathParams: {
+        org_id: CreateSelfHostEnrollmentPathOrgId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/organizations/${string}/self-host-enrollments`;
+};
+
+/**
+* Generated by Kubb (https://kubb.dev/).
+* Do not edit manually.
+*/
+
+/**
+ * @description Unique organization identifier.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @example org_abc123
+ * @type string
+*/
+type RevokeSelfHostEnrollmentPathOrgId = string;
+/**
+ * @description Unique enrollment identifier.
+ * @pattern ^[a-zA-Z0-9_.-]+$
+ * @example she_01h455vb4pex5vsknk084sn02q
+ * @type string
+*/
+type RevokeSelfHostEnrollmentPathEnrollmentId = string;
+/**
+ * @type object
+*/
+type RevokeSelfHostEnrollmentRequestConfig = {
+    data?: never;
+    /**
+     * @type object
+    */
+    pathParams: {
+        org_id: RevokeSelfHostEnrollmentPathOrgId;
+        enrollment_id: RevokeSelfHostEnrollmentPathEnrollmentId;
+    };
+    queryParams?: never;
+    headerParams?: never;
+    /**
+     * @type string
+    */
+    url: `/v1/organizations/${string}/self-host-enrollments/${string}`;
+};
+
 /**
 * Generated by Kubb (https://kubb.dev/).
 * Do not edit manually.
@@ -7642,6 +8308,10 @@ declare const operationsByTag: {
             readonly method: "GET";
             readonly path: "/v1/projects/{project_id}/audit-logs/export";
         };
+        readonly verifyAuditChain: {
+            readonly method: "GET";
+            readonly path: "/v1/projects/{project_id}/audit-logs/verify";
+        };
     };
     readonly anomalies: {
         readonly listAnomalyAlerts: {
@@ -7816,6 +8486,18 @@ declare const operationsByTag: {
             readonly method: "GET";
             readonly path: "/v1/regions";
         };
+        readonly listSelfHostEnrollments: {
+            readonly method: "GET";
+            readonly path: "/v1/organizations/{org_id}/self-host-enrollments";
+        };
+        readonly createSelfHostEnrollment: {
+            readonly method: "POST";
+            readonly path: "/v1/organizations/{org_id}/self-host-enrollments";
+        };
+        readonly revokeSelfHostEnrollment: {
+            readonly method: "DELETE";
+            readonly path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}";
+        };
     };
     readonly migrations: {
         readonly lintMigration: {
@@ -7848,6 +8530,10 @@ declare const operationsByTag: {
             readonly method: "POST";
             readonly path: "/v1/projects/{project_id}/policy-evaluations";
         };
+        readonly replayPolicy: {
+            readonly method: "POST";
+            readonly path: "/v1/projects/{project_id}/policy-replays";
+        };
     };
     readonly support: {
         readonly listSupportCases: {
@@ -7975,6 +8661,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/audit-logs/export";
         readonly operationId: "exportAuditLogs";
     };
+    readonly "GET /v1/projects/{project_id}/audit-logs/verify": {
+        readonly method: "GET";
+        readonly path: "/v1/projects/{project_id}/audit-logs/verify";
+        readonly operationId: "verifyAuditChain";
+    };
     readonly "GET /v1/plans": {
         readonly method: "GET";
         readonly path: "/v1/plans";
@@ -8135,6 +8826,11 @@ declare const operationsByPath: {
         readonly path: "/v1/projects/{project_id}/policy-evaluations";
         readonly operationId: "dryEvalPolicy";
     };
+    readonly "POST /v1/projects/{project_id}/policy-replays": {
+        readonly method: "POST";
+        readonly path: "/v1/projects/{project_id}/policy-replays";
+        readonly operationId: "replayPolicy";
+    };
     readonly "GET /v1/projects": {
         readonly method: "GET";
         readonly path: "/v1/projects";
@@ -8185,6 +8881,21 @@ declare const operationsByPath: {
         readonly path: "/v1/databases/{database_id}/replicas/{replica_id}";
         readonly operationId: "deleteReplica";
     };
+    readonly "GET /v1/organizations/{org_id}/self-host-enrollments": {
+        readonly method: "GET";
+        readonly path: "/v1/organizations/{org_id}/self-host-enrollments";
+        readonly operationId: "listSelfHostEnrollments";
+    };
+    readonly "POST /v1/organizations/{org_id}/self-host-enrollments": {
+        readonly method: "POST";
+        readonly path: "/v1/organizations/{org_id}/self-host-enrollments";
+        readonly operationId: "createSelfHostEnrollment";
+    };
+    readonly "DELETE /v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}": {
+        readonly method: "DELETE";
+        readonly path: "/v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}";
+        readonly operationId: "revokeSelfHostEnrollment";
+    };
     readonly "GET /v1/organizations/{org_id}/support/cases": {
         readonly method: "GET";
         readonly path: "/v1/organizations/{org_id}/support/cases";
@@ -8305,6 +9016,10 @@ type ExportAuditLogsParams = {
     pathParams: NonNullable<ExportAuditLogsRequestConfig["pathParams"]>;
     queryParams?: NonNullable<ExportAuditLogsRequestConfig["queryParams"]>;
 };
+type VerifyAuditChainParams = {
+    pathParams: NonNullable<VerifyAuditChainRequestConfig["pathParams"]>;
+    queryParams?: NonNullable<VerifyAuditChainRequestConfig["queryParams"]>;
+};
 type GetOrganizationPlanParams = {
     pathParams: NonNullable<GetOrganizationPlanRequestConfig["pathParams"]>;
 };
@@ -8412,6 +9127,10 @@ type DryEvalPolicyParams = {
     pathParams: NonNullable<DryEvalPolicyRequestConfig["pathParams"]>;
     body: NonNullable<DryEvalPolicyRequestConfig["data"]>;
 };
+type ReplayPolicyParams = {
+    pathParams: NonNullable<ReplayPolicyRequestConfig["pathParams"]>;
+    body: NonNullable<ReplayPolicyRequestConfig["data"]>;
+};
 type ListProjectsParams = {
     queryParams: NonNullable<ListProjectsRequestConfig["queryParams"]>;
 };
@@ -8442,6 +9161,16 @@ type CreateReplicaParams = {
 type DeleteReplicaParams = {
     pathParams: NonNullable<DeleteReplicaRequestConfig["pathParams"]>;
 };
+type ListSelfHostEnrollmentsParams = {
+    pathParams: NonNullable<ListSelfHostEnrollmentsRequestConfig["pathParams"]>;
+};
+type CreateSelfHostEnrollmentParams = {
+    pathParams: NonNullable<CreateSelfHostEnrollmentRequestConfig["pathParams"]>;
+    body: NonNullable<CreateSelfHostEnrollmentRequestConfig["data"]>;
+};
+type RevokeSelfHostEnrollmentParams = {
+    pathParams: NonNullable<RevokeSelfHostEnrollmentRequestConfig["pathParams"]>;
+};
 type ListSupportCasesParams = {
     pathParams: NonNullable<ListSupportCasesRequestConfig["pathParams"]>;
     queryParams?: NonNullable<ListSupportCasesRequestConfig["queryParams"]>;
@@ -8508,6 +9237,7 @@ interface ApiOperations {
         rotateAgentCredential(params: RotateAgentCredentialParams): Promise<RotateAgentCredentialStatus200>;
         listAuditLogs(params: ListAuditLogsParams): Promise<ListAuditLogsStatus200>;
         exportAuditLogs(params: ExportAuditLogsParams): Promise<ExportAuditLogsStatus200>;
+        verifyAuditChain(params: VerifyAuditChainParams): Promise<VerifyAuditChainStatus200>;
     };
     anomalies: {
         listAnomalyAlerts(params: ListAnomalyAlertsParams): Promise<ListAnomalyAlertsStatus200>;
@@ -8562,6 +9292,9 @@ interface ApiOperations {
     platform: {
         getHealth(): Promise<GetHealthStatus200>;
         listRegions(): Promise<ListRegionsStatus200>;
+        listSelfHostEnrollments(params: ListSelfHostEnrollmentsParams): Promise<ListSelfHostEnrollmentsStatus200>;
+        createSelfHostEnrollment(params: CreateSelfHostEnrollmentParams): Promise<CreateSelfHostEnrollmentStatus201>;
+        revokeSelfHostEnrollment(params: RevokeSelfHostEnrollmentParams): Promise<void>;
     };
     migrations: {
         lintMigration(params: LintMigrationParams): Promise<LintMigrationStatus200>;
@@ -8573,6 +9306,7 @@ interface ApiOperations {
         updatePolicyProfile(params: UpdatePolicyProfileParams): Promise<UpdatePolicyProfileStatus200>;
         deletePolicyProfile(params: DeletePolicyProfileParams): Promise<void>;
         dryEvalPolicy(params: DryEvalPolicyParams): Promise<DryEvalPolicyStatus200>;
+        replayPolicy(params: ReplayPolicyParams): Promise<ReplayPolicyStatus200>;
     };
     support: {
         listSupportCases(params: ListSupportCasesParams): Promise<ListSupportCasesStatus200>;
@@ -8650,6 +9384,10 @@ interface RequestMap {
         params: ExportAuditLogsParams;
         response: ExportAuditLogsStatus200;
     };
+    "GET /v1/projects/{project_id}/audit-logs/verify": {
+        params: VerifyAuditChainParams;
+        response: VerifyAuditChainStatus200;
+    };
     "GET /v1/plans": {
         params?: undefined;
         response: ListPlansStatus200;
@@ -8778,6 +9516,10 @@ interface RequestMap {
         params: DryEvalPolicyParams;
         response: DryEvalPolicyStatus200;
     };
+    "POST /v1/projects/{project_id}/policy-replays": {
+        params: ReplayPolicyParams;
+        response: ReplayPolicyStatus200;
+    };
     "GET /v1/projects": {
         params: ListProjectsParams;
         response: ListProjectsStatus200;
@@ -8818,6 +9560,18 @@ interface RequestMap {
         params: DeleteReplicaParams;
         response: void;
     };
+    "GET /v1/organizations/{org_id}/self-host-enrollments": {
+        params: ListSelfHostEnrollmentsParams;
+        response: ListSelfHostEnrollmentsStatus200;
+    };
+    "POST /v1/organizations/{org_id}/self-host-enrollments": {
+        params: CreateSelfHostEnrollmentParams;
+        response: CreateSelfHostEnrollmentStatus201;
+    };
+    "DELETE /v1/organizations/{org_id}/self-host-enrollments/{enrollment_id}": {
+        params: RevokeSelfHostEnrollmentParams;
+        response: void;
+    };
     "GET /v1/organizations/{org_id}/support/cases": {
         params: ListSupportCasesParams;
         response: ListSupportCasesStatus200;