OpenShell/sdk/go/proto/openshellv1/openshell.pb.go

// SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

// Code generated by protoc-gen-go. DO NOT EDIT.
// versions:
// 	protoc-gen-go v1.36.11
// 	protoc        (unknown)
// source: openshell.proto

package openshellv1

import (
	datamodelv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/datamodelv1"
	_ "github.com/NVIDIA/OpenShell/sdk/go/proto/optionsv1"
	sandboxv1 "github.com/NVIDIA/OpenShell/sdk/go/proto/sandboxv1"
	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
	structpb "google.golang.org/protobuf/types/known/structpb"
	reflect "reflect"
	sync "sync"
	unsafe "unsafe"
)

const (
	// Verify that this generated code is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
	// Verify that runtime/protoimpl is sufficiently up-to-date.
	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
)

// High-level sandbox lifecycle phase derived by the gateway.
//
// Clients should rely on this normalized lifecycle summary for readiness and
// deletion decisions instead of interpreting raw conditions.
type SandboxPhase int32

const (
	SandboxPhase_SANDBOX_PHASE_UNSPECIFIED  SandboxPhase = 0
	SandboxPhase_SANDBOX_PHASE_PROVISIONING SandboxPhase = 1
	SandboxPhase_SANDBOX_PHASE_READY        SandboxPhase = 2
	SandboxPhase_SANDBOX_PHASE_ERROR        SandboxPhase = 3
	SandboxPhase_SANDBOX_PHASE_DELETING     SandboxPhase = 4
	SandboxPhase_SANDBOX_PHASE_UNKNOWN      SandboxPhase = 5
	SandboxPhase_SANDBOX_PHASE_STOPPING     SandboxPhase = 6
	SandboxPhase_SANDBOX_PHASE_STOPPED      SandboxPhase = 7
	SandboxPhase_SANDBOX_PHASE_STARTING     SandboxPhase = 8
)

// Enum value maps for SandboxPhase.
var (
	SandboxPhase_name = map[int32]string{
		0: "SANDBOX_PHASE_UNSPECIFIED",
		1: "SANDBOX_PHASE_PROVISIONING",
		2: "SANDBOX_PHASE_READY",
		3: "SANDBOX_PHASE_ERROR",
		4: "SANDBOX_PHASE_DELETING",
		5: "SANDBOX_PHASE_UNKNOWN",
		6: "SANDBOX_PHASE_STOPPING",
		7: "SANDBOX_PHASE_STOPPED",
		8: "SANDBOX_PHASE_STARTING",
	}
	SandboxPhase_value = map[string]int32{
		"SANDBOX_PHASE_UNSPECIFIED":  0,
		"SANDBOX_PHASE_PROVISIONING": 1,
		"SANDBOX_PHASE_READY":        2,
		"SANDBOX_PHASE_ERROR":        3,
		"SANDBOX_PHASE_DELETING":     4,
		"SANDBOX_PHASE_UNKNOWN":      5,
		"SANDBOX_PHASE_STOPPING":     6,
		"SANDBOX_PHASE_STOPPED":      7,
		"SANDBOX_PHASE_STARTING":     8,
	}
)

func (x SandboxPhase) Enum() *SandboxPhase {
	p := new(SandboxPhase)
	*p = x
	return p
}

func (x SandboxPhase) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (SandboxPhase) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[0].Descriptor()
}

func (SandboxPhase) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[0]
}

func (x SandboxPhase) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use SandboxPhase.Descriptor instead.
func (SandboxPhase) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{0}
}

type ProviderCredentialRefreshStrategy int32

const (
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED                ProviderCredentialRefreshStrategy = 0
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC                     ProviderCredentialRefreshStrategy = 1
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL                   ProviderCredentialRefreshStrategy = 2
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN       ProviderCredentialRefreshStrategy = 3
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS  ProviderCredentialRefreshStrategy = 4
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT ProviderCredentialRefreshStrategy = 5
	ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE        ProviderCredentialRefreshStrategy = 6
)

// Enum value maps for ProviderCredentialRefreshStrategy.
var (
	ProviderCredentialRefreshStrategy_name = map[int32]string{
		0: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED",
		1: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC",
		2: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL",
		3: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN",
		4: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS",
		5: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT",
		6: "PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE",
	}
	ProviderCredentialRefreshStrategy_value = map[string]int32{
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED":                0,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC":                     1,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL":                   2,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN":       3,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS":  4,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT": 5,
		"PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE":        6,
	}
)

func (x ProviderCredentialRefreshStrategy) Enum() *ProviderCredentialRefreshStrategy {
	p := new(ProviderCredentialRefreshStrategy)
	*p = x
	return p
}

func (x ProviderCredentialRefreshStrategy) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderCredentialRefreshStrategy) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[1].Descriptor()
}

func (ProviderCredentialRefreshStrategy) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[1]
}

func (x ProviderCredentialRefreshStrategy) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderCredentialRefreshStrategy.Descriptor instead.
func (ProviderCredentialRefreshStrategy) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{1}
}

// Stable provider profile categories used by clients for grouping and filtering.
type ProviderProfileCategory int32

const (
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED    ProviderProfileCategory = 0
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_OTHER          ProviderProfileCategory = 1
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_INFERENCE      ProviderProfileCategory = 2
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_AGENT          ProviderProfileCategory = 3
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL ProviderProfileCategory = 4
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_MESSAGING      ProviderProfileCategory = 5
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_DATA           ProviderProfileCategory = 6
	ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_KNOWLEDGE      ProviderProfileCategory = 7
)

// Enum value maps for ProviderProfileCategory.
var (
	ProviderProfileCategory_name = map[int32]string{
		0: "PROVIDER_PROFILE_CATEGORY_UNSPECIFIED",
		1: "PROVIDER_PROFILE_CATEGORY_OTHER",
		2: "PROVIDER_PROFILE_CATEGORY_INFERENCE",
		3: "PROVIDER_PROFILE_CATEGORY_AGENT",
		4: "PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL",
		5: "PROVIDER_PROFILE_CATEGORY_MESSAGING",
		6: "PROVIDER_PROFILE_CATEGORY_DATA",
		7: "PROVIDER_PROFILE_CATEGORY_KNOWLEDGE",
	}
	ProviderProfileCategory_value = map[string]int32{
		"PROVIDER_PROFILE_CATEGORY_UNSPECIFIED":    0,
		"PROVIDER_PROFILE_CATEGORY_OTHER":          1,
		"PROVIDER_PROFILE_CATEGORY_INFERENCE":      2,
		"PROVIDER_PROFILE_CATEGORY_AGENT":          3,
		"PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL": 4,
		"PROVIDER_PROFILE_CATEGORY_MESSAGING":      5,
		"PROVIDER_PROFILE_CATEGORY_DATA":           6,
		"PROVIDER_PROFILE_CATEGORY_KNOWLEDGE":      7,
	}
)

func (x ProviderProfileCategory) Enum() *ProviderProfileCategory {
	p := new(ProviderProfileCategory)
	*p = x
	return p
}

func (x ProviderProfileCategory) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ProviderProfileCategory) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[2].Descriptor()
}

func (ProviderProfileCategory) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[2]
}

func (x ProviderProfileCategory) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ProviderProfileCategory.Descriptor instead.
func (ProviderProfileCategory) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{2}
}

// Policy load status.
type PolicyStatus int32

const (
	PolicyStatus_POLICY_STATUS_UNSPECIFIED PolicyStatus = 0
	// Server received the update; sandbox has not yet loaded it.
	PolicyStatus_POLICY_STATUS_PENDING PolicyStatus = 1
	// Sandbox successfully applied this policy version.
	PolicyStatus_POLICY_STATUS_LOADED PolicyStatus = 2
	// Sandbox attempted to apply but failed; LKG policy remains active.
	PolicyStatus_POLICY_STATUS_FAILED PolicyStatus = 3
	// A newer version was persisted before the sandbox loaded this one.
	PolicyStatus_POLICY_STATUS_SUPERSEDED PolicyStatus = 4
)

// Enum value maps for PolicyStatus.
var (
	PolicyStatus_name = map[int32]string{
		0: "POLICY_STATUS_UNSPECIFIED",
		1: "POLICY_STATUS_PENDING",
		2: "POLICY_STATUS_LOADED",
		3: "POLICY_STATUS_FAILED",
		4: "POLICY_STATUS_SUPERSEDED",
	}
	PolicyStatus_value = map[string]int32{
		"POLICY_STATUS_UNSPECIFIED": 0,
		"POLICY_STATUS_PENDING":     1,
		"POLICY_STATUS_LOADED":      2,
		"POLICY_STATUS_FAILED":      3,
		"POLICY_STATUS_SUPERSEDED":  4,
	}
)

func (x PolicyStatus) Enum() *PolicyStatus {
	p := new(PolicyStatus)
	*p = x
	return p
}

func (x PolicyStatus) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (PolicyStatus) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[3].Descriptor()
}

func (PolicyStatus) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[3]
}

func (x PolicyStatus) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use PolicyStatus.Descriptor instead.
func (PolicyStatus) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{3}
}

// Service status enum.
type ServiceStatus int32

const (
	ServiceStatus_SERVICE_STATUS_UNSPECIFIED ServiceStatus = 0
	ServiceStatus_SERVICE_STATUS_HEALTHY     ServiceStatus = 1
	ServiceStatus_SERVICE_STATUS_DEGRADED    ServiceStatus = 2
	ServiceStatus_SERVICE_STATUS_UNHEALTHY   ServiceStatus = 3
)

// Enum value maps for ServiceStatus.
var (
	ServiceStatus_name = map[int32]string{
		0: "SERVICE_STATUS_UNSPECIFIED",
		1: "SERVICE_STATUS_HEALTHY",
		2: "SERVICE_STATUS_DEGRADED",
		3: "SERVICE_STATUS_UNHEALTHY",
	}
	ServiceStatus_value = map[string]int32{
		"SERVICE_STATUS_UNSPECIFIED": 0,
		"SERVICE_STATUS_HEALTHY":     1,
		"SERVICE_STATUS_DEGRADED":    2,
		"SERVICE_STATUS_UNHEALTHY":   3,
	}
)

func (x ServiceStatus) Enum() *ServiceStatus {
	p := new(ServiceStatus)
	*p = x
	return p
}

func (x ServiceStatus) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (ServiceStatus) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[4].Descriptor()
}

func (ServiceStatus) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[4]
}

func (x ServiceStatus) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use ServiceStatus.Descriptor instead.
func (ServiceStatus) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{4}
}

// Workspace-scoped role for members.
type WorkspaceRole int32

const (
	WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED WorkspaceRole = 0
	WorkspaceRole_WORKSPACE_ROLE_USER        WorkspaceRole = 1
	WorkspaceRole_WORKSPACE_ROLE_ADMIN       WorkspaceRole = 2
)

// Enum value maps for WorkspaceRole.
var (
	WorkspaceRole_name = map[int32]string{
		0: "WORKSPACE_ROLE_UNSPECIFIED",
		1: "WORKSPACE_ROLE_USER",
		2: "WORKSPACE_ROLE_ADMIN",
	}
	WorkspaceRole_value = map[string]int32{
		"WORKSPACE_ROLE_UNSPECIFIED": 0,
		"WORKSPACE_ROLE_USER":        1,
		"WORKSPACE_ROLE_ADMIN":       2,
	}
)

func (x WorkspaceRole) Enum() *WorkspaceRole {
	p := new(WorkspaceRole)
	*p = x
	return p
}

func (x WorkspaceRole) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (WorkspaceRole) Descriptor() protoreflect.EnumDescriptor {
	return file_openshell_proto_enumTypes[5].Descriptor()
}

func (WorkspaceRole) Type() protoreflect.EnumType {
	return &file_openshell_proto_enumTypes[5]
}

func (x WorkspaceRole) Number() protoreflect.EnumNumber {
	return protoreflect.EnumNumber(x)
}

// Deprecated: Use WorkspaceRole.Descriptor instead.
func (WorkspaceRole) EnumDescriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{5}
}

// IssueSandboxToken request. Empty body; identity is established by the
// authentication credentials carried in the request headers (a projected
// Kubernetes ServiceAccount JWT in the K8s driver path).
type IssueSandboxTokenRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *IssueSandboxTokenRequest) Reset() {
	*x = IssueSandboxTokenRequest{}
	mi := &file_openshell_proto_msgTypes[0]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *IssueSandboxTokenRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*IssueSandboxTokenRequest) ProtoMessage() {}

func (x *IssueSandboxTokenRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[0]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use IssueSandboxTokenRequest.ProtoReflect.Descriptor instead.
func (*IssueSandboxTokenRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{0}
}

// IssueSandboxToken response. The supervisor caches the returned token in
// memory and presents it as `Authorization: Bearer` on every subsequent
// gateway RPC.
type IssueSandboxTokenResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-minted JWT bound to the calling sandbox's UUID.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry of the issued token, milliseconds since the epoch. 0 means
	// the token is non-expiring.
	ExpiresAtMs   int64 `protobuf:"varint,2,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *IssueSandboxTokenResponse) Reset() {
	*x = IssueSandboxTokenResponse{}
	mi := &file_openshell_proto_msgTypes[1]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *IssueSandboxTokenResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*IssueSandboxTokenResponse) ProtoMessage() {}

func (x *IssueSandboxTokenResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[1]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use IssueSandboxTokenResponse.ProtoReflect.Descriptor instead.
func (*IssueSandboxTokenResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{1}
}

func (x *IssueSandboxTokenResponse) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *IssueSandboxTokenResponse) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

// RefreshSandboxToken request. The calling principal must already be a
// sandbox principal (i.e. the request carries a still-valid gateway-minted
// JWT in its Authorization header). Extension service names are resolved
// against server-owned registrations and the sandbox's effective policy;
// callers never choose token audiences directly.
type RefreshSandboxTokenRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Operator registration names for extension services selected by the
	// sandbox's effective policy.
	ExtensionServiceNames []string `protobuf:"bytes,1,rep,name=extension_service_names,json=extensionServiceNames,proto3" json:"extension_service_names,omitempty"`
	unknownFields         protoimpl.UnknownFields
	sizeCache             protoimpl.SizeCache
}

func (x *RefreshSandboxTokenRequest) Reset() {
	*x = RefreshSandboxTokenRequest{}
	mi := &file_openshell_proto_msgTypes[2]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RefreshSandboxTokenRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RefreshSandboxTokenRequest) ProtoMessage() {}

func (x *RefreshSandboxTokenRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[2]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RefreshSandboxTokenRequest.ProtoReflect.Descriptor instead.
func (*RefreshSandboxTokenRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{2}
}

func (x *RefreshSandboxTokenRequest) GetExtensionServiceNames() []string {
	if x != nil {
		return x.ExtensionServiceNames
	}
	return nil
}

// RefreshSandboxToken response. The new token replaces the supervisor's
// in-memory bearer credential.
type RefreshSandboxTokenResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Fresh gateway-minted JWT bound to the same sandbox UUID.
	Token string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry of the new token, milliseconds since the epoch. 0 means
	// the token is non-expiring.
	ExpiresAtMs int64 `protobuf:"varint,2,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	// Fresh credentials for the requested, policy-authorized extension
	// services. These remain in supervisor memory and are never persisted.
	ExtensionCredentials []*ExtensionServiceCredential `protobuf:"bytes,3,rep,name=extension_credentials,json=extensionCredentials,proto3" json:"extension_credentials,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *RefreshSandboxTokenResponse) Reset() {
	*x = RefreshSandboxTokenResponse{}
	mi := &file_openshell_proto_msgTypes[3]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RefreshSandboxTokenResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RefreshSandboxTokenResponse) ProtoMessage() {}

func (x *RefreshSandboxTokenResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[3]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RefreshSandboxTokenResponse.ProtoReflect.Descriptor instead.
func (*RefreshSandboxTokenResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{3}
}

func (x *RefreshSandboxTokenResponse) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *RefreshSandboxTokenResponse) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

func (x *RefreshSandboxTokenResponse) GetExtensionCredentials() []*ExtensionServiceCredential {
	if x != nil {
		return x.ExtensionCredentials
	}
	return nil
}

// Health check request.
type HealthRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *HealthRequest) Reset() {
	*x = HealthRequest{}
	mi := &file_openshell_proto_msgTypes[4]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *HealthRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*HealthRequest) ProtoMessage() {}

func (x *HealthRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[4]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use HealthRequest.ProtoReflect.Descriptor instead.
func (*HealthRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{4}
}

// Health check response.
type HealthResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Service status.
	Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"`
	// Service version.
	Version       string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *HealthResponse) Reset() {
	*x = HealthResponse{}
	mi := &file_openshell_proto_msgTypes[5]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *HealthResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*HealthResponse) ProtoMessage() {}

func (x *HealthResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[5]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use HealthResponse.ProtoReflect.Descriptor instead.
func (*HealthResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{5}
}

func (x *HealthResponse) GetStatus() ServiceStatus {
	if x != nil {
		return x.Status
	}
	return ServiceStatus_SERVICE_STATUS_UNSPECIFIED
}

func (x *HealthResponse) GetVersion() string {
	if x != nil {
		return x.Version
	}
	return ""
}

// Current-user request. The identity comes from the authenticated request.
type GetCurrentUserRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetCurrentUserRequest) Reset() {
	*x = GetCurrentUserRequest{}
	mi := &file_openshell_proto_msgTypes[6]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetCurrentUserRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetCurrentUserRequest) ProtoMessage() {}

func (x *GetCurrentUserRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[6]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetCurrentUserRequest.ProtoReflect.Descriptor instead.
func (*GetCurrentUserRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{6}
}

// Authenticated user identity as validated by the gateway.
type GetCurrentUserResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Stable identity subject (for example, the OIDC `sub` claim).
	Subject string `protobuf:"bytes,1,opt,name=subject,proto3" json:"subject,omitempty"`
	// Human-readable identity name when supplied by the authentication provider.
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// Roles granted to the authenticated identity.
	Roles []string `protobuf:"bytes,3,rep,name=roles,proto3" json:"roles,omitempty"`
	// OAuth2 scopes granted to the authenticated identity.
	Scopes []string `protobuf:"bytes,4,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// Authentication provider that established the identity.
	IdentityProvider string `protobuf:"bytes,5,opt,name=identity_provider,json=identityProvider,proto3" json:"identity_provider,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *GetCurrentUserResponse) Reset() {
	*x = GetCurrentUserResponse{}
	mi := &file_openshell_proto_msgTypes[7]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetCurrentUserResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetCurrentUserResponse) ProtoMessage() {}

func (x *GetCurrentUserResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[7]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetCurrentUserResponse.ProtoReflect.Descriptor instead.
func (*GetCurrentUserResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{7}
}

func (x *GetCurrentUserResponse) GetSubject() string {
	if x != nil {
		return x.Subject
	}
	return ""
}

func (x *GetCurrentUserResponse) GetDisplayName() string {
	if x != nil {
		return x.DisplayName
	}
	return ""
}

func (x *GetCurrentUserResponse) GetRoles() []string {
	if x != nil {
		return x.Roles
	}
	return nil
}

func (x *GetCurrentUserResponse) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *GetCurrentUserResponse) GetIdentityProvider() string {
	if x != nil {
		return x.IdentityProvider
	}
	return ""
}

// Gateway info request.
type GetGatewayInfoRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetGatewayInfoRequest) Reset() {
	*x = GetGatewayInfoRequest{}
	mi := &file_openshell_proto_msgTypes[8]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetGatewayInfoRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetGatewayInfoRequest) ProtoMessage() {}

func (x *GetGatewayInfoRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[8]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetGatewayInfoRequest.ProtoReflect.Descriptor instead.
func (*GetGatewayInfoRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{8}
}

// Gateway info response.
type GetGatewayInfoResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Service status.
	Status ServiceStatus `protobuf:"varint,1,opt,name=status,proto3,enum=openshell.v1.ServiceStatus" json:"status,omitempty"`
	// OpenShell gateway binary version.
	GatewayVersion string `protobuf:"bytes,2,opt,name=gateway_version,json=gatewayVersion,proto3" json:"gateway_version,omitempty"`
	// Compute driver runtimes initialized by this gateway. Current gateways
	// return exactly one entry.
	ComputeDrivers []*ComputeDriverInfo `protobuf:"bytes,3,rep,name=compute_drivers,json=computeDrivers,proto3" json:"compute_drivers,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *GetGatewayInfoResponse) Reset() {
	*x = GetGatewayInfoResponse{}
	mi := &file_openshell_proto_msgTypes[9]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetGatewayInfoResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetGatewayInfoResponse) ProtoMessage() {}

func (x *GetGatewayInfoResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[9]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetGatewayInfoResponse.ProtoReflect.Descriptor instead.
func (*GetGatewayInfoResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{9}
}

func (x *GetGatewayInfoResponse) GetStatus() ServiceStatus {
	if x != nil {
		return x.Status
	}
	return ServiceStatus_SERVICE_STATUS_UNSPECIFIED
}

func (x *GetGatewayInfoResponse) GetGatewayVersion() string {
	if x != nil {
		return x.GatewayVersion
	}
	return ""
}

func (x *GetGatewayInfoResponse) GetComputeDrivers() []*ComputeDriverInfo {
	if x != nil {
		return x.ComputeDrivers
	}
	return nil
}

// Info for one initialized compute driver runtime.
type ComputeDriverInfo struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-selected driver name used for routing and driver_config keys.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Capabilities reported by the driver during gateway runtime initialization.
	Capabilities  *ComputeDriverCapabilities `protobuf:"bytes,2,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ComputeDriverInfo) Reset() {
	*x = ComputeDriverInfo{}
	mi := &file_openshell_proto_msgTypes[10]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ComputeDriverInfo) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ComputeDriverInfo) ProtoMessage() {}

func (x *ComputeDriverInfo) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[10]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ComputeDriverInfo.ProtoReflect.Descriptor instead.
func (*ComputeDriverInfo) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{10}
}

func (x *ComputeDriverInfo) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ComputeDriverInfo) GetCapabilities() *ComputeDriverCapabilities {
	if x != nil {
		return x.Capabilities
	}
	return nil
}

// Public compute driver capability snapshot.
type ComputeDriverCapabilities struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Driver-reported human-readable name from the startup capability snapshot.
	DriverName string `protobuf:"bytes,1,opt,name=driver_name,json=driverName,proto3" json:"driver_name,omitempty"`
	// Driver-reported implementation version from the startup capability snapshot.
	DriverVersion string `protobuf:"bytes,2,opt,name=driver_version,json=driverVersion,proto3" json:"driver_version,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ComputeDriverCapabilities) Reset() {
	*x = ComputeDriverCapabilities{}
	mi := &file_openshell_proto_msgTypes[11]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ComputeDriverCapabilities) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ComputeDriverCapabilities) ProtoMessage() {}

func (x *ComputeDriverCapabilities) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[11]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ComputeDriverCapabilities.ProtoReflect.Descriptor instead.
func (*ComputeDriverCapabilities) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{11}
}

func (x *ComputeDriverCapabilities) GetDriverName() string {
	if x != nil {
		return x.DriverName
	}
	return ""
}

func (x *ComputeDriverCapabilities) GetDriverVersion() string {
	if x != nil {
		return x.DriverVersion
	}
	return ""
}

// Public sandbox resource exposed by the OpenShell API.
//
// This is the canonical gateway-owned view of a sandbox. It merges user intent
// (`spec`) with gateway-managed metadata and status derived from internal
// compute-driver observations.
//
// Note: The `namespace` field has been removed from the public API. It remains
// in the internal `DriverSandbox` message as a compute-driver implementation detail.
type Sandbox struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata (id, name, labels, timestamps, resource version).
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Desired sandbox configuration submitted through the API.
	Spec *SandboxSpec `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"`
	// Latest user-facing observed status derived by the gateway.
	Status        *SandboxStatus `protobuf:"bytes,3,opt,name=status,proto3" json:"status,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *Sandbox) Reset() {
	*x = Sandbox{}
	mi := &file_openshell_proto_msgTypes[12]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *Sandbox) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*Sandbox) ProtoMessage() {}

func (x *Sandbox) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[12]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use Sandbox.ProtoReflect.Descriptor instead.
func (*Sandbox) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{12}
}

func (x *Sandbox) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *Sandbox) GetSpec() *SandboxSpec {
	if x != nil {
		return x.Spec
	}
	return nil
}

func (x *Sandbox) GetStatus() *SandboxStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

// Desired sandbox configuration provided through the public API.
type SandboxSpec struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Log level exposed to processes running inside the sandbox.
	LogLevel string `protobuf:"bytes,1,opt,name=log_level,json=logLevel,proto3" json:"log_level,omitempty"`
	// Environment variables injected into the sandbox runtime.
	Environment map[string]string `protobuf:"bytes,5,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Container or VM template used to provision the sandbox.
	Template *SandboxTemplate `protobuf:"bytes,6,opt,name=template,proto3" json:"template,omitempty"`
	// Required sandbox policy configuration.
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"`
	// Provider names to attach to this sandbox.
	Providers []string `protobuf:"bytes,8,rep,name=providers,proto3" json:"providers,omitempty"`
	// Portable resource requirements used by the gateway for driver selection
	// and by drivers for provisioning.
	ResourceRequirements *ResourceRequirements `protobuf:"bytes,9,opt,name=resource_requirements,json=resourceRequirements,proto3" json:"resource_requirements,omitempty"`
	// Canonical command launched once by the sandbox supervisor. No shell
	// parsing is performed. The gateway normalizes an omitted command to the
	// portable scratch login shell before persistence.
	Command []string `protobuf:"bytes,12,rep,name=command,proto3" json:"command,omitempty"`
	// Allocate a retained pseudo-terminal for the main process.
	Tty           bool `protobuf:"varint,13,opt,name=tty,proto3" json:"tty,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxSpec) Reset() {
	*x = SandboxSpec{}
	mi := &file_openshell_proto_msgTypes[13]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxSpec) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxSpec) ProtoMessage() {}

func (x *SandboxSpec) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[13]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxSpec.ProtoReflect.Descriptor instead.
func (*SandboxSpec) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{13}
}

func (x *SandboxSpec) GetLogLevel() string {
	if x != nil {
		return x.LogLevel
	}
	return ""
}

func (x *SandboxSpec) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *SandboxSpec) GetTemplate() *SandboxTemplate {
	if x != nil {
		return x.Template
	}
	return nil
}

func (x *SandboxSpec) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *SandboxSpec) GetProviders() []string {
	if x != nil {
		return x.Providers
	}
	return nil
}

func (x *SandboxSpec) GetResourceRequirements() *ResourceRequirements {
	if x != nil {
		return x.ResourceRequirements
	}
	return nil
}

func (x *SandboxSpec) GetCommand() []string {
	if x != nil {
		return x.Command
	}
	return nil
}

func (x *SandboxSpec) GetTty() bool {
	if x != nil {
		return x.Tty
	}
	return false
}

type ResourceRequirements struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// GPU requirements for the sandbox. Presence indicates a GPU request.
	Gpu           *GpuResourceRequirements `protobuf:"bytes,1,opt,name=gpu,proto3" json:"gpu,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ResourceRequirements) Reset() {
	*x = ResourceRequirements{}
	mi := &file_openshell_proto_msgTypes[14]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ResourceRequirements) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ResourceRequirements) ProtoMessage() {}

func (x *ResourceRequirements) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[14]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ResourceRequirements.ProtoReflect.Descriptor instead.
func (*ResourceRequirements) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{14}
}

func (x *ResourceRequirements) GetGpu() *GpuResourceRequirements {
	if x != nil {
		return x.Gpu
	}
	return nil
}

// Public GPU resource requirements.
type GpuResourceRequirements struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Optional number of GPUs requested. When omitted, the request is for one
	// GPU using the selected driver's default assignment behavior.
	Count         *uint32 `protobuf:"varint,1,opt,name=count,proto3,oneof" json:"count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GpuResourceRequirements) Reset() {
	*x = GpuResourceRequirements{}
	mi := &file_openshell_proto_msgTypes[15]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GpuResourceRequirements) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GpuResourceRequirements) ProtoMessage() {}

func (x *GpuResourceRequirements) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[15]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GpuResourceRequirements.ProtoReflect.Descriptor instead.
func (*GpuResourceRequirements) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{15}
}

func (x *GpuResourceRequirements) GetCount() uint32 {
	if x != nil && x.Count != nil {
		return *x.Count
	}
	return 0
}

// Public sandbox template mapped onto compute-driver template inputs.
type SandboxTemplate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Fully-qualified OCI image reference used to boot the sandbox.
	Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
	// Optional runtime class name requested from the compute platform.
	RuntimeClassName string `protobuf:"bytes,2,opt,name=runtime_class_name,json=runtimeClassName,proto3" json:"runtime_class_name,omitempty"`
	// Optional agent socket path exposed to the workload.
	AgentSocket string `protobuf:"bytes,3,opt,name=agent_socket,json=agentSocket,proto3" json:"agent_socket,omitempty"`
	// Labels applied to compute-platform resources for this sandbox.
	Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Annotations applied to compute-platform resources for this sandbox.
	Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Additional environment variables injected by the template.
	Environment map[string]string `protobuf:"bytes,6,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Platform-specific compute resource requirements and limits.
	Resources *structpb.Struct `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"`
	// Enable Kubernetes user namespace isolation (hostUsers: false).
	// When true, container UID 0 maps to a non-root host UID and capabilities
	// become namespaced. Requires Kubernetes 1.33+ with user namespace support
	// available (beta through 1.35, GA in 1.36+) and a supporting runtime.
	// When unset, the cluster-wide default is used.
	UserNamespaces *bool `protobuf:"varint,10,opt,name=user_namespaces,json=userNamespaces,proto3,oneof" json:"user_namespaces,omitempty"`
	// Driver-keyed opaque config envelope supplied by the caller.
	// The gateway selects the block matching the active compute driver and
	// forwards only that inner Struct to DriverSandboxTemplate.driver_config.
	// The selected driver owns nested schema validation.
	DriverConfig  *structpb.Struct `protobuf:"bytes,11,opt,name=driver_config,json=driverConfig,proto3" json:"driver_config,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxTemplate) Reset() {
	*x = SandboxTemplate{}
	mi := &file_openshell_proto_msgTypes[16]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxTemplate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxTemplate) ProtoMessage() {}

func (x *SandboxTemplate) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[16]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxTemplate.ProtoReflect.Descriptor instead.
func (*SandboxTemplate) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{16}
}

func (x *SandboxTemplate) GetImage() string {
	if x != nil {
		return x.Image
	}
	return ""
}

func (x *SandboxTemplate) GetRuntimeClassName() string {
	if x != nil {
		return x.RuntimeClassName
	}
	return ""
}

func (x *SandboxTemplate) GetAgentSocket() string {
	if x != nil {
		return x.AgentSocket
	}
	return ""
}

func (x *SandboxTemplate) GetLabels() map[string]string {
	if x != nil {
		return x.Labels
	}
	return nil
}

func (x *SandboxTemplate) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *SandboxTemplate) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *SandboxTemplate) GetResources() *structpb.Struct {
	if x != nil {
		return x.Resources
	}
	return nil
}

func (x *SandboxTemplate) GetUserNamespaces() bool {
	if x != nil && x.UserNamespaces != nil {
		return *x.UserNamespaces
	}
	return false
}

func (x *SandboxTemplate) GetDriverConfig() *structpb.Struct {
	if x != nil {
		return x.DriverConfig
	}
	return nil
}

// User-facing sandbox status derived by the gateway from compute-driver observations.
//
// Public status does not embed driver-only flags such as `deleting`.
type SandboxStatus struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Compute-platform sandbox object name.
	SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Name of the agent pod or equivalent runtime instance.
	AgentPod string `protobuf:"bytes,2,opt,name=agent_pod,json=agentPod,proto3" json:"agent_pod,omitempty"`
	// File descriptor or endpoint for reaching the agent service, when available.
	AgentFd string `protobuf:"bytes,3,opt,name=agent_fd,json=agentFd,proto3" json:"agent_fd,omitempty"`
	// File descriptor or endpoint for reaching the sandbox service, when available.
	SandboxFd string `protobuf:"bytes,4,opt,name=sandbox_fd,json=sandboxFd,proto3" json:"sandbox_fd,omitempty"`
	// Latest user-facing readiness and lifecycle conditions.
	Conditions []*SandboxCondition `protobuf:"bytes,5,rep,name=conditions,proto3" json:"conditions,omitempty"`
	// Gateway-derived lifecycle summary.
	Phase SandboxPhase `protobuf:"varint,6,opt,name=phase,proto3,enum=openshell.v1.SandboxPhase" json:"phase,omitempty"`
	// Currently active policy version (updated when sandbox reports loaded).
	CurrentPolicyVersion uint32 `protobuf:"varint,7,opt,name=current_policy_version,json=currentPolicyVersion,proto3" json:"current_policy_version,omitempty"`
	// Supervisor instance currently associated with the canonical main process.
	// The gateway uses this to reject stale exit reports after a restart.
	MainProcessInstanceId string `protobuf:"bytes,8,opt,name=main_process_instance_id,json=mainProcessInstanceId,proto3" json:"main_process_instance_id,omitempty"`
	// Normalized main process result. Signal exits use 128 + signal number.
	// Presence indicates that the main process exited and the sandbox is in Error.
	ExitCode      *int32 `protobuf:"varint,9,opt,name=exit_code,json=exitCode,proto3,oneof" json:"exit_code,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStatus) Reset() {
	*x = SandboxStatus{}
	mi := &file_openshell_proto_msgTypes[17]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStatus) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStatus) ProtoMessage() {}

func (x *SandboxStatus) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[17]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStatus.ProtoReflect.Descriptor instead.
func (*SandboxStatus) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{17}
}

func (x *SandboxStatus) GetSandboxName() string {
	if x != nil {
		return x.SandboxName
	}
	return ""
}

func (x *SandboxStatus) GetAgentPod() string {
	if x != nil {
		return x.AgentPod
	}
	return ""
}

func (x *SandboxStatus) GetAgentFd() string {
	if x != nil {
		return x.AgentFd
	}
	return ""
}

func (x *SandboxStatus) GetSandboxFd() string {
	if x != nil {
		return x.SandboxFd
	}
	return ""
}

func (x *SandboxStatus) GetConditions() []*SandboxCondition {
	if x != nil {
		return x.Conditions
	}
	return nil
}

func (x *SandboxStatus) GetPhase() SandboxPhase {
	if x != nil {
		return x.Phase
	}
	return SandboxPhase_SANDBOX_PHASE_UNSPECIFIED
}

func (x *SandboxStatus) GetCurrentPolicyVersion() uint32 {
	if x != nil {
		return x.CurrentPolicyVersion
	}
	return 0
}

func (x *SandboxStatus) GetMainProcessInstanceId() string {
	if x != nil {
		return x.MainProcessInstanceId
	}
	return ""
}

func (x *SandboxStatus) GetExitCode() int32 {
	if x != nil && x.ExitCode != nil {
		return *x.ExitCode
	}
	return 0
}

// User-facing sandbox condition derived from driver-native conditions.
type SandboxCondition struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Condition class, typically mirroring the underlying platform condition type.
	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
	// Condition status value such as `True`, `False`, or `Unknown`.
	Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
	// Short machine-readable reason associated with the condition.
	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// Human-readable condition message.
	Message string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
	// Timestamp reported by the underlying platform for the last transition.
	LastTransitionTime string `protobuf:"bytes,5,opt,name=last_transition_time,json=lastTransitionTime,proto3" json:"last_transition_time,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *SandboxCondition) Reset() {
	*x = SandboxCondition{}
	mi := &file_openshell_proto_msgTypes[18]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxCondition) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxCondition) ProtoMessage() {}

func (x *SandboxCondition) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[18]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxCondition.ProtoReflect.Descriptor instead.
func (*SandboxCondition) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{18}
}

func (x *SandboxCondition) GetType() string {
	if x != nil {
		return x.Type
	}
	return ""
}

func (x *SandboxCondition) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *SandboxCondition) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

func (x *SandboxCondition) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *SandboxCondition) GetLastTransitionTime() string {
	if x != nil {
		return x.LastTransitionTime
	}
	return ""
}

// Public platform event exposed on the sandbox watch stream.
type PlatformEvent struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Event timestamp in milliseconds since epoch.
	TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"`
	// Event source (e.g. "kubernetes", "docker", "process").
	Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"`
	// Event type/severity (e.g. "Normal", "Warning").
	Type string `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
	// Short reason code (e.g. "Started", "Pulled", "Failed").
	Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
	// Human-readable event message.
	Message string `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"`
	// Optional metadata as key-value pairs.
	Metadata      map[string]string `protobuf:"bytes,6,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PlatformEvent) Reset() {
	*x = PlatformEvent{}
	mi := &file_openshell_proto_msgTypes[19]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PlatformEvent) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PlatformEvent) ProtoMessage() {}

func (x *PlatformEvent) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[19]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PlatformEvent.ProtoReflect.Descriptor instead.
func (*PlatformEvent) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{19}
}

func (x *PlatformEvent) GetTimestampMs() int64 {
	if x != nil {
		return x.TimestampMs
	}
	return 0
}

func (x *PlatformEvent) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *PlatformEvent) GetType() string {
	if x != nil {
		return x.Type
	}
	return ""
}

func (x *PlatformEvent) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

func (x *PlatformEvent) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *PlatformEvent) GetMetadata() map[string]string {
	if x != nil {
		return x.Metadata
	}
	return nil
}

// Create sandbox request.
type CreateSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	Spec  *SandboxSpec           `protobuf:"bytes,1,opt,name=spec,proto3" json:"spec,omitempty"`
	// Optional user-supplied sandbox name. When empty the server generates one.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Optional labels for the sandbox (key-value metadata).
	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Optional annotations for the sandbox (non-selector metadata).
	Annotations map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Workspace for the sandbox. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateSandboxRequest) Reset() {
	*x = CreateSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[20]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSandboxRequest) ProtoMessage() {}

func (x *CreateSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[20]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSandboxRequest.ProtoReflect.Descriptor instead.
func (*CreateSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{20}
}

func (x *CreateSandboxRequest) GetSpec() *SandboxSpec {
	if x != nil {
		return x.Spec
	}
	return nil
}

func (x *CreateSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *CreateSandboxRequest) GetLabels() map[string]string {
	if x != nil {
		return x.Labels
	}
	return nil
}

func (x *CreateSandboxRequest) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *CreateSandboxRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Get sandbox request.
type GetSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxRequest) Reset() {
	*x = GetSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[21]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxRequest) ProtoMessage() {}

func (x *GetSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[21]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{21}
}

func (x *GetSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *GetSandboxRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// List sandboxes request.
type ListSandboxesRequest struct {
	state  protoimpl.MessageState `protogen:"open.v1"`
	Limit  uint32                 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
	Offset uint32                 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
	// Optional label selector for filtering (format: "key1=value1,key2=value2").
	LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// List across all workspaces. Mutually exclusive with workspace.
	AllWorkspaces bool `protobuf:"varint,5,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxesRequest) Reset() {
	*x = ListSandboxesRequest{}
	mi := &file_openshell_proto_msgTypes[22]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxesRequest) ProtoMessage() {}

func (x *ListSandboxesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[22]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxesRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{22}
}

func (x *ListSandboxesRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListSandboxesRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

func (x *ListSandboxesRequest) GetLabelSelector() string {
	if x != nil {
		return x.LabelSelector
	}
	return ""
}

func (x *ListSandboxesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *ListSandboxesRequest) GetAllWorkspaces() bool {
	if x != nil {
		return x.AllWorkspaces
	}
	return false
}

// List providers attached to a sandbox request.
type ListSandboxProvidersRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxProvidersRequest) Reset() {
	*x = ListSandboxProvidersRequest{}
	mi := &file_openshell_proto_msgTypes[23]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxProvidersRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxProvidersRequest) ProtoMessage() {}

func (x *ListSandboxProvidersRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[23]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxProvidersRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxProvidersRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{23}
}

func (x *ListSandboxProvidersRequest) GetSandboxName() string {
	if x != nil {
		return x.SandboxName
	}
	return ""
}

func (x *ListSandboxProvidersRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Attach provider to sandbox request.
type AttachSandboxProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Provider name to attach.
	ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Expected resource version for optimistic concurrency control.
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AttachSandboxProviderRequest) Reset() {
	*x = AttachSandboxProviderRequest{}
	mi := &file_openshell_proto_msgTypes[24]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AttachSandboxProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AttachSandboxProviderRequest) ProtoMessage() {}

func (x *AttachSandboxProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[24]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AttachSandboxProviderRequest.ProtoReflect.Descriptor instead.
func (*AttachSandboxProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{24}
}

func (x *AttachSandboxProviderRequest) GetSandboxName() string {
	if x != nil {
		return x.SandboxName
	}
	return ""
}

func (x *AttachSandboxProviderRequest) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *AttachSandboxProviderRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *AttachSandboxProviderRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Detach provider from sandbox request.
type DetachSandboxProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	SandboxName string `protobuf:"bytes,1,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Provider name to detach.
	ProviderName string `protobuf:"bytes,2,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	// Expected resource version for optimistic concurrency control.
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	ExpectedResourceVersion uint64 `protobuf:"varint,3,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DetachSandboxProviderRequest) Reset() {
	*x = DetachSandboxProviderRequest{}
	mi := &file_openshell_proto_msgTypes[25]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DetachSandboxProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DetachSandboxProviderRequest) ProtoMessage() {}

func (x *DetachSandboxProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[25]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DetachSandboxProviderRequest.ProtoReflect.Descriptor instead.
func (*DetachSandboxProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{25}
}

func (x *DetachSandboxProviderRequest) GetSandboxName() string {
	if x != nil {
		return x.SandboxName
	}
	return ""
}

func (x *DetachSandboxProviderRequest) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *DetachSandboxProviderRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *DetachSandboxProviderRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Delete sandbox request.
type DeleteSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteSandboxRequest) Reset() {
	*x = DeleteSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[26]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteSandboxRequest) ProtoMessage() {}

func (x *DeleteSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[26]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteSandboxRequest.ProtoReflect.Descriptor instead.
func (*DeleteSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{26}
}

func (x *DeleteSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteSandboxRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Stop sandbox request.
type StopSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StopSandboxRequest) Reset() {
	*x = StopSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[27]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StopSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StopSandboxRequest) ProtoMessage() {}

func (x *StopSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[27]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StopSandboxRequest.ProtoReflect.Descriptor instead.
func (*StopSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{27}
}

func (x *StopSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *StopSandboxRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Start sandbox request.
type StartSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key).
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StartSandboxRequest) Reset() {
	*x = StartSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[28]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StartSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StartSandboxRequest) ProtoMessage() {}

func (x *StartSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[28]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StartSandboxRequest.ProtoReflect.Descriptor instead.
func (*StartSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{28}
}

func (x *StartSandboxRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *StartSandboxRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Sandbox response.
type SandboxResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Sandbox       *Sandbox               `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxResponse) Reset() {
	*x = SandboxResponse{}
	mi := &file_openshell_proto_msgTypes[29]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxResponse) ProtoMessage() {}

func (x *SandboxResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[29]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxResponse.ProtoReflect.Descriptor instead.
func (*SandboxResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{29}
}

func (x *SandboxResponse) GetSandbox() *Sandbox {
	if x != nil {
		return x.Sandbox
	}
	return nil
}

// List sandboxes response.
type ListSandboxesResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Sandboxes     []*Sandbox             `protobuf:"bytes,1,rep,name=sandboxes,proto3" json:"sandboxes,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxesResponse) Reset() {
	*x = ListSandboxesResponse{}
	mi := &file_openshell_proto_msgTypes[30]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxesResponse) ProtoMessage() {}

func (x *ListSandboxesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[30]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxesResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{30}
}

func (x *ListSandboxesResponse) GetSandboxes() []*Sandbox {
	if x != nil {
		return x.Sandboxes
	}
	return nil
}

// List providers attached to a sandbox response.
type ListSandboxProvidersResponse struct {
	state         protoimpl.MessageState  `protogen:"open.v1"`
	Providers     []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxProvidersResponse) Reset() {
	*x = ListSandboxProvidersResponse{}
	mi := &file_openshell_proto_msgTypes[31]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxProvidersResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxProvidersResponse) ProtoMessage() {}

func (x *ListSandboxProvidersResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[31]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxProvidersResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxProvidersResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{31}
}

func (x *ListSandboxProvidersResponse) GetProviders() []*datamodelv1.Provider {
	if x != nil {
		return x.Providers
	}
	return nil
}

// Attach provider to sandbox response.
type AttachSandboxProviderResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Sandbox *Sandbox               `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// True when the provider was newly attached. False means it was already attached.
	Attached      bool `protobuf:"varint,2,opt,name=attached,proto3" json:"attached,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AttachSandboxProviderResponse) Reset() {
	*x = AttachSandboxProviderResponse{}
	mi := &file_openshell_proto_msgTypes[32]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AttachSandboxProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AttachSandboxProviderResponse) ProtoMessage() {}

func (x *AttachSandboxProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[32]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AttachSandboxProviderResponse.ProtoReflect.Descriptor instead.
func (*AttachSandboxProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{32}
}

func (x *AttachSandboxProviderResponse) GetSandbox() *Sandbox {
	if x != nil {
		return x.Sandbox
	}
	return nil
}

func (x *AttachSandboxProviderResponse) GetAttached() bool {
	if x != nil {
		return x.Attached
	}
	return false
}

// Detach provider from sandbox response.
type DetachSandboxProviderResponse struct {
	state   protoimpl.MessageState `protogen:"open.v1"`
	Sandbox *Sandbox               `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// True when the provider was removed. False means it was not attached.
	Detached      bool `protobuf:"varint,2,opt,name=detached,proto3" json:"detached,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DetachSandboxProviderResponse) Reset() {
	*x = DetachSandboxProviderResponse{}
	mi := &file_openshell_proto_msgTypes[33]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DetachSandboxProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DetachSandboxProviderResponse) ProtoMessage() {}

func (x *DetachSandboxProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[33]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DetachSandboxProviderResponse.ProtoReflect.Descriptor instead.
func (*DetachSandboxProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{33}
}

func (x *DetachSandboxProviderResponse) GetSandbox() *Sandbox {
	if x != nil {
		return x.Sandbox
	}
	return nil
}

func (x *DetachSandboxProviderResponse) GetDetached() bool {
	if x != nil {
		return x.Detached
	}
	return false
}

// Delete sandbox response.
type DeleteSandboxResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Deleted       bool                   `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteSandboxResponse) Reset() {
	*x = DeleteSandboxResponse{}
	mi := &file_openshell_proto_msgTypes[34]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteSandboxResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteSandboxResponse) ProtoMessage() {}

func (x *DeleteSandboxResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[34]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteSandboxResponse.ProtoReflect.Descriptor instead.
func (*DeleteSandboxResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{34}
}

func (x *DeleteSandboxResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

// Create SSH session request.
type CreateSshSessionRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	SandboxId     string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateSshSessionRequest) Reset() {
	*x = CreateSshSessionRequest{}
	mi := &file_openshell_proto_msgTypes[35]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSshSessionRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSshSessionRequest) ProtoMessage() {}

func (x *CreateSshSessionRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[35]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSshSessionRequest.ProtoReflect.Descriptor instead.
func (*CreateSshSessionRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{35}
}

func (x *CreateSshSessionRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

// Create SSH session response.
//
// Fields are interpolated into an SSH `ProxyCommand` string that OpenSSH
// executes through `/bin/sh -c` on the caller's workstation. Servers MUST
// uphold the charset contract below; clients MUST reject responses that
// violate it. The client's own escaping provides defense-in-depth, but
// narrow charsets close injection vectors at the trust boundary.
type CreateSshSessionResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id. [A-Za-z0-9._-]{1,128}.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Session token for the gateway tunnel. URL-safe ASCII
	// ([A-Za-z0-9._~+/=-]) up to 4096 bytes. No shell metacharacters or
	// whitespace.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Gateway host for SSH proxy connection. IPv4 address, bracketed IPv6
	// address, or DNS hostname (Punycode-encoded for IDN). Alphanumeric plus
	// `.-:[]` only, up to 253 bytes.
	GatewayHost string `protobuf:"bytes,3,opt,name=gateway_host,json=gatewayHost,proto3" json:"gateway_host,omitempty"`
	// Gateway port for SSH proxy connection. Must be in range 1..=65535.
	GatewayPort uint32 `protobuf:"varint,4,opt,name=gateway_port,json=gatewayPort,proto3" json:"gateway_port,omitempty"`
	// Gateway scheme. Must be exactly "http" or "https".
	GatewayScheme string `protobuf:"bytes,5,opt,name=gateway_scheme,json=gatewayScheme,proto3" json:"gateway_scheme,omitempty"`
	// Optional host key fingerprint. If non-empty, [A-Za-z0-9:+/=-] only.
	HostKeyFingerprint string `protobuf:"bytes,7,opt,name=host_key_fingerprint,json=hostKeyFingerprint,proto3" json:"host_key_fingerprint,omitempty"`
	// Expiry timestamp in milliseconds since epoch. 0 means no expiry.
	ExpiresAtMs   int64 `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateSshSessionResponse) Reset() {
	*x = CreateSshSessionResponse{}
	mi := &file_openshell_proto_msgTypes[36]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateSshSessionResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateSshSessionResponse) ProtoMessage() {}

func (x *CreateSshSessionResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[36]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateSshSessionResponse.ProtoReflect.Descriptor instead.
func (*CreateSshSessionResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{36}
}

func (x *CreateSshSessionResponse) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *CreateSshSessionResponse) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *CreateSshSessionResponse) GetGatewayHost() string {
	if x != nil {
		return x.GatewayHost
	}
	return ""
}

func (x *CreateSshSessionResponse) GetGatewayPort() uint32 {
	if x != nil {
		return x.GatewayPort
	}
	return 0
}

func (x *CreateSshSessionResponse) GetGatewayScheme() string {
	if x != nil {
		return x.GatewayScheme
	}
	return ""
}

func (x *CreateSshSessionResponse) GetHostKeyFingerprint() string {
	if x != nil {
		return x.HostKeyFingerprint
	}
	return ""
}

func (x *CreateSshSessionResponse) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

// Request to expose an HTTP service running inside a sandbox.
type ExposeServiceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service name within the sandbox.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// Loopback TCP port inside the sandbox.
	TargetPort uint32 `protobuf:"varint,3,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	// Whether to print/use the browser-facing service URL.
	Domain bool `protobuf:"varint,4,opt,name=domain,proto3" json:"domain,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExposeServiceRequest) Reset() {
	*x = ExposeServiceRequest{}
	mi := &file_openshell_proto_msgTypes[37]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExposeServiceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExposeServiceRequest) ProtoMessage() {}

func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[37]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{37}
}

func (x *ExposeServiceRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ExposeServiceRequest) GetService() string {
	if x != nil {
		return x.Service
	}
	return ""
}

func (x *ExposeServiceRequest) GetTargetPort() uint32 {
	if x != nil {
		return x.TargetPort
	}
	return 0
}

func (x *ExposeServiceRequest) GetDomain() bool {
	if x != nil {
		return x.Domain
	}
	return false
}

func (x *ExposeServiceRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Request to fetch an exposed sandbox service endpoint.
type GetServiceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service name within the sandbox. Empty selects the unnamed endpoint.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetServiceRequest) Reset() {
	*x = GetServiceRequest{}
	mi := &file_openshell_proto_msgTypes[38]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetServiceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetServiceRequest) ProtoMessage() {}

func (x *GetServiceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[38]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetServiceRequest.ProtoReflect.Descriptor instead.
func (*GetServiceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{38}
}

func (x *GetServiceRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *GetServiceRequest) GetService() string {
	if x != nil {
		return x.Service
	}
	return ""
}

func (x *GetServiceRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Request to list exposed sandbox service endpoints.
type ListServicesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Optional sandbox name. Empty lists endpoints for all sandboxes.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Page size. Zero uses the server default.
	Limit uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	// Page offset.
	Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// List across all workspaces. Mutually exclusive with workspace.
	AllWorkspaces bool `protobuf:"varint,5,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListServicesRequest) Reset() {
	*x = ListServicesRequest{}
	mi := &file_openshell_proto_msgTypes[39]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListServicesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListServicesRequest) ProtoMessage() {}

func (x *ListServicesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[39]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListServicesRequest.ProtoReflect.Descriptor instead.
func (*ListServicesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{39}
}

func (x *ListServicesRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *ListServicesRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListServicesRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

func (x *ListServicesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *ListServicesRequest) GetAllWorkspaces() bool {
	if x != nil {
		return x.AllWorkspaces
	}
	return false
}

// Response containing exposed sandbox service endpoints.
type ListServicesResponse struct {
	state         protoimpl.MessageState     `protogen:"open.v1"`
	Services      []*ServiceEndpointResponse `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListServicesResponse) Reset() {
	*x = ListServicesResponse{}
	mi := &file_openshell_proto_msgTypes[40]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListServicesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListServicesResponse) ProtoMessage() {}

func (x *ListServicesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[40]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListServicesResponse.ProtoReflect.Descriptor instead.
func (*ListServicesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{40}
}

func (x *ListServicesResponse) GetServices() []*ServiceEndpointResponse {
	if x != nil {
		return x.Services
	}
	return nil
}

// Request to delete an exposed sandbox service endpoint.
type DeleteServiceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Sandbox string `protobuf:"bytes,1,opt,name=sandbox,proto3" json:"sandbox,omitempty"`
	// Service name within the sandbox. Empty selects the unnamed endpoint.
	Service string `protobuf:"bytes,2,opt,name=service,proto3" json:"service,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteServiceRequest) Reset() {
	*x = DeleteServiceRequest{}
	mi := &file_openshell_proto_msgTypes[41]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteServiceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteServiceRequest) ProtoMessage() {}

func (x *DeleteServiceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[41]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteServiceRequest.ProtoReflect.Descriptor instead.
func (*DeleteServiceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{41}
}

func (x *DeleteServiceRequest) GetSandbox() string {
	if x != nil {
		return x.Sandbox
	}
	return ""
}

func (x *DeleteServiceRequest) GetService() string {
	if x != nil {
		return x.Service
	}
	return ""
}

func (x *DeleteServiceRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Response for deleting an exposed sandbox service endpoint.
type DeleteServiceResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// True when an endpoint existed and was deleted.
	Deleted       bool `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteServiceResponse) Reset() {
	*x = DeleteServiceResponse{}
	mi := &file_openshell_proto_msgTypes[42]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteServiceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteServiceResponse) ProtoMessage() {}

func (x *DeleteServiceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[42]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteServiceResponse.ProtoReflect.Descriptor instead.
func (*DeleteServiceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{42}
}

func (x *DeleteServiceResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

// Persisted sandbox service endpoint.
type ServiceEndpoint struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata.
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Sandbox object ID.
	SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Sandbox name.
	SandboxName string `protobuf:"bytes,3,opt,name=sandbox_name,json=sandboxName,proto3" json:"sandbox_name,omitempty"`
	// Service name within the sandbox.
	ServiceName string `protobuf:"bytes,4,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// Loopback TCP port inside the sandbox.
	TargetPort uint32 `protobuf:"varint,5,opt,name=target_port,json=targetPort,proto3" json:"target_port,omitempty"`
	// Whether browser-facing service routing is enabled for this endpoint.
	Domain        bool `protobuf:"varint,6,opt,name=domain,proto3" json:"domain,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ServiceEndpoint) Reset() {
	*x = ServiceEndpoint{}
	mi := &file_openshell_proto_msgTypes[43]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ServiceEndpoint) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ServiceEndpoint) ProtoMessage() {}

func (x *ServiceEndpoint) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[43]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ServiceEndpoint.ProtoReflect.Descriptor instead.
func (*ServiceEndpoint) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{43}
}

func (x *ServiceEndpoint) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *ServiceEndpoint) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ServiceEndpoint) GetSandboxName() string {
	if x != nil {
		return x.SandboxName
	}
	return ""
}

func (x *ServiceEndpoint) GetServiceName() string {
	if x != nil {
		return x.ServiceName
	}
	return ""
}

func (x *ServiceEndpoint) GetTargetPort() uint32 {
	if x != nil {
		return x.TargetPort
	}
	return 0
}

func (x *ServiceEndpoint) GetDomain() bool {
	if x != nil {
		return x.Domain
	}
	return false
}

// Response containing a service endpoint and, when available, its local URL.
type ServiceEndpointResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Endpoint      *ServiceEndpoint       `protobuf:"bytes,1,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
	Url           string                 `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ServiceEndpointResponse) Reset() {
	*x = ServiceEndpointResponse{}
	mi := &file_openshell_proto_msgTypes[44]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ServiceEndpointResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ServiceEndpointResponse) ProtoMessage() {}

func (x *ServiceEndpointResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[44]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ServiceEndpointResponse.ProtoReflect.Descriptor instead.
func (*ServiceEndpointResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{44}
}

func (x *ServiceEndpointResponse) GetEndpoint() *ServiceEndpoint {
	if x != nil {
		return x.Endpoint
	}
	return nil
}

func (x *ServiceEndpointResponse) GetUrl() string {
	if x != nil {
		return x.Url
	}
	return ""
}

// Revoke SSH session request.
type RevokeSshSessionRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Session token to revoke.
	Token         string `protobuf:"bytes,1,opt,name=token,proto3" json:"token,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RevokeSshSessionRequest) Reset() {
	*x = RevokeSshSessionRequest{}
	mi := &file_openshell_proto_msgTypes[45]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RevokeSshSessionRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RevokeSshSessionRequest) ProtoMessage() {}

func (x *RevokeSshSessionRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[45]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RevokeSshSessionRequest.ProtoReflect.Descriptor instead.
func (*RevokeSshSessionRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{45}
}

func (x *RevokeSshSessionRequest) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

// Revoke SSH session response.
type RevokeSshSessionResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// True when a session was revoked.
	Revoked       bool `protobuf:"varint,1,opt,name=revoked,proto3" json:"revoked,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RevokeSshSessionResponse) Reset() {
	*x = RevokeSshSessionResponse{}
	mi := &file_openshell_proto_msgTypes[46]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RevokeSshSessionResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RevokeSshSessionResponse) ProtoMessage() {}

func (x *RevokeSshSessionResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[46]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RevokeSshSessionResponse.ProtoReflect.Descriptor instead.
func (*RevokeSshSessionResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{46}
}

func (x *RevokeSshSessionResponse) GetRevoked() bool {
	if x != nil {
		return x.Revoked
	}
	return false
}

// Execute command request.
type ExecSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Command and arguments.
	Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"`
	// Optional working directory.
	Workdir string `protobuf:"bytes,3,opt,name=workdir,proto3" json:"workdir,omitempty"`
	// Optional environment overrides.
	Environment map[string]string `protobuf:"bytes,4,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Optional timeout in seconds. 0 means no timeout.
	TimeoutSeconds uint32 `protobuf:"varint,5,opt,name=timeout_seconds,json=timeoutSeconds,proto3" json:"timeout_seconds,omitempty"`
	// Optional stdin payload passed to the command.
	Stdin []byte `protobuf:"bytes,6,opt,name=stdin,proto3" json:"stdin,omitempty"`
	// Request a pseudo-terminal for the remote command.
	Tty bool `protobuf:"varint,7,opt,name=tty,proto3" json:"tty,omitempty"`
	// Initial terminal columns (used when tty=true, 0 = use default).
	Cols uint32 `protobuf:"varint,8,opt,name=cols,proto3" json:"cols,omitempty"`
	// Initial terminal rows (used when tty=true, 0 = use default).
	Rows          uint32 `protobuf:"varint,9,opt,name=rows,proto3" json:"rows,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxRequest) Reset() {
	*x = ExecSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[47]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxRequest) ProtoMessage() {}

func (x *ExecSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[47]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxRequest.ProtoReflect.Descriptor instead.
func (*ExecSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{47}
}

func (x *ExecSandboxRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ExecSandboxRequest) GetCommand() []string {
	if x != nil {
		return x.Command
	}
	return nil
}

func (x *ExecSandboxRequest) GetWorkdir() string {
	if x != nil {
		return x.Workdir
	}
	return ""
}

func (x *ExecSandboxRequest) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *ExecSandboxRequest) GetTimeoutSeconds() uint32 {
	if x != nil {
		return x.TimeoutSeconds
	}
	return 0
}

func (x *ExecSandboxRequest) GetStdin() []byte {
	if x != nil {
		return x.Stdin
	}
	return nil
}

func (x *ExecSandboxRequest) GetTty() bool {
	if x != nil {
		return x.Tty
	}
	return false
}

func (x *ExecSandboxRequest) GetCols() uint32 {
	if x != nil {
		return x.Cols
	}
	return 0
}

func (x *ExecSandboxRequest) GetRows() uint32 {
	if x != nil {
		return x.Rows
	}
	return 0
}

// One stdout chunk from a sandbox exec.
type ExecSandboxStdout struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Data          []byte                 `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxStdout) Reset() {
	*x = ExecSandboxStdout{}
	mi := &file_openshell_proto_msgTypes[48]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxStdout) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxStdout) ProtoMessage() {}

func (x *ExecSandboxStdout) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[48]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxStdout.ProtoReflect.Descriptor instead.
func (*ExecSandboxStdout) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{48}
}

func (x *ExecSandboxStdout) GetData() []byte {
	if x != nil {
		return x.Data
	}
	return nil
}

// One stderr chunk from a sandbox exec.
type ExecSandboxStderr struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Data          []byte                 `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxStderr) Reset() {
	*x = ExecSandboxStderr{}
	mi := &file_openshell_proto_msgTypes[49]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxStderr) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxStderr) ProtoMessage() {}

func (x *ExecSandboxStderr) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[49]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxStderr.ProtoReflect.Descriptor instead.
func (*ExecSandboxStderr) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{49}
}

func (x *ExecSandboxStderr) GetData() []byte {
	if x != nil {
		return x.Data
	}
	return nil
}

// Final exit status for a sandbox exec.
type ExecSandboxExit struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	ExitCode      int32                  `protobuf:"varint,1,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxExit) Reset() {
	*x = ExecSandboxExit{}
	mi := &file_openshell_proto_msgTypes[50]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxExit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxExit) ProtoMessage() {}

func (x *ExecSandboxExit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[50]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxExit.ProtoReflect.Descriptor instead.
func (*ExecSandboxExit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{50}
}

func (x *ExecSandboxExit) GetExitCode() int32 {
	if x != nil {
		return x.ExitCode
	}
	return 0
}

// One event in a sandbox exec stream.
type ExecSandboxEvent struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*ExecSandboxEvent_Stdout
	//	*ExecSandboxEvent_Stderr
	//	*ExecSandboxEvent_Exit
	Payload       isExecSandboxEvent_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxEvent) Reset() {
	*x = ExecSandboxEvent{}
	mi := &file_openshell_proto_msgTypes[51]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxEvent) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxEvent) ProtoMessage() {}

func (x *ExecSandboxEvent) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[51]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxEvent.ProtoReflect.Descriptor instead.
func (*ExecSandboxEvent) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{51}
}

func (x *ExecSandboxEvent) GetPayload() isExecSandboxEvent_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *ExecSandboxEvent) GetStdout() *ExecSandboxStdout {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxEvent_Stdout); ok {
			return x.Stdout
		}
	}
	return nil
}

func (x *ExecSandboxEvent) GetStderr() *ExecSandboxStderr {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxEvent_Stderr); ok {
			return x.Stderr
		}
	}
	return nil
}

func (x *ExecSandboxEvent) GetExit() *ExecSandboxExit {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxEvent_Exit); ok {
			return x.Exit
		}
	}
	return nil
}

type isExecSandboxEvent_Payload interface {
	isExecSandboxEvent_Payload()
}

type ExecSandboxEvent_Stdout struct {
	Stdout *ExecSandboxStdout `protobuf:"bytes,1,opt,name=stdout,proto3,oneof"`
}

type ExecSandboxEvent_Stderr struct {
	Stderr *ExecSandboxStderr `protobuf:"bytes,2,opt,name=stderr,proto3,oneof"`
}

type ExecSandboxEvent_Exit struct {
	Exit *ExecSandboxExit `protobuf:"bytes,3,opt,name=exit,proto3,oneof"`
}

func (*ExecSandboxEvent_Stdout) isExecSandboxEvent_Payload() {}

func (*ExecSandboxEvent_Stderr) isExecSandboxEvent_Payload() {}

func (*ExecSandboxEvent_Exit) isExecSandboxEvent_Payload() {}

// Initial frame for one TCP forward stream.
type TcpForwardInit struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Optional service identifier for audit/correlation.
	ServiceId string `protobuf:"bytes,4,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
	// Target the gateway should request from the supervisor.
	//
	// Types that are valid to be assigned to Target:
	//
	//	*TcpForwardInit_Ssh
	//	*TcpForwardInit_Tcp
	Target isTcpForwardInit_Target `protobuf_oneof:"target"`
	// Optional target-specific authorization token. SSH targets use this as the
	// short-lived SSH session token issued by CreateSshSession.
	AuthorizationToken string `protobuf:"bytes,7,opt,name=authorization_token,json=authorizationToken,proto3" json:"authorization_token,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *TcpForwardInit) Reset() {
	*x = TcpForwardInit{}
	mi := &file_openshell_proto_msgTypes[52]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TcpForwardInit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TcpForwardInit) ProtoMessage() {}

func (x *TcpForwardInit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[52]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TcpForwardInit.ProtoReflect.Descriptor instead.
func (*TcpForwardInit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{52}
}

func (x *TcpForwardInit) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *TcpForwardInit) GetServiceId() string {
	if x != nil {
		return x.ServiceId
	}
	return ""
}

func (x *TcpForwardInit) GetTarget() isTcpForwardInit_Target {
	if x != nil {
		return x.Target
	}
	return nil
}

func (x *TcpForwardInit) GetSsh() *SshRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*TcpForwardInit_Ssh); ok {
			return x.Ssh
		}
	}
	return nil
}

func (x *TcpForwardInit) GetTcp() *TcpRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*TcpForwardInit_Tcp); ok {
			return x.Tcp
		}
	}
	return nil
}

func (x *TcpForwardInit) GetAuthorizationToken() string {
	if x != nil {
		return x.AuthorizationToken
	}
	return ""
}

type isTcpForwardInit_Target interface {
	isTcpForwardInit_Target()
}

type TcpForwardInit_Ssh struct {
	Ssh *SshRelayTarget `protobuf:"bytes,5,opt,name=ssh,proto3,oneof"`
}

type TcpForwardInit_Tcp struct {
	Tcp *TcpRelayTarget `protobuf:"bytes,6,opt,name=tcp,proto3,oneof"`
}

func (*TcpForwardInit_Ssh) isTcpForwardInit_Target() {}

func (*TcpForwardInit_Tcp) isTcpForwardInit_Target() {}

// A single frame on the CLI-to-gateway TCP forward stream.
type TcpForwardFrame struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*TcpForwardFrame_Init
	//	*TcpForwardFrame_Data
	Payload       isTcpForwardFrame_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TcpForwardFrame) Reset() {
	*x = TcpForwardFrame{}
	mi := &file_openshell_proto_msgTypes[53]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TcpForwardFrame) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TcpForwardFrame) ProtoMessage() {}

func (x *TcpForwardFrame) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[53]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TcpForwardFrame.ProtoReflect.Descriptor instead.
func (*TcpForwardFrame) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{53}
}

func (x *TcpForwardFrame) GetPayload() isTcpForwardFrame_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *TcpForwardFrame) GetInit() *TcpForwardInit {
	if x != nil {
		if x, ok := x.Payload.(*TcpForwardFrame_Init); ok {
			return x.Init
		}
	}
	return nil
}

func (x *TcpForwardFrame) GetData() []byte {
	if x != nil {
		if x, ok := x.Payload.(*TcpForwardFrame_Data); ok {
			return x.Data
		}
	}
	return nil
}

type isTcpForwardFrame_Payload interface {
	isTcpForwardFrame_Payload()
}

type TcpForwardFrame_Init struct {
	Init *TcpForwardInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type TcpForwardFrame_Data struct {
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"`
}

func (*TcpForwardFrame_Init) isTcpForwardFrame_Payload() {}

func (*TcpForwardFrame_Data) isTcpForwardFrame_Payload() {}

// Client-to-server message for interactive exec.
type ExecSandboxInput struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*ExecSandboxInput_Start
	//	*ExecSandboxInput_Stdin
	//	*ExecSandboxInput_Resize
	Payload       isExecSandboxInput_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxInput) Reset() {
	*x = ExecSandboxInput{}
	mi := &file_openshell_proto_msgTypes[54]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxInput) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxInput) ProtoMessage() {}

func (x *ExecSandboxInput) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[54]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxInput.ProtoReflect.Descriptor instead.
func (*ExecSandboxInput) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{54}
}

func (x *ExecSandboxInput) GetPayload() isExecSandboxInput_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *ExecSandboxInput) GetStart() *ExecSandboxRequest {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxInput_Start); ok {
			return x.Start
		}
	}
	return nil
}

func (x *ExecSandboxInput) GetStdin() []byte {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxInput_Stdin); ok {
			return x.Stdin
		}
	}
	return nil
}

func (x *ExecSandboxInput) GetResize() *ExecSandboxWindowResize {
	if x != nil {
		if x, ok := x.Payload.(*ExecSandboxInput_Resize); ok {
			return x.Resize
		}
	}
	return nil
}

type isExecSandboxInput_Payload interface {
	isExecSandboxInput_Payload()
}

type ExecSandboxInput_Start struct {
	// First message: exec request metadata.
	Start *ExecSandboxRequest `protobuf:"bytes,1,opt,name=start,proto3,oneof"`
}

type ExecSandboxInput_Stdin struct {
	// Subsequent messages: raw stdin bytes.
	Stdin []byte `protobuf:"bytes,2,opt,name=stdin,proto3,oneof"`
}

type ExecSandboxInput_Resize struct {
	// Terminal window size change.
	Resize *ExecSandboxWindowResize `protobuf:"bytes,3,opt,name=resize,proto3,oneof"`
}

func (*ExecSandboxInput_Start) isExecSandboxInput_Payload() {}

func (*ExecSandboxInput_Stdin) isExecSandboxInput_Payload() {}

func (*ExecSandboxInput_Resize) isExecSandboxInput_Payload() {}

// Terminal window resize event for interactive exec.
type ExecSandboxWindowResize struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Cols          uint32                 `protobuf:"varint,1,opt,name=cols,proto3" json:"cols,omitempty"`
	Rows          uint32                 `protobuf:"varint,2,opt,name=rows,proto3" json:"rows,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExecSandboxWindowResize) Reset() {
	*x = ExecSandboxWindowResize{}
	mi := &file_openshell_proto_msgTypes[55]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExecSandboxWindowResize) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExecSandboxWindowResize) ProtoMessage() {}

func (x *ExecSandboxWindowResize) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[55]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExecSandboxWindowResize.ProtoReflect.Descriptor instead.
func (*ExecSandboxWindowResize) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{55}
}

func (x *ExecSandboxWindowResize) GetCols() uint32 {
	if x != nil {
		return x.Cols
	}
	return 0
}

func (x *ExecSandboxWindowResize) GetRows() uint32 {
	if x != nil {
		return x.Rows
	}
	return 0
}

// SSH session record stored in persistence.
type SshSession struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Kubernetes-style metadata (id, name, labels, timestamps, resource version).
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Session token.
	Token string `protobuf:"bytes,3,opt,name=token,proto3" json:"token,omitempty"`
	// Expiry timestamp in milliseconds since epoch. 0 means no expiry
	// (backward-compatible default for sessions created before this field existed).
	ExpiresAtMs int64 `protobuf:"varint,4,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	// Revoked flag.
	Revoked       bool `protobuf:"varint,5,opt,name=revoked,proto3" json:"revoked,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SshSession) Reset() {
	*x = SshSession{}
	mi := &file_openshell_proto_msgTypes[56]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SshSession) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SshSession) ProtoMessage() {}

func (x *SshSession) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[56]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SshSession.ProtoReflect.Descriptor instead.
func (*SshSession) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{56}
}

func (x *SshSession) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *SshSession) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *SshSession) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *SshSession) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

func (x *SshSession) GetRevoked() bool {
	if x != nil {
		return x.Revoked
	}
	return false
}

// Watch sandbox request.
type WatchSandboxRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Stream sandbox status snapshots.
	FollowStatus bool `protobuf:"varint,2,opt,name=follow_status,json=followStatus,proto3" json:"follow_status,omitempty"`
	// Stream openshell-server process logs correlated to this sandbox.
	FollowLogs bool `protobuf:"varint,3,opt,name=follow_logs,json=followLogs,proto3" json:"follow_logs,omitempty"`
	// Stream platform events correlated to this sandbox.
	FollowEvents bool `protobuf:"varint,4,opt,name=follow_events,json=followEvents,proto3" json:"follow_events,omitempty"`
	// Replay the last N log lines (best-effort) before following.
	LogTailLines uint32 `protobuf:"varint,5,opt,name=log_tail_lines,json=logTailLines,proto3" json:"log_tail_lines,omitempty"`
	// Replay the last N platform events (best-effort) before following.
	EventTail uint32 `protobuf:"varint,6,opt,name=event_tail,json=eventTail,proto3" json:"event_tail,omitempty"`
	// Stop streaming once the sandbox reaches a terminal phase (READY or ERROR).
	StopOnTerminal bool `protobuf:"varint,7,opt,name=stop_on_terminal,json=stopOnTerminal,proto3" json:"stop_on_terminal,omitempty"`
	// Only include log lines with timestamp >= this value (milliseconds since epoch).
	// 0 means no time filter. Applies to both tail replay and live streaming.
	LogSinceMs int64 `protobuf:"varint,8,opt,name=log_since_ms,json=logSinceMs,proto3" json:"log_since_ms,omitempty"`
	// Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources.
	LogSources []string `protobuf:"bytes,9,rep,name=log_sources,json=logSources,proto3" json:"log_sources,omitempty"`
	// Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels.
	LogMinLevel   string `protobuf:"bytes,10,opt,name=log_min_level,json=logMinLevel,proto3" json:"log_min_level,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *WatchSandboxRequest) Reset() {
	*x = WatchSandboxRequest{}
	mi := &file_openshell_proto_msgTypes[57]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *WatchSandboxRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*WatchSandboxRequest) ProtoMessage() {}

func (x *WatchSandboxRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[57]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use WatchSandboxRequest.ProtoReflect.Descriptor instead.
func (*WatchSandboxRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{57}
}

func (x *WatchSandboxRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *WatchSandboxRequest) GetFollowStatus() bool {
	if x != nil {
		return x.FollowStatus
	}
	return false
}

func (x *WatchSandboxRequest) GetFollowLogs() bool {
	if x != nil {
		return x.FollowLogs
	}
	return false
}

func (x *WatchSandboxRequest) GetFollowEvents() bool {
	if x != nil {
		return x.FollowEvents
	}
	return false
}

func (x *WatchSandboxRequest) GetLogTailLines() uint32 {
	if x != nil {
		return x.LogTailLines
	}
	return 0
}

func (x *WatchSandboxRequest) GetEventTail() uint32 {
	if x != nil {
		return x.EventTail
	}
	return 0
}

func (x *WatchSandboxRequest) GetStopOnTerminal() bool {
	if x != nil {
		return x.StopOnTerminal
	}
	return false
}

func (x *WatchSandboxRequest) GetLogSinceMs() int64 {
	if x != nil {
		return x.LogSinceMs
	}
	return 0
}

func (x *WatchSandboxRequest) GetLogSources() []string {
	if x != nil {
		return x.LogSources
	}
	return nil
}

func (x *WatchSandboxRequest) GetLogMinLevel() string {
	if x != nil {
		return x.LogMinLevel
	}
	return ""
}

// One event in a sandbox watch stream.
type SandboxStreamEvent struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*SandboxStreamEvent_Sandbox
	//	*SandboxStreamEvent_Log
	//	*SandboxStreamEvent_Event
	//	*SandboxStreamEvent_Warning
	//	*SandboxStreamEvent_DraftPolicyUpdate
	Payload       isSandboxStreamEvent_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStreamEvent) Reset() {
	*x = SandboxStreamEvent{}
	mi := &file_openshell_proto_msgTypes[58]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStreamEvent) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStreamEvent) ProtoMessage() {}

func (x *SandboxStreamEvent) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[58]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStreamEvent.ProtoReflect.Descriptor instead.
func (*SandboxStreamEvent) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{58}
}

func (x *SandboxStreamEvent) GetPayload() isSandboxStreamEvent_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *SandboxStreamEvent) GetSandbox() *Sandbox {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Sandbox); ok {
			return x.Sandbox
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetLog() *SandboxLogLine {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Log); ok {
			return x.Log
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetEvent() *PlatformEvent {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Event); ok {
			return x.Event
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetWarning() *SandboxStreamWarning {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_Warning); ok {
			return x.Warning
		}
	}
	return nil
}

func (x *SandboxStreamEvent) GetDraftPolicyUpdate() *DraftPolicyUpdate {
	if x != nil {
		if x, ok := x.Payload.(*SandboxStreamEvent_DraftPolicyUpdate); ok {
			return x.DraftPolicyUpdate
		}
	}
	return nil
}

type isSandboxStreamEvent_Payload interface {
	isSandboxStreamEvent_Payload()
}

type SandboxStreamEvent_Sandbox struct {
	// Latest sandbox snapshot.
	Sandbox *Sandbox `protobuf:"bytes,1,opt,name=sandbox,proto3,oneof"`
}

type SandboxStreamEvent_Log struct {
	// One server log line/event.
	Log *SandboxLogLine `protobuf:"bytes,2,opt,name=log,proto3,oneof"`
}

type SandboxStreamEvent_Event struct {
	// One platform event.
	Event *PlatformEvent `protobuf:"bytes,3,opt,name=event,proto3,oneof"`
}

type SandboxStreamEvent_Warning struct {
	// Warning from the server (e.g. missed messages due to lag).
	Warning *SandboxStreamWarning `protobuf:"bytes,4,opt,name=warning,proto3,oneof"`
}

type SandboxStreamEvent_DraftPolicyUpdate struct {
	// Draft policy update notification.
	DraftPolicyUpdate *DraftPolicyUpdate `protobuf:"bytes,5,opt,name=draft_policy_update,json=draftPolicyUpdate,proto3,oneof"`
}

func (*SandboxStreamEvent_Sandbox) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_Log) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_Event) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_Warning) isSandboxStreamEvent_Payload() {}

func (*SandboxStreamEvent_DraftPolicyUpdate) isSandboxStreamEvent_Payload() {}

// Log line correlated to a sandbox.
type SandboxLogLine struct {
	state       protoimpl.MessageState `protogen:"open.v1"`
	SandboxId   string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	TimestampMs int64                  `protobuf:"varint,2,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"`
	Level       string                 `protobuf:"bytes,3,opt,name=level,proto3" json:"level,omitempty"`
	Target      string                 `protobuf:"bytes,4,opt,name=target,proto3" json:"target,omitempty"`
	Message     string                 `protobuf:"bytes,5,opt,name=message,proto3" json:"message,omitempty"`
	// Log source: "gateway" (server-side) or "sandbox" (supervisor).
	// Empty is treated as "gateway" for backward compatibility.
	Source string `protobuf:"bytes,6,opt,name=source,proto3" json:"source,omitempty"`
	// Structured key-value fields from the tracing event (e.g. dst_host, action).
	Fields        map[string]string `protobuf:"bytes,7,rep,name=fields,proto3" json:"fields,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxLogLine) Reset() {
	*x = SandboxLogLine{}
	mi := &file_openshell_proto_msgTypes[59]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxLogLine) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxLogLine) ProtoMessage() {}

func (x *SandboxLogLine) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[59]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxLogLine.ProtoReflect.Descriptor instead.
func (*SandboxLogLine) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{59}
}

func (x *SandboxLogLine) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *SandboxLogLine) GetTimestampMs() int64 {
	if x != nil {
		return x.TimestampMs
	}
	return 0
}

func (x *SandboxLogLine) GetLevel() string {
	if x != nil {
		return x.Level
	}
	return ""
}

func (x *SandboxLogLine) GetTarget() string {
	if x != nil {
		return x.Target
	}
	return ""
}

func (x *SandboxLogLine) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *SandboxLogLine) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *SandboxLogLine) GetFields() map[string]string {
	if x != nil {
		return x.Fields
	}
	return nil
}

type SandboxStreamWarning struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Message       string                 `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxStreamWarning) Reset() {
	*x = SandboxStreamWarning{}
	mi := &file_openshell_proto_msgTypes[60]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxStreamWarning) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxStreamWarning) ProtoMessage() {}

func (x *SandboxStreamWarning) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[60]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxStreamWarning.ProtoReflect.Descriptor instead.
func (*SandboxStreamWarning) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{60}
}

func (x *SandboxStreamWarning) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

// Create provider request.
type CreateProviderRequest struct {
	state    protoimpl.MessageState `protogen:"open.v1"`
	Provider *datamodelv1.Provider  `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Workspace for the provider. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateProviderRequest) Reset() {
	*x = CreateProviderRequest{}
	mi := &file_openshell_proto_msgTypes[61]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateProviderRequest) ProtoMessage() {}

func (x *CreateProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[61]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateProviderRequest.ProtoReflect.Descriptor instead.
func (*CreateProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{61}
}

func (x *CreateProviderRequest) GetProvider() *datamodelv1.Provider {
	if x != nil {
		return x.Provider
	}
	return nil
}

func (x *CreateProviderRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Get provider request.
type GetProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	Name  string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetProviderRequest) Reset() {
	*x = GetProviderRequest{}
	mi := &file_openshell_proto_msgTypes[62]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderRequest) ProtoMessage() {}

func (x *GetProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[62]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderRequest.ProtoReflect.Descriptor instead.
func (*GetProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{62}
}

func (x *GetProviderRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *GetProviderRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// List providers request.
type ListProvidersRequest struct {
	state  protoimpl.MessageState `protogen:"open.v1"`
	Limit  uint32                 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
	Offset uint32                 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// List across all workspaces. Mutually exclusive with workspace.
	AllWorkspaces bool `protobuf:"varint,4,opt,name=all_workspaces,json=allWorkspaces,proto3" json:"all_workspaces,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProvidersRequest) Reset() {
	*x = ListProvidersRequest{}
	mi := &file_openshell_proto_msgTypes[63]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProvidersRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProvidersRequest) ProtoMessage() {}

func (x *ListProvidersRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[63]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProvidersRequest.ProtoReflect.Descriptor instead.
func (*ListProvidersRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{63}
}

func (x *ListProvidersRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListProvidersRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

func (x *ListProvidersRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *ListProvidersRequest) GetAllWorkspaces() bool {
	if x != nil {
		return x.AllWorkspaces
	}
	return false
}

// Update provider request.
type UpdateProviderRequest struct {
	state    protoimpl.MessageState `protogen:"open.v1"`
	Provider *datamodelv1.Provider  `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	// Optional per-credential expiry timestamps to merge into the provider.
	// A zero value removes the expiry for that credential.
	CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,2,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateProviderRequest) Reset() {
	*x = UpdateProviderRequest{}
	mi := &file_openshell_proto_msgTypes[64]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateProviderRequest) ProtoMessage() {}

func (x *UpdateProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[64]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateProviderRequest.ProtoReflect.Descriptor instead.
func (*UpdateProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{64}
}

func (x *UpdateProviderRequest) GetProvider() *datamodelv1.Provider {
	if x != nil {
		return x.Provider
	}
	return nil
}

func (x *UpdateProviderRequest) GetCredentialExpiresAtMs() map[string]int64 {
	if x != nil {
		return x.CredentialExpiresAtMs
	}
	return nil
}

func (x *UpdateProviderRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Delete provider request.
type DeleteProviderRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	Name  string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderRequest) Reset() {
	*x = DeleteProviderRequest{}
	mi := &file_openshell_proto_msgTypes[65]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderRequest) ProtoMessage() {}

func (x *DeleteProviderRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[65]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderRequest.ProtoReflect.Descriptor instead.
func (*DeleteProviderRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{65}
}

func (x *DeleteProviderRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *DeleteProviderRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Provider response.
type ProviderResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Provider      *datamodelv1.Provider  `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderResponse) Reset() {
	*x = ProviderResponse{}
	mi := &file_openshell_proto_msgTypes[66]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderResponse) ProtoMessage() {}

func (x *ProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[66]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderResponse.ProtoReflect.Descriptor instead.
func (*ProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{66}
}

func (x *ProviderResponse) GetProvider() *datamodelv1.Provider {
	if x != nil {
		return x.Provider
	}
	return nil
}

// List providers response.
type ListProvidersResponse struct {
	state         protoimpl.MessageState  `protogen:"open.v1"`
	Providers     []*datamodelv1.Provider `protobuf:"bytes,1,rep,name=providers,proto3" json:"providers,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProvidersResponse) Reset() {
	*x = ListProvidersResponse{}
	mi := &file_openshell_proto_msgTypes[67]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProvidersResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProvidersResponse) ProtoMessage() {}

func (x *ListProvidersResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[67]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProvidersResponse.ProtoReflect.Descriptor instead.
func (*ListProvidersResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{67}
}

func (x *ListProvidersResponse) GetProviders() []*datamodelv1.Provider {
	if x != nil {
		return x.Providers
	}
	return nil
}

// List provider type profiles request.
type ListProviderProfilesRequest struct {
	state  protoimpl.MessageState `protogen:"open.v1"`
	Limit  uint32                 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
	Offset uint32                 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
	// Workspace scope. When set, returns workspace-scoped + built-in profiles.
	// When empty, returns platform-scoped + built-in only.
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProviderProfilesRequest) Reset() {
	*x = ListProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[68]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProviderProfilesRequest) ProtoMessage() {}

func (x *ListProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[68]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*ListProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{68}
}

func (x *ListProviderProfilesRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListProviderProfilesRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

func (x *ListProviderProfilesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Fetch provider type profile request.
type GetProviderProfileRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	Id    string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Workspace scope for two-tier profile resolution. When set, checks
	// workspace-scoped profiles first, then platform-scoped, then built-in.
	// When empty, checks platform-scoped then built-in only.
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetProviderProfileRequest) Reset() {
	*x = GetProviderProfileRequest{}
	mi := &file_openshell_proto_msgTypes[69]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderProfileRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderProfileRequest) ProtoMessage() {}

func (x *GetProviderProfileRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[69]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderProfileRequest.ProtoReflect.Descriptor instead.
func (*GetProviderProfileRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{69}
}

func (x *GetProviderProfileRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *GetProviderProfileRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Provider profile payload with optional source metadata for diagnostics.
type ProviderProfileImportItem struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Profile       *ProviderProfile       `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
	Source        string                 `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileImportItem) Reset() {
	*x = ProviderProfileImportItem{}
	mi := &file_openshell_proto_msgTypes[70]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileImportItem) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileImportItem) ProtoMessage() {}

func (x *ProviderProfileImportItem) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[70]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileImportItem.ProtoReflect.Descriptor instead.
func (*ProviderProfileImportItem) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{70}
}

func (x *ProviderProfileImportItem) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

func (x *ProviderProfileImportItem) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

// Provider profile validation diagnostic.
type ProviderProfileDiagnostic struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Source        string                 `protobuf:"bytes,1,opt,name=source,proto3" json:"source,omitempty"`
	ProfileId     string                 `protobuf:"bytes,2,opt,name=profile_id,json=profileId,proto3" json:"profile_id,omitempty"`
	Field         string                 `protobuf:"bytes,3,opt,name=field,proto3" json:"field,omitempty"`
	Message       string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
	Severity      string                 `protobuf:"bytes,5,opt,name=severity,proto3" json:"severity,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileDiagnostic) Reset() {
	*x = ProviderProfileDiagnostic{}
	mi := &file_openshell_proto_msgTypes[71]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileDiagnostic) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileDiagnostic) ProtoMessage() {}

func (x *ProviderProfileDiagnostic) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[71]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileDiagnostic.ProtoReflect.Descriptor instead.
func (*ProviderProfileDiagnostic) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{71}
}

func (x *ProviderProfileDiagnostic) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetProfileId() string {
	if x != nil {
		return x.ProfileId
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetField() string {
	if x != nil {
		return x.Field
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetMessage() string {
	if x != nil {
		return x.Message
	}
	return ""
}

func (x *ProviderProfileDiagnostic) GetSeverity() string {
	if x != nil {
		return x.Severity
	}
	return ""
}

// Endpoint selector for token grant audience overrides.
type ProviderCredentialTokenGrantAudienceOverride struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Optional: endpoint host selector. If omitted, inherits the profile endpoint host.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// Optional: endpoint port selector. If omitted, matches the expanded profile endpoint port.
	Port uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	// Optional: endpoint path selector. If omitted, inherits the profile endpoint path.
	Path string `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
	// Resource audience to request for matching endpoints.
	Audience string `protobuf:"bytes,4,opt,name=audience,proto3" json:"audience,omitempty"`
	// Optional: OAuth2 scopes to request. If omitted, inherits the token grant scopes.
	Scopes        []string `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderCredentialTokenGrantAudienceOverride) Reset() {
	*x = ProviderCredentialTokenGrantAudienceOverride{}
	mi := &file_openshell_proto_msgTypes[72]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialTokenGrantAudienceOverride) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialTokenGrantAudienceOverride) ProtoMessage() {}

func (x *ProviderCredentialTokenGrantAudienceOverride) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[72]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialTokenGrantAudienceOverride.ProtoReflect.Descriptor instead.
func (*ProviderCredentialTokenGrantAudienceOverride) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{72}
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetAudience() string {
	if x != nil {
		return x.Audience
	}
	return ""
}

func (x *ProviderCredentialTokenGrantAudienceOverride) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

// Provider credential token grant configuration.
// When present, the credential is obtained dynamically via OAuth2 grant when needed.
type ProviderCredentialTokenGrant struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// OAuth2 token endpoint URL (e.g., https://keycloak.example.com/realms/my-realm/protocol/openid-connect/token)
	TokenEndpoint string `protobuf:"bytes,1,opt,name=token_endpoint,json=tokenEndpoint,proto3" json:"token_endpoint,omitempty"`
	// Optional: default resource audience to request from the token service
	Audience string `protobuf:"bytes,2,opt,name=audience,proto3" json:"audience,omitempty"`
	// Optional: audience to request when fetching the JWT-SVID from SPIRE.
	// If omitted, the sandbox derives this from token_endpoint.
	JwtSvidAudience string `protobuf:"bytes,6,opt,name=jwt_svid_audience,json=jwtSvidAudience,proto3" json:"jwt_svid_audience,omitempty"`
	// Optional: OAuth2 scopes to request
	Scopes []string `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"`
	// Optional: override token cache TTL (seconds)
	// If 0 or omitted, use expires_in from token response
	CacheTtlSeconds int64 `protobuf:"varint,4,opt,name=cache_ttl_seconds,json=cacheTtlSeconds,proto3" json:"cache_ttl_seconds,omitempty"`
	// Optional: endpoint-specific resource audience overrides.
	AudienceOverrides []*ProviderCredentialTokenGrantAudienceOverride `protobuf:"bytes,5,rep,name=audience_overrides,json=audienceOverrides,proto3" json:"audience_overrides,omitempty"`
	// Optional: OAuth2 client_assertion_type value. If omitted, OpenShell uses
	// urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
	ClientAssertionType string `protobuf:"bytes,7,opt,name=client_assertion_type,json=clientAssertionType,proto3" json:"client_assertion_type,omitempty"`
	unknownFields       protoimpl.UnknownFields
	sizeCache           protoimpl.SizeCache
}

func (x *ProviderCredentialTokenGrant) Reset() {
	*x = ProviderCredentialTokenGrant{}
	mi := &file_openshell_proto_msgTypes[73]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialTokenGrant) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialTokenGrant) ProtoMessage() {}

func (x *ProviderCredentialTokenGrant) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[73]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialTokenGrant.ProtoReflect.Descriptor instead.
func (*ProviderCredentialTokenGrant) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{73}
}

func (x *ProviderCredentialTokenGrant) GetTokenEndpoint() string {
	if x != nil {
		return x.TokenEndpoint
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetAudience() string {
	if x != nil {
		return x.Audience
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetJwtSvidAudience() string {
	if x != nil {
		return x.JwtSvidAudience
	}
	return ""
}

func (x *ProviderCredentialTokenGrant) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *ProviderCredentialTokenGrant) GetCacheTtlSeconds() int64 {
	if x != nil {
		return x.CacheTtlSeconds
	}
	return 0
}

func (x *ProviderCredentialTokenGrant) GetAudienceOverrides() []*ProviderCredentialTokenGrantAudienceOverride {
	if x != nil {
		return x.AudienceOverrides
	}
	return nil
}

func (x *ProviderCredentialTokenGrant) GetClientAssertionType() string {
	if x != nil {
		return x.ClientAssertionType
	}
	return ""
}

// Provider credential declaration.
type ProviderProfileCredential struct {
	state         protoimpl.MessageState        `protogen:"open.v1"`
	Name          string                        `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Description   string                        `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
	EnvVars       []string                      `protobuf:"bytes,3,rep,name=env_vars,json=envVars,proto3" json:"env_vars,omitempty"`
	Required      bool                          `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
	AuthStyle     string                        `protobuf:"bytes,5,opt,name=auth_style,json=authStyle,proto3" json:"auth_style,omitempty"`
	HeaderName    string                        `protobuf:"bytes,6,opt,name=header_name,json=headerName,proto3" json:"header_name,omitempty"`
	QueryParam    string                        `protobuf:"bytes,7,opt,name=query_param,json=queryParam,proto3" json:"query_param,omitempty"`
	Refresh       *ProviderCredentialRefresh    `protobuf:"bytes,8,opt,name=refresh,proto3" json:"refresh,omitempty"`
	PathTemplate  string                        `protobuf:"bytes,9,opt,name=path_template,json=pathTemplate,proto3" json:"path_template,omitempty"`
	TokenGrant    *ProviderCredentialTokenGrant `protobuf:"bytes,10,opt,name=token_grant,json=tokenGrant,proto3" json:"token_grant,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileCredential) Reset() {
	*x = ProviderProfileCredential{}
	mi := &file_openshell_proto_msgTypes[74]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileCredential) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileCredential) ProtoMessage() {}

func (x *ProviderProfileCredential) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[74]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileCredential.ProtoReflect.Descriptor instead.
func (*ProviderProfileCredential) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{74}
}

func (x *ProviderProfileCredential) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ProviderProfileCredential) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *ProviderProfileCredential) GetEnvVars() []string {
	if x != nil {
		return x.EnvVars
	}
	return nil
}

func (x *ProviderProfileCredential) GetRequired() bool {
	if x != nil {
		return x.Required
	}
	return false
}

func (x *ProviderProfileCredential) GetAuthStyle() string {
	if x != nil {
		return x.AuthStyle
	}
	return ""
}

func (x *ProviderProfileCredential) GetHeaderName() string {
	if x != nil {
		return x.HeaderName
	}
	return ""
}

func (x *ProviderProfileCredential) GetQueryParam() string {
	if x != nil {
		return x.QueryParam
	}
	return ""
}

func (x *ProviderProfileCredential) GetRefresh() *ProviderCredentialRefresh {
	if x != nil {
		return x.Refresh
	}
	return nil
}

func (x *ProviderProfileCredential) GetPathTemplate() string {
	if x != nil {
		return x.PathTemplate
	}
	return ""
}

func (x *ProviderProfileCredential) GetTokenGrant() *ProviderCredentialTokenGrant {
	if x != nil {
		return x.TokenGrant
	}
	return nil
}

type ProviderCredentialRefreshMaterial struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Name          string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Description   string                 `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
	Required      bool                   `protobuf:"varint,3,opt,name=required,proto3" json:"required,omitempty"`
	Secret        bool                   `protobuf:"varint,4,opt,name=secret,proto3" json:"secret,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderCredentialRefreshMaterial) Reset() {
	*x = ProviderCredentialRefreshMaterial{}
	mi := &file_openshell_proto_msgTypes[75]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefreshMaterial) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefreshMaterial) ProtoMessage() {}

func (x *ProviderCredentialRefreshMaterial) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[75]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefreshMaterial.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefreshMaterial) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{75}
}

func (x *ProviderCredentialRefreshMaterial) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ProviderCredentialRefreshMaterial) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *ProviderCredentialRefreshMaterial) GetRequired() bool {
	if x != nil {
		return x.Required
	}
	return false
}

func (x *ProviderCredentialRefreshMaterial) GetSecret() bool {
	if x != nil {
		return x.Secret
	}
	return false
}

// Declares that a single refresh operation mints more than one credential.
// The refresh is attached to a primary credential; each additional output
// maps a strategy-defined semantic output id to a sibling credential whose
// env_vars receive the minted value.
type ProviderCredentialRefreshOutput struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Output        string                 `protobuf:"bytes,1,opt,name=output,proto3" json:"output,omitempty"`         // strategy-defined semantic output id (e.g. "session_token")
	Credential    string                 `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"` // sibling credential name whose env_vars receive this output
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderCredentialRefreshOutput) Reset() {
	*x = ProviderCredentialRefreshOutput{}
	mi := &file_openshell_proto_msgTypes[76]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefreshOutput) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefreshOutput) ProtoMessage() {}

func (x *ProviderCredentialRefreshOutput) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[76]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefreshOutput.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefreshOutput) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{76}
}

func (x *ProviderCredentialRefreshOutput) GetOutput() string {
	if x != nil {
		return x.Output
	}
	return ""
}

func (x *ProviderCredentialRefreshOutput) GetCredential() string {
	if x != nil {
		return x.Credential
	}
	return ""
}

type ProviderCredentialRefresh struct {
	state                protoimpl.MessageState               `protogen:"open.v1"`
	Strategy             ProviderCredentialRefreshStrategy    `protobuf:"varint,1,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	TokenUrl             string                               `protobuf:"bytes,2,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"`
	Scopes               []string                             `protobuf:"bytes,3,rep,name=scopes,proto3" json:"scopes,omitempty"`
	RefreshBeforeSeconds int64                                `protobuf:"varint,4,opt,name=refresh_before_seconds,json=refreshBeforeSeconds,proto3" json:"refresh_before_seconds,omitempty"`
	MaxLifetimeSeconds   int64                                `protobuf:"varint,5,opt,name=max_lifetime_seconds,json=maxLifetimeSeconds,proto3" json:"max_lifetime_seconds,omitempty"`
	Material             []*ProviderCredentialRefreshMaterial `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty"`
	AdditionalOutputs    []*ProviderCredentialRefreshOutput   `protobuf:"bytes,7,rep,name=additional_outputs,json=additionalOutputs,proto3" json:"additional_outputs,omitempty"`
	unknownFields        protoimpl.UnknownFields
	sizeCache            protoimpl.SizeCache
}

func (x *ProviderCredentialRefresh) Reset() {
	*x = ProviderCredentialRefresh{}
	mi := &file_openshell_proto_msgTypes[77]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefresh) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefresh) ProtoMessage() {}

func (x *ProviderCredentialRefresh) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[77]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefresh.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefresh) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{77}
}

func (x *ProviderCredentialRefresh) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *ProviderCredentialRefresh) GetTokenUrl() string {
	if x != nil {
		return x.TokenUrl
	}
	return ""
}

func (x *ProviderCredentialRefresh) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *ProviderCredentialRefresh) GetRefreshBeforeSeconds() int64 {
	if x != nil {
		return x.RefreshBeforeSeconds
	}
	return 0
}

func (x *ProviderCredentialRefresh) GetMaxLifetimeSeconds() int64 {
	if x != nil {
		return x.MaxLifetimeSeconds
	}
	return 0
}

func (x *ProviderCredentialRefresh) GetMaterial() []*ProviderCredentialRefreshMaterial {
	if x != nil {
		return x.Material
	}
	return nil
}

func (x *ProviderCredentialRefresh) GetAdditionalOutputs() []*ProviderCredentialRefreshOutput {
	if x != nil {
		return x.AdditionalOutputs
	}
	return nil
}

type ProviderCredentialRefreshStatus struct {
	state           protoimpl.MessageState            `protogen:"open.v1"`
	ProviderName    string                            `protobuf:"bytes,1,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	ProviderId      string                            `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
	CredentialKey   string                            `protobuf:"bytes,3,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	Strategy        ProviderCredentialRefreshStrategy `protobuf:"varint,4,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	Status          string                            `protobuf:"bytes,5,opt,name=status,proto3" json:"status,omitempty"`
	ExpiresAtMs     int64                             `protobuf:"varint,6,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	NextRefreshAtMs int64                             `protobuf:"varint,7,opt,name=next_refresh_at_ms,json=nextRefreshAtMs,proto3" json:"next_refresh_at_ms,omitempty"`
	LastRefreshAtMs int64                             `protobuf:"varint,8,opt,name=last_refresh_at_ms,json=lastRefreshAtMs,proto3" json:"last_refresh_at_ms,omitempty"`
	LastError       string                            `protobuf:"bytes,9,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *ProviderCredentialRefreshStatus) Reset() {
	*x = ProviderCredentialRefreshStatus{}
	mi := &file_openshell_proto_msgTypes[78]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderCredentialRefreshStatus) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderCredentialRefreshStatus) ProtoMessage() {}

func (x *ProviderCredentialRefreshStatus) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[78]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderCredentialRefreshStatus.ProtoReflect.Descriptor instead.
func (*ProviderCredentialRefreshStatus) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{78}
}

func (x *ProviderCredentialRefreshStatus) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetProviderId() string {
	if x != nil {
		return x.ProviderId
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *ProviderCredentialRefreshStatus) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *ProviderCredentialRefreshStatus) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

func (x *ProviderCredentialRefreshStatus) GetNextRefreshAtMs() int64 {
	if x != nil {
		return x.NextRefreshAtMs
	}
	return 0
}

func (x *ProviderCredentialRefreshStatus) GetLastRefreshAtMs() int64 {
	if x != nil {
		return x.LastRefreshAtMs
	}
	return 0
}

func (x *ProviderCredentialRefreshStatus) GetLastError() string {
	if x != nil {
		return x.LastError
	}
	return ""
}

// Provider profile local discovery declaration.
type ProviderProfileDiscovery struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Credential names from ProviderProfile.credentials eligible for local discovery.
	Credentials   []string `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileDiscovery) Reset() {
	*x = ProviderProfileDiscovery{}
	mi := &file_openshell_proto_msgTypes[79]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileDiscovery) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileDiscovery) ProtoMessage() {}

func (x *ProviderProfileDiscovery) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[79]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileDiscovery.ProtoReflect.Descriptor instead.
func (*ProviderProfileDiscovery) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{79}
}

func (x *ProviderProfileDiscovery) GetCredentials() []string {
	if x != nil {
		return x.Credentials
	}
	return nil
}

type StoredProviderCredentialRefreshState struct {
	state         protoimpl.MessageState            `protogen:"open.v1"`
	Metadata      *datamodelv1.ObjectMeta           `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	ProviderId    string                            `protobuf:"bytes,2,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
	ProviderName  string                            `protobuf:"bytes,3,opt,name=provider_name,json=providerName,proto3" json:"provider_name,omitempty"`
	CredentialKey string                            `protobuf:"bytes,4,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	Strategy      ProviderCredentialRefreshStrategy `protobuf:"varint,5,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	Material      map[string]string                 `protobuf:"bytes,6,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Material names classified as secret. Newly configured values live in the
	// active credential driver and are absent from material. Legacy inline values
	// are not automatically migrated before OpenShell 0.1.0.
	SecretMaterialKeys   []string `protobuf:"bytes,7,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"`
	ExpiresAtMs          int64    `protobuf:"varint,8,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	NextRefreshAtMs      int64    `protobuf:"varint,9,opt,name=next_refresh_at_ms,json=nextRefreshAtMs,proto3" json:"next_refresh_at_ms,omitempty"`
	LastRefreshAtMs      int64    `protobuf:"varint,10,opt,name=last_refresh_at_ms,json=lastRefreshAtMs,proto3" json:"last_refresh_at_ms,omitempty"`
	Status               string   `protobuf:"bytes,11,opt,name=status,proto3" json:"status,omitempty"`
	LastError            string   `protobuf:"bytes,12,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"`
	TokenUrl             string   `protobuf:"bytes,13,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"`
	Scopes               []string `protobuf:"bytes,14,rep,name=scopes,proto3" json:"scopes,omitempty"`
	RefreshBeforeSeconds int64    `protobuf:"varint,15,opt,name=refresh_before_seconds,json=refreshBeforeSeconds,proto3" json:"refresh_before_seconds,omitempty"`
	MaxLifetimeSeconds   int64    `protobuf:"varint,16,opt,name=max_lifetime_seconds,json=maxLifetimeSeconds,proto3" json:"max_lifetime_seconds,omitempty"`
	// Resolved mapping of strategy-defined output id -> concrete env key, pinned
	// at configure time from the profile's additional_outputs. Read by minting,
	// collision reservation, and env-key surfacing so later profile edits cannot
	// silently redirect writes.
	AdditionalOutputKeys map[string]string `protobuf:"bytes,17,rep,name=additional_output_keys,json=additionalOutputKeys,proto3" json:"additional_output_keys,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Opaque gateway-owned authorization epoch for the configured refresh
	// grant. Explicit refresh configuration creates a new epoch; automatic and
	// manual token rotation preserve it. It is never derived from or exposed
	// with refresh material.
	AuthorizationEpoch string `protobuf:"bytes,18,opt,name=authorization_epoch,json=authorizationEpoch,proto3" json:"authorization_epoch,omitempty"`
	// Secret refresh material is stored through the gateway's active credential
	// driver. The persisted refresh state keeps only opaque handles; resolved
	// values exist in gateway memory for the duration of one mint operation.
	SecretMaterialHandles map[string]*datamodelv1.CredentialHandle `protobuf:"bytes,19,rep,name=secret_material_handles,json=secretMaterialHandles,proto3" json:"secret_material_handles,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Handles replaced by reconfiguration or issuer-driven refresh-token
	// rotation. This is a repeated entry rather than a material-keyed map so
	// multiple superseded generations of the same material remain recoverable.
	// Cleanup is retried by the refresh worker so a gateway crash or temporary
	// credential-backend outage does not lose the deletion reference.
	PendingSecretDeletions []*StoredRefreshMaterialDeletion `protobuf:"bytes,20,rep,name=pending_secret_deletions,json=pendingSecretDeletions,proto3" json:"pending_secret_deletions,omitempty"`
	unknownFields          protoimpl.UnknownFields
	sizeCache              protoimpl.SizeCache
}

func (x *StoredProviderCredentialRefreshState) Reset() {
	*x = StoredProviderCredentialRefreshState{}
	mi := &file_openshell_proto_msgTypes[80]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StoredProviderCredentialRefreshState) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StoredProviderCredentialRefreshState) ProtoMessage() {}

func (x *StoredProviderCredentialRefreshState) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[80]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StoredProviderCredentialRefreshState.ProtoReflect.Descriptor instead.
func (*StoredProviderCredentialRefreshState) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{80}
}

func (x *StoredProviderCredentialRefreshState) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *StoredProviderCredentialRefreshState) GetProviderId() string {
	if x != nil {
		return x.ProviderId
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetProviderName() string {
	if x != nil {
		return x.ProviderName
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *StoredProviderCredentialRefreshState) GetMaterial() map[string]string {
	if x != nil {
		return x.Material
	}
	return nil
}

func (x *StoredProviderCredentialRefreshState) GetSecretMaterialKeys() []string {
	if x != nil {
		return x.SecretMaterialKeys
	}
	return nil
}

func (x *StoredProviderCredentialRefreshState) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

func (x *StoredProviderCredentialRefreshState) GetNextRefreshAtMs() int64 {
	if x != nil {
		return x.NextRefreshAtMs
	}
	return 0
}

func (x *StoredProviderCredentialRefreshState) GetLastRefreshAtMs() int64 {
	if x != nil {
		return x.LastRefreshAtMs
	}
	return 0
}

func (x *StoredProviderCredentialRefreshState) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetLastError() string {
	if x != nil {
		return x.LastError
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetTokenUrl() string {
	if x != nil {
		return x.TokenUrl
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetScopes() []string {
	if x != nil {
		return x.Scopes
	}
	return nil
}

func (x *StoredProviderCredentialRefreshState) GetRefreshBeforeSeconds() int64 {
	if x != nil {
		return x.RefreshBeforeSeconds
	}
	return 0
}

func (x *StoredProviderCredentialRefreshState) GetMaxLifetimeSeconds() int64 {
	if x != nil {
		return x.MaxLifetimeSeconds
	}
	return 0
}

func (x *StoredProviderCredentialRefreshState) GetAdditionalOutputKeys() map[string]string {
	if x != nil {
		return x.AdditionalOutputKeys
	}
	return nil
}

func (x *StoredProviderCredentialRefreshState) GetAuthorizationEpoch() string {
	if x != nil {
		return x.AuthorizationEpoch
	}
	return ""
}

func (x *StoredProviderCredentialRefreshState) GetSecretMaterialHandles() map[string]*datamodelv1.CredentialHandle {
	if x != nil {
		return x.SecretMaterialHandles
	}
	return nil
}

func (x *StoredProviderCredentialRefreshState) GetPendingSecretDeletions() []*StoredRefreshMaterialDeletion {
	if x != nil {
		return x.PendingSecretDeletions
	}
	return nil
}

type StoredRefreshMaterialDeletion struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Original material name used to derive the credential driver's storage key.
	MaterialKey string `protobuf:"bytes,1,opt,name=material_key,json=materialKey,proto3" json:"material_key,omitempty"`
	// Opaque handle for the superseded secret object.
	Handle        *datamodelv1.CredentialHandle `protobuf:"bytes,2,opt,name=handle,proto3" json:"handle,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StoredRefreshMaterialDeletion) Reset() {
	*x = StoredRefreshMaterialDeletion{}
	mi := &file_openshell_proto_msgTypes[81]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StoredRefreshMaterialDeletion) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StoredRefreshMaterialDeletion) ProtoMessage() {}

func (x *StoredRefreshMaterialDeletion) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[81]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StoredRefreshMaterialDeletion.ProtoReflect.Descriptor instead.
func (*StoredRefreshMaterialDeletion) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{81}
}

func (x *StoredRefreshMaterialDeletion) GetMaterialKey() string {
	if x != nil {
		return x.MaterialKey
	}
	return ""
}

func (x *StoredRefreshMaterialDeletion) GetHandle() *datamodelv1.CredentialHandle {
	if x != nil {
		return x.Handle
	}
	return nil
}

type GetProviderRefreshStatusRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Provider      string                 `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey string                 `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetProviderRefreshStatusRequest) Reset() {
	*x = GetProviderRefreshStatusRequest{}
	mi := &file_openshell_proto_msgTypes[82]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderRefreshStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderRefreshStatusRequest) ProtoMessage() {}

func (x *GetProviderRefreshStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[82]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderRefreshStatusRequest.ProtoReflect.Descriptor instead.
func (*GetProviderRefreshStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{82}
}

func (x *GetProviderRefreshStatusRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *GetProviderRefreshStatusRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *GetProviderRefreshStatusRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type GetProviderRefreshStatusResponse struct {
	state         protoimpl.MessageState             `protogen:"open.v1"`
	Credentials   []*ProviderCredentialRefreshStatus `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetProviderRefreshStatusResponse) Reset() {
	*x = GetProviderRefreshStatusResponse{}
	mi := &file_openshell_proto_msgTypes[83]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetProviderRefreshStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetProviderRefreshStatusResponse) ProtoMessage() {}

func (x *GetProviderRefreshStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[83]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetProviderRefreshStatusResponse.ProtoReflect.Descriptor instead.
func (*GetProviderRefreshStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{83}
}

func (x *GetProviderRefreshStatusResponse) GetCredentials() []*ProviderCredentialRefreshStatus {
	if x != nil {
		return x.Credentials
	}
	return nil
}

type ConfigureProviderRefreshRequest struct {
	state         protoimpl.MessageState            `protogen:"open.v1"`
	Provider      string                            `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey string                            `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	Strategy      ProviderCredentialRefreshStrategy `protobuf:"varint,3,opt,name=strategy,proto3,enum=openshell.v1.ProviderCredentialRefreshStrategy" json:"strategy,omitempty"`
	Material      map[string]string                 `protobuf:"bytes,4,rep,name=material,proto3" json:"material,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Additional material names the caller requests be stored as secrets. Every
	// name must be present in material. The server also classifies secrets from
	// the authoritative provider profile and refresh strategy.
	SecretMaterialKeys []string `protobuf:"bytes,5,rep,name=secret_material_keys,json=secretMaterialKeys,proto3" json:"secret_material_keys,omitempty"`
	ExpiresAtMs        *int64   `protobuf:"varint,6,opt,name=expires_at_ms,json=expiresAtMs,proto3,oneof" json:"expires_at_ms,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,7,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ConfigureProviderRefreshRequest) Reset() {
	*x = ConfigureProviderRefreshRequest{}
	mi := &file_openshell_proto_msgTypes[84]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ConfigureProviderRefreshRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ConfigureProviderRefreshRequest) ProtoMessage() {}

func (x *ConfigureProviderRefreshRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[84]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ConfigureProviderRefreshRequest.ProtoReflect.Descriptor instead.
func (*ConfigureProviderRefreshRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{84}
}

func (x *ConfigureProviderRefreshRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *ConfigureProviderRefreshRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *ConfigureProviderRefreshRequest) GetStrategy() ProviderCredentialRefreshStrategy {
	if x != nil {
		return x.Strategy
	}
	return ProviderCredentialRefreshStrategy_PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED
}

func (x *ConfigureProviderRefreshRequest) GetMaterial() map[string]string {
	if x != nil {
		return x.Material
	}
	return nil
}

func (x *ConfigureProviderRefreshRequest) GetSecretMaterialKeys() []string {
	if x != nil {
		return x.SecretMaterialKeys
	}
	return nil
}

func (x *ConfigureProviderRefreshRequest) GetExpiresAtMs() int64 {
	if x != nil && x.ExpiresAtMs != nil {
		return *x.ExpiresAtMs
	}
	return 0
}

func (x *ConfigureProviderRefreshRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type ConfigureProviderRefreshResponse struct {
	state         protoimpl.MessageState           `protogen:"open.v1"`
	Status        *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ConfigureProviderRefreshResponse) Reset() {
	*x = ConfigureProviderRefreshResponse{}
	mi := &file_openshell_proto_msgTypes[85]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ConfigureProviderRefreshResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ConfigureProviderRefreshResponse) ProtoMessage() {}

func (x *ConfigureProviderRefreshResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[85]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ConfigureProviderRefreshResponse.ProtoReflect.Descriptor instead.
func (*ConfigureProviderRefreshResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{85}
}

func (x *ConfigureProviderRefreshResponse) GetStatus() *ProviderCredentialRefreshStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

type RotateProviderCredentialRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Provider      string                 `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey string                 `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RotateProviderCredentialRequest) Reset() {
	*x = RotateProviderCredentialRequest{}
	mi := &file_openshell_proto_msgTypes[86]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RotateProviderCredentialRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RotateProviderCredentialRequest) ProtoMessage() {}

func (x *RotateProviderCredentialRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[86]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RotateProviderCredentialRequest.ProtoReflect.Descriptor instead.
func (*RotateProviderCredentialRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{86}
}

func (x *RotateProviderCredentialRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *RotateProviderCredentialRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *RotateProviderCredentialRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type RotateProviderCredentialResponse struct {
	state         protoimpl.MessageState           `protogen:"open.v1"`
	Status        *ProviderCredentialRefreshStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RotateProviderCredentialResponse) Reset() {
	*x = RotateProviderCredentialResponse{}
	mi := &file_openshell_proto_msgTypes[87]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RotateProviderCredentialResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RotateProviderCredentialResponse) ProtoMessage() {}

func (x *RotateProviderCredentialResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[87]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RotateProviderCredentialResponse.ProtoReflect.Descriptor instead.
func (*RotateProviderCredentialResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{87}
}

func (x *RotateProviderCredentialResponse) GetStatus() *ProviderCredentialRefreshStatus {
	if x != nil {
		return x.Status
	}
	return nil
}

type DeleteProviderRefreshRequest struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Provider      string                 `protobuf:"bytes,1,opt,name=provider,proto3" json:"provider,omitempty"`
	CredentialKey string                 `protobuf:"bytes,2,opt,name=credential_key,json=credentialKey,proto3" json:"credential_key,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderRefreshRequest) Reset() {
	*x = DeleteProviderRefreshRequest{}
	mi := &file_openshell_proto_msgTypes[88]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderRefreshRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderRefreshRequest) ProtoMessage() {}

func (x *DeleteProviderRefreshRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[88]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderRefreshRequest.ProtoReflect.Descriptor instead.
func (*DeleteProviderRefreshRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{88}
}

func (x *DeleteProviderRefreshRequest) GetProvider() string {
	if x != nil {
		return x.Provider
	}
	return ""
}

func (x *DeleteProviderRefreshRequest) GetCredentialKey() string {
	if x != nil {
		return x.CredentialKey
	}
	return ""
}

func (x *DeleteProviderRefreshRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type DeleteProviderRefreshResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Deleted       bool                   `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderRefreshResponse) Reset() {
	*x = DeleteProviderRefreshResponse{}
	mi := &file_openshell_proto_msgTypes[89]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderRefreshResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderRefreshResponse) ProtoMessage() {}

func (x *DeleteProviderRefreshResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[89]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderRefreshResponse.ProtoReflect.Descriptor instead.
func (*DeleteProviderRefreshResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{89}
}

func (x *DeleteProviderRefreshResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

// Provider type profile metadata exposed to clients.
type ProviderProfile struct {
	state            protoimpl.MessageState       `protogen:"open.v1"`
	Id               string                       `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	DisplayName      string                       `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	Description      string                       `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	Category         ProviderProfileCategory      `protobuf:"varint,4,opt,name=category,proto3,enum=openshell.v1.ProviderProfileCategory" json:"category,omitempty"`
	Credentials      []*ProviderProfileCredential `protobuf:"bytes,5,rep,name=credentials,proto3" json:"credentials,omitempty"`
	Endpoints        []*sandboxv1.NetworkEndpoint `protobuf:"bytes,6,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	Binaries         []*sandboxv1.NetworkBinary   `protobuf:"bytes,7,rep,name=binaries,proto3" json:"binaries,omitempty"`
	InferenceCapable bool                         `protobuf:"varint,8,opt,name=inference_capable,json=inferenceCapable,proto3" json:"inference_capable,omitempty"`
	Discovery        *ProviderProfileDiscovery    `protobuf:"bytes,9,opt,name=discovery,proto3" json:"discovery,omitempty"`
	// Storage resource version for custom profiles. Built-in profiles and new
	// profile files use 0. Gateway responses set this for stored custom profiles.
	// Update calls use this for optimistic concurrency.
	ResourceVersion uint64 `protobuf:"varint,10,opt,name=resource_version,json=resourceVersion,proto3" json:"resource_version,omitempty"`
	// Optional non-secret annotations attached by profile sources or importers.
	Annotations map[string]string `protobuf:"bytes,11,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Server-set provenance: "builtin", "user", or "interceptor/{name}".
	// Ignored on import/update payloads.
	Source string `protobuf:"bytes,12,opt,name=source,proto3" json:"source,omitempty"`
	// Server-set visibility: "platform", "workspace", or empty for
	// non-scoped sources. Ignored on import/update payloads.
	Scope         string `protobuf:"bytes,13,opt,name=scope,proto3" json:"scope,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfile) Reset() {
	*x = ProviderProfile{}
	mi := &file_openshell_proto_msgTypes[90]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfile) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfile) ProtoMessage() {}

func (x *ProviderProfile) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[90]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfile.ProtoReflect.Descriptor instead.
func (*ProviderProfile) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{90}
}

func (x *ProviderProfile) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *ProviderProfile) GetDisplayName() string {
	if x != nil {
		return x.DisplayName
	}
	return ""
}

func (x *ProviderProfile) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *ProviderProfile) GetCategory() ProviderProfileCategory {
	if x != nil {
		return x.Category
	}
	return ProviderProfileCategory_PROVIDER_PROFILE_CATEGORY_UNSPECIFIED
}

func (x *ProviderProfile) GetCredentials() []*ProviderProfileCredential {
	if x != nil {
		return x.Credentials
	}
	return nil
}

func (x *ProviderProfile) GetEndpoints() []*sandboxv1.NetworkEndpoint {
	if x != nil {
		return x.Endpoints
	}
	return nil
}

func (x *ProviderProfile) GetBinaries() []*sandboxv1.NetworkBinary {
	if x != nil {
		return x.Binaries
	}
	return nil
}

func (x *ProviderProfile) GetInferenceCapable() bool {
	if x != nil {
		return x.InferenceCapable
	}
	return false
}

func (x *ProviderProfile) GetDiscovery() *ProviderProfileDiscovery {
	if x != nil {
		return x.Discovery
	}
	return nil
}

func (x *ProviderProfile) GetResourceVersion() uint64 {
	if x != nil {
		return x.ResourceVersion
	}
	return 0
}

func (x *ProviderProfile) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *ProviderProfile) GetSource() string {
	if x != nil {
		return x.Source
	}
	return ""
}

func (x *ProviderProfile) GetScope() string {
	if x != nil {
		return x.Scope
	}
	return ""
}

// Stored custom provider profile object.
type StoredProviderProfile struct {
	state         protoimpl.MessageState  `protogen:"open.v1"`
	Metadata      *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	Profile       *ProviderProfile        `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StoredProviderProfile) Reset() {
	*x = StoredProviderProfile{}
	mi := &file_openshell_proto_msgTypes[91]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StoredProviderProfile) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StoredProviderProfile) ProtoMessage() {}

func (x *StoredProviderProfile) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[91]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StoredProviderProfile.ProtoReflect.Descriptor instead.
func (*StoredProviderProfile) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{91}
}

func (x *StoredProviderProfile) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *StoredProviderProfile) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

// Provider profile response.
type ProviderProfileResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Profile       *ProviderProfile       `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ProviderProfileResponse) Reset() {
	*x = ProviderProfileResponse{}
	mi := &file_openshell_proto_msgTypes[92]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ProviderProfileResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ProviderProfileResponse) ProtoMessage() {}

func (x *ProviderProfileResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[92]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ProviderProfileResponse.ProtoReflect.Descriptor instead.
func (*ProviderProfileResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{92}
}

func (x *ProviderProfileResponse) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

// List provider profiles response.
type ListProviderProfilesResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Profiles      []*ProviderProfile     `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListProviderProfilesResponse) Reset() {
	*x = ListProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[93]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListProviderProfilesResponse) ProtoMessage() {}

func (x *ListProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[93]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*ListProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{93}
}

func (x *ListProviderProfilesResponse) GetProfiles() []*ProviderProfile {
	if x != nil {
		return x.Profiles
	}
	return nil
}

// Import custom provider profiles request.
type ImportProviderProfilesRequest struct {
	state    protoimpl.MessageState       `protogen:"open.v1"`
	Profiles []*ProviderProfileImportItem `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
	// Workspace scope. When set, profiles are workspace-scoped (Workspace Admin).
	// When empty, profiles are platform-scoped (Platform Admin).
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ImportProviderProfilesRequest) Reset() {
	*x = ImportProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[94]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ImportProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ImportProviderProfilesRequest) ProtoMessage() {}

func (x *ImportProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[94]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ImportProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*ImportProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{94}
}

func (x *ImportProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem {
	if x != nil {
		return x.Profiles
	}
	return nil
}

func (x *ImportProviderProfilesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Import custom provider profiles response.
type ImportProviderProfilesResponse struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	Diagnostics   []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
	Profiles      []*ProviderProfile           `protobuf:"bytes,2,rep,name=profiles,proto3" json:"profiles,omitempty"`
	Imported      bool                         `protobuf:"varint,3,opt,name=imported,proto3" json:"imported,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ImportProviderProfilesResponse) Reset() {
	*x = ImportProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[95]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ImportProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ImportProviderProfilesResponse) ProtoMessage() {}

func (x *ImportProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[95]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ImportProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*ImportProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{95}
}

func (x *ImportProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic {
	if x != nil {
		return x.Diagnostics
	}
	return nil
}

func (x *ImportProviderProfilesResponse) GetProfiles() []*ProviderProfile {
	if x != nil {
		return x.Profiles
	}
	return nil
}

func (x *ImportProviderProfilesResponse) GetImported() bool {
	if x != nil {
		return x.Imported
	}
	return false
}

// Update one custom provider profile request.
type UpdateProviderProfilesRequest struct {
	state   protoimpl.MessageState     `protogen:"open.v1"`
	Profile *ProviderProfileImportItem `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
	// Expected storage resource version for optimistic concurrency control.
	// If 0, the server uses the resource_version embedded in profile.profile.
	// Updates without a non-zero version are rejected to prevent stale files from
	// silently overwriting newer profile definitions.
	ExpectedResourceVersion uint64 `protobuf:"varint,2,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Existing custom provider profile ID to update. The payload ID must match.
	Id string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
	// Workspace scope. When set, targets workspace-scoped profile. When empty,
	// targets platform-scoped profile.
	Workspace     string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateProviderProfilesRequest) Reset() {
	*x = UpdateProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[96]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateProviderProfilesRequest) ProtoMessage() {}

func (x *UpdateProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[96]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*UpdateProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{96}
}

func (x *UpdateProviderProfilesRequest) GetProfile() *ProviderProfileImportItem {
	if x != nil {
		return x.Profile
	}
	return nil
}

func (x *UpdateProviderProfilesRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *UpdateProviderProfilesRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *UpdateProviderProfilesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Update one custom provider profile response.
type UpdateProviderProfilesResponse struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	Diagnostics   []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
	Profile       *ProviderProfile             `protobuf:"bytes,2,opt,name=profile,proto3" json:"profile,omitempty"`
	Updated       bool                         `protobuf:"varint,3,opt,name=updated,proto3" json:"updated,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateProviderProfilesResponse) Reset() {
	*x = UpdateProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[97]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateProviderProfilesResponse) ProtoMessage() {}

func (x *UpdateProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[97]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*UpdateProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{97}
}

func (x *UpdateProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic {
	if x != nil {
		return x.Diagnostics
	}
	return nil
}

func (x *UpdateProviderProfilesResponse) GetProfile() *ProviderProfile {
	if x != nil {
		return x.Profile
	}
	return nil
}

func (x *UpdateProviderProfilesResponse) GetUpdated() bool {
	if x != nil {
		return x.Updated
	}
	return false
}

// Lint provider profiles request.
type LintProviderProfilesRequest struct {
	state    protoimpl.MessageState       `protogen:"open.v1"`
	Profiles []*ProviderProfileImportItem `protobuf:"bytes,1,rep,name=profiles,proto3" json:"profiles,omitempty"`
	// Workspace scope. Used to check for conflicts against existing profiles
	// in the target workspace.
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *LintProviderProfilesRequest) Reset() {
	*x = LintProviderProfilesRequest{}
	mi := &file_openshell_proto_msgTypes[98]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *LintProviderProfilesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*LintProviderProfilesRequest) ProtoMessage() {}

func (x *LintProviderProfilesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[98]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use LintProviderProfilesRequest.ProtoReflect.Descriptor instead.
func (*LintProviderProfilesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{98}
}

func (x *LintProviderProfilesRequest) GetProfiles() []*ProviderProfileImportItem {
	if x != nil {
		return x.Profiles
	}
	return nil
}

func (x *LintProviderProfilesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Lint provider profiles response.
type LintProviderProfilesResponse struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	Diagnostics   []*ProviderProfileDiagnostic `protobuf:"bytes,1,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
	Valid         bool                         `protobuf:"varint,2,opt,name=valid,proto3" json:"valid,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *LintProviderProfilesResponse) Reset() {
	*x = LintProviderProfilesResponse{}
	mi := &file_openshell_proto_msgTypes[99]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *LintProviderProfilesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*LintProviderProfilesResponse) ProtoMessage() {}

func (x *LintProviderProfilesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[99]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use LintProviderProfilesResponse.ProtoReflect.Descriptor instead.
func (*LintProviderProfilesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{99}
}

func (x *LintProviderProfilesResponse) GetDiagnostics() []*ProviderProfileDiagnostic {
	if x != nil {
		return x.Diagnostics
	}
	return nil
}

func (x *LintProviderProfilesResponse) GetValid() bool {
	if x != nil {
		return x.Valid
	}
	return false
}

// Delete provider response.
type DeleteProviderResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Deleted       bool                   `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderResponse) Reset() {
	*x = DeleteProviderResponse{}
	mi := &file_openshell_proto_msgTypes[100]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderResponse) ProtoMessage() {}

func (x *DeleteProviderResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[100]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderResponse.ProtoReflect.Descriptor instead.
func (*DeleteProviderResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{100}
}

func (x *DeleteProviderResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

// Delete custom provider profile request.
type DeleteProviderProfileRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	Id    string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Workspace scope. When set, targets workspace-scoped profile. When empty,
	// targets platform-scoped profile.
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderProfileRequest) Reset() {
	*x = DeleteProviderProfileRequest{}
	mi := &file_openshell_proto_msgTypes[101]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderProfileRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderProfileRequest) ProtoMessage() {}

func (x *DeleteProviderProfileRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[101]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderProfileRequest.ProtoReflect.Descriptor instead.
func (*DeleteProviderProfileRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{101}
}

func (x *DeleteProviderProfileRequest) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *DeleteProviderProfileRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Delete custom provider profile response.
type DeleteProviderProfileResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Deleted       bool                   `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteProviderProfileResponse) Reset() {
	*x = DeleteProviderProfileResponse{}
	mi := &file_openshell_proto_msgTypes[102]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteProviderProfileResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteProviderProfileResponse) ProtoMessage() {}

func (x *DeleteProviderProfileResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[102]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteProviderProfileResponse.ProtoReflect.Descriptor instead.
func (*DeleteProviderProfileResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{102}
}

func (x *DeleteProviderProfileResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

// Get sandbox provider environment request.
type GetSandboxProviderEnvironmentRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The sandbox ID.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Whether the requesting supervisor enforces endpoint bindings for static
	// provider credentials. Gateways withhold static credential material when
	// this capability is absent.
	SupportsStaticCredentialBindings bool `protobuf:"varint,2,opt,name=supports_static_credential_bindings,json=supportsStaticCredentialBindings,proto3" json:"supports_static_credential_bindings,omitempty"`
	unknownFields                    protoimpl.UnknownFields
	sizeCache                        protoimpl.SizeCache
}

func (x *GetSandboxProviderEnvironmentRequest) Reset() {
	*x = GetSandboxProviderEnvironmentRequest{}
	mi := &file_openshell_proto_msgTypes[103]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxProviderEnvironmentRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxProviderEnvironmentRequest) ProtoMessage() {}

func (x *GetSandboxProviderEnvironmentRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[103]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxProviderEnvironmentRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxProviderEnvironmentRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{103}
}

func (x *GetSandboxProviderEnvironmentRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *GetSandboxProviderEnvironmentRequest) GetSupportsStaticCredentialBindings() bool {
	if x != nil {
		return x.SupportsStaticCredentialBindings
	}
	return false
}

// One network endpoint at which a static provider credential may be resolved.
type StaticCredentialEndpointBinding struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port          uint32                 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	Path          string                 `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StaticCredentialEndpointBinding) Reset() {
	*x = StaticCredentialEndpointBinding{}
	mi := &file_openshell_proto_msgTypes[104]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StaticCredentialEndpointBinding) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StaticCredentialEndpointBinding) ProtoMessage() {}

func (x *StaticCredentialEndpointBinding) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[104]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StaticCredentialEndpointBinding.ProtoReflect.Descriptor instead.
func (*StaticCredentialEndpointBinding) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{104}
}

func (x *StaticCredentialEndpointBinding) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *StaticCredentialEndpointBinding) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *StaticCredentialEndpointBinding) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

// Endpoint allowlist for one static provider credential environment variable.
type StaticCredentialBinding struct {
	state     protoimpl.MessageState             `protogen:"open.v1"`
	Endpoints []*StaticCredentialEndpointBinding `protobuf:"bytes,1,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
	// Stable identity of the provider credential that produced this binding.
	// Supervisors use it to retain old revision placeholders only across
	// rotations of the same provider credential.
	CredentialIdentity string `protobuf:"bytes,2,opt,name=credential_identity,json=credentialIdentity,proto3" json:"credential_identity,omitempty"`
	// Opaque gateway-issued handle for a refresh-managed credential identity
	// epoch. When non-empty, supervisors keep the workload placeholder stable
	// across access-token rotations and replace only the resolver value. The
	// handle changes when the sandbox, provider, credential key, refresh
	// authorization epoch, or endpoint authorization boundary changes.
	WorkloadCredentialHandle string `protobuf:"bytes,3,opt,name=workload_credential_handle,json=workloadCredentialHandle,proto3" json:"workload_credential_handle,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *StaticCredentialBinding) Reset() {
	*x = StaticCredentialBinding{}
	mi := &file_openshell_proto_msgTypes[105]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StaticCredentialBinding) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StaticCredentialBinding) ProtoMessage() {}

func (x *StaticCredentialBinding) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[105]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StaticCredentialBinding.ProtoReflect.Descriptor instead.
func (*StaticCredentialBinding) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{105}
}

func (x *StaticCredentialBinding) GetEndpoints() []*StaticCredentialEndpointBinding {
	if x != nil {
		return x.Endpoints
	}
	return nil
}

func (x *StaticCredentialBinding) GetCredentialIdentity() string {
	if x != nil {
		return x.CredentialIdentity
	}
	return ""
}

func (x *StaticCredentialBinding) GetWorkloadCredentialHandle() string {
	if x != nil {
		return x.WorkloadCredentialHandle
	}
	return ""
}

// Get sandbox provider environment response.
type GetSandboxProviderEnvironmentResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Provider credential environment variables.
	Environment map[string]string `protobuf:"bytes,1,rep,name=environment,proto3" json:"environment,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Fingerprint for the provider credential inputs that produced environment.
	ProviderEnvRevision uint64 `protobuf:"varint,2,opt,name=provider_env_revision,json=providerEnvRevision,proto3" json:"provider_env_revision,omitempty"`
	// Expiration timestamps for returned environment variables.
	CredentialExpiresAtMs map[string]int64 `protobuf:"bytes,3,rep,name=credential_expires_at_ms,json=credentialExpiresAtMs,proto3" json:"credential_expires_at_ms,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"varint,2,opt,name=value"`
	// Dynamic credentials that require token grants or other runtime injection.
	// Maps endpoint-bound provider metadata to credential metadata.
	// Supervisor uses this to inject Authorization headers for token grant credentials.
	DynamicCredentials map[string]*ProviderProfileCredential `protobuf:"bytes,4,rep,name=dynamic_credentials,json=dynamicCredentials,proto3" json:"dynamic_credentials,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Endpoint allowlists for static credential environment variables. Metadata
	// can be incomplete when a provider profile is invalid; capable supervisors
	// reject all static material in that snapshot while preserving independently
	// endpoint-bound dynamic credentials.
	StaticCredentialBindings map[string]*StaticCredentialBinding `protobuf:"bytes,5,rep,name=static_credential_bindings,json=staticCredentialBindings,proto3" json:"static_credential_bindings,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Environment variables that contain provider configuration rather than
	// credentials and therefore do not require endpoint-scoped resolution.
	NonSecretEnvironmentKeys []string `protobuf:"bytes,6,rep,name=non_secret_environment_keys,json=nonSecretEnvironmentKeys,proto3" json:"non_secret_environment_keys,omitempty"`
	unknownFields            protoimpl.UnknownFields
	sizeCache                protoimpl.SizeCache
}

func (x *GetSandboxProviderEnvironmentResponse) Reset() {
	*x = GetSandboxProviderEnvironmentResponse{}
	mi := &file_openshell_proto_msgTypes[106]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxProviderEnvironmentResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxProviderEnvironmentResponse) ProtoMessage() {}

func (x *GetSandboxProviderEnvironmentResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[106]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxProviderEnvironmentResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxProviderEnvironmentResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{106}
}

func (x *GetSandboxProviderEnvironmentResponse) GetEnvironment() map[string]string {
	if x != nil {
		return x.Environment
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetProviderEnvRevision() uint64 {
	if x != nil {
		return x.ProviderEnvRevision
	}
	return 0
}

func (x *GetSandboxProviderEnvironmentResponse) GetCredentialExpiresAtMs() map[string]int64 {
	if x != nil {
		return x.CredentialExpiresAtMs
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetDynamicCredentials() map[string]*ProviderProfileCredential {
	if x != nil {
		return x.DynamicCredentials
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetStaticCredentialBindings() map[string]*StaticCredentialBinding {
	if x != nil {
		return x.StaticCredentialBindings
	}
	return nil
}

func (x *GetSandboxProviderEnvironmentResponse) GetNonSecretEnvironmentKeys() []string {
	if x != nil {
		return x.NonSecretEnvironmentKeys
	}
	return nil
}

// Update sandbox policy request.
type UpdateConfigRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key). Required for sandbox-scoped updates.
	// Not required when `global=true`.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The new policy to apply.
	//
	// Sandbox scope (`global=false`):
	//   - only network_policies and inference fields may differ from create-time
	//     policy; static fields must match version 1.
	//
	// Global scope (`global=true`):
	// - applies to all sandboxes in full (no merge).
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,2,opt,name=policy,proto3" json:"policy,omitempty"`
	// Optional single setting key to mutate.
	SettingKey string `protobuf:"bytes,3,opt,name=setting_key,json=settingKey,proto3" json:"setting_key,omitempty"`
	// Setting value for upsert operations.
	SettingValue *sandboxv1.SettingValue `protobuf:"bytes,4,opt,name=setting_value,json=settingValue,proto3" json:"setting_value,omitempty"`
	// Delete the setting key from scope.
	// Sandbox-scoped deletes are rejected; only global delete is supported.
	DeleteSetting bool `protobuf:"varint,5,opt,name=delete_setting,json=deleteSetting,proto3" json:"delete_setting,omitempty"`
	// Apply mutation at gateway-global scope.
	Global bool `protobuf:"varint,6,opt,name=global,proto3" json:"global,omitempty"`
	// Batched incremental policy merge operations. Sandbox-scoped only.
	MergeOperations []*PolicyMergeOperation `protobuf:"bytes,7,rep,name=merge_operations,json=mergeOperations,proto3" json:"merge_operations,omitempty"`
	// Expected resource version for optimistic concurrency control (sandbox-scoped only).
	// If 0, the server uses the current version (backward compatibility).
	// If non-zero, the server validates that the sandbox's current resource_version
	// matches this value before applying the mutation, returning ABORTED on mismatch.
	// Ignored for global-scoped updates.
	ExpectedResourceVersion uint64 `protobuf:"varint,8,opt,name=expected_resource_version,json=expectedResourceVersion,proto3" json:"expected_resource_version,omitempty"`
	// Caller-provided annotations associated with a sandbox-scoped update. Values
	// must not contain secrets; the gateway treats them as opaque metadata and does
	// not interpret or verify their semantics. For policy updates, the gateway
	// stores the annotations immutably with the revision and merges them into
	// sandbox metadata as a convenience projection. For setting-only updates, it
	// only merges them into sandbox metadata.
	Annotations map[string]string `protobuf:"bytes,9,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	// Workspace scope. Empty defaults to "default". Ignored for global-scoped updates.
	Workspace     string `protobuf:"bytes,10,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateConfigRequest) Reset() {
	*x = UpdateConfigRequest{}
	mi := &file_openshell_proto_msgTypes[107]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateConfigRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateConfigRequest) ProtoMessage() {}

func (x *UpdateConfigRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[107]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateConfigRequest.ProtoReflect.Descriptor instead.
func (*UpdateConfigRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{107}
}

func (x *UpdateConfigRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *UpdateConfigRequest) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *UpdateConfigRequest) GetSettingKey() string {
	if x != nil {
		return x.SettingKey
	}
	return ""
}

func (x *UpdateConfigRequest) GetSettingValue() *sandboxv1.SettingValue {
	if x != nil {
		return x.SettingValue
	}
	return nil
}

func (x *UpdateConfigRequest) GetDeleteSetting() bool {
	if x != nil {
		return x.DeleteSetting
	}
	return false
}

func (x *UpdateConfigRequest) GetGlobal() bool {
	if x != nil {
		return x.Global
	}
	return false
}

func (x *UpdateConfigRequest) GetMergeOperations() []*PolicyMergeOperation {
	if x != nil {
		return x.MergeOperations
	}
	return nil
}

func (x *UpdateConfigRequest) GetExpectedResourceVersion() uint64 {
	if x != nil {
		return x.ExpectedResourceVersion
	}
	return 0
}

func (x *UpdateConfigRequest) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

func (x *UpdateConfigRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type PolicyMergeOperation struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Operation:
	//
	//	*PolicyMergeOperation_AddRule
	//	*PolicyMergeOperation_RemoveEndpoint
	//	*PolicyMergeOperation_RemoveRule
	//	*PolicyMergeOperation_AddDenyRules
	//	*PolicyMergeOperation_AddAllowRules
	//	*PolicyMergeOperation_RemoveBinary
	Operation     isPolicyMergeOperation_Operation `protobuf_oneof:"operation"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PolicyMergeOperation) Reset() {
	*x = PolicyMergeOperation{}
	mi := &file_openshell_proto_msgTypes[108]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PolicyMergeOperation) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PolicyMergeOperation) ProtoMessage() {}

func (x *PolicyMergeOperation) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[108]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PolicyMergeOperation.ProtoReflect.Descriptor instead.
func (*PolicyMergeOperation) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{108}
}

func (x *PolicyMergeOperation) GetOperation() isPolicyMergeOperation_Operation {
	if x != nil {
		return x.Operation
	}
	return nil
}

func (x *PolicyMergeOperation) GetAddRule() *AddNetworkRule {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_AddRule); ok {
			return x.AddRule
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetRemoveEndpoint() *RemoveNetworkEndpoint {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_RemoveEndpoint); ok {
			return x.RemoveEndpoint
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetRemoveRule() *RemoveNetworkRule {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_RemoveRule); ok {
			return x.RemoveRule
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetAddDenyRules() *AddDenyRules {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_AddDenyRules); ok {
			return x.AddDenyRules
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetAddAllowRules() *AddAllowRules {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_AddAllowRules); ok {
			return x.AddAllowRules
		}
	}
	return nil
}

func (x *PolicyMergeOperation) GetRemoveBinary() *RemoveNetworkBinary {
	if x != nil {
		if x, ok := x.Operation.(*PolicyMergeOperation_RemoveBinary); ok {
			return x.RemoveBinary
		}
	}
	return nil
}

type isPolicyMergeOperation_Operation interface {
	isPolicyMergeOperation_Operation()
}

type PolicyMergeOperation_AddRule struct {
	AddRule *AddNetworkRule `protobuf:"bytes,1,opt,name=add_rule,json=addRule,proto3,oneof"`
}

type PolicyMergeOperation_RemoveEndpoint struct {
	RemoveEndpoint *RemoveNetworkEndpoint `protobuf:"bytes,2,opt,name=remove_endpoint,json=removeEndpoint,proto3,oneof"`
}

type PolicyMergeOperation_RemoveRule struct {
	RemoveRule *RemoveNetworkRule `protobuf:"bytes,3,opt,name=remove_rule,json=removeRule,proto3,oneof"`
}

type PolicyMergeOperation_AddDenyRules struct {
	AddDenyRules *AddDenyRules `protobuf:"bytes,4,opt,name=add_deny_rules,json=addDenyRules,proto3,oneof"`
}

type PolicyMergeOperation_AddAllowRules struct {
	AddAllowRules *AddAllowRules `protobuf:"bytes,5,opt,name=add_allow_rules,json=addAllowRules,proto3,oneof"`
}

type PolicyMergeOperation_RemoveBinary struct {
	RemoveBinary *RemoveNetworkBinary `protobuf:"bytes,6,opt,name=remove_binary,json=removeBinary,proto3,oneof"`
}

func (*PolicyMergeOperation_AddRule) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_RemoveEndpoint) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_RemoveRule) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_AddDenyRules) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_AddAllowRules) isPolicyMergeOperation_Operation() {}

func (*PolicyMergeOperation_RemoveBinary) isPolicyMergeOperation_Operation() {}

type AddNetworkRule struct {
	state         protoimpl.MessageState       `protogen:"open.v1"`
	RuleName      string                       `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	Rule          *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=rule,proto3" json:"rule,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddNetworkRule) Reset() {
	*x = AddNetworkRule{}
	mi := &file_openshell_proto_msgTypes[109]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddNetworkRule) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddNetworkRule) ProtoMessage() {}

func (x *AddNetworkRule) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[109]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddNetworkRule.ProtoReflect.Descriptor instead.
func (*AddNetworkRule) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{109}
}

func (x *AddNetworkRule) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *AddNetworkRule) GetRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.Rule
	}
	return nil
}

type RemoveNetworkEndpoint struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	RuleName      string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	Host          string                 `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	Port          uint32                 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveNetworkEndpoint) Reset() {
	*x = RemoveNetworkEndpoint{}
	mi := &file_openshell_proto_msgTypes[110]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveNetworkEndpoint) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveNetworkEndpoint) ProtoMessage() {}

func (x *RemoveNetworkEndpoint) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[110]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveNetworkEndpoint.ProtoReflect.Descriptor instead.
func (*RemoveNetworkEndpoint) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{110}
}

func (x *RemoveNetworkEndpoint) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *RemoveNetworkEndpoint) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *RemoveNetworkEndpoint) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

type RemoveNetworkRule struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	RuleName      string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveNetworkRule) Reset() {
	*x = RemoveNetworkRule{}
	mi := &file_openshell_proto_msgTypes[111]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveNetworkRule) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveNetworkRule) ProtoMessage() {}

func (x *RemoveNetworkRule) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[111]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveNetworkRule.ProtoReflect.Descriptor instead.
func (*RemoveNetworkRule) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{111}
}

func (x *RemoveNetworkRule) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

type AddDenyRules struct {
	state         protoimpl.MessageState  `protogen:"open.v1"`
	Host          string                  `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port          uint32                  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	DenyRules     []*sandboxv1.L7DenyRule `protobuf:"bytes,3,rep,name=deny_rules,json=denyRules,proto3" json:"deny_rules,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddDenyRules) Reset() {
	*x = AddDenyRules{}
	mi := &file_openshell_proto_msgTypes[112]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddDenyRules) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddDenyRules) ProtoMessage() {}

func (x *AddDenyRules) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[112]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddDenyRules.ProtoReflect.Descriptor instead.
func (*AddDenyRules) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{112}
}

func (x *AddDenyRules) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *AddDenyRules) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *AddDenyRules) GetDenyRules() []*sandboxv1.L7DenyRule {
	if x != nil {
		return x.DenyRules
	}
	return nil
}

type AddAllowRules struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Host          string                 `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	Port          uint32                 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	Rules         []*sandboxv1.L7Rule    `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddAllowRules) Reset() {
	*x = AddAllowRules{}
	mi := &file_openshell_proto_msgTypes[113]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddAllowRules) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddAllowRules) ProtoMessage() {}

func (x *AddAllowRules) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[113]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddAllowRules.ProtoReflect.Descriptor instead.
func (*AddAllowRules) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{113}
}

func (x *AddAllowRules) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *AddAllowRules) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *AddAllowRules) GetRules() []*sandboxv1.L7Rule {
	if x != nil {
		return x.Rules
	}
	return nil
}

type RemoveNetworkBinary struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	RuleName      string                 `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	BinaryPath    string                 `protobuf:"bytes,2,opt,name=binary_path,json=binaryPath,proto3" json:"binary_path,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveNetworkBinary) Reset() {
	*x = RemoveNetworkBinary{}
	mi := &file_openshell_proto_msgTypes[114]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveNetworkBinary) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveNetworkBinary) ProtoMessage() {}

func (x *RemoveNetworkBinary) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[114]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveNetworkBinary.ProtoReflect.Descriptor instead.
func (*RemoveNetworkBinary) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{114}
}

func (x *RemoveNetworkBinary) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *RemoveNetworkBinary) GetBinaryPath() string {
	if x != nil {
		return x.BinaryPath
	}
	return ""
}

// Update sandbox policy response.
type UpdateConfigResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Assigned policy version (monotonically increasing per sandbox).
	Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// SHA-256 hash of the serialized policy payload.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Settings revision for the scope that was modified.
	SettingsRevision uint64 `protobuf:"varint,3,opt,name=settings_revision,json=settingsRevision,proto3" json:"settings_revision,omitempty"`
	// True when a setting delete operation removed an existing key.
	Deleted bool `protobuf:"varint,4,opt,name=deleted,proto3" json:"deleted,omitempty"`
	// Sandbox metadata annotations after the update. Empty for global updates.
	Annotations   map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UpdateConfigResponse) Reset() {
	*x = UpdateConfigResponse{}
	mi := &file_openshell_proto_msgTypes[115]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UpdateConfigResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UpdateConfigResponse) ProtoMessage() {}

func (x *UpdateConfigResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[115]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UpdateConfigResponse.ProtoReflect.Descriptor instead.
func (*UpdateConfigResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{115}
}

func (x *UpdateConfigResponse) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *UpdateConfigResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *UpdateConfigResponse) GetSettingsRevision() uint64 {
	if x != nil {
		return x.SettingsRevision
	}
	return 0
}

func (x *UpdateConfigResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

func (x *UpdateConfigResponse) GetAnnotations() map[string]string {
	if x != nil {
		return x.Annotations
	}
	return nil
}

// Get sandbox policy status request.
type GetSandboxPolicyStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key). Ignored when global is true.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// The specific policy version to query. 0 means latest.
	Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	// Query global policy revisions instead of a sandbox-scoped one.
	Global bool `protobuf:"varint,3,opt,name=global,proto3" json:"global,omitempty"`
	// Workspace scope. Empty defaults to "default". Ignored when global is true.
	Workspace     string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxPolicyStatusRequest) Reset() {
	*x = GetSandboxPolicyStatusRequest{}
	mi := &file_openshell_proto_msgTypes[116]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxPolicyStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxPolicyStatusRequest) ProtoMessage() {}

func (x *GetSandboxPolicyStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[116]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxPolicyStatusRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxPolicyStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{116}
}

func (x *GetSandboxPolicyStatusRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *GetSandboxPolicyStatusRequest) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *GetSandboxPolicyStatusRequest) GetGlobal() bool {
	if x != nil {
		return x.Global
	}
	return false
}

func (x *GetSandboxPolicyStatusRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Get sandbox policy status response.
type GetSandboxPolicyStatusResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The queried policy revision.
	Revision *SandboxPolicyRevision `protobuf:"bytes,1,opt,name=revision,proto3" json:"revision,omitempty"`
	// The currently active (loaded) policy version for this sandbox.
	ActiveVersion uint32 `protobuf:"varint,2,opt,name=active_version,json=activeVersion,proto3" json:"active_version,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxPolicyStatusResponse) Reset() {
	*x = GetSandboxPolicyStatusResponse{}
	mi := &file_openshell_proto_msgTypes[117]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxPolicyStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxPolicyStatusResponse) ProtoMessage() {}

func (x *GetSandboxPolicyStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[117]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxPolicyStatusResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxPolicyStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{117}
}

func (x *GetSandboxPolicyStatusResponse) GetRevision() *SandboxPolicyRevision {
	if x != nil {
		return x.Revision
	}
	return nil
}

func (x *GetSandboxPolicyStatusResponse) GetActiveVersion() uint32 {
	if x != nil {
		return x.ActiveVersion
	}
	return 0
}

// List sandbox policies request.
type ListSandboxPoliciesRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name (canonical lookup key). Ignored when global is true.
	Name   string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Limit  uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	Offset uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"`
	// List global policy revisions instead of sandbox-scoped ones.
	Global bool `protobuf:"varint,4,opt,name=global,proto3" json:"global,omitempty"`
	// Workspace scope. Empty defaults to "default". Ignored when global is true.
	Workspace     string `protobuf:"bytes,5,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxPoliciesRequest) Reset() {
	*x = ListSandboxPoliciesRequest{}
	mi := &file_openshell_proto_msgTypes[118]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxPoliciesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxPoliciesRequest) ProtoMessage() {}

func (x *ListSandboxPoliciesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[118]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxPoliciesRequest.ProtoReflect.Descriptor instead.
func (*ListSandboxPoliciesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{118}
}

func (x *ListSandboxPoliciesRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ListSandboxPoliciesRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListSandboxPoliciesRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

func (x *ListSandboxPoliciesRequest) GetGlobal() bool {
	if x != nil {
		return x.Global
	}
	return false
}

func (x *ListSandboxPoliciesRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// List sandbox policies response.
type ListSandboxPoliciesResponse struct {
	state         protoimpl.MessageState   `protogen:"open.v1"`
	Revisions     []*SandboxPolicyRevision `protobuf:"bytes,1,rep,name=revisions,proto3" json:"revisions,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListSandboxPoliciesResponse) Reset() {
	*x = ListSandboxPoliciesResponse{}
	mi := &file_openshell_proto_msgTypes[119]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListSandboxPoliciesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListSandboxPoliciesResponse) ProtoMessage() {}

func (x *ListSandboxPoliciesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[119]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListSandboxPoliciesResponse.ProtoReflect.Descriptor instead.
func (*ListSandboxPoliciesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{119}
}

func (x *ListSandboxPoliciesResponse) GetRevisions() []*SandboxPolicyRevision {
	if x != nil {
		return x.Revisions
	}
	return nil
}

// Report policy load status (called by sandbox runtime after reload attempt).
type ReportPolicyStatusRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// The policy version that was attempted.
	Version uint32 `protobuf:"varint,2,opt,name=version,proto3" json:"version,omitempty"`
	// Load result status.
	Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"`
	// Error message if status is FAILED.
	LoadError     string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportPolicyStatusRequest) Reset() {
	*x = ReportPolicyStatusRequest{}
	mi := &file_openshell_proto_msgTypes[120]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportPolicyStatusRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportPolicyStatusRequest) ProtoMessage() {}

func (x *ReportPolicyStatusRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[120]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportPolicyStatusRequest.ProtoReflect.Descriptor instead.
func (*ReportPolicyStatusRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{120}
}

func (x *ReportPolicyStatusRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportPolicyStatusRequest) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *ReportPolicyStatusRequest) GetStatus() PolicyStatus {
	if x != nil {
		return x.Status
	}
	return PolicyStatus_POLICY_STATUS_UNSPECIFIED
}

func (x *ReportPolicyStatusRequest) GetLoadError() string {
	if x != nil {
		return x.LoadError
	}
	return ""
}

// Report policy status response.
type ReportPolicyStatusResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportPolicyStatusResponse) Reset() {
	*x = ReportPolicyStatusResponse{}
	mi := &file_openshell_proto_msgTypes[121]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportPolicyStatusResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportPolicyStatusResponse) ProtoMessage() {}

func (x *ReportPolicyStatusResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[121]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportPolicyStatusResponse.ProtoReflect.Descriptor instead.
func (*ReportPolicyStatusResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{121}
}

// A versioned policy revision with metadata.
type SandboxPolicyRevision struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Policy version (monotonically increasing per sandbox).
	Version uint32 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
	// SHA-256 hash of the serialized policy payload.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Load status of this revision.
	Status PolicyStatus `protobuf:"varint,3,opt,name=status,proto3,enum=openshell.v1.PolicyStatus" json:"status,omitempty"`
	// Error message if status is FAILED.
	LoadError string `protobuf:"bytes,4,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"`
	// Milliseconds since epoch when this revision was created.
	CreatedAtMs int64 `protobuf:"varint,5,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"`
	// Milliseconds since epoch when this revision was loaded by the sandbox.
	LoadedAtMs int64 `protobuf:"varint,6,opt,name=loaded_at_ms,json=loadedAtMs,proto3" json:"loaded_at_ms,omitempty"`
	// The full policy (only populated when explicitly requested).
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,7,opt,name=policy,proto3" json:"policy,omitempty"`
	// Immutable provenance supplied with this policy revision.
	Provenance    map[string]string `protobuf:"bytes,8,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SandboxPolicyRevision) Reset() {
	*x = SandboxPolicyRevision{}
	mi := &file_openshell_proto_msgTypes[122]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SandboxPolicyRevision) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SandboxPolicyRevision) ProtoMessage() {}

func (x *SandboxPolicyRevision) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[122]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SandboxPolicyRevision.ProtoReflect.Descriptor instead.
func (*SandboxPolicyRevision) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{122}
}

func (x *SandboxPolicyRevision) GetVersion() uint32 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *SandboxPolicyRevision) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *SandboxPolicyRevision) GetStatus() PolicyStatus {
	if x != nil {
		return x.Status
	}
	return PolicyStatus_POLICY_STATUS_UNSPECIFIED
}

func (x *SandboxPolicyRevision) GetLoadError() string {
	if x != nil {
		return x.LoadError
	}
	return ""
}

func (x *SandboxPolicyRevision) GetCreatedAtMs() int64 {
	if x != nil {
		return x.CreatedAtMs
	}
	return 0
}

func (x *SandboxPolicyRevision) GetLoadedAtMs() int64 {
	if x != nil {
		return x.LoadedAtMs
	}
	return 0
}

func (x *SandboxPolicyRevision) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *SandboxPolicyRevision) GetProvenance() map[string]string {
	if x != nil {
		return x.Provenance
	}
	return nil
}

// Get sandbox logs request (one-shot fetch).
type GetSandboxLogsRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox id.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Maximum number of log lines to return. 0 means use default (2000).
	Lines uint32 `protobuf:"varint,2,opt,name=lines,proto3" json:"lines,omitempty"`
	// Only include logs with timestamp >= this value (ms since epoch). 0 means no filter.
	SinceMs int64 `protobuf:"varint,3,opt,name=since_ms,json=sinceMs,proto3" json:"since_ms,omitempty"`
	// Filter by log source (e.g. "gateway", "sandbox"). Empty means all sources.
	Sources []string `protobuf:"bytes,4,rep,name=sources,proto3" json:"sources,omitempty"`
	// Minimum log level to include (e.g. "INFO", "WARN", "ERROR"). Empty means all levels.
	MinLevel string `protobuf:"bytes,5,opt,name=min_level,json=minLevel,proto3" json:"min_level,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxLogsRequest) Reset() {
	*x = GetSandboxLogsRequest{}
	mi := &file_openshell_proto_msgTypes[123]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxLogsRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxLogsRequest) ProtoMessage() {}

func (x *GetSandboxLogsRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[123]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxLogsRequest.ProtoReflect.Descriptor instead.
func (*GetSandboxLogsRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{123}
}

func (x *GetSandboxLogsRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *GetSandboxLogsRequest) GetLines() uint32 {
	if x != nil {
		return x.Lines
	}
	return 0
}

func (x *GetSandboxLogsRequest) GetSinceMs() int64 {
	if x != nil {
		return x.SinceMs
	}
	return 0
}

func (x *GetSandboxLogsRequest) GetSources() []string {
	if x != nil {
		return x.Sources
	}
	return nil
}

func (x *GetSandboxLogsRequest) GetMinLevel() string {
	if x != nil {
		return x.MinLevel
	}
	return ""
}

func (x *GetSandboxLogsRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

// Batch of log lines pushed from sandbox to server.
type PushSandboxLogsRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// The sandbox ID.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Log lines to ingest.
	Logs          []*SandboxLogLine `protobuf:"bytes,2,rep,name=logs,proto3" json:"logs,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PushSandboxLogsRequest) Reset() {
	*x = PushSandboxLogsRequest{}
	mi := &file_openshell_proto_msgTypes[124]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PushSandboxLogsRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PushSandboxLogsRequest) ProtoMessage() {}

func (x *PushSandboxLogsRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[124]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PushSandboxLogsRequest.ProtoReflect.Descriptor instead.
func (*PushSandboxLogsRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{124}
}

func (x *PushSandboxLogsRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *PushSandboxLogsRequest) GetLogs() []*SandboxLogLine {
	if x != nil {
		return x.Logs
	}
	return nil
}

// Push sandbox logs response.
type PushSandboxLogsResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PushSandboxLogsResponse) Reset() {
	*x = PushSandboxLogsResponse{}
	mi := &file_openshell_proto_msgTypes[125]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PushSandboxLogsResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PushSandboxLogsResponse) ProtoMessage() {}

func (x *PushSandboxLogsResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[125]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PushSandboxLogsResponse.ProtoReflect.Descriptor instead.
func (*PushSandboxLogsResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{125}
}

// Get sandbox logs response.
type GetSandboxLogsResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Log lines in chronological order.
	Logs []*SandboxLogLine `protobuf:"bytes,1,rep,name=logs,proto3" json:"logs,omitempty"`
	// Total number of lines in the server's buffer for this sandbox.
	BufferTotal   uint32 `protobuf:"varint,2,opt,name=buffer_total,json=bufferTotal,proto3" json:"buffer_total,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetSandboxLogsResponse) Reset() {
	*x = GetSandboxLogsResponse{}
	mi := &file_openshell_proto_msgTypes[126]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetSandboxLogsResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetSandboxLogsResponse) ProtoMessage() {}

func (x *GetSandboxLogsResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[126]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetSandboxLogsResponse.ProtoReflect.Descriptor instead.
func (*GetSandboxLogsResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{126}
}

func (x *GetSandboxLogsResponse) GetLogs() []*SandboxLogLine {
	if x != nil {
		return x.Logs
	}
	return nil
}

func (x *GetSandboxLogsResponse) GetBufferTotal() uint32 {
	if x != nil {
		return x.BufferTotal
	}
	return 0
}

// Envelope for supervisor-to-gateway messages on the ConnectSupervisor stream.
type SupervisorMessage struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*SupervisorMessage_Hello
	//	*SupervisorMessage_Heartbeat
	//	*SupervisorMessage_RelayOpenResult
	//	*SupervisorMessage_RelayClose
	Payload       isSupervisorMessage_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SupervisorMessage) Reset() {
	*x = SupervisorMessage{}
	mi := &file_openshell_proto_msgTypes[127]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SupervisorMessage) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SupervisorMessage) ProtoMessage() {}

func (x *SupervisorMessage) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[127]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SupervisorMessage.ProtoReflect.Descriptor instead.
func (*SupervisorMessage) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{127}
}

func (x *SupervisorMessage) GetPayload() isSupervisorMessage_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *SupervisorMessage) GetHello() *SupervisorHello {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_Hello); ok {
			return x.Hello
		}
	}
	return nil
}

func (x *SupervisorMessage) GetHeartbeat() *SupervisorHeartbeat {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_Heartbeat); ok {
			return x.Heartbeat
		}
	}
	return nil
}

func (x *SupervisorMessage) GetRelayOpenResult() *RelayOpenResult {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_RelayOpenResult); ok {
			return x.RelayOpenResult
		}
	}
	return nil
}

func (x *SupervisorMessage) GetRelayClose() *RelayClose {
	if x != nil {
		if x, ok := x.Payload.(*SupervisorMessage_RelayClose); ok {
			return x.RelayClose
		}
	}
	return nil
}

type isSupervisorMessage_Payload interface {
	isSupervisorMessage_Payload()
}

type SupervisorMessage_Hello struct {
	Hello *SupervisorHello `protobuf:"bytes,1,opt,name=hello,proto3,oneof"`
}

type SupervisorMessage_Heartbeat struct {
	Heartbeat *SupervisorHeartbeat `protobuf:"bytes,2,opt,name=heartbeat,proto3,oneof"`
}

type SupervisorMessage_RelayOpenResult struct {
	RelayOpenResult *RelayOpenResult `protobuf:"bytes,3,opt,name=relay_open_result,json=relayOpenResult,proto3,oneof"`
}

type SupervisorMessage_RelayClose struct {
	RelayClose *RelayClose `protobuf:"bytes,4,opt,name=relay_close,json=relayClose,proto3,oneof"`
}

func (*SupervisorMessage_Hello) isSupervisorMessage_Payload() {}

func (*SupervisorMessage_Heartbeat) isSupervisorMessage_Payload() {}

func (*SupervisorMessage_RelayOpenResult) isSupervisorMessage_Payload() {}

func (*SupervisorMessage_RelayClose) isSupervisorMessage_Payload() {}

// Envelope for gateway-to-supervisor messages on the ConnectSupervisor stream.
type GatewayMessage struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*GatewayMessage_SessionAccepted
	//	*GatewayMessage_SessionRejected
	//	*GatewayMessage_Heartbeat
	//	*GatewayMessage_RelayOpen
	//	*GatewayMessage_RelayClose
	Payload       isGatewayMessage_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GatewayMessage) Reset() {
	*x = GatewayMessage{}
	mi := &file_openshell_proto_msgTypes[128]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GatewayMessage) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GatewayMessage) ProtoMessage() {}

func (x *GatewayMessage) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[128]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GatewayMessage.ProtoReflect.Descriptor instead.
func (*GatewayMessage) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{128}
}

func (x *GatewayMessage) GetPayload() isGatewayMessage_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *GatewayMessage) GetSessionAccepted() *SessionAccepted {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_SessionAccepted); ok {
			return x.SessionAccepted
		}
	}
	return nil
}

func (x *GatewayMessage) GetSessionRejected() *SessionRejected {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_SessionRejected); ok {
			return x.SessionRejected
		}
	}
	return nil
}

func (x *GatewayMessage) GetHeartbeat() *GatewayHeartbeat {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_Heartbeat); ok {
			return x.Heartbeat
		}
	}
	return nil
}

func (x *GatewayMessage) GetRelayOpen() *RelayOpen {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_RelayOpen); ok {
			return x.RelayOpen
		}
	}
	return nil
}

func (x *GatewayMessage) GetRelayClose() *RelayClose {
	if x != nil {
		if x, ok := x.Payload.(*GatewayMessage_RelayClose); ok {
			return x.RelayClose
		}
	}
	return nil
}

type isGatewayMessage_Payload interface {
	isGatewayMessage_Payload()
}

type GatewayMessage_SessionAccepted struct {
	SessionAccepted *SessionAccepted `protobuf:"bytes,1,opt,name=session_accepted,json=sessionAccepted,proto3,oneof"`
}

type GatewayMessage_SessionRejected struct {
	SessionRejected *SessionRejected `protobuf:"bytes,2,opt,name=session_rejected,json=sessionRejected,proto3,oneof"`
}

type GatewayMessage_Heartbeat struct {
	Heartbeat *GatewayHeartbeat `protobuf:"bytes,3,opt,name=heartbeat,proto3,oneof"`
}

type GatewayMessage_RelayOpen struct {
	RelayOpen *RelayOpen `protobuf:"bytes,4,opt,name=relay_open,json=relayOpen,proto3,oneof"`
}

type GatewayMessage_RelayClose struct {
	RelayClose *RelayClose `protobuf:"bytes,5,opt,name=relay_close,json=relayClose,proto3,oneof"`
}

func (*GatewayMessage_SessionAccepted) isGatewayMessage_Payload() {}

func (*GatewayMessage_SessionRejected) isGatewayMessage_Payload() {}

func (*GatewayMessage_Heartbeat) isGatewayMessage_Payload() {}

func (*GatewayMessage_RelayOpen) isGatewayMessage_Payload() {}

func (*GatewayMessage_RelayClose) isGatewayMessage_Payload() {}

// Supervisor identifies itself and the sandbox it manages.
type SupervisorHello struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox ID this supervisor manages.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Supervisor instance ID (e.g. boot id or process epoch).
	InstanceId    string `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SupervisorHello) Reset() {
	*x = SupervisorHello{}
	mi := &file_openshell_proto_msgTypes[129]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SupervisorHello) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SupervisorHello) ProtoMessage() {}

func (x *SupervisorHello) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[129]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SupervisorHello.ProtoReflect.Descriptor instead.
func (*SupervisorHello) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{129}
}

func (x *SupervisorHello) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *SupervisorHello) GetInstanceId() string {
	if x != nil {
		return x.InstanceId
	}
	return ""
}

// Gateway accepts the supervisor session.
type SessionAccepted struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-assigned session ID for this connection.
	SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"`
	// Recommended heartbeat interval in seconds.
	HeartbeatIntervalSecs uint32 `protobuf:"varint,2,opt,name=heartbeat_interval_secs,json=heartbeatIntervalSecs,proto3" json:"heartbeat_interval_secs,omitempty"`
	unknownFields         protoimpl.UnknownFields
	sizeCache             protoimpl.SizeCache
}

func (x *SessionAccepted) Reset() {
	*x = SessionAccepted{}
	mi := &file_openshell_proto_msgTypes[130]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SessionAccepted) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SessionAccepted) ProtoMessage() {}

func (x *SessionAccepted) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[130]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SessionAccepted.ProtoReflect.Descriptor instead.
func (*SessionAccepted) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{130}
}

func (x *SessionAccepted) GetSessionId() string {
	if x != nil {
		return x.SessionId
	}
	return ""
}

func (x *SessionAccepted) GetHeartbeatIntervalSecs() uint32 {
	if x != nil {
		return x.HeartbeatIntervalSecs
	}
	return 0
}

// Gateway rejects the supervisor session.
type SessionRejected struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Human-readable rejection reason.
	Reason        string `protobuf:"bytes,1,opt,name=reason,proto3" json:"reason,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SessionRejected) Reset() {
	*x = SessionRejected{}
	mi := &file_openshell_proto_msgTypes[131]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SessionRejected) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SessionRejected) ProtoMessage() {}

func (x *SessionRejected) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[131]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SessionRejected.ProtoReflect.Descriptor instead.
func (*SessionRejected) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{131}
}

func (x *SessionRejected) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

// Supervisor heartbeat.
type SupervisorHeartbeat struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SupervisorHeartbeat) Reset() {
	*x = SupervisorHeartbeat{}
	mi := &file_openshell_proto_msgTypes[132]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SupervisorHeartbeat) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SupervisorHeartbeat) ProtoMessage() {}

func (x *SupervisorHeartbeat) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[132]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SupervisorHeartbeat.ProtoReflect.Descriptor instead.
func (*SupervisorHeartbeat) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{132}
}

// Gateway heartbeat.
type GatewayHeartbeat struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GatewayHeartbeat) Reset() {
	*x = GatewayHeartbeat{}
	mi := &file_openshell_proto_msgTypes[133]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GatewayHeartbeat) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GatewayHeartbeat) ProtoMessage() {}

func (x *GatewayHeartbeat) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[133]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GatewayHeartbeat.ProtoReflect.Descriptor instead.
func (*GatewayHeartbeat) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{133}
}

// Terminal result reported before the supervisor shuts down. A successful RPC
// response confirms that the result was durably handled by the gateway.
type ReportMainProcessExitRequest struct {
	state      protoimpl.MessageState `protogen:"open.v1"`
	SandboxId  string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	InstanceId string                 `protobuf:"bytes,2,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
	// Normalized process result. Signal exits use 128 + signal number.
	ExitCode      int32 `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportMainProcessExitRequest) Reset() {
	*x = ReportMainProcessExitRequest{}
	mi := &file_openshell_proto_msgTypes[134]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportMainProcessExitRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportMainProcessExitRequest) ProtoMessage() {}

func (x *ReportMainProcessExitRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[134]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportMainProcessExitRequest.ProtoReflect.Descriptor instead.
func (*ReportMainProcessExitRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{134}
}

func (x *ReportMainProcessExitRequest) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *ReportMainProcessExitRequest) GetInstanceId() string {
	if x != nil {
		return x.InstanceId
	}
	return ""
}

func (x *ReportMainProcessExitRequest) GetExitCode() int32 {
	if x != nil {
		return x.ExitCode
	}
	return 0
}

type ReportMainProcessExitResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ReportMainProcessExitResponse) Reset() {
	*x = ReportMainProcessExitResponse{}
	mi := &file_openshell_proto_msgTypes[135]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ReportMainProcessExitResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ReportMainProcessExitResponse) ProtoMessage() {}

func (x *ReportMainProcessExitResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[135]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ReportMainProcessExitResponse.ProtoReflect.Descriptor instead.
func (*ReportMainProcessExitResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{135}
}

// Gateway requests the supervisor to open a relay channel.
//
// On receiving this, the supervisor should initiate a RelayStream RPC to
// the gateway, sending a RelayInit in the first RelayFrame to associate
// the new HTTP/2 stream with the pending relay slot. The supervisor
// bridges that stream to the requested local target.
type RelayOpen struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-allocated channel identifier (UUID).
	ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	// Target the supervisor should dial inside the sandbox.
	// If absent, supervisors treat the relay as SSH for compatibility.
	//
	// Types that are valid to be assigned to Target:
	//
	//	*RelayOpen_Ssh
	//	*RelayOpen_Tcp
	Target isRelayOpen_Target `protobuf_oneof:"target"`
	// Optional service identifier for audit/correlation.
	ServiceId     string `protobuf:"bytes,5,opt,name=service_id,json=serviceId,proto3" json:"service_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayOpen) Reset() {
	*x = RelayOpen{}
	mi := &file_openshell_proto_msgTypes[136]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayOpen) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayOpen) ProtoMessage() {}

func (x *RelayOpen) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[136]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayOpen.ProtoReflect.Descriptor instead.
func (*RelayOpen) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{136}
}

func (x *RelayOpen) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

func (x *RelayOpen) GetTarget() isRelayOpen_Target {
	if x != nil {
		return x.Target
	}
	return nil
}

func (x *RelayOpen) GetSsh() *SshRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*RelayOpen_Ssh); ok {
			return x.Ssh
		}
	}
	return nil
}

func (x *RelayOpen) GetTcp() *TcpRelayTarget {
	if x != nil {
		if x, ok := x.Target.(*RelayOpen_Tcp); ok {
			return x.Tcp
		}
	}
	return nil
}

func (x *RelayOpen) GetServiceId() string {
	if x != nil {
		return x.ServiceId
	}
	return ""
}

type isRelayOpen_Target interface {
	isRelayOpen_Target()
}

type RelayOpen_Ssh struct {
	Ssh *SshRelayTarget `protobuf:"bytes,2,opt,name=ssh,proto3,oneof"`
}

type RelayOpen_Tcp struct {
	Tcp *TcpRelayTarget `protobuf:"bytes,3,opt,name=tcp,proto3,oneof"`
}

func (*RelayOpen_Ssh) isRelayOpen_Target() {}

func (*RelayOpen_Tcp) isRelayOpen_Target() {}

// Built-in SSH relay target.
type SshRelayTarget struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SshRelayTarget) Reset() {
	*x = SshRelayTarget{}
	mi := &file_openshell_proto_msgTypes[137]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SshRelayTarget) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SshRelayTarget) ProtoMessage() {}

func (x *SshRelayTarget) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[137]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SshRelayTarget.ProtoReflect.Descriptor instead.
func (*SshRelayTarget) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{137}
}

// TCP target dialed by the supervisor from inside the sandbox.
type TcpRelayTarget struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Phase 1 accepts loopback only: 127.0.0.1, ::1, or localhost.
	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
	// Target port. Must fit in u16 and be non-zero.
	Port          uint32 `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *TcpRelayTarget) Reset() {
	*x = TcpRelayTarget{}
	mi := &file_openshell_proto_msgTypes[138]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *TcpRelayTarget) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*TcpRelayTarget) ProtoMessage() {}

func (x *TcpRelayTarget) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[138]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use TcpRelayTarget.ProtoReflect.Descriptor instead.
func (*TcpRelayTarget) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{138}
}

func (x *TcpRelayTarget) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *TcpRelayTarget) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

// Initial RelayStream frame sent by the supervisor to claim a pending relay.
type RelayInit struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Gateway-allocated channel identifier (UUID).
	ChannelId     string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayInit) Reset() {
	*x = RelayInit{}
	mi := &file_openshell_proto_msgTypes[139]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayInit) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayInit) ProtoMessage() {}

func (x *RelayInit) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[139]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayInit.ProtoReflect.Descriptor instead.
func (*RelayInit) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{139}
}

func (x *RelayInit) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

// A single frame on the RelayStream RPC.
//
// The supervisor MUST send `init` as the first frame. All subsequent frames
// in either direction carry raw bytes in `data`.
type RelayFrame struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Types that are valid to be assigned to Payload:
	//
	//	*RelayFrame_Init
	//	*RelayFrame_Data
	Payload       isRelayFrame_Payload `protobuf_oneof:"payload"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayFrame) Reset() {
	*x = RelayFrame{}
	mi := &file_openshell_proto_msgTypes[140]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayFrame) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayFrame) ProtoMessage() {}

func (x *RelayFrame) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[140]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayFrame.ProtoReflect.Descriptor instead.
func (*RelayFrame) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{140}
}

func (x *RelayFrame) GetPayload() isRelayFrame_Payload {
	if x != nil {
		return x.Payload
	}
	return nil
}

func (x *RelayFrame) GetInit() *RelayInit {
	if x != nil {
		if x, ok := x.Payload.(*RelayFrame_Init); ok {
			return x.Init
		}
	}
	return nil
}

func (x *RelayFrame) GetData() []byte {
	if x != nil {
		if x, ok := x.Payload.(*RelayFrame_Data); ok {
			return x.Data
		}
	}
	return nil
}

type isRelayFrame_Payload interface {
	isRelayFrame_Payload()
}

type RelayFrame_Init struct {
	Init *RelayInit `protobuf:"bytes,1,opt,name=init,proto3,oneof"`
}

type RelayFrame_Data struct {
	Data []byte `protobuf:"bytes,2,opt,name=data,proto3,oneof"`
}

func (*RelayFrame_Init) isRelayFrame_Payload() {}

func (*RelayFrame_Data) isRelayFrame_Payload() {}

// Supervisor reports the result of a relay open request.
type RelayOpenResult struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Channel identifier from the RelayOpen request.
	ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	// True if the relay was successfully established.
	Success bool `protobuf:"varint,2,opt,name=success,proto3" json:"success,omitempty"`
	// Error message if success is false.
	Error         string `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayOpenResult) Reset() {
	*x = RelayOpenResult{}
	mi := &file_openshell_proto_msgTypes[141]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayOpenResult) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayOpenResult) ProtoMessage() {}

func (x *RelayOpenResult) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[141]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayOpenResult.ProtoReflect.Descriptor instead.
func (*RelayOpenResult) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{141}
}

func (x *RelayOpenResult) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

func (x *RelayOpenResult) GetSuccess() bool {
	if x != nil {
		return x.Success
	}
	return false
}

func (x *RelayOpenResult) GetError() string {
	if x != nil {
		return x.Error
	}
	return ""
}

// Either side requests closure of a relay channel.
type RelayClose struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Channel identifier to close.
	ChannelId string `protobuf:"bytes,1,opt,name=channel_id,json=channelId,proto3" json:"channel_id,omitempty"`
	// Optional reason for closure.
	Reason        string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RelayClose) Reset() {
	*x = RelayClose{}
	mi := &file_openshell_proto_msgTypes[142]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RelayClose) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RelayClose) ProtoMessage() {}

func (x *RelayClose) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[142]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RelayClose.ProtoReflect.Descriptor instead.
func (*RelayClose) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{142}
}

func (x *RelayClose) GetChannelId() string {
	if x != nil {
		return x.ChannelId
	}
	return ""
}

func (x *RelayClose) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

// Observed HTTP method+path pattern from L7 inspection.
type L7RequestSample struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// HTTP method: GET, POST, PUT, DELETE, etc.
	Method string `protobuf:"bytes,1,opt,name=method,proto3" json:"method,omitempty"`
	// HTTP path: /v1/models, /repos/myorg/issues
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// L7 decision: "audit" or "deny" (allowed requests not collected).
	Decision string `protobuf:"bytes,3,opt,name=decision,proto3" json:"decision,omitempty"`
	// Number of times this (method, path) was observed.
	Count         uint32 `protobuf:"varint,4,opt,name=count,proto3" json:"count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *L7RequestSample) Reset() {
	*x = L7RequestSample{}
	mi := &file_openshell_proto_msgTypes[143]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *L7RequestSample) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*L7RequestSample) ProtoMessage() {}

func (x *L7RequestSample) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[143]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use L7RequestSample.ProtoReflect.Descriptor instead.
func (*L7RequestSample) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{143}
}

func (x *L7RequestSample) GetMethod() string {
	if x != nil {
		return x.Method
	}
	return ""
}

func (x *L7RequestSample) GetPath() string {
	if x != nil {
		return x.Path
	}
	return ""
}

func (x *L7RequestSample) GetDecision() string {
	if x != nil {
		return x.Decision
	}
	return ""
}

func (x *L7RequestSample) GetCount() uint32 {
	if x != nil {
		return x.Count
	}
	return 0
}

// Structured denial summary from sandbox aggregator.
type DenialSummary struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox ID that produced this summary.
	SandboxId string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	// Denied destination host.
	Host string `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
	// Denied destination port.
	Port uint32 `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`
	// Binary that attempted the connection.
	Binary string `protobuf:"bytes,4,opt,name=binary,proto3" json:"binary,omitempty"`
	// Process ancestor chain.
	Ancestors []string `protobuf:"bytes,5,rep,name=ancestors,proto3" json:"ancestors,omitempty"`
	// Denial reason from OPA evaluation.
	DenyReason string `protobuf:"bytes,6,opt,name=deny_reason,json=denyReason,proto3" json:"deny_reason,omitempty"`
	// First denial timestamp (ms since epoch).
	FirstSeenMs int64 `protobuf:"varint,7,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"`
	// Most recent denial timestamp (ms since epoch).
	LastSeenMs int64 `protobuf:"varint,8,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"`
	// Number of denials in the current window.
	Count uint32 `protobuf:"varint,9,opt,name=count,proto3" json:"count,omitempty"`
	// Events dropped during aggregator cooldown.
	SuppressedCount uint32 `protobuf:"varint,10,opt,name=suppressed_count,json=suppressedCount,proto3" json:"suppressed_count,omitempty"`
	// Cumulative lifetime count (never resets).
	TotalCount uint32 `protobuf:"varint,11,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"`
	// Distinct cmdline strings observed (sanitized of credentials).
	SampleCmdlines []string `protobuf:"bytes,12,rep,name=sample_cmdlines,json=sampleCmdlines,proto3" json:"sample_cmdlines,omitempty"`
	// SHA-256 of the binary for audit trail.
	BinarySha256 string `protobuf:"bytes,13,opt,name=binary_sha256,json=binarySha256,proto3" json:"binary_sha256,omitempty"`
	// True if emitted by stale-flush rather than threshold.
	Persistent bool `protobuf:"varint,14,opt,name=persistent,proto3" json:"persistent,omitempty"`
	// Denial category: "l4_deny", "l7_deny", "l7_audit", "ssrf".
	DenialStage string `protobuf:"bytes,15,opt,name=denial_stage,json=denialStage,proto3" json:"denial_stage,omitempty"`
	// Observed HTTP request patterns (from L7 inspection).
	L7RequestSamples []*L7RequestSample `protobuf:"bytes,16,rep,name=l7_request_samples,json=l7RequestSamples,proto3" json:"l7_request_samples,omitempty"`
	// True if L7 inspection was active during observation window.
	L7InspectionActive bool `protobuf:"varint,17,opt,name=l7_inspection_active,json=l7InspectionActive,proto3" json:"l7_inspection_active,omitempty"`
	unknownFields      protoimpl.UnknownFields
	sizeCache          protoimpl.SizeCache
}

func (x *DenialSummary) Reset() {
	*x = DenialSummary{}
	mi := &file_openshell_proto_msgTypes[144]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DenialSummary) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DenialSummary) ProtoMessage() {}

func (x *DenialSummary) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[144]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DenialSummary.ProtoReflect.Descriptor instead.
func (*DenialSummary) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{144}
}

func (x *DenialSummary) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *DenialSummary) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *DenialSummary) GetPort() uint32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *DenialSummary) GetBinary() string {
	if x != nil {
		return x.Binary
	}
	return ""
}

func (x *DenialSummary) GetAncestors() []string {
	if x != nil {
		return x.Ancestors
	}
	return nil
}

func (x *DenialSummary) GetDenyReason() string {
	if x != nil {
		return x.DenyReason
	}
	return ""
}

func (x *DenialSummary) GetFirstSeenMs() int64 {
	if x != nil {
		return x.FirstSeenMs
	}
	return 0
}

func (x *DenialSummary) GetLastSeenMs() int64 {
	if x != nil {
		return x.LastSeenMs
	}
	return 0
}

func (x *DenialSummary) GetCount() uint32 {
	if x != nil {
		return x.Count
	}
	return 0
}

func (x *DenialSummary) GetSuppressedCount() uint32 {
	if x != nil {
		return x.SuppressedCount
	}
	return 0
}

func (x *DenialSummary) GetTotalCount() uint32 {
	if x != nil {
		return x.TotalCount
	}
	return 0
}

func (x *DenialSummary) GetSampleCmdlines() []string {
	if x != nil {
		return x.SampleCmdlines
	}
	return nil
}

func (x *DenialSummary) GetBinarySha256() string {
	if x != nil {
		return x.BinarySha256
	}
	return ""
}

func (x *DenialSummary) GetPersistent() bool {
	if x != nil {
		return x.Persistent
	}
	return false
}

func (x *DenialSummary) GetDenialStage() string {
	if x != nil {
		return x.DenialStage
	}
	return ""
}

func (x *DenialSummary) GetL7RequestSamples() []*L7RequestSample {
	if x != nil {
		return x.L7RequestSamples
	}
	return nil
}

func (x *DenialSummary) GetL7InspectionActive() bool {
	if x != nil {
		return x.L7InspectionActive
	}
	return false
}

// Count of denied actions grouped only by sanitized telemetry category.
type DenialGroupCount struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sanitized denial category, e.g. "connect_policy", "l7_policy", "ssrf".
	DenyGroup string `protobuf:"bytes,1,opt,name=deny_group,json=denyGroup,proto3" json:"deny_group,omitempty"`
	// Number of denied actions in this category.
	DeniedCount   uint32 `protobuf:"varint,2,opt,name=denied_count,json=deniedCount,proto3" json:"denied_count,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DenialGroupCount) Reset() {
	*x = DenialGroupCount{}
	mi := &file_openshell_proto_msgTypes[145]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DenialGroupCount) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DenialGroupCount) ProtoMessage() {}

func (x *DenialGroupCount) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[145]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DenialGroupCount.ProtoReflect.Descriptor instead.
func (*DenialGroupCount) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{145}
}

func (x *DenialGroupCount) GetDenyGroup() string {
	if x != nil {
		return x.DenyGroup
	}
	return ""
}

func (x *DenialGroupCount) GetDeniedCount() uint32 {
	if x != nil {
		return x.DeniedCount
	}
	return 0
}

// Anonymous sandbox network activity counters. This intentionally excludes
// hosts, paths, binaries, raw deny reasons, sandbox IDs, and user content.
type NetworkActivitySummary struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Total observed network activities in the current window.
	NetworkActivityCount uint32 `protobuf:"varint,1,opt,name=network_activity_count,json=networkActivityCount,proto3" json:"network_activity_count,omitempty"`
	// Total denied actions in the current window.
	DeniedActionCount uint32 `protobuf:"varint,2,opt,name=denied_action_count,json=deniedActionCount,proto3" json:"denied_action_count,omitempty"`
	// Denied action counts grouped by sanitized category.
	DenialsByGroup []*DenialGroupCount `protobuf:"bytes,3,rep,name=denials_by_group,json=denialsByGroup,proto3" json:"denials_by_group,omitempty"`
	unknownFields  protoimpl.UnknownFields
	sizeCache      protoimpl.SizeCache
}

func (x *NetworkActivitySummary) Reset() {
	*x = NetworkActivitySummary{}
	mi := &file_openshell_proto_msgTypes[146]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *NetworkActivitySummary) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*NetworkActivitySummary) ProtoMessage() {}

func (x *NetworkActivitySummary) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[146]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use NetworkActivitySummary.ProtoReflect.Descriptor instead.
func (*NetworkActivitySummary) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{146}
}

func (x *NetworkActivitySummary) GetNetworkActivityCount() uint32 {
	if x != nil {
		return x.NetworkActivityCount
	}
	return 0
}

func (x *NetworkActivitySummary) GetDeniedActionCount() uint32 {
	if x != nil {
		return x.DeniedActionCount
	}
	return 0
}

func (x *NetworkActivitySummary) GetDenialsByGroup() []*DenialGroupCount {
	if x != nil {
		return x.DenialsByGroup
	}
	return nil
}

// A proposed policy rule with rationale and approval status.
type PolicyChunk struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Unique chunk identifier.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Approval status: "pending", "approved", "rejected".
	Status string `protobuf:"bytes,2,opt,name=status,proto3" json:"status,omitempty"`
	// Proposed network_policies map key.
	RuleName string `protobuf:"bytes,3,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	// The proposed network policy rule.
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,4,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	// Human-readable explanation of why this rule is proposed.
	Rationale string `protobuf:"bytes,5,opt,name=rationale,proto3" json:"rationale,omitempty"`
	// Security concerns flagged by analysis (empty if none).
	SecurityNotes string `protobuf:"bytes,6,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"`
	// Analysis confidence (0.0-1.0). 0 for mechanistic mode.
	Confidence float32 `protobuf:"fixed32,7,opt,name=confidence,proto3" json:"confidence,omitempty"`
	// IDs of denial summaries that led to this chunk.
	DenialSummaryIds []string `protobuf:"bytes,8,rep,name=denial_summary_ids,json=denialSummaryIds,proto3" json:"denial_summary_ids,omitempty"`
	// Creation timestamp (ms since epoch).
	CreatedAtMs int64 `protobuf:"varint,9,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"`
	// When the user approved/rejected (ms since epoch). 0 if undecided.
	DecidedAtMs int64 `protobuf:"varint,10,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"`
	// Recommendation stage: "initial" or "refined" (progressive L7 visibility).
	Stage string `protobuf:"bytes,11,opt,name=stage,proto3" json:"stage,omitempty"`
	// For stage="refined": the initial chunk this replaces.
	SupersedesChunkId string `protobuf:"bytes,12,opt,name=supersedes_chunk_id,json=supersedesChunkId,proto3" json:"supersedes_chunk_id,omitempty"`
	// How many times this endpoint has been seen across denial flush cycles.
	HitCount int32 `protobuf:"varint,13,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"`
	// First time this endpoint was proposed (ms since epoch).
	FirstSeenMs int64 `protobuf:"varint,14,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"`
	// Most recent time this endpoint was re-proposed (ms since epoch).
	LastSeenMs int64 `protobuf:"varint,15,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"`
	// Binary path that triggered the denial (denormalized for display convenience).
	Binary string `protobuf:"bytes,16,opt,name=binary,proto3" json:"binary,omitempty"`
	// Validation verdict from gateway-side static checks (prover output).
	// Free-form summary string for human consumption in the inbox card.
	// Empty until the prover has run for this chunk.
	ValidationResult string `protobuf:"bytes,17,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"`
	// Operator-supplied free-form text accompanying a rejection. Populated
	// when the reviewer rejects via `RejectDraftChunkRequest.reason`; surfaced
	// back to the in-sandbox agent so it can revise the proposal.
	// Empty for non-rejected chunks.
	RejectionReason string `protobuf:"bytes,18,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *PolicyChunk) Reset() {
	*x = PolicyChunk{}
	mi := &file_openshell_proto_msgTypes[147]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PolicyChunk) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PolicyChunk) ProtoMessage() {}

func (x *PolicyChunk) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[147]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PolicyChunk.ProtoReflect.Descriptor instead.
func (*PolicyChunk) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{147}
}

func (x *PolicyChunk) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *PolicyChunk) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *PolicyChunk) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *PolicyChunk) GetProposedRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.ProposedRule
	}
	return nil
}

func (x *PolicyChunk) GetRationale() string {
	if x != nil {
		return x.Rationale
	}
	return ""
}

func (x *PolicyChunk) GetSecurityNotes() string {
	if x != nil {
		return x.SecurityNotes
	}
	return ""
}

func (x *PolicyChunk) GetConfidence() float32 {
	if x != nil {
		return x.Confidence
	}
	return 0
}

func (x *PolicyChunk) GetDenialSummaryIds() []string {
	if x != nil {
		return x.DenialSummaryIds
	}
	return nil
}

func (x *PolicyChunk) GetCreatedAtMs() int64 {
	if x != nil {
		return x.CreatedAtMs
	}
	return 0
}

func (x *PolicyChunk) GetDecidedAtMs() int64 {
	if x != nil {
		return x.DecidedAtMs
	}
	return 0
}

func (x *PolicyChunk) GetStage() string {
	if x != nil {
		return x.Stage
	}
	return ""
}

func (x *PolicyChunk) GetSupersedesChunkId() string {
	if x != nil {
		return x.SupersedesChunkId
	}
	return ""
}

func (x *PolicyChunk) GetHitCount() int32 {
	if x != nil {
		return x.HitCount
	}
	return 0
}

func (x *PolicyChunk) GetFirstSeenMs() int64 {
	if x != nil {
		return x.FirstSeenMs
	}
	return 0
}

func (x *PolicyChunk) GetLastSeenMs() int64 {
	if x != nil {
		return x.LastSeenMs
	}
	return 0
}

func (x *PolicyChunk) GetBinary() string {
	if x != nil {
		return x.Binary
	}
	return ""
}

func (x *PolicyChunk) GetValidationResult() string {
	if x != nil {
		return x.ValidationResult
	}
	return ""
}

func (x *PolicyChunk) GetRejectionReason() string {
	if x != nil {
		return x.RejectionReason
	}
	return ""
}

// Notification that the draft policy was updated.
type DraftPolicyUpdate struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Current draft version.
	DraftVersion uint64 `protobuf:"varint,1,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// Number of new chunks added in this update.
	NewChunks uint32 `protobuf:"varint,2,opt,name=new_chunks,json=newChunks,proto3" json:"new_chunks,omitempty"`
	// Total pending chunks awaiting approval.
	TotalPending uint32 `protobuf:"varint,3,opt,name=total_pending,json=totalPending,proto3" json:"total_pending,omitempty"`
	// Brief description of what changed.
	Summary       string `protobuf:"bytes,4,opt,name=summary,proto3" json:"summary,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DraftPolicyUpdate) Reset() {
	*x = DraftPolicyUpdate{}
	mi := &file_openshell_proto_msgTypes[148]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DraftPolicyUpdate) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DraftPolicyUpdate) ProtoMessage() {}

func (x *DraftPolicyUpdate) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[148]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DraftPolicyUpdate.ProtoReflect.Descriptor instead.
func (*DraftPolicyUpdate) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{148}
}

func (x *DraftPolicyUpdate) GetDraftVersion() uint64 {
	if x != nil {
		return x.DraftVersion
	}
	return 0
}

func (x *DraftPolicyUpdate) GetNewChunks() uint32 {
	if x != nil {
		return x.NewChunks
	}
	return 0
}

func (x *DraftPolicyUpdate) GetTotalPending() uint32 {
	if x != nil {
		return x.TotalPending
	}
	return 0
}

func (x *DraftPolicyUpdate) GetSummary() string {
	if x != nil {
		return x.Summary
	}
	return ""
}

// Submit analysis results from sandbox to gateway.
type SubmitPolicyAnalysisRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Aggregated denial summaries.
	Summaries []*DenialSummary `protobuf:"bytes,1,rep,name=summaries,proto3" json:"summaries,omitempty"`
	// Proposed policy chunks (validated by sandbox OPA engine).
	ProposedChunks []*PolicyChunk `protobuf:"bytes,2,rep,name=proposed_chunks,json=proposedChunks,proto3" json:"proposed_chunks,omitempty"`
	// Analysis mode. `mechanistic` is the observation-driven path from the
	// denial aggregator — chunks targeting the same host|port|binary fold
	// into one row with hit_count incremented. `agent_authored` is an
	// intentional proposal from an in-sandbox agent — each submission lands
	// as its own chunk so the redraft-after-rejection loop has a stable id
	// to watch. Other values are treated as agent-style (no dedup) so a new
	// mode does not silently collapse proposals.
	AnalysisMode string `protobuf:"bytes,3,opt,name=analysis_mode,json=analysisMode,proto3" json:"analysis_mode,omitempty"`
	// Sandbox name.
	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
	// Anonymous network activity counters.
	NetworkActivitySummaries []*NetworkActivitySummary `protobuf:"bytes,5,rep,name=network_activity_summaries,json=networkActivitySummaries,proto3" json:"network_activity_summaries,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,6,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *SubmitPolicyAnalysisRequest) Reset() {
	*x = SubmitPolicyAnalysisRequest{}
	mi := &file_openshell_proto_msgTypes[149]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SubmitPolicyAnalysisRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SubmitPolicyAnalysisRequest) ProtoMessage() {}

func (x *SubmitPolicyAnalysisRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[149]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SubmitPolicyAnalysisRequest.ProtoReflect.Descriptor instead.
func (*SubmitPolicyAnalysisRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{149}
}

func (x *SubmitPolicyAnalysisRequest) GetSummaries() []*DenialSummary {
	if x != nil {
		return x.Summaries
	}
	return nil
}

func (x *SubmitPolicyAnalysisRequest) GetProposedChunks() []*PolicyChunk {
	if x != nil {
		return x.ProposedChunks
	}
	return nil
}

func (x *SubmitPolicyAnalysisRequest) GetAnalysisMode() string {
	if x != nil {
		return x.AnalysisMode
	}
	return ""
}

func (x *SubmitPolicyAnalysisRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *SubmitPolicyAnalysisRequest) GetNetworkActivitySummaries() []*NetworkActivitySummary {
	if x != nil {
		return x.NetworkActivitySummaries
	}
	return nil
}

func (x *SubmitPolicyAnalysisRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type SubmitPolicyAnalysisResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Number of chunks accepted by the gateway.
	AcceptedChunks uint32 `protobuf:"varint,1,opt,name=accepted_chunks,json=acceptedChunks,proto3" json:"accepted_chunks,omitempty"`
	// Number of chunks rejected by gateway validation.
	RejectedChunks uint32 `protobuf:"varint,2,opt,name=rejected_chunks,json=rejectedChunks,proto3" json:"rejected_chunks,omitempty"`
	// Reasons for each rejected chunk.
	RejectionReasons []string `protobuf:"bytes,3,rep,name=rejection_reasons,json=rejectionReasons,proto3" json:"rejection_reasons,omitempty"`
	// Server-assigned chunk IDs for the accepted chunks, in submission order.
	// Agents use these to watch proposal state via policy.local's
	// GET /v1/proposals/{id} and /wait endpoints.
	AcceptedChunkIds []string `protobuf:"bytes,4,rep,name=accepted_chunk_ids,json=acceptedChunkIds,proto3" json:"accepted_chunk_ids,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *SubmitPolicyAnalysisResponse) Reset() {
	*x = SubmitPolicyAnalysisResponse{}
	mi := &file_openshell_proto_msgTypes[150]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *SubmitPolicyAnalysisResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*SubmitPolicyAnalysisResponse) ProtoMessage() {}

func (x *SubmitPolicyAnalysisResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[150]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use SubmitPolicyAnalysisResponse.ProtoReflect.Descriptor instead.
func (*SubmitPolicyAnalysisResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{150}
}

func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunks() uint32 {
	if x != nil {
		return x.AcceptedChunks
	}
	return 0
}

func (x *SubmitPolicyAnalysisResponse) GetRejectedChunks() uint32 {
	if x != nil {
		return x.RejectedChunks
	}
	return 0
}

func (x *SubmitPolicyAnalysisResponse) GetRejectionReasons() []string {
	if x != nil {
		return x.RejectionReasons
	}
	return nil
}

func (x *SubmitPolicyAnalysisResponse) GetAcceptedChunkIds() []string {
	if x != nil {
		return x.AcceptedChunkIds
	}
	return nil
}

// Get draft policy for a sandbox.
type GetDraftPolicyRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional status filter: "pending", "approved", "rejected", or "" for all.
	StatusFilter string `protobuf:"bytes,2,opt,name=status_filter,json=statusFilter,proto3" json:"status_filter,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetDraftPolicyRequest) Reset() {
	*x = GetDraftPolicyRequest{}
	mi := &file_openshell_proto_msgTypes[151]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftPolicyRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftPolicyRequest) ProtoMessage() {}

func (x *GetDraftPolicyRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[151]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftPolicyRequest.ProtoReflect.Descriptor instead.
func (*GetDraftPolicyRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{151}
}

func (x *GetDraftPolicyRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *GetDraftPolicyRequest) GetStatusFilter() string {
	if x != nil {
		return x.StatusFilter
	}
	return ""
}

func (x *GetDraftPolicyRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type GetDraftPolicyResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Draft policy chunks.
	Chunks []*PolicyChunk `protobuf:"bytes,1,rep,name=chunks,proto3" json:"chunks,omitempty"`
	// LLM-generated summary of all analysis (empty in mechanistic mode).
	RollingSummary string `protobuf:"bytes,2,opt,name=rolling_summary,json=rollingSummary,proto3" json:"rolling_summary,omitempty"`
	// Current draft version.
	DraftVersion uint64 `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// When the last analysis completed (ms since epoch).
	LastAnalyzedAtMs int64 `protobuf:"varint,4,opt,name=last_analyzed_at_ms,json=lastAnalyzedAtMs,proto3" json:"last_analyzed_at_ms,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *GetDraftPolicyResponse) Reset() {
	*x = GetDraftPolicyResponse{}
	mi := &file_openshell_proto_msgTypes[152]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftPolicyResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftPolicyResponse) ProtoMessage() {}

func (x *GetDraftPolicyResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[152]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftPolicyResponse.ProtoReflect.Descriptor instead.
func (*GetDraftPolicyResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{152}
}

func (x *GetDraftPolicyResponse) GetChunks() []*PolicyChunk {
	if x != nil {
		return x.Chunks
	}
	return nil
}

func (x *GetDraftPolicyResponse) GetRollingSummary() string {
	if x != nil {
		return x.RollingSummary
	}
	return ""
}

func (x *GetDraftPolicyResponse) GetDraftVersion() uint64 {
	if x != nil {
		return x.DraftVersion
	}
	return 0
}

func (x *GetDraftPolicyResponse) GetLastAnalyzedAtMs() int64 {
	if x != nil {
		return x.LastAnalyzedAtMs
	}
	return 0
}

// Approve a single draft chunk.
type ApproveDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Chunk ID to approve.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveDraftChunkRequest) Reset() {
	*x = ApproveDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[153]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveDraftChunkRequest) ProtoMessage() {}

func (x *ApproveDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[153]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*ApproveDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{153}
}

func (x *ApproveDraftChunkRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ApproveDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *ApproveDraftChunkRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type ApproveDraftChunkResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// New policy version after merge.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the new policy.
	PolicyHash    string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveDraftChunkResponse) Reset() {
	*x = ApproveDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[154]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveDraftChunkResponse) ProtoMessage() {}

func (x *ApproveDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[154]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*ApproveDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{154}
}

func (x *ApproveDraftChunkResponse) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *ApproveDraftChunkResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

// Reject a single draft chunk.
type RejectDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Chunk ID to reject.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// Optional reason for rejection (fed to LLM context in future analysis).
	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RejectDraftChunkRequest) Reset() {
	*x = RejectDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[155]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RejectDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RejectDraftChunkRequest) ProtoMessage() {}

func (x *RejectDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[155]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RejectDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*RejectDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{155}
}

func (x *RejectDraftChunkRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *RejectDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *RejectDraftChunkRequest) GetReason() string {
	if x != nil {
		return x.Reason
	}
	return ""
}

func (x *RejectDraftChunkRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type RejectDraftChunkResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RejectDraftChunkResponse) Reset() {
	*x = RejectDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[156]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RejectDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RejectDraftChunkResponse) ProtoMessage() {}

func (x *RejectDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[156]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RejectDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*RejectDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{156}
}

// Approve all pending chunks.
type ApproveAllDraftChunksRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Include chunks with security_notes (default false: skips them).
	IncludeSecurityFlagged bool `protobuf:"varint,2,opt,name=include_security_flagged,json=includeSecurityFlagged,proto3" json:"include_security_flagged,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveAllDraftChunksRequest) Reset() {
	*x = ApproveAllDraftChunksRequest{}
	mi := &file_openshell_proto_msgTypes[157]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveAllDraftChunksRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveAllDraftChunksRequest) ProtoMessage() {}

func (x *ApproveAllDraftChunksRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[157]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveAllDraftChunksRequest.ProtoReflect.Descriptor instead.
func (*ApproveAllDraftChunksRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{157}
}

func (x *ApproveAllDraftChunksRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ApproveAllDraftChunksRequest) GetIncludeSecurityFlagged() bool {
	if x != nil {
		return x.IncludeSecurityFlagged
	}
	return false
}

func (x *ApproveAllDraftChunksRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type ApproveAllDraftChunksResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// New policy version after merge.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the new policy.
	PolicyHash string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	// Number of chunks approved.
	ChunksApproved uint32 `protobuf:"varint,3,opt,name=chunks_approved,json=chunksApproved,proto3" json:"chunks_approved,omitempty"`
	// Number of chunks skipped (security-flagged).
	ChunksSkipped uint32 `protobuf:"varint,4,opt,name=chunks_skipped,json=chunksSkipped,proto3" json:"chunks_skipped,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ApproveAllDraftChunksResponse) Reset() {
	*x = ApproveAllDraftChunksResponse{}
	mi := &file_openshell_proto_msgTypes[158]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ApproveAllDraftChunksResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ApproveAllDraftChunksResponse) ProtoMessage() {}

func (x *ApproveAllDraftChunksResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[158]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ApproveAllDraftChunksResponse.ProtoReflect.Descriptor instead.
func (*ApproveAllDraftChunksResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{158}
}

func (x *ApproveAllDraftChunksResponse) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *ApproveAllDraftChunksResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *ApproveAllDraftChunksResponse) GetChunksApproved() uint32 {
	if x != nil {
		return x.ChunksApproved
	}
	return 0
}

func (x *ApproveAllDraftChunksResponse) GetChunksSkipped() uint32 {
	if x != nil {
		return x.ChunksSkipped
	}
	return 0
}

// Edit a pending chunk in-place.
type EditDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Chunk ID to edit.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// The modified rule (replaces existing proposed_rule).
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,3,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,4,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *EditDraftChunkRequest) Reset() {
	*x = EditDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[159]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *EditDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*EditDraftChunkRequest) ProtoMessage() {}

func (x *EditDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[159]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use EditDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*EditDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{159}
}

func (x *EditDraftChunkRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *EditDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *EditDraftChunkRequest) GetProposedRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.ProposedRule
	}
	return nil
}

func (x *EditDraftChunkRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type EditDraftChunkResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *EditDraftChunkResponse) Reset() {
	*x = EditDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[160]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *EditDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*EditDraftChunkResponse) ProtoMessage() {}

func (x *EditDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[160]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use EditDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*EditDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{160}
}

// Reverse an approval (remove merged rule from active policy).
type UndoDraftChunkRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Chunk ID to undo.
	ChunkId string `protobuf:"bytes,2,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,3,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UndoDraftChunkRequest) Reset() {
	*x = UndoDraftChunkRequest{}
	mi := &file_openshell_proto_msgTypes[161]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UndoDraftChunkRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UndoDraftChunkRequest) ProtoMessage() {}

func (x *UndoDraftChunkRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[161]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UndoDraftChunkRequest.ProtoReflect.Descriptor instead.
func (*UndoDraftChunkRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{161}
}

func (x *UndoDraftChunkRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *UndoDraftChunkRequest) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

func (x *UndoDraftChunkRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type UndoDraftChunkResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// New policy version after removal.
	PolicyVersion uint32 `protobuf:"varint,1,opt,name=policy_version,json=policyVersion,proto3" json:"policy_version,omitempty"`
	// SHA-256 hash of the updated policy.
	PolicyHash    string `protobuf:"bytes,2,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *UndoDraftChunkResponse) Reset() {
	*x = UndoDraftChunkResponse{}
	mi := &file_openshell_proto_msgTypes[162]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *UndoDraftChunkResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*UndoDraftChunkResponse) ProtoMessage() {}

func (x *UndoDraftChunkResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[162]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use UndoDraftChunkResponse.ProtoReflect.Descriptor instead.
func (*UndoDraftChunkResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{162}
}

func (x *UndoDraftChunkResponse) GetPolicyVersion() uint32 {
	if x != nil {
		return x.PolicyVersion
	}
	return 0
}

func (x *UndoDraftChunkResponse) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

// Clear all pending draft chunks for a sandbox.
type ClearDraftChunksRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ClearDraftChunksRequest) Reset() {
	*x = ClearDraftChunksRequest{}
	mi := &file_openshell_proto_msgTypes[163]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ClearDraftChunksRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ClearDraftChunksRequest) ProtoMessage() {}

func (x *ClearDraftChunksRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[163]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ClearDraftChunksRequest.ProtoReflect.Descriptor instead.
func (*ClearDraftChunksRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{163}
}

func (x *ClearDraftChunksRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *ClearDraftChunksRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type ClearDraftChunksResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Number of chunks cleared.
	ChunksCleared uint32 `protobuf:"varint,1,opt,name=chunks_cleared,json=chunksCleared,proto3" json:"chunks_cleared,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ClearDraftChunksResponse) Reset() {
	*x = ClearDraftChunksResponse{}
	mi := &file_openshell_proto_msgTypes[164]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ClearDraftChunksResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ClearDraftChunksResponse) ProtoMessage() {}

func (x *ClearDraftChunksResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[164]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ClearDraftChunksResponse.ProtoReflect.Descriptor instead.
func (*ClearDraftChunksResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{164}
}

func (x *ClearDraftChunksResponse) GetChunksCleared() uint32 {
	if x != nil {
		return x.ChunksCleared
	}
	return 0
}

// Get decision history for a sandbox's draft policy.
type GetDraftHistoryRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Sandbox name.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Workspace scope. Empty defaults to "default".
	Workspace     string `protobuf:"bytes,2,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetDraftHistoryRequest) Reset() {
	*x = GetDraftHistoryRequest{}
	mi := &file_openshell_proto_msgTypes[165]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftHistoryRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftHistoryRequest) ProtoMessage() {}

func (x *GetDraftHistoryRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[165]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftHistoryRequest.ProtoReflect.Descriptor instead.
func (*GetDraftHistoryRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{165}
}

func (x *GetDraftHistoryRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *GetDraftHistoryRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

type DraftHistoryEntry struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Event timestamp (ms since epoch).
	TimestampMs int64 `protobuf:"varint,1,opt,name=timestamp_ms,json=timestampMs,proto3" json:"timestamp_ms,omitempty"`
	// Event type: "denial_detected", "analysis_cycle", "approved",
	// "rejected", "edited", "undone", "cleared".
	EventType string `protobuf:"bytes,2,opt,name=event_type,json=eventType,proto3" json:"event_type,omitempty"`
	// Human-readable description.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Associated chunk ID (if applicable).
	ChunkId       string `protobuf:"bytes,4,opt,name=chunk_id,json=chunkId,proto3" json:"chunk_id,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DraftHistoryEntry) Reset() {
	*x = DraftHistoryEntry{}
	mi := &file_openshell_proto_msgTypes[166]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DraftHistoryEntry) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DraftHistoryEntry) ProtoMessage() {}

func (x *DraftHistoryEntry) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[166]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DraftHistoryEntry.ProtoReflect.Descriptor instead.
func (*DraftHistoryEntry) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{166}
}

func (x *DraftHistoryEntry) GetTimestampMs() int64 {
	if x != nil {
		return x.TimestampMs
	}
	return 0
}

func (x *DraftHistoryEntry) GetEventType() string {
	if x != nil {
		return x.EventType
	}
	return ""
}

func (x *DraftHistoryEntry) GetDescription() string {
	if x != nil {
		return x.Description
	}
	return ""
}

func (x *DraftHistoryEntry) GetChunkId() string {
	if x != nil {
		return x.ChunkId
	}
	return ""
}

type GetDraftHistoryResponse struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Chronological decision history.
	Entries       []*DraftHistoryEntry `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetDraftHistoryResponse) Reset() {
	*x = GetDraftHistoryResponse{}
	mi := &file_openshell_proto_msgTypes[167]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetDraftHistoryResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetDraftHistoryResponse) ProtoMessage() {}

func (x *GetDraftHistoryResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[167]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetDraftHistoryResponse.ProtoReflect.Descriptor instead.
func (*GetDraftHistoryResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{167}
}

func (x *GetDraftHistoryResponse) GetEntries() []*DraftHistoryEntry {
	if x != nil {
		return x.Entries
	}
	return nil
}

// Stored payload for a policy revision row in the generic objects table.
type PolicyRevisionPayload struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Serialized policy contents.
	Policy *sandboxv1.SandboxPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"`
	// Deterministic hash of the policy payload.
	Hash string `protobuf:"bytes,2,opt,name=hash,proto3" json:"hash,omitempty"`
	// Load error reported by the sandbox, if any.
	LoadError string `protobuf:"bytes,3,opt,name=load_error,json=loadError,proto3" json:"load_error,omitempty"`
	// When the policy version was reported as loaded (ms since epoch). 0 if unset.
	LoadedAtMs int64 `protobuf:"varint,4,opt,name=loaded_at_ms,json=loadedAtMs,proto3" json:"loaded_at_ms,omitempty"`
	// Immutable provenance supplied when this revision was created.
	Provenance    map[string]string `protobuf:"bytes,5,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *PolicyRevisionPayload) Reset() {
	*x = PolicyRevisionPayload{}
	mi := &file_openshell_proto_msgTypes[168]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *PolicyRevisionPayload) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*PolicyRevisionPayload) ProtoMessage() {}

func (x *PolicyRevisionPayload) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[168]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use PolicyRevisionPayload.ProtoReflect.Descriptor instead.
func (*PolicyRevisionPayload) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{168}
}

func (x *PolicyRevisionPayload) GetPolicy() *sandboxv1.SandboxPolicy {
	if x != nil {
		return x.Policy
	}
	return nil
}

func (x *PolicyRevisionPayload) GetHash() string {
	if x != nil {
		return x.Hash
	}
	return ""
}

func (x *PolicyRevisionPayload) GetLoadError() string {
	if x != nil {
		return x.LoadError
	}
	return ""
}

func (x *PolicyRevisionPayload) GetLoadedAtMs() int64 {
	if x != nil {
		return x.LoadedAtMs
	}
	return 0
}

func (x *PolicyRevisionPayload) GetProvenance() map[string]string {
	if x != nil {
		return x.Provenance
	}
	return nil
}

// Stored payload for a draft policy chunk row in the generic objects table.
type DraftChunkPayload struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Proposed network_policies map key.
	RuleName string `protobuf:"bytes,1,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	// Proposed network policy rule.
	ProposedRule *sandboxv1.NetworkPolicyRule `protobuf:"bytes,2,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	// Human-readable explanation of why this rule is proposed.
	Rationale string `protobuf:"bytes,3,opt,name=rationale,proto3" json:"rationale,omitempty"`
	// Security concerns flagged by analysis (empty if none).
	SecurityNotes string `protobuf:"bytes,4,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"`
	// Analysis confidence (0.0-1.0). 0 for mechanistic mode.
	Confidence float32 `protobuf:"fixed32,5,opt,name=confidence,proto3" json:"confidence,omitempty"`
	// When the user approved/rejected (ms since epoch). 0 if undecided.
	DecidedAtMs int64 `protobuf:"varint,6,opt,name=decided_at_ms,json=decidedAtMs,proto3" json:"decided_at_ms,omitempty"`
	// Denormalized endpoint host for dedup and display.
	Host string `protobuf:"bytes,7,opt,name=host,proto3" json:"host,omitempty"`
	// Denormalized endpoint port for dedup and display.
	Port int32 `protobuf:"varint,8,opt,name=port,proto3" json:"port,omitempty"`
	// Binary path that triggered the denial.
	Binary string `protobuf:"bytes,9,opt,name=binary,proto3" json:"binary,omitempty"`
	// Current draft version for the owning sandbox.
	DraftVersion int64 `protobuf:"varint,10,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	// Gateway prover verdict for this chunk; empty until prover runs.
	// Mirrors PolicyChunk.validation_result.
	ValidationResult string `protobuf:"bytes,11,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"`
	// Operator-supplied free-form rejection text; empty for non-rejected
	// chunks. Mirrors PolicyChunk.rejection_reason.
	RejectionReason string `protobuf:"bytes,12,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *DraftChunkPayload) Reset() {
	*x = DraftChunkPayload{}
	mi := &file_openshell_proto_msgTypes[169]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DraftChunkPayload) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DraftChunkPayload) ProtoMessage() {}

func (x *DraftChunkPayload) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[169]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DraftChunkPayload.ProtoReflect.Descriptor instead.
func (*DraftChunkPayload) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{169}
}

func (x *DraftChunkPayload) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *DraftChunkPayload) GetProposedRule() *sandboxv1.NetworkPolicyRule {
	if x != nil {
		return x.ProposedRule
	}
	return nil
}

func (x *DraftChunkPayload) GetRationale() string {
	if x != nil {
		return x.Rationale
	}
	return ""
}

func (x *DraftChunkPayload) GetSecurityNotes() string {
	if x != nil {
		return x.SecurityNotes
	}
	return ""
}

func (x *DraftChunkPayload) GetConfidence() float32 {
	if x != nil {
		return x.Confidence
	}
	return 0
}

func (x *DraftChunkPayload) GetDecidedAtMs() int64 {
	if x != nil {
		return x.DecidedAtMs
	}
	return 0
}

func (x *DraftChunkPayload) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *DraftChunkPayload) GetPort() int32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *DraftChunkPayload) GetBinary() string {
	if x != nil {
		return x.Binary
	}
	return ""
}

func (x *DraftChunkPayload) GetDraftVersion() int64 {
	if x != nil {
		return x.DraftVersion
	}
	return 0
}

func (x *DraftChunkPayload) GetValidationResult() string {
	if x != nil {
		return x.ValidationResult
	}
	return ""
}

func (x *DraftChunkPayload) GetRejectionReason() string {
	if x != nil {
		return x.RejectionReason
	}
	return ""
}

// Internal stored policy revision row materialized from the generic objects table.
type StoredPolicyRevision struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	SandboxId     string                 `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	Version       int64                  `protobuf:"varint,3,opt,name=version,proto3" json:"version,omitempty"`
	PolicyPayload []byte                 `protobuf:"bytes,4,opt,name=policy_payload,json=policyPayload,proto3" json:"policy_payload,omitempty"`
	PolicyHash    string                 `protobuf:"bytes,5,opt,name=policy_hash,json=policyHash,proto3" json:"policy_hash,omitempty"`
	Status        string                 `protobuf:"bytes,6,opt,name=status,proto3" json:"status,omitempty"`
	LoadError     *string                `protobuf:"bytes,7,opt,name=load_error,json=loadError,proto3,oneof" json:"load_error,omitempty"`
	CreatedAtMs   int64                  `protobuf:"varint,8,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"`
	LoadedAtMs    *int64                 `protobuf:"varint,9,opt,name=loaded_at_ms,json=loadedAtMs,proto3,oneof" json:"loaded_at_ms,omitempty"`
	Provenance    map[string]string      `protobuf:"bytes,10,rep,name=provenance,proto3" json:"provenance,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *StoredPolicyRevision) Reset() {
	*x = StoredPolicyRevision{}
	mi := &file_openshell_proto_msgTypes[170]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StoredPolicyRevision) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StoredPolicyRevision) ProtoMessage() {}

func (x *StoredPolicyRevision) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[170]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StoredPolicyRevision.ProtoReflect.Descriptor instead.
func (*StoredPolicyRevision) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{170}
}

func (x *StoredPolicyRevision) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *StoredPolicyRevision) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *StoredPolicyRevision) GetVersion() int64 {
	if x != nil {
		return x.Version
	}
	return 0
}

func (x *StoredPolicyRevision) GetPolicyPayload() []byte {
	if x != nil {
		return x.PolicyPayload
	}
	return nil
}

func (x *StoredPolicyRevision) GetPolicyHash() string {
	if x != nil {
		return x.PolicyHash
	}
	return ""
}

func (x *StoredPolicyRevision) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *StoredPolicyRevision) GetLoadError() string {
	if x != nil && x.LoadError != nil {
		return *x.LoadError
	}
	return ""
}

func (x *StoredPolicyRevision) GetCreatedAtMs() int64 {
	if x != nil {
		return x.CreatedAtMs
	}
	return 0
}

func (x *StoredPolicyRevision) GetLoadedAtMs() int64 {
	if x != nil && x.LoadedAtMs != nil {
		return *x.LoadedAtMs
	}
	return 0
}

func (x *StoredPolicyRevision) GetProvenance() map[string]string {
	if x != nil {
		return x.Provenance
	}
	return nil
}

// Internal stored draft chunk row materialized from the generic objects table.
type StoredDraftChunk struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	SandboxId     string                 `protobuf:"bytes,2,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
	DraftVersion  int64                  `protobuf:"varint,3,opt,name=draft_version,json=draftVersion,proto3" json:"draft_version,omitempty"`
	Status        string                 `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
	RuleName      string                 `protobuf:"bytes,5,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	ProposedRule  []byte                 `protobuf:"bytes,6,opt,name=proposed_rule,json=proposedRule,proto3" json:"proposed_rule,omitempty"`
	Rationale     string                 `protobuf:"bytes,7,opt,name=rationale,proto3" json:"rationale,omitempty"`
	SecurityNotes string                 `protobuf:"bytes,8,opt,name=security_notes,json=securityNotes,proto3" json:"security_notes,omitempty"`
	Confidence    float64                `protobuf:"fixed64,9,opt,name=confidence,proto3" json:"confidence,omitempty"`
	CreatedAtMs   int64                  `protobuf:"varint,10,opt,name=created_at_ms,json=createdAtMs,proto3" json:"created_at_ms,omitempty"`
	DecidedAtMs   *int64                 `protobuf:"varint,11,opt,name=decided_at_ms,json=decidedAtMs,proto3,oneof" json:"decided_at_ms,omitempty"`
	Host          string                 `protobuf:"bytes,12,opt,name=host,proto3" json:"host,omitempty"`
	Port          int32                  `protobuf:"varint,13,opt,name=port,proto3" json:"port,omitempty"`
	Binary        string                 `protobuf:"bytes,14,opt,name=binary,proto3" json:"binary,omitempty"`
	HitCount      int32                  `protobuf:"varint,15,opt,name=hit_count,json=hitCount,proto3" json:"hit_count,omitempty"`
	FirstSeenMs   int64                  `protobuf:"varint,16,opt,name=first_seen_ms,json=firstSeenMs,proto3" json:"first_seen_ms,omitempty"`
	LastSeenMs    int64                  `protobuf:"varint,17,opt,name=last_seen_ms,json=lastSeenMs,proto3" json:"last_seen_ms,omitempty"`
	// Gateway prover verdict; empty until the prover runs. See PolicyChunk.
	ValidationResult string `protobuf:"bytes,18,opt,name=validation_result,json=validationResult,proto3" json:"validation_result,omitempty"`
	// Operator-supplied free-form rejection text. See PolicyChunk.
	RejectionReason string `protobuf:"bytes,19,opt,name=rejection_reason,json=rejectionReason,proto3" json:"rejection_reason,omitempty"`
	unknownFields   protoimpl.UnknownFields
	sizeCache       protoimpl.SizeCache
}

func (x *StoredDraftChunk) Reset() {
	*x = StoredDraftChunk{}
	mi := &file_openshell_proto_msgTypes[171]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *StoredDraftChunk) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*StoredDraftChunk) ProtoMessage() {}

func (x *StoredDraftChunk) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[171]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use StoredDraftChunk.ProtoReflect.Descriptor instead.
func (*StoredDraftChunk) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{171}
}

func (x *StoredDraftChunk) GetId() string {
	if x != nil {
		return x.Id
	}
	return ""
}

func (x *StoredDraftChunk) GetSandboxId() string {
	if x != nil {
		return x.SandboxId
	}
	return ""
}

func (x *StoredDraftChunk) GetDraftVersion() int64 {
	if x != nil {
		return x.DraftVersion
	}
	return 0
}

func (x *StoredDraftChunk) GetStatus() string {
	if x != nil {
		return x.Status
	}
	return ""
}

func (x *StoredDraftChunk) GetRuleName() string {
	if x != nil {
		return x.RuleName
	}
	return ""
}

func (x *StoredDraftChunk) GetProposedRule() []byte {
	if x != nil {
		return x.ProposedRule
	}
	return nil
}

func (x *StoredDraftChunk) GetRationale() string {
	if x != nil {
		return x.Rationale
	}
	return ""
}

func (x *StoredDraftChunk) GetSecurityNotes() string {
	if x != nil {
		return x.SecurityNotes
	}
	return ""
}

func (x *StoredDraftChunk) GetConfidence() float64 {
	if x != nil {
		return x.Confidence
	}
	return 0
}

func (x *StoredDraftChunk) GetCreatedAtMs() int64 {
	if x != nil {
		return x.CreatedAtMs
	}
	return 0
}

func (x *StoredDraftChunk) GetDecidedAtMs() int64 {
	if x != nil && x.DecidedAtMs != nil {
		return *x.DecidedAtMs
	}
	return 0
}

func (x *StoredDraftChunk) GetHost() string {
	if x != nil {
		return x.Host
	}
	return ""
}

func (x *StoredDraftChunk) GetPort() int32 {
	if x != nil {
		return x.Port
	}
	return 0
}

func (x *StoredDraftChunk) GetBinary() string {
	if x != nil {
		return x.Binary
	}
	return ""
}

func (x *StoredDraftChunk) GetHitCount() int32 {
	if x != nil {
		return x.HitCount
	}
	return 0
}

func (x *StoredDraftChunk) GetFirstSeenMs() int64 {
	if x != nil {
		return x.FirstSeenMs
	}
	return 0
}

func (x *StoredDraftChunk) GetLastSeenMs() int64 {
	if x != nil {
		return x.LastSeenMs
	}
	return 0
}

func (x *StoredDraftChunk) GetValidationResult() string {
	if x != nil {
		return x.ValidationResult
	}
	return ""
}

func (x *StoredDraftChunk) GetRejectionReason() string {
	if x != nil {
		return x.RejectionReason
	}
	return ""
}

// Create workspace request.
type CreateWorkspaceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name. Must be a valid DNS-1123 label.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Optional labels for the workspace (key-value metadata).
	Labels        map[string]string `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateWorkspaceRequest) Reset() {
	*x = CreateWorkspaceRequest{}
	mi := &file_openshell_proto_msgTypes[172]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateWorkspaceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateWorkspaceRequest) ProtoMessage() {}

func (x *CreateWorkspaceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[172]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateWorkspaceRequest.ProtoReflect.Descriptor instead.
func (*CreateWorkspaceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{172}
}

func (x *CreateWorkspaceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

func (x *CreateWorkspaceRequest) GetLabels() map[string]string {
	if x != nil {
		return x.Labels
	}
	return nil
}

// Create workspace response.
type CreateWorkspaceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Workspace     *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *CreateWorkspaceResponse) Reset() {
	*x = CreateWorkspaceResponse{}
	mi := &file_openshell_proto_msgTypes[173]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *CreateWorkspaceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*CreateWorkspaceResponse) ProtoMessage() {}

func (x *CreateWorkspaceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[173]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use CreateWorkspaceResponse.ProtoReflect.Descriptor instead.
func (*CreateWorkspaceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{173}
}

func (x *CreateWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace {
	if x != nil {
		return x.Workspace
	}
	return nil
}

// Get workspace request.
type GetWorkspaceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name (canonical lookup key).
	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetWorkspaceRequest) Reset() {
	*x = GetWorkspaceRequest{}
	mi := &file_openshell_proto_msgTypes[174]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetWorkspaceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetWorkspaceRequest) ProtoMessage() {}

func (x *GetWorkspaceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[174]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetWorkspaceRequest.ProtoReflect.Descriptor instead.
func (*GetWorkspaceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{174}
}

func (x *GetWorkspaceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

// Get workspace response.
type GetWorkspaceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Workspace     *datamodelv1.Workspace `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *GetWorkspaceResponse) Reset() {
	*x = GetWorkspaceResponse{}
	mi := &file_openshell_proto_msgTypes[175]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *GetWorkspaceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*GetWorkspaceResponse) ProtoMessage() {}

func (x *GetWorkspaceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[175]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use GetWorkspaceResponse.ProtoReflect.Descriptor instead.
func (*GetWorkspaceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{175}
}

func (x *GetWorkspaceResponse) GetWorkspace() *datamodelv1.Workspace {
	if x != nil {
		return x.Workspace
	}
	return nil
}

// List workspaces request.
type ListWorkspacesRequest struct {
	state  protoimpl.MessageState `protogen:"open.v1"`
	Limit  uint32                 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
	Offset uint32                 `protobuf:"varint,2,opt,name=offset,proto3" json:"offset,omitempty"`
	// Optional label selector for filtering (format: "key1=value1,key2=value2").
	LabelSelector string `protobuf:"bytes,3,opt,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspacesRequest) Reset() {
	*x = ListWorkspacesRequest{}
	mi := &file_openshell_proto_msgTypes[176]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspacesRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspacesRequest) ProtoMessage() {}

func (x *ListWorkspacesRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[176]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspacesRequest.ProtoReflect.Descriptor instead.
func (*ListWorkspacesRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{176}
}

func (x *ListWorkspacesRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListWorkspacesRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

func (x *ListWorkspacesRequest) GetLabelSelector() string {
	if x != nil {
		return x.LabelSelector
	}
	return ""
}

// List workspaces response.
type ListWorkspacesResponse struct {
	state         protoimpl.MessageState   `protogen:"open.v1"`
	Workspaces    []*datamodelv1.Workspace `protobuf:"bytes,1,rep,name=workspaces,proto3" json:"workspaces,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspacesResponse) Reset() {
	*x = ListWorkspacesResponse{}
	mi := &file_openshell_proto_msgTypes[177]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspacesResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspacesResponse) ProtoMessage() {}

func (x *ListWorkspacesResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[177]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspacesResponse.ProtoReflect.Descriptor instead.
func (*ListWorkspacesResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{177}
}

func (x *ListWorkspacesResponse) GetWorkspaces() []*datamodelv1.Workspace {
	if x != nil {
		return x.Workspaces
	}
	return nil
}

// Delete workspace request.
type DeleteWorkspaceRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name (canonical lookup key).
	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteWorkspaceRequest) Reset() {
	*x = DeleteWorkspaceRequest{}
	mi := &file_openshell_proto_msgTypes[178]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteWorkspaceRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteWorkspaceRequest) ProtoMessage() {}

func (x *DeleteWorkspaceRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[178]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteWorkspaceRequest.ProtoReflect.Descriptor instead.
func (*DeleteWorkspaceRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{178}
}

func (x *DeleteWorkspaceRequest) GetName() string {
	if x != nil {
		return x.Name
	}
	return ""
}

// Delete workspace response.
type DeleteWorkspaceResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Deleted       bool                   `protobuf:"varint,1,opt,name=deleted,proto3" json:"deleted,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *DeleteWorkspaceResponse) Reset() {
	*x = DeleteWorkspaceResponse{}
	mi := &file_openshell_proto_msgTypes[179]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *DeleteWorkspaceResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*DeleteWorkspaceResponse) ProtoMessage() {}

func (x *DeleteWorkspaceResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[179]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use DeleteWorkspaceResponse.ProtoReflect.Descriptor instead.
func (*DeleteWorkspaceResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{179}
}

func (x *DeleteWorkspaceResponse) GetDeleted() bool {
	if x != nil {
		return x.Deleted
	}
	return false
}

// Workspace membership record.
type WorkspaceMember struct {
	state    protoimpl.MessageState  `protogen:"open.v1"`
	Metadata *datamodelv1.ObjectMeta `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// OIDC subject claim identifying the principal.
	PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	// Role assigned to the principal within the workspace.
	Role          WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *WorkspaceMember) Reset() {
	*x = WorkspaceMember{}
	mi := &file_openshell_proto_msgTypes[180]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *WorkspaceMember) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*WorkspaceMember) ProtoMessage() {}

func (x *WorkspaceMember) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[180]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use WorkspaceMember.ProtoReflect.Descriptor instead.
func (*WorkspaceMember) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{180}
}

func (x *WorkspaceMember) GetMetadata() *datamodelv1.ObjectMeta {
	if x != nil {
		return x.Metadata
	}
	return nil
}

func (x *WorkspaceMember) GetPrincipalSubject() string {
	if x != nil {
		return x.PrincipalSubject
	}
	return ""
}

func (x *WorkspaceMember) GetRole() WorkspaceRole {
	if x != nil {
		return x.Role
	}
	return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED
}

// Add workspace member request.
type AddWorkspaceMemberRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name.
	Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// OIDC subject claim identifying the principal.
	PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	// Role to assign.
	Role          WorkspaceRole `protobuf:"varint,3,opt,name=role,proto3,enum=openshell.v1.WorkspaceRole" json:"role,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddWorkspaceMemberRequest) Reset() {
	*x = AddWorkspaceMemberRequest{}
	mi := &file_openshell_proto_msgTypes[181]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddWorkspaceMemberRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddWorkspaceMemberRequest) ProtoMessage() {}

func (x *AddWorkspaceMemberRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[181]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddWorkspaceMemberRequest.ProtoReflect.Descriptor instead.
func (*AddWorkspaceMemberRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{181}
}

func (x *AddWorkspaceMemberRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *AddWorkspaceMemberRequest) GetPrincipalSubject() string {
	if x != nil {
		return x.PrincipalSubject
	}
	return ""
}

func (x *AddWorkspaceMemberRequest) GetRole() WorkspaceRole {
	if x != nil {
		return x.Role
	}
	return WorkspaceRole_WORKSPACE_ROLE_UNSPECIFIED
}

// Add workspace member response.
type AddWorkspaceMemberResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Member        *WorkspaceMember       `protobuf:"bytes,1,opt,name=member,proto3" json:"member,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *AddWorkspaceMemberResponse) Reset() {
	*x = AddWorkspaceMemberResponse{}
	mi := &file_openshell_proto_msgTypes[182]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *AddWorkspaceMemberResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*AddWorkspaceMemberResponse) ProtoMessage() {}

func (x *AddWorkspaceMemberResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[182]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use AddWorkspaceMemberResponse.ProtoReflect.Descriptor instead.
func (*AddWorkspaceMemberResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{182}
}

func (x *AddWorkspaceMemberResponse) GetMember() *WorkspaceMember {
	if x != nil {
		return x.Member
	}
	return nil
}

// Remove workspace member request.
type RemoveWorkspaceMemberRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name.
	Workspace string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	// OIDC subject claim identifying the principal to remove.
	PrincipalSubject string `protobuf:"bytes,2,opt,name=principal_subject,json=principalSubject,proto3" json:"principal_subject,omitempty"`
	unknownFields    protoimpl.UnknownFields
	sizeCache        protoimpl.SizeCache
}

func (x *RemoveWorkspaceMemberRequest) Reset() {
	*x = RemoveWorkspaceMemberRequest{}
	mi := &file_openshell_proto_msgTypes[183]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveWorkspaceMemberRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveWorkspaceMemberRequest) ProtoMessage() {}

func (x *RemoveWorkspaceMemberRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[183]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveWorkspaceMemberRequest.ProtoReflect.Descriptor instead.
func (*RemoveWorkspaceMemberRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{183}
}

func (x *RemoveWorkspaceMemberRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *RemoveWorkspaceMemberRequest) GetPrincipalSubject() string {
	if x != nil {
		return x.PrincipalSubject
	}
	return ""
}

// Remove workspace member response.
type RemoveWorkspaceMemberResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Removed       bool                   `protobuf:"varint,1,opt,name=removed,proto3" json:"removed,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *RemoveWorkspaceMemberResponse) Reset() {
	*x = RemoveWorkspaceMemberResponse{}
	mi := &file_openshell_proto_msgTypes[184]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *RemoveWorkspaceMemberResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*RemoveWorkspaceMemberResponse) ProtoMessage() {}

func (x *RemoveWorkspaceMemberResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[184]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use RemoveWorkspaceMemberResponse.ProtoReflect.Descriptor instead.
func (*RemoveWorkspaceMemberResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{184}
}

func (x *RemoveWorkspaceMemberResponse) GetRemoved() bool {
	if x != nil {
		return x.Removed
	}
	return false
}

// List workspace members request.
type ListWorkspaceMembersRequest struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Workspace name.
	Workspace     string `protobuf:"bytes,1,opt,name=workspace,proto3" json:"workspace,omitempty"`
	Limit         uint32 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
	Offset        uint32 `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspaceMembersRequest) Reset() {
	*x = ListWorkspaceMembersRequest{}
	mi := &file_openshell_proto_msgTypes[185]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspaceMembersRequest) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspaceMembersRequest) ProtoMessage() {}

func (x *ListWorkspaceMembersRequest) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[185]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspaceMembersRequest.ProtoReflect.Descriptor instead.
func (*ListWorkspaceMembersRequest) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{185}
}

func (x *ListWorkspaceMembersRequest) GetWorkspace() string {
	if x != nil {
		return x.Workspace
	}
	return ""
}

func (x *ListWorkspaceMembersRequest) GetLimit() uint32 {
	if x != nil {
		return x.Limit
	}
	return 0
}

func (x *ListWorkspaceMembersRequest) GetOffset() uint32 {
	if x != nil {
		return x.Offset
	}
	return 0
}

// List workspace members response.
type ListWorkspaceMembersResponse struct {
	state         protoimpl.MessageState `protogen:"open.v1"`
	Members       []*WorkspaceMember     `protobuf:"bytes,1,rep,name=members,proto3" json:"members,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ListWorkspaceMembersResponse) Reset() {
	*x = ListWorkspaceMembersResponse{}
	mi := &file_openshell_proto_msgTypes[186]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ListWorkspaceMembersResponse) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ListWorkspaceMembersResponse) ProtoMessage() {}

func (x *ListWorkspaceMembersResponse) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[186]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ListWorkspaceMembersResponse.ProtoReflect.Descriptor instead.
func (*ListWorkspaceMembersResponse) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{186}
}

func (x *ListWorkspaceMembersResponse) GetMembers() []*WorkspaceMember {
	if x != nil {
		return x.Members
	}
	return nil
}

// Short-lived credential for one policy-authorized extension service.
// Kept at the end of the file so adding it does not renumber existing
// generated message descriptors.
type ExtensionServiceCredential struct {
	state protoimpl.MessageState `protogen:"open.v1"`
	// Operator registration name used to correlate the credential with the
	// stable service registration delivered by GetSandboxConfig.
	ServiceName string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
	// Gateway-minted JWT with an audience derived from the registration.
	Token string `protobuf:"bytes,2,opt,name=token,proto3" json:"token,omitempty"`
	// Absolute expiry of the token, milliseconds since the epoch.
	ExpiresAtMs   int64 `protobuf:"varint,3,opt,name=expires_at_ms,json=expiresAtMs,proto3" json:"expires_at_ms,omitempty"`
	unknownFields protoimpl.UnknownFields
	sizeCache     protoimpl.SizeCache
}

func (x *ExtensionServiceCredential) Reset() {
	*x = ExtensionServiceCredential{}
	mi := &file_openshell_proto_msgTypes[187]
	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
	ms.StoreMessageInfo(mi)
}

func (x *ExtensionServiceCredential) String() string {
	return protoimpl.X.MessageStringOf(x)
}

func (*ExtensionServiceCredential) ProtoMessage() {}

func (x *ExtensionServiceCredential) ProtoReflect() protoreflect.Message {
	mi := &file_openshell_proto_msgTypes[187]
	if x != nil {
		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
		if ms.LoadMessageInfo() == nil {
			ms.StoreMessageInfo(mi)
		}
		return ms
	}
	return mi.MessageOf(x)
}

// Deprecated: Use ExtensionServiceCredential.ProtoReflect.Descriptor instead.
func (*ExtensionServiceCredential) Descriptor() ([]byte, []int) {
	return file_openshell_proto_rawDescGZIP(), []int{187}
}

func (x *ExtensionServiceCredential) GetServiceName() string {
	if x != nil {
		return x.ServiceName
	}
	return ""
}

func (x *ExtensionServiceCredential) GetToken() string {
	if x != nil {
		return x.Token
	}
	return ""
}

func (x *ExtensionServiceCredential) GetExpiresAtMs() int64 {
	if x != nil {
		return x.ExpiresAtMs
	}
	return 0
}

var File_openshell_proto protoreflect.FileDescriptor

const file_openshell_proto_rawDesc = "" +
	"\n" +
	"\x0fopenshell.proto\x12\fopenshell.v1\x1a\x0fdatamodel.proto\x1a\x1cgoogle/protobuf/struct.proto\x1a\roptions.proto\x1a\rsandbox.proto\"\x1a\n" +
	"\x18IssueSandboxTokenRequest\"[\n" +
	"\x19IssueSandboxTokenResponse\x12\x1a\n" +
	"\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" +
	"\rexpires_at_ms\x18\x02 \x01(\x03R\vexpiresAtMs\"T\n" +
	"\x1aRefreshSandboxTokenRequest\x126\n" +
	"\x17extension_service_names\x18\x01 \x03(\tR\x15extensionServiceNames\"\xbc\x01\n" +
	"\x1bRefreshSandboxTokenResponse\x12\x1a\n" +
	"\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" +
	"\rexpires_at_ms\x18\x02 \x01(\x03R\vexpiresAtMs\x12]\n" +
	"\x15extension_credentials\x18\x03 \x03(\v2(.openshell.v1.ExtensionServiceCredentialR\x14extensionCredentials\"\x0f\n" +
	"\rHealthRequest\"_\n" +
	"\x0eHealthResponse\x123\n" +
	"\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12\x18\n" +
	"\aversion\x18\x02 \x01(\tR\aversion\"\x17\n" +
	"\x15GetCurrentUserRequest\"\xb0\x01\n" +
	"\x16GetCurrentUserResponse\x12\x18\n" +
	"\asubject\x18\x01 \x01(\tR\asubject\x12!\n" +
	"\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12\x14\n" +
	"\x05roles\x18\x03 \x03(\tR\x05roles\x12\x16\n" +
	"\x06scopes\x18\x04 \x03(\tR\x06scopes\x12+\n" +
	"\x11identity_provider\x18\x05 \x01(\tR\x10identityProvider\"\x17\n" +
	"\x15GetGatewayInfoRequest\"\xc0\x01\n" +
	"\x16GetGatewayInfoResponse\x123\n" +
	"\x06status\x18\x01 \x01(\x0e2\x1b.openshell.v1.ServiceStatusR\x06status\x12'\n" +
	"\x0fgateway_version\x18\x02 \x01(\tR\x0egatewayVersion\x12H\n" +
	"\x0fcompute_drivers\x18\x03 \x03(\v2\x1f.openshell.v1.ComputeDriverInfoR\x0ecomputeDrivers\"t\n" +
	"\x11ComputeDriverInfo\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12K\n" +
	"\fcapabilities\x18\x02 \x01(\v2'.openshell.v1.ComputeDriverCapabilitiesR\fcapabilities\"c\n" +
	"\x19ComputeDriverCapabilities\x12\x1f\n" +
	"\vdriver_name\x18\x01 \x01(\tR\n" +
	"driverName\x12%\n" +
	"\x0edriver_version\x18\x02 \x01(\tR\rdriverVersion\"\xd8\x01\n" +
	"\aSandbox\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12-\n" +
	"\x04spec\x18\x02 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x123\n" +
	"\x06status\x18\x03 \x01(\v2\x1b.openshell.v1.SandboxStatusR\x06statusJ\x04\b\x04\x10\x05J\x04\b\x05\x10\x06R\x05phaseR\x16current_policy_version\"\x83\x04\n" +
	"\vSandboxSpec\x12\x1b\n" +
	"\tlog_level\x18\x01 \x01(\tR\blogLevel\x12L\n" +
	"\venvironment\x18\x05 \x03(\v2*.openshell.v1.SandboxSpec.EnvironmentEntryR\venvironment\x129\n" +
	"\btemplate\x18\x06 \x01(\v2\x1d.openshell.v1.SandboxTemplateR\btemplate\x12;\n" +
	"\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1c\n" +
	"\tproviders\x18\b \x03(\tR\tproviders\x12W\n" +
	"\x15resource_requirements\x18\t \x01(\v2\".openshell.v1.ResourceRequirementsR\x14resourceRequirements\x12\x18\n" +
	"\acommand\x18\f \x03(\tR\acommand\x12\x10\n" +
	"\x03tty\x18\r \x01(\bR\x03tty\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01J\x04\b\n" +
	"\x10\vJ\x04\b\v\x10\fR\n" +
	"gpu_deviceR\x16proposal_approval_mode\"O\n" +
	"\x14ResourceRequirements\x127\n" +
	"\x03gpu\x18\x01 \x01(\v2%.openshell.v1.GpuResourceRequirementsR\x03gpu\">\n" +
	"\x17GpuResourceRequirements\x12\x19\n" +
	"\x05count\x18\x01 \x01(\rH\x00R\x05count\x88\x01\x01B\b\n" +
	"\x06_count\"\xef\x05\n" +
	"\x0fSandboxTemplate\x12\x14\n" +
	"\x05image\x18\x01 \x01(\tR\x05image\x12,\n" +
	"\x12runtime_class_name\x18\x02 \x01(\tR\x10runtimeClassName\x12!\n" +
	"\fagent_socket\x18\x03 \x01(\tR\vagentSocket\x12A\n" +
	"\x06labels\x18\x04 \x03(\v2).openshell.v1.SandboxTemplate.LabelsEntryR\x06labels\x12P\n" +
	"\vannotations\x18\x05 \x03(\v2..openshell.v1.SandboxTemplate.AnnotationsEntryR\vannotations\x12P\n" +
	"\venvironment\x18\x06 \x03(\v2..openshell.v1.SandboxTemplate.EnvironmentEntryR\venvironment\x125\n" +
	"\tresources\x18\a \x01(\v2\x17.google.protobuf.StructR\tresources\x12,\n" +
	"\x0fuser_namespaces\x18\n" +
	" \x01(\bH\x00R\x0euserNamespaces\x88\x01\x01\x12<\n" +
	"\rdriver_config\x18\v \x01(\v2\x17.google.protobuf.StructR\fdriverConfig\x1a9\n" +
	"\vLabelsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x12\n" +
	"\x10_user_namespacesJ\x04\b\t\x10\n" +
	"R\x16volume_claim_templates\"\x9a\x03\n" +
	"\rSandboxStatus\x12!\n" +
	"\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12\x1b\n" +
	"\tagent_pod\x18\x02 \x01(\tR\bagentPod\x12\x19\n" +
	"\bagent_fd\x18\x03 \x01(\tR\aagentFd\x12\x1d\n" +
	"\n" +
	"sandbox_fd\x18\x04 \x01(\tR\tsandboxFd\x12>\n" +
	"\n" +
	"conditions\x18\x05 \x03(\v2\x1e.openshell.v1.SandboxConditionR\n" +
	"conditions\x120\n" +
	"\x05phase\x18\x06 \x01(\x0e2\x1a.openshell.v1.SandboxPhaseR\x05phase\x124\n" +
	"\x16current_policy_version\x18\a \x01(\rR\x14currentPolicyVersion\x127\n" +
	"\x18main_process_instance_id\x18\b \x01(\tR\x15mainProcessInstanceId\x12 \n" +
	"\texit_code\x18\t \x01(\x05H\x00R\bexitCode\x88\x01\x01B\f\n" +
	"\n" +
	"_exit_code\"\xa2\x01\n" +
	"\x10SandboxCondition\x12\x12\n" +
	"\x04type\x18\x01 \x01(\tR\x04type\x12\x16\n" +
	"\x06status\x18\x02 \x01(\tR\x06status\x12\x16\n" +
	"\x06reason\x18\x03 \x01(\tR\x06reason\x12\x18\n" +
	"\amessage\x18\x04 \x01(\tR\amessage\x120\n" +
	"\x14last_transition_time\x18\x05 \x01(\tR\x12lastTransitionTime\"\x94\x02\n" +
	"\rPlatformEvent\x12!\n" +
	"\ftimestamp_ms\x18\x01 \x01(\x03R\vtimestampMs\x12\x16\n" +
	"\x06source\x18\x02 \x01(\tR\x06source\x12\x12\n" +
	"\x04type\x18\x03 \x01(\tR\x04type\x12\x16\n" +
	"\x06reason\x18\x04 \x01(\tR\x06reason\x12\x18\n" +
	"\amessage\x18\x05 \x01(\tR\amessage\x12E\n" +
	"\bmetadata\x18\x06 \x03(\v2).openshell.v1.PlatformEvent.MetadataEntryR\bmetadata\x1a;\n" +
	"\rMetadataEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x91\x03\n" +
	"\x14CreateSandboxRequest\x12-\n" +
	"\x04spec\x18\x01 \x01(\v2\x19.openshell.v1.SandboxSpecR\x04spec\x12\x12\n" +
	"\x04name\x18\x02 \x01(\tR\x04name\x12F\n" +
	"\x06labels\x18\x03 \x03(\v2..openshell.v1.CreateSandboxRequest.LabelsEntryR\x06labels\x12U\n" +
	"\vannotations\x18\x04 \x03(\v23.openshell.v1.CreateSandboxRequest.AnnotationsEntryR\vannotations\x12\x1c\n" +
	"\tworkspace\x18\x05 \x01(\tR\tworkspace\x1a9\n" +
	"\vLabelsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"E\n" +
	"\x11GetSandboxRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xb0\x01\n" +
	"\x14ListSandboxesRequest\x12\x14\n" +
	"\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x02 \x01(\rR\x06offset\x12%\n" +
	"\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\x12%\n" +
	"\x0eall_workspaces\x18\x05 \x01(\bR\rallWorkspaces\"^\n" +
	"\x1bListSandboxProvidersRequest\x12!\n" +
	"\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xc0\x01\n" +
	"\x1cAttachSandboxProviderRequest\x12!\n" +
	"\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12#\n" +
	"\rprovider_name\x18\x02 \x01(\tR\fproviderName\x12:\n" +
	"\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\"\xc0\x01\n" +
	"\x1cDetachSandboxProviderRequest\x12!\n" +
	"\fsandbox_name\x18\x01 \x01(\tR\vsandboxName\x12#\n" +
	"\rprovider_name\x18\x02 \x01(\tR\fproviderName\x12:\n" +
	"\x19expected_resource_version\x18\x03 \x01(\x04R\x17expectedResourceVersion\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\"H\n" +
	"\x14DeleteSandboxRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"F\n" +
	"\x12StopSandboxRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"G\n" +
	"\x13StartSandboxRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"B\n" +
	"\x0fSandboxResponse\x12/\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\"L\n" +
	"\x15ListSandboxesResponse\x123\n" +
	"\tsandboxes\x18\x01 \x03(\v2\x15.openshell.v1.SandboxR\tsandboxes\"^\n" +
	"\x1cListSandboxProvidersResponse\x12>\n" +
	"\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"l\n" +
	"\x1dAttachSandboxProviderResponse\x12/\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" +
	"\battached\x18\x02 \x01(\bR\battached\"l\n" +
	"\x1dDetachSandboxProviderResponse\x12/\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxR\asandbox\x12\x1a\n" +
	"\bdetached\x18\x02 \x01(\bR\bdetached\"1\n" +
	"\x15DeleteSandboxResponse\x12\x18\n" +
	"\adeleted\x18\x01 \x01(\bR\adeleted\"8\n" +
	"\x17CreateSshSessionRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x98\x02\n" +
	"\x18CreateSshSessionResponse\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1a\n" +
	"\x05token\x18\x02 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12!\n" +
	"\fgateway_host\x18\x03 \x01(\tR\vgatewayHost\x12!\n" +
	"\fgateway_port\x18\x04 \x01(\rR\vgatewayPort\x12%\n" +
	"\x0egateway_scheme\x18\x05 \x01(\tR\rgatewayScheme\x120\n" +
	"\x14host_key_fingerprint\x18\a \x01(\tR\x12hostKeyFingerprint\x12\"\n" +
	"\rexpires_at_ms\x18\b \x01(\x03R\vexpiresAtMs\"\xa1\x01\n" +
	"\x14ExposeServiceRequest\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" +
	"\aservice\x18\x02 \x01(\tR\aservice\x12\x1f\n" +
	"\vtarget_port\x18\x03 \x01(\rR\n" +
	"targetPort\x12\x16\n" +
	"\x06domain\x18\x04 \x01(\bR\x06domain\x12\x1c\n" +
	"\tworkspace\x18\x05 \x01(\tR\tworkspace\"e\n" +
	"\x11GetServiceRequest\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" +
	"\aservice\x18\x02 \x01(\tR\aservice\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xa2\x01\n" +
	"\x13ListServicesRequest\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x14\n" +
	"\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x03 \x01(\rR\x06offset\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\x12%\n" +
	"\x0eall_workspaces\x18\x05 \x01(\bR\rallWorkspaces\"Y\n" +
	"\x14ListServicesResponse\x12A\n" +
	"\bservices\x18\x01 \x03(\v2%.openshell.v1.ServiceEndpointResponseR\bservices\"h\n" +
	"\x14DeleteServiceRequest\x12\x18\n" +
	"\asandbox\x18\x01 \x01(\tR\asandbox\x12\x18\n" +
	"\aservice\x18\x02 \x01(\tR\aservice\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"1\n" +
	"\x15DeleteServiceResponse\x12\x18\n" +
	"\adeleted\x18\x01 \x01(\bR\adeleted\"\xef\x01\n" +
	"\x0fServiceEndpoint\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12!\n" +
	"\fsandbox_name\x18\x03 \x01(\tR\vsandboxName\x12!\n" +
	"\fservice_name\x18\x04 \x01(\tR\vserviceName\x12\x1f\n" +
	"\vtarget_port\x18\x05 \x01(\rR\n" +
	"targetPort\x12\x16\n" +
	"\x06domain\x18\x06 \x01(\bR\x06domain\"f\n" +
	"\x17ServiceEndpointResponse\x129\n" +
	"\bendpoint\x18\x01 \x01(\v2\x1d.openshell.v1.ServiceEndpointR\bendpoint\x12\x10\n" +
	"\x03url\x18\x02 \x01(\tR\x03url\"5\n" +
	"\x17RevokeSshSessionRequest\x12\x1a\n" +
	"\x05token\x18\x01 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\"4\n" +
	"\x18RevokeSshSessionResponse\x12\x18\n" +
	"\arevoked\x18\x01 \x01(\bR\arevoked\"\xf5\x02\n" +
	"\x12ExecSandboxRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" +
	"\acommand\x18\x02 \x03(\tR\acommand\x12\x18\n" +
	"\aworkdir\x18\x03 \x01(\tR\aworkdir\x12S\n" +
	"\venvironment\x18\x04 \x03(\v21.openshell.v1.ExecSandboxRequest.EnvironmentEntryR\venvironment\x12'\n" +
	"\x0ftimeout_seconds\x18\x05 \x01(\rR\x0etimeoutSeconds\x12\x14\n" +
	"\x05stdin\x18\x06 \x01(\fR\x05stdin\x12\x10\n" +
	"\x03tty\x18\a \x01(\bR\x03tty\x12\x12\n" +
	"\x04cols\x18\b \x01(\rR\x04cols\x12\x12\n" +
	"\x04rows\x18\t \x01(\rR\x04rows\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"'\n" +
	"\x11ExecSandboxStdout\x12\x12\n" +
	"\x04data\x18\x01 \x01(\fR\x04data\"'\n" +
	"\x11ExecSandboxStderr\x12\x12\n" +
	"\x04data\x18\x01 \x01(\fR\x04data\".\n" +
	"\x0fExecSandboxExit\x12\x1b\n" +
	"\texit_code\x18\x01 \x01(\x05R\bexitCode\"\xc8\x01\n" +
	"\x10ExecSandboxEvent\x129\n" +
	"\x06stdout\x18\x01 \x01(\v2\x1f.openshell.v1.ExecSandboxStdoutH\x00R\x06stdout\x129\n" +
	"\x06stderr\x18\x02 \x01(\v2\x1f.openshell.v1.ExecSandboxStderrH\x00R\x06stderr\x123\n" +
	"\x04exit\x18\x03 \x01(\v2\x1d.openshell.v1.ExecSandboxExitH\x00R\x04exitB\t\n" +
	"\apayload\"\xf3\x01\n" +
	"\x0eTcpForwardInit\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1d\n" +
	"\n" +
	"service_id\x18\x04 \x01(\tR\tserviceId\x120\n" +
	"\x03ssh\x18\x05 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" +
	"\x03tcp\x18\x06 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x125\n" +
	"\x13authorization_token\x18\a \x01(\tB\x04\x88\xb5\x18\x01R\x12authorizationTokenB\b\n" +
	"\x06target\"f\n" +
	"\x0fTcpForwardFrame\x122\n" +
	"\x04init\x18\x01 \x01(\v2\x1c.openshell.v1.TcpForwardInitH\x00R\x04init\x12\x14\n" +
	"\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" +
	"\apayload\"\xb0\x01\n" +
	"\x10ExecSandboxInput\x128\n" +
	"\x05start\x18\x01 \x01(\v2 .openshell.v1.ExecSandboxRequestH\x00R\x05start\x12\x16\n" +
	"\x05stdin\x18\x02 \x01(\fH\x00R\x05stdin\x12?\n" +
	"\x06resize\x18\x03 \x01(\v2%.openshell.v1.ExecSandboxWindowResizeH\x00R\x06resizeB\t\n" +
	"\apayload\"A\n" +
	"\x17ExecSandboxWindowResize\x12\x12\n" +
	"\x04cols\x18\x01 \x01(\rR\x04cols\x12\x12\n" +
	"\x04rows\x18\x02 \x01(\rR\x04rows\"\xc5\x01\n" +
	"\n" +
	"SshSession\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x1a\n" +
	"\x05token\x18\x03 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" +
	"\rexpires_at_ms\x18\x04 \x01(\x03R\vexpiresAtMs\x12\x18\n" +
	"\arevoked\x18\x05 \x01(\bR\arevoked\"\xe6\x02\n" +
	"\x13WatchSandboxRequest\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12#\n" +
	"\rfollow_status\x18\x02 \x01(\bR\ffollowStatus\x12\x1f\n" +
	"\vfollow_logs\x18\x03 \x01(\bR\n" +
	"followLogs\x12#\n" +
	"\rfollow_events\x18\x04 \x01(\bR\ffollowEvents\x12$\n" +
	"\x0elog_tail_lines\x18\x05 \x01(\rR\flogTailLines\x12\x1d\n" +
	"\n" +
	"event_tail\x18\x06 \x01(\rR\teventTail\x12(\n" +
	"\x10stop_on_terminal\x18\a \x01(\bR\x0estopOnTerminal\x12 \n" +
	"\flog_since_ms\x18\b \x01(\x03R\n" +
	"logSinceMs\x12\x1f\n" +
	"\vlog_sources\x18\t \x03(\tR\n" +
	"logSources\x12\"\n" +
	"\rlog_min_level\x18\n" +
	" \x01(\tR\vlogMinLevel\"\xcc\x02\n" +
	"\x12SandboxStreamEvent\x121\n" +
	"\asandbox\x18\x01 \x01(\v2\x15.openshell.v1.SandboxH\x00R\asandbox\x120\n" +
	"\x03log\x18\x02 \x01(\v2\x1c.openshell.v1.SandboxLogLineH\x00R\x03log\x123\n" +
	"\x05event\x18\x03 \x01(\v2\x1b.openshell.v1.PlatformEventH\x00R\x05event\x12>\n" +
	"\awarning\x18\x04 \x01(\v2\".openshell.v1.SandboxStreamWarningH\x00R\awarning\x12Q\n" +
	"\x13draft_policy_update\x18\x05 \x01(\v2\x1f.openshell.v1.DraftPolicyUpdateH\x00R\x11draftPolicyUpdateB\t\n" +
	"\apayload\"\xaf\x02\n" +
	"\x0eSandboxLogLine\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12!\n" +
	"\ftimestamp_ms\x18\x02 \x01(\x03R\vtimestampMs\x12\x14\n" +
	"\x05level\x18\x03 \x01(\tR\x05level\x12\x16\n" +
	"\x06target\x18\x04 \x01(\tR\x06target\x12\x18\n" +
	"\amessage\x18\x05 \x01(\tR\amessage\x12\x16\n" +
	"\x06source\x18\x06 \x01(\tR\x06source\x12@\n" +
	"\x06fields\x18\a \x03(\v2(.openshell.v1.SandboxLogLine.FieldsEntryR\x06fields\x1a9\n" +
	"\vFieldsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"0\n" +
	"\x14SandboxStreamWarning\x12\x18\n" +
	"\amessage\x18\x01 \x01(\tR\amessage\"s\n" +
	"\x15CreateProviderRequest\x12<\n" +
	"\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"F\n" +
	"\x12GetProviderRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x89\x01\n" +
	"\x14ListProvidersRequest\x12\x14\n" +
	"\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x02 \x01(\rR\x06offset\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\x12%\n" +
	"\x0eall_workspaces\x18\x04 \x01(\bR\rallWorkspaces\"\xb6\x02\n" +
	"\x15UpdateProviderRequest\x12<\n" +
	"\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\x12w\n" +
	"\x18credential_expires_at_ms\x18\x02 \x03(\v2>.openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\x1aH\n" +
	"\x1aCredentialExpiresAtMsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01\"I\n" +
	"\x15DeleteProviderRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"P\n" +
	"\x10ProviderResponse\x12<\n" +
	"\bprovider\x18\x01 \x01(\v2 .openshell.datamodel.v1.ProviderR\bprovider\"W\n" +
	"\x15ListProvidersResponse\x12>\n" +
	"\tproviders\x18\x01 \x03(\v2 .openshell.datamodel.v1.ProviderR\tproviders\"i\n" +
	"\x1bListProviderProfilesRequest\x12\x14\n" +
	"\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x02 \x01(\rR\x06offset\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"I\n" +
	"\x19GetProviderProfileRequest\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"l\n" +
	"\x19ProviderProfileImportItem\x127\n" +
	"\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x16\n" +
	"\x06source\x18\x02 \x01(\tR\x06source\"\x9e\x01\n" +
	"\x19ProviderProfileDiagnostic\x12\x16\n" +
	"\x06source\x18\x01 \x01(\tR\x06source\x12\x1d\n" +
	"\n" +
	"profile_id\x18\x02 \x01(\tR\tprofileId\x12\x14\n" +
	"\x05field\x18\x03 \x01(\tR\x05field\x12\x18\n" +
	"\amessage\x18\x04 \x01(\tR\amessage\x12\x1a\n" +
	"\bseverity\x18\x05 \x01(\tR\bseverity\"\x9e\x01\n" +
	",ProviderCredentialTokenGrantAudienceOverride\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" +
	"\x04path\x18\x03 \x01(\tR\x04path\x12\x1a\n" +
	"\baudience\x18\x04 \x01(\tR\baudience\x12\x16\n" +
	"\x06scopes\x18\x05 \x03(\tR\x06scopes\"\xf0\x02\n" +
	"\x1cProviderCredentialTokenGrant\x12%\n" +
	"\x0etoken_endpoint\x18\x01 \x01(\tR\rtokenEndpoint\x12\x1a\n" +
	"\baudience\x18\x02 \x01(\tR\baudience\x12*\n" +
	"\x11jwt_svid_audience\x18\x06 \x01(\tR\x0fjwtSvidAudience\x12\x16\n" +
	"\x06scopes\x18\x03 \x03(\tR\x06scopes\x12*\n" +
	"\x11cache_ttl_seconds\x18\x04 \x01(\x03R\x0fcacheTtlSeconds\x12i\n" +
	"\x12audience_overrides\x18\x05 \x03(\v2:.openshell.v1.ProviderCredentialTokenGrantAudienceOverrideR\x11audienceOverrides\x122\n" +
	"\x15client_assertion_type\x18\a \x01(\tR\x13clientAssertionType\"\x9e\x03\n" +
	"\x19ProviderProfileCredential\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12 \n" +
	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x19\n" +
	"\benv_vars\x18\x03 \x03(\tR\aenvVars\x12\x1a\n" +
	"\brequired\x18\x04 \x01(\bR\brequired\x12\x1d\n" +
	"\n" +
	"auth_style\x18\x05 \x01(\tR\tauthStyle\x12\x1f\n" +
	"\vheader_name\x18\x06 \x01(\tR\n" +
	"headerName\x12\x1f\n" +
	"\vquery_param\x18\a \x01(\tR\n" +
	"queryParam\x12A\n" +
	"\arefresh\x18\b \x01(\v2'.openshell.v1.ProviderCredentialRefreshR\arefresh\x12#\n" +
	"\rpath_template\x18\t \x01(\tR\fpathTemplate\x12K\n" +
	"\vtoken_grant\x18\n" +
	" \x01(\v2*.openshell.v1.ProviderCredentialTokenGrantR\n" +
	"tokenGrant\"\x8d\x01\n" +
	"!ProviderCredentialRefreshMaterial\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12 \n" +
	"\vdescription\x18\x02 \x01(\tR\vdescription\x12\x1a\n" +
	"\brequired\x18\x03 \x01(\bR\brequired\x12\x16\n" +
	"\x06secret\x18\x04 \x01(\bR\x06secret\"Y\n" +
	"\x1fProviderCredentialRefreshOutput\x12\x16\n" +
	"\x06output\x18\x01 \x01(\tR\x06output\x12\x1e\n" +
	"\n" +
	"credential\x18\x02 \x01(\tR\n" +
	"credential\"\xb0\x03\n" +
	"\x19ProviderCredentialRefresh\x12K\n" +
	"\bstrategy\x18\x01 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x1b\n" +
	"\ttoken_url\x18\x02 \x01(\tR\btokenUrl\x12\x16\n" +
	"\x06scopes\x18\x03 \x03(\tR\x06scopes\x124\n" +
	"\x16refresh_before_seconds\x18\x04 \x01(\x03R\x14refreshBeforeSeconds\x120\n" +
	"\x14max_lifetime_seconds\x18\x05 \x01(\x03R\x12maxLifetimeSeconds\x12K\n" +
	"\bmaterial\x18\x06 \x03(\v2/.openshell.v1.ProviderCredentialRefreshMaterialR\bmaterial\x12\\\n" +
	"\x12additional_outputs\x18\a \x03(\v2-.openshell.v1.ProviderCredentialRefreshOutputR\x11additionalOutputs\"\x90\x03\n" +
	"\x1fProviderCredentialRefreshStatus\x12#\n" +
	"\rprovider_name\x18\x01 \x01(\tR\fproviderName\x12\x1f\n" +
	"\vprovider_id\x18\x02 \x01(\tR\n" +
	"providerId\x12%\n" +
	"\x0ecredential_key\x18\x03 \x01(\tR\rcredentialKey\x12K\n" +
	"\bstrategy\x18\x04 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12\x16\n" +
	"\x06status\x18\x05 \x01(\tR\x06status\x12\"\n" +
	"\rexpires_at_ms\x18\x06 \x01(\x03R\vexpiresAtMs\x12+\n" +
	"\x12next_refresh_at_ms\x18\a \x01(\x03R\x0fnextRefreshAtMs\x12+\n" +
	"\x12last_refresh_at_ms\x18\b \x01(\x03R\x0flastRefreshAtMs\x12\x1d\n" +
	"\n" +
	"last_error\x18\t \x01(\tR\tlastError\"<\n" +
	"\x18ProviderProfileDiscovery\x12 \n" +
	"\vcredentials\x18\x01 \x03(\tR\vcredentials\"\xa7\v\n" +
	"$StoredProviderCredentialRefreshState\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12\x1f\n" +
	"\vprovider_id\x18\x02 \x01(\tR\n" +
	"providerId\x12#\n" +
	"\rprovider_name\x18\x03 \x01(\tR\fproviderName\x12%\n" +
	"\x0ecredential_key\x18\x04 \x01(\tR\rcredentialKey\x12K\n" +
	"\bstrategy\x18\x05 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12b\n" +
	"\bmaterial\x18\x06 \x03(\v2@.openshell.v1.StoredProviderCredentialRefreshState.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" +
	"\x14secret_material_keys\x18\a \x03(\tR\x12secretMaterialKeys\x12\"\n" +
	"\rexpires_at_ms\x18\b \x01(\x03R\vexpiresAtMs\x12+\n" +
	"\x12next_refresh_at_ms\x18\t \x01(\x03R\x0fnextRefreshAtMs\x12+\n" +
	"\x12last_refresh_at_ms\x18\n" +
	" \x01(\x03R\x0flastRefreshAtMs\x12\x16\n" +
	"\x06status\x18\v \x01(\tR\x06status\x12\x1d\n" +
	"\n" +
	"last_error\x18\f \x01(\tR\tlastError\x12\x1b\n" +
	"\ttoken_url\x18\r \x01(\tR\btokenUrl\x12\x16\n" +
	"\x06scopes\x18\x0e \x03(\tR\x06scopes\x124\n" +
	"\x16refresh_before_seconds\x18\x0f \x01(\x03R\x14refreshBeforeSeconds\x120\n" +
	"\x14max_lifetime_seconds\x18\x10 \x01(\x03R\x12maxLifetimeSeconds\x12\x82\x01\n" +
	"\x16additional_output_keys\x18\x11 \x03(\v2L.openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntryR\x14additionalOutputKeys\x12/\n" +
	"\x13authorization_epoch\x18\x12 \x01(\tR\x12authorizationEpoch\x12\x85\x01\n" +
	"\x17secret_material_handles\x18\x13 \x03(\v2M.openshell.v1.StoredProviderCredentialRefreshState.SecretMaterialHandlesEntryR\x15secretMaterialHandles\x12e\n" +
	"\x18pending_secret_deletions\x18\x14 \x03(\v2+.openshell.v1.StoredRefreshMaterialDeletionR\x16pendingSecretDeletions\x1a;\n" +
	"\rMaterialEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aG\n" +
	"\x19AdditionalOutputKeysEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1ar\n" +
	"\x1aSecretMaterialHandlesEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12>\n" +
	"\x05value\x18\x02 \x01(\v2(.openshell.datamodel.v1.CredentialHandleR\x05value:\x028\x01\"\x84\x01\n" +
	"\x1dStoredRefreshMaterialDeletion\x12!\n" +
	"\fmaterial_key\x18\x01 \x01(\tR\vmaterialKey\x12@\n" +
	"\x06handle\x18\x02 \x01(\v2(.openshell.datamodel.v1.CredentialHandleR\x06handle\"\x82\x01\n" +
	"\x1fGetProviderRefreshStatusRequest\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"s\n" +
	" GetProviderRefreshStatusResponse\x12O\n" +
	"\vcredentials\x18\x01 \x03(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\vcredentials\"\xd8\x03\n" +
	"\x1fConfigureProviderRefreshRequest\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12K\n" +
	"\bstrategy\x18\x03 \x01(\x0e2/.openshell.v1.ProviderCredentialRefreshStrategyR\bstrategy\x12]\n" +
	"\bmaterial\x18\x04 \x03(\v2;.openshell.v1.ConfigureProviderRefreshRequest.MaterialEntryB\x04\x88\xb5\x18\x01R\bmaterial\x120\n" +
	"\x14secret_material_keys\x18\x05 \x03(\tR\x12secretMaterialKeys\x12'\n" +
	"\rexpires_at_ms\x18\x06 \x01(\x03H\x00R\vexpiresAtMs\x88\x01\x01\x12\x1c\n" +
	"\tworkspace\x18\a \x01(\tR\tworkspace\x1a;\n" +
	"\rMaterialEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x10\n" +
	"\x0e_expires_at_ms\"i\n" +
	" ConfigureProviderRefreshResponse\x12E\n" +
	"\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\x82\x01\n" +
	"\x1fRotateProviderCredentialRequest\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"i\n" +
	" RotateProviderCredentialResponse\x12E\n" +
	"\x06status\x18\x01 \x01(\v2-.openshell.v1.ProviderCredentialRefreshStatusR\x06status\"\x7f\n" +
	"\x1cDeleteProviderRefreshRequest\x12\x1a\n" +
	"\bprovider\x18\x01 \x01(\tR\bprovider\x12%\n" +
	"\x0ecredential_key\x18\x02 \x01(\tR\rcredentialKey\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"9\n" +
	"\x1dDeleteProviderRefreshResponse\x12\x18\n" +
	"\adeleted\x18\x01 \x01(\bR\adeleted\"\xd8\x05\n" +
	"\x0fProviderProfile\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12!\n" +
	"\fdisplay_name\x18\x02 \x01(\tR\vdisplayName\x12 \n" +
	"\vdescription\x18\x03 \x01(\tR\vdescription\x12A\n" +
	"\bcategory\x18\x04 \x01(\x0e2%.openshell.v1.ProviderProfileCategoryR\bcategory\x12I\n" +
	"\vcredentials\x18\x05 \x03(\v2'.openshell.v1.ProviderProfileCredentialR\vcredentials\x12C\n" +
	"\tendpoints\x18\x06 \x03(\v2%.openshell.sandbox.v1.NetworkEndpointR\tendpoints\x12?\n" +
	"\bbinaries\x18\a \x03(\v2#.openshell.sandbox.v1.NetworkBinaryR\bbinaries\x12+\n" +
	"\x11inference_capable\x18\b \x01(\bR\x10inferenceCapable\x12D\n" +
	"\tdiscovery\x18\t \x01(\v2&.openshell.v1.ProviderProfileDiscoveryR\tdiscovery\x12)\n" +
	"\x10resource_version\x18\n" +
	" \x01(\x04R\x0fresourceVersion\x12P\n" +
	"\vannotations\x18\v \x03(\v2..openshell.v1.ProviderProfile.AnnotationsEntryR\vannotations\x12\x16\n" +
	"\x06source\x18\f \x01(\tR\x06source\x12\x14\n" +
	"\x05scope\x18\r \x01(\tR\x05scope\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x90\x01\n" +
	"\x15StoredProviderProfile\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x127\n" +
	"\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"R\n" +
	"\x17ProviderProfileResponse\x127\n" +
	"\aprofile\x18\x01 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\"Y\n" +
	"\x1cListProviderProfilesResponse\x129\n" +
	"\bprofiles\x18\x01 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\"\x82\x01\n" +
	"\x1dImportProviderProfilesRequest\x12C\n" +
	"\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"\xc2\x01\n" +
	"\x1eImportProviderProfilesResponse\x12I\n" +
	"\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x129\n" +
	"\bprofiles\x18\x02 \x03(\v2\x1d.openshell.v1.ProviderProfileR\bprofiles\x12\x1a\n" +
	"\bimported\x18\x03 \x01(\bR\bimported\"\xcc\x01\n" +
	"\x1dUpdateProviderProfilesRequest\x12A\n" +
	"\aprofile\x18\x01 \x01(\v2'.openshell.v1.ProviderProfileImportItemR\aprofile\x12:\n" +
	"\x19expected_resource_version\x18\x02 \x01(\x04R\x17expectedResourceVersion\x12\x0e\n" +
	"\x02id\x18\x03 \x01(\tR\x02id\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\"\xbe\x01\n" +
	"\x1eUpdateProviderProfilesResponse\x12I\n" +
	"\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x127\n" +
	"\aprofile\x18\x02 \x01(\v2\x1d.openshell.v1.ProviderProfileR\aprofile\x12\x18\n" +
	"\aupdated\x18\x03 \x01(\bR\aupdated\"\x80\x01\n" +
	"\x1bLintProviderProfilesRequest\x12C\n" +
	"\bprofiles\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileImportItemR\bprofiles\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x7f\n" +
	"\x1cLintProviderProfilesResponse\x12I\n" +
	"\vdiagnostics\x18\x01 \x03(\v2'.openshell.v1.ProviderProfileDiagnosticR\vdiagnostics\x12\x14\n" +
	"\x05valid\x18\x02 \x01(\bR\x05valid\"2\n" +
	"\x16DeleteProviderResponse\x12\x18\n" +
	"\adeleted\x18\x01 \x01(\bR\adeleted\"L\n" +
	"\x1cDeleteProviderProfileRequest\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"9\n" +
	"\x1dDeleteProviderProfileResponse\x12\x18\n" +
	"\adeleted\x18\x01 \x01(\bR\adeleted\"\x94\x01\n" +
	"$GetSandboxProviderEnvironmentRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12M\n" +
	"#supports_static_credential_bindings\x18\x02 \x01(\bR supportsStaticCredentialBindings\"]\n" +
	"\x1fStaticCredentialEndpointBinding\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\x12\x12\n" +
	"\x04path\x18\x03 \x01(\tR\x04path\"\xd5\x01\n" +
	"\x17StaticCredentialBinding\x12K\n" +
	"\tendpoints\x18\x01 \x03(\v2-.openshell.v1.StaticCredentialEndpointBindingR\tendpoints\x12/\n" +
	"\x13credential_identity\x18\x02 \x01(\tR\x12credentialIdentity\x12<\n" +
	"\x1aworkload_credential_handle\x18\x03 \x01(\tR\x18workloadCredentialHandle\"\x90\b\n" +
	"%GetSandboxProviderEnvironmentResponse\x12l\n" +
	"\venvironment\x18\x01 \x03(\v2D.openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntryB\x04\x88\xb5\x18\x01R\venvironment\x122\n" +
	"\x15provider_env_revision\x18\x02 \x01(\x04R\x13providerEnvRevision\x12\x87\x01\n" +
	"\x18credential_expires_at_ms\x18\x03 \x03(\v2N.openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntryR\x15credentialExpiresAtMs\x12|\n" +
	"\x13dynamic_credentials\x18\x04 \x03(\v2K.openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntryR\x12dynamicCredentials\x12\x8f\x01\n" +
	"\x1astatic_credential_bindings\x18\x05 \x03(\v2Q.openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntryR\x18staticCredentialBindings\x12=\n" +
	"\x1bnon_secret_environment_keys\x18\x06 \x03(\tR\x18nonSecretEnvironmentKeys\x1a>\n" +
	"\x10EnvironmentEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1aH\n" +
	"\x1aCredentialExpiresAtMsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\x03R\x05value:\x028\x01\x1an\n" +
	"\x17DynamicCredentialsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12=\n" +
	"\x05value\x18\x02 \x01(\v2'.openshell.v1.ProviderProfileCredentialR\x05value:\x028\x01\x1ar\n" +
	"\x1dStaticCredentialBindingsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12;\n" +
	"\x05value\x18\x02 \x01(\v2%.openshell.v1.StaticCredentialBindingR\x05value:\x028\x01\"\xce\x04\n" +
	"\x13UpdateConfigRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12;\n" +
	"\x06policy\x18\x02 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x1f\n" +
	"\vsetting_key\x18\x03 \x01(\tR\n" +
	"settingKey\x12G\n" +
	"\rsetting_value\x18\x04 \x01(\v2\".openshell.sandbox.v1.SettingValueR\fsettingValue\x12%\n" +
	"\x0edelete_setting\x18\x05 \x01(\bR\rdeleteSetting\x12\x16\n" +
	"\x06global\x18\x06 \x01(\bR\x06global\x12M\n" +
	"\x10merge_operations\x18\a \x03(\v2\".openshell.v1.PolicyMergeOperationR\x0fmergeOperations\x12:\n" +
	"\x19expected_resource_version\x18\b \x01(\x04R\x17expectedResourceVersion\x12T\n" +
	"\vannotations\x18\t \x03(\v22.openshell.v1.UpdateConfigRequest.AnnotationsEntryR\vannotations\x12\x1c\n" +
	"\tworkspace\x18\n" +
	" \x01(\tR\tworkspace\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc7\x03\n" +
	"\x14PolicyMergeOperation\x129\n" +
	"\badd_rule\x18\x01 \x01(\v2\x1c.openshell.v1.AddNetworkRuleH\x00R\aaddRule\x12N\n" +
	"\x0fremove_endpoint\x18\x02 \x01(\v2#.openshell.v1.RemoveNetworkEndpointH\x00R\x0eremoveEndpoint\x12B\n" +
	"\vremove_rule\x18\x03 \x01(\v2\x1f.openshell.v1.RemoveNetworkRuleH\x00R\n" +
	"removeRule\x12B\n" +
	"\x0eadd_deny_rules\x18\x04 \x01(\v2\x1a.openshell.v1.AddDenyRulesH\x00R\faddDenyRules\x12E\n" +
	"\x0fadd_allow_rules\x18\x05 \x01(\v2\x1b.openshell.v1.AddAllowRulesH\x00R\raddAllowRules\x12H\n" +
	"\rremove_binary\x18\x06 \x01(\v2!.openshell.v1.RemoveNetworkBinaryH\x00R\fremoveBinaryB\v\n" +
	"\toperation\"j\n" +
	"\x0eAddNetworkRule\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12;\n" +
	"\x04rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\x04rule\"\\\n" +
	"\x15RemoveNetworkEndpoint\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12\x12\n" +
	"\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x03 \x01(\rR\x04port\"0\n" +
	"\x11RemoveNetworkRule\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\"w\n" +
	"\fAddDenyRules\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\x12?\n" +
	"\n" +
	"deny_rules\x18\x03 \x03(\v2 .openshell.sandbox.v1.L7DenyRuleR\tdenyRules\"k\n" +
	"\rAddAllowRules\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\x122\n" +
	"\x05rules\x18\x03 \x03(\v2\x1c.openshell.sandbox.v1.L7RuleR\x05rules\"S\n" +
	"\x13RemoveNetworkBinary\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12\x1f\n" +
	"\vbinary_path\x18\x02 \x01(\tR\n" +
	"binaryPath\"\xaf\x02\n" +
	"\x14UpdateConfigResponse\x12\x18\n" +
	"\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x12+\n" +
	"\x11settings_revision\x18\x03 \x01(\x04R\x10settingsRevision\x12\x18\n" +
	"\adeleted\x18\x04 \x01(\bR\adeleted\x12U\n" +
	"\vannotations\x18\x05 \x03(\v23.openshell.v1.UpdateConfigResponse.AnnotationsEntryR\vannotations\x1a>\n" +
	"\x10AnnotationsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x83\x01\n" +
	"\x1dGetSandboxPolicyStatusRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" +
	"\aversion\x18\x02 \x01(\rR\aversion\x12\x16\n" +
	"\x06global\x18\x03 \x01(\bR\x06global\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x88\x01\n" +
	"\x1eGetSandboxPolicyStatusResponse\x12?\n" +
	"\brevision\x18\x01 \x01(\v2#.openshell.v1.SandboxPolicyRevisionR\brevision\x12%\n" +
	"\x0eactive_version\x18\x02 \x01(\rR\ractiveVersion\"\x94\x01\n" +
	"\x1aListSandboxPoliciesRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x14\n" +
	"\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x03 \x01(\rR\x06offset\x12\x16\n" +
	"\x06global\x18\x04 \x01(\bR\x06global\x12\x1c\n" +
	"\tworkspace\x18\x05 \x01(\tR\tworkspace\"`\n" +
	"\x1bListSandboxPoliciesResponse\x12A\n" +
	"\trevisions\x18\x01 \x03(\v2#.openshell.v1.SandboxPolicyRevisionR\trevisions\"\xa7\x01\n" +
	"\x19ReportPolicyStatusRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" +
	"\aversion\x18\x02 \x01(\rR\aversion\x122\n" +
	"\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" +
	"\n" +
	"load_error\x18\x04 \x01(\tR\tloadError\"\x1c\n" +
	"\x1aReportPolicyStatusResponse\"\xbc\x03\n" +
	"\x15SandboxPolicyRevision\x12\x18\n" +
	"\aversion\x18\x01 \x01(\rR\aversion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x122\n" +
	"\x06status\x18\x03 \x01(\x0e2\x1a.openshell.v1.PolicyStatusR\x06status\x12\x1d\n" +
	"\n" +
	"load_error\x18\x04 \x01(\tR\tloadError\x12\"\n" +
	"\rcreated_at_ms\x18\x05 \x01(\x03R\vcreatedAtMs\x12 \n" +
	"\floaded_at_ms\x18\x06 \x01(\x03R\n" +
	"loadedAtMs\x12;\n" +
	"\x06policy\x18\a \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12S\n" +
	"\n" +
	"provenance\x18\b \x03(\v23.openshell.v1.SandboxPolicyRevision.ProvenanceEntryR\n" +
	"provenance\x1a=\n" +
	"\x0fProvenanceEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xbc\x01\n" +
	"\x15GetSandboxLogsRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x14\n" +
	"\x05lines\x18\x02 \x01(\rR\x05lines\x12\x19\n" +
	"\bsince_ms\x18\x03 \x01(\x03R\asinceMs\x12\x18\n" +
	"\asources\x18\x04 \x03(\tR\asources\x12\x1b\n" +
	"\tmin_level\x18\x05 \x01(\tR\bminLevel\x12\x1c\n" +
	"\tworkspace\x18\x06 \x01(\tR\tworkspace\"i\n" +
	"\x16PushSandboxLogsRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x120\n" +
	"\x04logs\x18\x02 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\"\x19\n" +
	"\x17PushSandboxLogsResponse\"m\n" +
	"\x16GetSandboxLogsResponse\x120\n" +
	"\x04logs\x18\x01 \x03(\v2\x1c.openshell.v1.SandboxLogLineR\x04logs\x12!\n" +
	"\fbuffer_total\x18\x02 \x01(\rR\vbufferTotal\"\xa2\x02\n" +
	"\x11SupervisorMessage\x125\n" +
	"\x05hello\x18\x01 \x01(\v2\x1d.openshell.v1.SupervisorHelloH\x00R\x05hello\x12A\n" +
	"\theartbeat\x18\x02 \x01(\v2!.openshell.v1.SupervisorHeartbeatH\x00R\theartbeat\x12K\n" +
	"\x11relay_open_result\x18\x03 \x01(\v2\x1d.openshell.v1.RelayOpenResultH\x00R\x0frelayOpenResult\x12;\n" +
	"\vrelay_close\x18\x04 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" +
	"relayCloseB\t\n" +
	"\apayload\"\xea\x02\n" +
	"\x0eGatewayMessage\x12J\n" +
	"\x10session_accepted\x18\x01 \x01(\v2\x1d.openshell.v1.SessionAcceptedH\x00R\x0fsessionAccepted\x12J\n" +
	"\x10session_rejected\x18\x02 \x01(\v2\x1d.openshell.v1.SessionRejectedH\x00R\x0fsessionRejected\x12>\n" +
	"\theartbeat\x18\x03 \x01(\v2\x1e.openshell.v1.GatewayHeartbeatH\x00R\theartbeat\x128\n" +
	"\n" +
	"relay_open\x18\x04 \x01(\v2\x17.openshell.v1.RelayOpenH\x00R\trelayOpen\x12;\n" +
	"\vrelay_close\x18\x05 \x01(\v2\x18.openshell.v1.RelayCloseH\x00R\n" +
	"relayCloseB\t\n" +
	"\apayload\"Q\n" +
	"\x0fSupervisorHello\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
	"\vinstance_id\x18\x02 \x01(\tR\n" +
	"instanceId\"h\n" +
	"\x0fSessionAccepted\x12\x1d\n" +
	"\n" +
	"session_id\x18\x01 \x01(\tR\tsessionId\x126\n" +
	"\x17heartbeat_interval_secs\x18\x02 \x01(\rR\x15heartbeatIntervalSecs\")\n" +
	"\x0fSessionRejected\x12\x16\n" +
	"\x06reason\x18\x01 \x01(\tR\x06reason\"\x15\n" +
	"\x13SupervisorHeartbeat\"\x12\n" +
	"\x10GatewayHeartbeat\"{\n" +
	"\x1cReportMainProcessExitRequest\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
	"\vinstance_id\x18\x02 \x01(\tR\n" +
	"instanceId\x12\x1b\n" +
	"\texit_code\x18\x03 \x01(\x05R\bexitCode\"\x1f\n" +
	"\x1dReportMainProcessExitResponse\"\xb7\x01\n" +
	"\tRelayOpen\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\x120\n" +
	"\x03ssh\x18\x02 \x01(\v2\x1c.openshell.v1.SshRelayTargetH\x00R\x03ssh\x120\n" +
	"\x03tcp\x18\x03 \x01(\v2\x1c.openshell.v1.TcpRelayTargetH\x00R\x03tcp\x12\x1d\n" +
	"\n" +
	"service_id\x18\x05 \x01(\tR\tserviceIdB\b\n" +
	"\x06target\"\x10\n" +
	"\x0eSshRelayTarget\"8\n" +
	"\x0eTcpRelayTarget\x12\x12\n" +
	"\x04host\x18\x01 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x02 \x01(\rR\x04port\"*\n" +
	"\tRelayInit\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\"\\\n" +
	"\n" +
	"RelayFrame\x12-\n" +
	"\x04init\x18\x01 \x01(\v2\x17.openshell.v1.RelayInitH\x00R\x04init\x12\x14\n" +
	"\x04data\x18\x02 \x01(\fH\x00R\x04dataB\t\n" +
	"\apayload\"`\n" +
	"\x0fRelayOpenResult\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\x12\x18\n" +
	"\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" +
	"\x05error\x18\x03 \x01(\tR\x05error\"C\n" +
	"\n" +
	"RelayClose\x12\x1d\n" +
	"\n" +
	"channel_id\x18\x01 \x01(\tR\tchannelId\x12\x16\n" +
	"\x06reason\x18\x02 \x01(\tR\x06reason\"o\n" +
	"\x0fL7RequestSample\x12\x16\n" +
	"\x06method\x18\x01 \x01(\tR\x06method\x12\x12\n" +
	"\x04path\x18\x02 \x01(\tR\x04path\x12\x1a\n" +
	"\bdecision\x18\x03 \x01(\tR\bdecision\x12\x14\n" +
	"\x05count\x18\x04 \x01(\rR\x05count\"\xe5\x04\n" +
	"\rDenialSummary\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x12\n" +
	"\x04host\x18\x02 \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\x03 \x01(\rR\x04port\x12\x16\n" +
	"\x06binary\x18\x04 \x01(\tR\x06binary\x12\x1c\n" +
	"\tancestors\x18\x05 \x03(\tR\tancestors\x12\x1f\n" +
	"\vdeny_reason\x18\x06 \x01(\tR\n" +
	"denyReason\x12\"\n" +
	"\rfirst_seen_ms\x18\a \x01(\x03R\vfirstSeenMs\x12 \n" +
	"\flast_seen_ms\x18\b \x01(\x03R\n" +
	"lastSeenMs\x12\x14\n" +
	"\x05count\x18\t \x01(\rR\x05count\x12)\n" +
	"\x10suppressed_count\x18\n" +
	" \x01(\rR\x0fsuppressedCount\x12\x1f\n" +
	"\vtotal_count\x18\v \x01(\rR\n" +
	"totalCount\x12'\n" +
	"\x0fsample_cmdlines\x18\f \x03(\tR\x0esampleCmdlines\x12#\n" +
	"\rbinary_sha256\x18\r \x01(\tR\fbinarySha256\x12\x1e\n" +
	"\n" +
	"persistent\x18\x0e \x01(\bR\n" +
	"persistent\x12!\n" +
	"\fdenial_stage\x18\x0f \x01(\tR\vdenialStage\x12K\n" +
	"\x12l7_request_samples\x18\x10 \x03(\v2\x1d.openshell.v1.L7RequestSampleR\x10l7RequestSamples\x120\n" +
	"\x14l7_inspection_active\x18\x11 \x01(\bR\x12l7InspectionActive\"T\n" +
	"\x10DenialGroupCount\x12\x1d\n" +
	"\n" +
	"deny_group\x18\x01 \x01(\tR\tdenyGroup\x12!\n" +
	"\fdenied_count\x18\x02 \x01(\rR\vdeniedCount\"\xc8\x01\n" +
	"\x16NetworkActivitySummary\x124\n" +
	"\x16network_activity_count\x18\x01 \x01(\rR\x14networkActivityCount\x12.\n" +
	"\x13denied_action_count\x18\x02 \x01(\rR\x11deniedActionCount\x12H\n" +
	"\x10denials_by_group\x18\x03 \x03(\v2\x1e.openshell.v1.DenialGroupCountR\x0edenialsByGroup\"\x94\x05\n" +
	"\vPolicyChunk\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12\x16\n" +
	"\x06status\x18\x02 \x01(\tR\x06status\x12\x1b\n" +
	"\trule_name\x18\x03 \x01(\tR\bruleName\x12L\n" +
	"\rproposed_rule\x18\x04 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" +
	"\trationale\x18\x05 \x01(\tR\trationale\x12%\n" +
	"\x0esecurity_notes\x18\x06 \x01(\tR\rsecurityNotes\x12\x1e\n" +
	"\n" +
	"confidence\x18\a \x01(\x02R\n" +
	"confidence\x12,\n" +
	"\x12denial_summary_ids\x18\b \x03(\tR\x10denialSummaryIds\x12\"\n" +
	"\rcreated_at_ms\x18\t \x01(\x03R\vcreatedAtMs\x12\"\n" +
	"\rdecided_at_ms\x18\n" +
	" \x01(\x03R\vdecidedAtMs\x12\x14\n" +
	"\x05stage\x18\v \x01(\tR\x05stage\x12.\n" +
	"\x13supersedes_chunk_id\x18\f \x01(\tR\x11supersedesChunkId\x12\x1b\n" +
	"\thit_count\x18\r \x01(\x05R\bhitCount\x12\"\n" +
	"\rfirst_seen_ms\x18\x0e \x01(\x03R\vfirstSeenMs\x12 \n" +
	"\flast_seen_ms\x18\x0f \x01(\x03R\n" +
	"lastSeenMs\x12\x16\n" +
	"\x06binary\x18\x10 \x01(\tR\x06binary\x12+\n" +
	"\x11validation_result\x18\x11 \x01(\tR\x10validationResult\x12)\n" +
	"\x10rejection_reason\x18\x12 \x01(\tR\x0frejectionReason\"\x96\x01\n" +
	"\x11DraftPolicyUpdate\x12#\n" +
	"\rdraft_version\x18\x01 \x01(\x04R\fdraftVersion\x12\x1d\n" +
	"\n" +
	"new_chunks\x18\x02 \x01(\rR\tnewChunks\x12#\n" +
	"\rtotal_pending\x18\x03 \x01(\rR\ftotalPending\x12\x18\n" +
	"\asummary\x18\x04 \x01(\tR\asummary\"\xd7\x02\n" +
	"\x1bSubmitPolicyAnalysisRequest\x129\n" +
	"\tsummaries\x18\x01 \x03(\v2\x1b.openshell.v1.DenialSummaryR\tsummaries\x12B\n" +
	"\x0fproposed_chunks\x18\x02 \x03(\v2\x19.openshell.v1.PolicyChunkR\x0eproposedChunks\x12#\n" +
	"\ranalysis_mode\x18\x03 \x01(\tR\fanalysisMode\x12\x12\n" +
	"\x04name\x18\x04 \x01(\tR\x04name\x12b\n" +
	"\x1anetwork_activity_summaries\x18\x05 \x03(\v2$.openshell.v1.NetworkActivitySummaryR\x18networkActivitySummaries\x12\x1c\n" +
	"\tworkspace\x18\x06 \x01(\tR\tworkspace\"\xcb\x01\n" +
	"\x1cSubmitPolicyAnalysisResponse\x12'\n" +
	"\x0faccepted_chunks\x18\x01 \x01(\rR\x0eacceptedChunks\x12'\n" +
	"\x0frejected_chunks\x18\x02 \x01(\rR\x0erejectedChunks\x12+\n" +
	"\x11rejection_reasons\x18\x03 \x03(\tR\x10rejectionReasons\x12,\n" +
	"\x12accepted_chunk_ids\x18\x04 \x03(\tR\x10acceptedChunkIds\"n\n" +
	"\x15GetDraftPolicyRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12#\n" +
	"\rstatus_filter\x18\x02 \x01(\tR\fstatusFilter\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xc8\x01\n" +
	"\x16GetDraftPolicyResponse\x121\n" +
	"\x06chunks\x18\x01 \x03(\v2\x19.openshell.v1.PolicyChunkR\x06chunks\x12'\n" +
	"\x0frolling_summary\x18\x02 \x01(\tR\x0erollingSummary\x12#\n" +
	"\rdraft_version\x18\x03 \x01(\x04R\fdraftVersion\x12-\n" +
	"\x13last_analyzed_at_ms\x18\x04 \x01(\x03R\x10lastAnalyzedAtMs\"g\n" +
	"\x18ApproveDraftChunkRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"c\n" +
	"\x19ApproveDraftChunkResponse\x12%\n" +
	"\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\"~\n" +
	"\x17RejectDraftChunkRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x16\n" +
	"\x06reason\x18\x03 \x01(\tR\x06reason\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x1a\n" +
	"\x18RejectDraftChunkResponse\"\x8a\x01\n" +
	"\x1cApproveAllDraftChunksRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x128\n" +
	"\x18include_security_flagged\x18\x02 \x01(\bR\x16includeSecurityFlagged\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"\xb7\x01\n" +
	"\x1dApproveAllDraftChunksResponse\x12%\n" +
	"\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\x12'\n" +
	"\x0fchunks_approved\x18\x03 \x01(\rR\x0echunksApproved\x12%\n" +
	"\x0echunks_skipped\x18\x04 \x01(\rR\rchunksSkipped\"\xb2\x01\n" +
	"\x15EditDraftChunkRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12L\n" +
	"\rproposed_rule\x18\x03 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" +
	"\tworkspace\x18\x04 \x01(\tR\tworkspace\"\x18\n" +
	"\x16EditDraftChunkResponse\"d\n" +
	"\x15UndoDraftChunkRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x19\n" +
	"\bchunk_id\x18\x02 \x01(\tR\achunkId\x12\x1c\n" +
	"\tworkspace\x18\x03 \x01(\tR\tworkspace\"`\n" +
	"\x16UndoDraftChunkResponse\x12%\n" +
	"\x0epolicy_version\x18\x01 \x01(\rR\rpolicyVersion\x12\x1f\n" +
	"\vpolicy_hash\x18\x02 \x01(\tR\n" +
	"policyHash\"K\n" +
	"\x17ClearDraftChunksRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"A\n" +
	"\x18ClearDraftChunksResponse\x12%\n" +
	"\x0echunks_cleared\x18\x01 \x01(\rR\rchunksCleared\"J\n" +
	"\x16GetDraftHistoryRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
	"\tworkspace\x18\x02 \x01(\tR\tworkspace\"\x92\x01\n" +
	"\x11DraftHistoryEntry\x12!\n" +
	"\ftimestamp_ms\x18\x01 \x01(\x03R\vtimestampMs\x12\x1d\n" +
	"\n" +
	"event_type\x18\x02 \x01(\tR\teventType\x12 \n" +
	"\vdescription\x18\x03 \x01(\tR\vdescription\x12\x19\n" +
	"\bchunk_id\x18\x04 \x01(\tR\achunkId\"T\n" +
	"\x17GetDraftHistoryResponse\x129\n" +
	"\aentries\x18\x01 \x03(\v2\x1f.openshell.v1.DraftHistoryEntryR\aentries\"\xbd\x02\n" +
	"\x15PolicyRevisionPayload\x12;\n" +
	"\x06policy\x18\x01 \x01(\v2#.openshell.sandbox.v1.SandboxPolicyR\x06policy\x12\x12\n" +
	"\x04hash\x18\x02 \x01(\tR\x04hash\x12\x1d\n" +
	"\n" +
	"load_error\x18\x03 \x01(\tR\tloadError\x12 \n" +
	"\floaded_at_ms\x18\x04 \x01(\x03R\n" +
	"loadedAtMs\x12S\n" +
	"\n" +
	"provenance\x18\x05 \x03(\v23.openshell.v1.PolicyRevisionPayload.ProvenanceEntryR\n" +
	"provenance\x1a=\n" +
	"\x0fProvenanceEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc4\x03\n" +
	"\x11DraftChunkPayload\x12\x1b\n" +
	"\trule_name\x18\x01 \x01(\tR\bruleName\x12L\n" +
	"\rproposed_rule\x18\x02 \x01(\v2'.openshell.sandbox.v1.NetworkPolicyRuleR\fproposedRule\x12\x1c\n" +
	"\trationale\x18\x03 \x01(\tR\trationale\x12%\n" +
	"\x0esecurity_notes\x18\x04 \x01(\tR\rsecurityNotes\x12\x1e\n" +
	"\n" +
	"confidence\x18\x05 \x01(\x02R\n" +
	"confidence\x12\"\n" +
	"\rdecided_at_ms\x18\x06 \x01(\x03R\vdecidedAtMs\x12\x12\n" +
	"\x04host\x18\a \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\b \x01(\x05R\x04port\x12\x16\n" +
	"\x06binary\x18\t \x01(\tR\x06binary\x12#\n" +
	"\rdraft_version\x18\n" +
	" \x01(\x03R\fdraftVersion\x12+\n" +
	"\x11validation_result\x18\v \x01(\tR\x10validationResult\x12)\n" +
	"\x10rejection_reason\x18\f \x01(\tR\x0frejectionReason\"\xe1\x03\n" +
	"\x14StoredPolicyRevision\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12\x18\n" +
	"\aversion\x18\x03 \x01(\x03R\aversion\x12%\n" +
	"\x0epolicy_payload\x18\x04 \x01(\fR\rpolicyPayload\x12\x1f\n" +
	"\vpolicy_hash\x18\x05 \x01(\tR\n" +
	"policyHash\x12\x16\n" +
	"\x06status\x18\x06 \x01(\tR\x06status\x12\"\n" +
	"\n" +
	"load_error\x18\a \x01(\tH\x00R\tloadError\x88\x01\x01\x12\"\n" +
	"\rcreated_at_ms\x18\b \x01(\x03R\vcreatedAtMs\x12%\n" +
	"\floaded_at_ms\x18\t \x01(\x03H\x01R\n" +
	"loadedAtMs\x88\x01\x01\x12R\n" +
	"\n" +
	"provenance\x18\n" +
	" \x03(\v22.openshell.v1.StoredPolicyRevision.ProvenanceEntryR\n" +
	"provenance\x1a=\n" +
	"\x0fProvenanceEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\r\n" +
	"\v_load_errorB\x0f\n" +
	"\r_loaded_at_ms\"\xff\x04\n" +
	"\x10StoredDraftChunk\x12\x0e\n" +
	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1d\n" +
	"\n" +
	"sandbox_id\x18\x02 \x01(\tR\tsandboxId\x12#\n" +
	"\rdraft_version\x18\x03 \x01(\x03R\fdraftVersion\x12\x16\n" +
	"\x06status\x18\x04 \x01(\tR\x06status\x12\x1b\n" +
	"\trule_name\x18\x05 \x01(\tR\bruleName\x12#\n" +
	"\rproposed_rule\x18\x06 \x01(\fR\fproposedRule\x12\x1c\n" +
	"\trationale\x18\a \x01(\tR\trationale\x12%\n" +
	"\x0esecurity_notes\x18\b \x01(\tR\rsecurityNotes\x12\x1e\n" +
	"\n" +
	"confidence\x18\t \x01(\x01R\n" +
	"confidence\x12\"\n" +
	"\rcreated_at_ms\x18\n" +
	" \x01(\x03R\vcreatedAtMs\x12'\n" +
	"\rdecided_at_ms\x18\v \x01(\x03H\x00R\vdecidedAtMs\x88\x01\x01\x12\x12\n" +
	"\x04host\x18\f \x01(\tR\x04host\x12\x12\n" +
	"\x04port\x18\r \x01(\x05R\x04port\x12\x16\n" +
	"\x06binary\x18\x0e \x01(\tR\x06binary\x12\x1b\n" +
	"\thit_count\x18\x0f \x01(\x05R\bhitCount\x12\"\n" +
	"\rfirst_seen_ms\x18\x10 \x01(\x03R\vfirstSeenMs\x12 \n" +
	"\flast_seen_ms\x18\x11 \x01(\x03R\n" +
	"lastSeenMs\x12+\n" +
	"\x11validation_result\x18\x12 \x01(\tR\x10validationResult\x12)\n" +
	"\x10rejection_reason\x18\x13 \x01(\tR\x0frejectionReasonB\x10\n" +
	"\x0e_decided_at_ms\"\xb1\x01\n" +
	"\x16CreateWorkspaceRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\x12H\n" +
	"\x06labels\x18\x02 \x03(\v20.openshell.v1.CreateWorkspaceRequest.LabelsEntryR\x06labels\x1a9\n" +
	"\vLabelsEntry\x12\x10\n" +
	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"Z\n" +
	"\x17CreateWorkspaceResponse\x12?\n" +
	"\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\")\n" +
	"\x13GetWorkspaceRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\"W\n" +
	"\x14GetWorkspaceResponse\x12?\n" +
	"\tworkspace\x18\x01 \x01(\v2!.openshell.datamodel.v1.WorkspaceR\tworkspace\"l\n" +
	"\x15ListWorkspacesRequest\x12\x14\n" +
	"\x05limit\x18\x01 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x02 \x01(\rR\x06offset\x12%\n" +
	"\x0elabel_selector\x18\x03 \x01(\tR\rlabelSelector\"[\n" +
	"\x16ListWorkspacesResponse\x12A\n" +
	"\n" +
	"workspaces\x18\x01 \x03(\v2!.openshell.datamodel.v1.WorkspaceR\n" +
	"workspaces\",\n" +
	"\x16DeleteWorkspaceRequest\x12\x12\n" +
	"\x04name\x18\x01 \x01(\tR\x04name\"3\n" +
	"\x17DeleteWorkspaceResponse\x12\x18\n" +
	"\adeleted\x18\x01 \x01(\bR\adeleted\"\xaf\x01\n" +
	"\x0fWorkspaceMember\x12>\n" +
	"\bmetadata\x18\x01 \x01(\v2\".openshell.datamodel.v1.ObjectMetaR\bmetadata\x12+\n" +
	"\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" +
	"\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"\x97\x01\n" +
	"\x19AddWorkspaceMemberRequest\x12\x1c\n" +
	"\tworkspace\x18\x01 \x01(\tR\tworkspace\x12+\n" +
	"\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\x12/\n" +
	"\x04role\x18\x03 \x01(\x0e2\x1b.openshell.v1.WorkspaceRoleR\x04role\"S\n" +
	"\x1aAddWorkspaceMemberResponse\x125\n" +
	"\x06member\x18\x01 \x01(\v2\x1d.openshell.v1.WorkspaceMemberR\x06member\"i\n" +
	"\x1cRemoveWorkspaceMemberRequest\x12\x1c\n" +
	"\tworkspace\x18\x01 \x01(\tR\tworkspace\x12+\n" +
	"\x11principal_subject\x18\x02 \x01(\tR\x10principalSubject\"9\n" +
	"\x1dRemoveWorkspaceMemberResponse\x12\x18\n" +
	"\aremoved\x18\x01 \x01(\bR\aremoved\"i\n" +
	"\x1bListWorkspaceMembersRequest\x12\x1c\n" +
	"\tworkspace\x18\x01 \x01(\tR\tworkspace\x12\x14\n" +
	"\x05limit\x18\x02 \x01(\rR\x05limit\x12\x16\n" +
	"\x06offset\x18\x03 \x01(\rR\x06offset\"W\n" +
	"\x1cListWorkspaceMembersResponse\x127\n" +
	"\amembers\x18\x01 \x03(\v2\x1d.openshell.v1.WorkspaceMemberR\amembers\"\x7f\n" +
	"\x1aExtensionServiceCredential\x12!\n" +
	"\fservice_name\x18\x01 \x01(\tR\vserviceName\x12\x1a\n" +
	"\x05token\x18\x02 \x01(\tB\x04\x88\xb5\x18\x01R\x05token\x12\"\n" +
	"\rexpires_at_ms\x18\x03 \x01(\x03R\vexpiresAtMs*\x89\x02\n" +
	"\fSandboxPhase\x12\x1d\n" +
	"\x19SANDBOX_PHASE_UNSPECIFIED\x10\x00\x12\x1e\n" +
	"\x1aSANDBOX_PHASE_PROVISIONING\x10\x01\x12\x17\n" +
	"\x13SANDBOX_PHASE_READY\x10\x02\x12\x17\n" +
	"\x13SANDBOX_PHASE_ERROR\x10\x03\x12\x1a\n" +
	"\x16SANDBOX_PHASE_DELETING\x10\x04\x12\x19\n" +
	"\x15SANDBOX_PHASE_UNKNOWN\x10\x05\x12\x1a\n" +
	"\x16SANDBOX_PHASE_STOPPING\x10\x06\x12\x19\n" +
	"\x15SANDBOX_PHASE_STOPPED\x10\a\x12\x1a\n" +
	"\x16SANDBOX_PHASE_STARTING\x10\b*\xc3\x03\n" +
	"!ProviderCredentialRefreshStrategy\x124\n" +
	"0PROVIDER_CREDENTIAL_REFRESH_STRATEGY_UNSPECIFIED\x10\x00\x12/\n" +
	"+PROVIDER_CREDENTIAL_REFRESH_STRATEGY_STATIC\x10\x01\x121\n" +
	"-PROVIDER_CREDENTIAL_REFRESH_STRATEGY_EXTERNAL\x10\x02\x12=\n" +
	"9PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_REFRESH_TOKEN\x10\x03\x12B\n" +
	">PROVIDER_CREDENTIAL_REFRESH_STRATEGY_OAUTH2_CLIENT_CREDENTIALS\x10\x04\x12C\n" +
	"?PROVIDER_CREDENTIAL_REFRESH_STRATEGY_GOOGLE_SERVICE_ACCOUNT_JWT\x10\x05\x12<\n" +
	"8PROVIDER_CREDENTIAL_REFRESH_STRATEGY_AWS_STS_ASSUME_ROLE\x10\x06*\xdb\x02\n" +
	"\x17ProviderProfileCategory\x12)\n" +
	"%PROVIDER_PROFILE_CATEGORY_UNSPECIFIED\x10\x00\x12#\n" +
	"\x1fPROVIDER_PROFILE_CATEGORY_OTHER\x10\x01\x12'\n" +
	"#PROVIDER_PROFILE_CATEGORY_INFERENCE\x10\x02\x12#\n" +
	"\x1fPROVIDER_PROFILE_CATEGORY_AGENT\x10\x03\x12,\n" +
	"(PROVIDER_PROFILE_CATEGORY_SOURCE_CONTROL\x10\x04\x12'\n" +
	"#PROVIDER_PROFILE_CATEGORY_MESSAGING\x10\x05\x12\"\n" +
	"\x1ePROVIDER_PROFILE_CATEGORY_DATA\x10\x06\x12'\n" +
	"#PROVIDER_PROFILE_CATEGORY_KNOWLEDGE\x10\a*\x9a\x01\n" +
	"\fPolicyStatus\x12\x1d\n" +
	"\x19POLICY_STATUS_UNSPECIFIED\x10\x00\x12\x19\n" +
	"\x15POLICY_STATUS_PENDING\x10\x01\x12\x18\n" +
	"\x14POLICY_STATUS_LOADED\x10\x02\x12\x18\n" +
	"\x14POLICY_STATUS_FAILED\x10\x03\x12\x1c\n" +
	"\x18POLICY_STATUS_SUPERSEDED\x10\x04*\x86\x01\n" +
	"\rServiceStatus\x12\x1e\n" +
	"\x1aSERVICE_STATUS_UNSPECIFIED\x10\x00\x12\x1a\n" +
	"\x16SERVICE_STATUS_HEALTHY\x10\x01\x12\x1b\n" +
	"\x17SERVICE_STATUS_DEGRADED\x10\x02\x12\x1c\n" +
	"\x18SERVICE_STATUS_UNHEALTHY\x10\x03*b\n" +
	"\rWorkspaceRole\x12\x1e\n" +
	"\x1aWORKSPACE_ROLE_UNSPECIFIED\x10\x00\x12\x17\n" +
	"\x13WORKSPACE_ROLE_USER\x10\x01\x12\x18\n" +
	"\x14WORKSPACE_ROLE_ADMIN\x10\x022\x95E\n" +
	"\tOpenShell\x12Z\n" +
	"\x06Health\x12\x1b.openshell.v1.HealthRequest\x1a\x1c.openshell.v1.HealthResponse\"\x15\x82\xb5\x18\x11\n" +
	"\x0funauthenticated\x12i\n" +
	"\x0eGetCurrentUser\x12#.openshell.v1.GetCurrentUserRequest\x1a$.openshell.v1.GetCurrentUserResponse\"\f\x82\xb5\x18\b\n" +
	"\x06bearer\x12\x86\x01\n" +
	"\x0eGetGatewayInfo\x12#.openshell.v1.GetGatewayInfoRequest\x1a$.openshell.v1.GetGatewayInfoResponse\")\x82\xb5\x18%\n" +
	"\x06bearer\x1a\x0eplatform_admin\"\vconfig:read\x12u\n" +
	"\rCreateSandbox\x12\".openshell.v1.CreateSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12n\n" +
	"\n" +
	"GetSandbox\x12\x1f.openshell.v1.GetSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12z\n" +
	"\rListSandboxes\x12\".openshell.v1.ListSandboxesRequest\x1a#.openshell.v1.ListSandboxesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x8f\x01\n" +
	"\x14ListSandboxProviders\x12).openshell.v1.ListSandboxProvidersRequest\x1a*.openshell.v1.ListSandboxProvidersResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x93\x01\n" +
	"\x15AttachSandboxProvider\x12*.openshell.v1.AttachSandboxProviderRequest\x1a+.openshell.v1.AttachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x93\x01\n" +
	"\x15DetachSandboxProvider\x12*.openshell.v1.DetachSandboxProviderRequest\x1a+.openshell.v1.DetachSandboxProviderResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12{\n" +
	"\rDeleteSandbox\x12\".openshell.v1.DeleteSandboxRequest\x1a#.openshell.v1.DeleteSandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12q\n" +
	"\vStopSandbox\x12 .openshell.v1.StopSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12s\n" +
	"\fStartSandbox\x12!.openshell.v1.StartSandboxRequest\x1a\x1d.openshell.v1.SandboxResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" +
	"\x10CreateSshSession\x12%.openshell.v1.CreateSshSessionRequest\x1a&.openshell.v1.CreateSshSessionResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12}\n" +
	"\rExposeService\x12\".openshell.v1.ExposeServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12v\n" +
	"\n" +
	"GetService\x12\x1f.openshell.v1.GetServiceRequest\x1a%.openshell.v1.ServiceEndpointResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12w\n" +
	"\fListServices\x12!.openshell.v1.ListServicesRequest\x1a\".openshell.v1.ListServicesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12{\n" +
	"\rDeleteService\x12\".openshell.v1.DeleteServiceRequest\x1a#.openshell.v1.DeleteServiceResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12\x84\x01\n" +
	"\x10RevokeSshSession\x12%.openshell.v1.RevokeSshSessionRequest\x1a&.openshell.v1.RevokeSshSessionResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write\x12t\n" +
	"\vExecSandbox\x12 .openshell.v1.ExecSandboxRequest\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write0\x01\x12q\n" +
	"\n" +
	"ForwardTcp\x12\x1d.openshell.v1.TcpForwardFrame\x1a\x1d.openshell.v1.TcpForwardFrame\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12\x7f\n" +
	"\x16ExecSandboxInteractive\x12\x1e.openshell.v1.ExecSandboxInput\x1a\x1e.openshell.v1.ExecSandboxEvent\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rsandbox:write(\x010\x01\x12z\n" +
	"\x0eCreateProvider\x12#.openshell.v1.CreateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12r\n" +
	"\vGetProvider\x12 .openshell.v1.GetProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12{\n" +
	"\rListProviders\x12\".openshell.v1.ListProvidersRequest\x1a#.openshell.v1.ListProvidersResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x90\x01\n" +
	"\x14ListProviderProfiles\x12).openshell.v1.ListProviderProfilesRequest\x1a*.openshell.v1.ListProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x87\x01\n" +
	"\x12GetProviderProfile\x12'.openshell.v1.GetProviderProfileRequest\x1a%.openshell.v1.ProviderProfileResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x98\x01\n" +
	"\x16ImportProviderProfiles\x12+.openshell.v1.ImportProviderProfilesRequest\x1a,.openshell.v1.ImportProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x98\x01\n" +
	"\x16UpdateProviderProfiles\x12+.openshell.v1.UpdateProviderProfilesRequest\x1a,.openshell.v1.UpdateProviderProfilesResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" +
	"\x14LintProviderProfiles\x12).openshell.v1.LintProviderProfilesRequest\x1a*.openshell.v1.LintProviderProfilesResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12z\n" +
	"\x0eUpdateProvider\x12#.openshell.v1.UpdateProviderRequest\x1a\x1e.openshell.v1.ProviderResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9c\x01\n" +
	"\x18GetProviderRefreshStatus\x12-.openshell.v1.GetProviderRefreshStatusRequest\x1a..openshell.v1.GetProviderRefreshStatusResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x04user\"\rprovider:read\x12\x9e\x01\n" +
	"\x18ConfigureProviderRefresh\x12-.openshell.v1.ConfigureProviderRefreshRequest\x1a..openshell.v1.ConfigureProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x9e\x01\n" +
	"\x18RotateProviderCredential\x12-.openshell.v1.RotateProviderCredentialRequest\x1a..openshell.v1.RotateProviderCredentialResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" +
	"\x15DeleteProviderRefresh\x12*.openshell.v1.DeleteProviderRefreshRequest\x1a+.openshell.v1.DeleteProviderRefreshResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x80\x01\n" +
	"\x0eDeleteProvider\x12#.openshell.v1.DeleteProviderRequest\x1a$.openshell.v1.DeleteProviderResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x95\x01\n" +
	"\x15DeleteProviderProfile\x12*.openshell.v1.DeleteProviderProfileRequest\x1a+.openshell.v1.DeleteProviderProfileResponse\"#\x82\xb5\x18\x1f\n" +
	"\x06bearer\x12\x05admin\"\x0eprovider:write\x12\x90\x01\n" +
	"\x10GetSandboxConfig\x12-.openshell.sandbox.v1.GetSandboxConfigRequest\x1a..openshell.sandbox.v1.GetSandboxConfigResponse\"\x1d\x82\xb5\x18\x19\n" +
	"\x04dual\x12\x04user\"\vconfig:read\x12\x8c\x01\n" +
	"\x10GetGatewayConfig\x12-.openshell.sandbox.v1.GetGatewayConfigRequest\x1a..openshell.sandbox.v1.GetGatewayConfigResponse\"\x19\x82\xb5\x18\x15\n" +
	"\x06bearer\"\vconfig:read\x12v\n" +
	"\fUpdateConfig\x12!.openshell.v1.UpdateConfigRequest\x1a\".openshell.v1.UpdateConfigResponse\"\x1f\x82\xb5\x18\x1b\n" +
	"\x04dual\x12\x05admin\"\fconfig:write\x12\x95\x01\n" +
	"\x16GetSandboxPolicyStatus\x12+.openshell.v1.GetSandboxPolicyStatusRequest\x1a,.openshell.v1.GetSandboxPolicyStatusResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12\x8c\x01\n" +
	"\x13ListSandboxPolicies\x12(.openshell.v1.ListSandboxPoliciesRequest\x1a).openshell.v1.ListSandboxPoliciesResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12v\n" +
	"\x12ReportPolicyStatus\x12'.openshell.v1.ReportPolicyStatusRequest\x1a(.openshell.v1.ReportPolicyStatusResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x97\x01\n" +
	"\x1dGetSandboxProviderEnvironment\x122.openshell.v1.GetSandboxProviderEnvironmentRequest\x1a3.openshell.v1.GetSandboxProviderEnvironmentResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12}\n" +
	"\x0eGetSandboxLogs\x12#.openshell.v1.GetSandboxLogsRequest\x1a$.openshell.v1.GetSandboxLogsResponse\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read\x12o\n" +
	"\x0fPushSandboxLogs\x12$.openshell.v1.PushSandboxLogsRequest\x1a%.openshell.v1.PushSandboxLogsResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox(\x01\x12e\n" +
	"\x11ConnectSupervisor\x12\x1f.openshell.v1.SupervisorMessage\x1a\x1c.openshell.v1.GatewayMessage\"\r\x82\xb5\x18\t\n" +
	"\asandbox(\x010\x01\x12\x7f\n" +
	"\x15ReportMainProcessExit\x12*.openshell.v1.ReportMainProcessExitRequest\x1a+.openshell.v1.ReportMainProcessExitResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12T\n" +
	"\vRelayStream\x12\x18.openshell.v1.RelayFrame\x1a\x18.openshell.v1.RelayFrame\"\r\x82\xb5\x18\t\n" +
	"\asandbox(\x010\x01\x12w\n" +
	"\fWatchSandbox\x12!.openshell.v1.WatchSandboxRequest\x1a .openshell.v1.SandboxStreamEvent\" \x82\xb5\x18\x1c\n" +
	"\x06bearer\x12\x04user\"\fsandbox:read0\x01\x12|\n" +
	"\x14SubmitPolicyAnalysis\x12).openshell.v1.SubmitPolicyAnalysisRequest\x1a*.openshell.v1.SubmitPolicyAnalysisResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12z\n" +
	"\x0eGetDraftPolicy\x12#.openshell.v1.GetDraftPolicyRequest\x1a$.openshell.v1.GetDraftPolicyResponse\"\x1d\x82\xb5\x18\x19\n" +
	"\x04dual\x12\x04user\"\vconfig:read\x12\x87\x01\n" +
	"\x11ApproveDraftChunk\x12&.openshell.v1.ApproveDraftChunkRequest\x1a'.openshell.v1.ApproveDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" +
	"\x10RejectDraftChunk\x12%.openshell.v1.RejectDraftChunkRequest\x1a&.openshell.v1.RejectDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x93\x01\n" +
	"\x15ApproveAllDraftChunks\x12*.openshell.v1.ApproveAllDraftChunksRequest\x1a+.openshell.v1.ApproveAllDraftChunksResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" +
	"\x0eEditDraftChunk\x12#.openshell.v1.EditDraftChunkRequest\x1a$.openshell.v1.EditDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12~\n" +
	"\x0eUndoDraftChunk\x12#.openshell.v1.UndoDraftChunkRequest\x1a$.openshell.v1.UndoDraftChunkResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x84\x01\n" +
	"\x10ClearDraftChunks\x12%.openshell.v1.ClearDraftChunksRequest\x1a&.openshell.v1.ClearDraftChunksResponse\"!\x82\xb5\x18\x1d\n" +
	"\x06bearer\x12\x05admin\"\fconfig:write\x12\x7f\n" +
	"\x0fGetDraftHistory\x12$.openshell.v1.GetDraftHistoryRequest\x1a%.openshell.v1.GetDraftHistoryResponse\"\x1f\x82\xb5\x18\x1b\n" +
	"\x06bearer\x12\x04user\"\vconfig:read\x12s\n" +
	"\x11IssueSandboxToken\x12&.openshell.v1.IssueSandboxTokenRequest\x1a'.openshell.v1.IssueSandboxTokenResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12y\n" +
	"\x13RefreshSandboxToken\x12(.openshell.v1.RefreshSandboxTokenRequest\x1a).openshell.v1.RefreshSandboxTokenResponse\"\r\x82\xb5\x18\t\n" +
	"\asandbox\x12\x8d\x01\n" +
	"\x0fCreateWorkspace\x12$.openshell.v1.CreateWorkspaceRequest\x1a%.openshell.v1.CreateWorkspaceResponse\"-\x82\xb5\x18)\n" +
	"\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12y\n" +
	"\fGetWorkspace\x12!.openshell.v1.GetWorkspaceRequest\x1a\".openshell.v1.GetWorkspaceResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x7f\n" +
	"\x0eListWorkspaces\x12#.openshell.v1.ListWorkspacesRequest\x1a$.openshell.v1.ListWorkspacesResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x04user\"\x0eworkspace:read\x12\x8d\x01\n" +
	"\x0fDeleteWorkspace\x12$.openshell.v1.DeleteWorkspaceRequest\x1a%.openshell.v1.DeleteWorkspaceResponse\"-\x82\xb5\x18)\n" +
	"\x06bearer\x1a\x0eplatform_admin\"\x0fworkspace:write\x12\x8d\x01\n" +
	"\x12AddWorkspaceMember\x12'.openshell.v1.AddWorkspaceMemberRequest\x1a(.openshell.v1.AddWorkspaceMemberResponse\"$\x82\xb5\x18 \n" +
	"\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x96\x01\n" +
	"\x15RemoveWorkspaceMember\x12*.openshell.v1.RemoveWorkspaceMemberRequest\x1a+.openshell.v1.RemoveWorkspaceMemberResponse\"$\x82\xb5\x18 \n" +
	"\x06bearer\x12\x05admin\"\x0fworkspace:write\x12\x91\x01\n" +
	"\x14ListWorkspaceMembers\x12).openshell.v1.ListWorkspaceMembersRequest\x1a*.openshell.v1.ListWorkspaceMembersResponse\"\"\x82\xb5\x18\x1e\n" +
	"\x06bearer\x12\x04user\"\x0eworkspace:readb\x06proto3"

var (
	file_openshell_proto_rawDescOnce sync.Once
	file_openshell_proto_rawDescData []byte
)

func file_openshell_proto_rawDescGZIP() []byte {
	file_openshell_proto_rawDescOnce.Do(func() {
		file_openshell_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)))
	})
	return file_openshell_proto_rawDescData
}

var file_openshell_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
var file_openshell_proto_msgTypes = make([]protoimpl.MessageInfo, 213)
var file_openshell_proto_goTypes = []any{
	(SandboxPhase)(0),                                    // 0: openshell.v1.SandboxPhase
	(ProviderCredentialRefreshStrategy)(0),               // 1: openshell.v1.ProviderCredentialRefreshStrategy
	(ProviderProfileCategory)(0),                         // 2: openshell.v1.ProviderProfileCategory
	(PolicyStatus)(0),                                    // 3: openshell.v1.PolicyStatus
	(ServiceStatus)(0),                                   // 4: openshell.v1.ServiceStatus
	(WorkspaceRole)(0),                                   // 5: openshell.v1.WorkspaceRole
	(*IssueSandboxTokenRequest)(nil),                     // 6: openshell.v1.IssueSandboxTokenRequest
	(*IssueSandboxTokenResponse)(nil),                    // 7: openshell.v1.IssueSandboxTokenResponse
	(*RefreshSandboxTokenRequest)(nil),                   // 8: openshell.v1.RefreshSandboxTokenRequest
	(*RefreshSandboxTokenResponse)(nil),                  // 9: openshell.v1.RefreshSandboxTokenResponse
	(*HealthRequest)(nil),                                // 10: openshell.v1.HealthRequest
	(*HealthResponse)(nil),                               // 11: openshell.v1.HealthResponse
	(*GetCurrentUserRequest)(nil),                        // 12: openshell.v1.GetCurrentUserRequest
	(*GetCurrentUserResponse)(nil),                       // 13: openshell.v1.GetCurrentUserResponse
	(*GetGatewayInfoRequest)(nil),                        // 14: openshell.v1.GetGatewayInfoRequest
	(*GetGatewayInfoResponse)(nil),                       // 15: openshell.v1.GetGatewayInfoResponse
	(*ComputeDriverInfo)(nil),                            // 16: openshell.v1.ComputeDriverInfo
	(*ComputeDriverCapabilities)(nil),                    // 17: openshell.v1.ComputeDriverCapabilities
	(*Sandbox)(nil),                                      // 18: openshell.v1.Sandbox
	(*SandboxSpec)(nil),                                  // 19: openshell.v1.SandboxSpec
	(*ResourceRequirements)(nil),                         // 20: openshell.v1.ResourceRequirements
	(*GpuResourceRequirements)(nil),                      // 21: openshell.v1.GpuResourceRequirements
	(*SandboxTemplate)(nil),                              // 22: openshell.v1.SandboxTemplate
	(*SandboxStatus)(nil),                                // 23: openshell.v1.SandboxStatus
	(*SandboxCondition)(nil),                             // 24: openshell.v1.SandboxCondition
	(*PlatformEvent)(nil),                                // 25: openshell.v1.PlatformEvent
	(*CreateSandboxRequest)(nil),                         // 26: openshell.v1.CreateSandboxRequest
	(*GetSandboxRequest)(nil),                            // 27: openshell.v1.GetSandboxRequest
	(*ListSandboxesRequest)(nil),                         // 28: openshell.v1.ListSandboxesRequest
	(*ListSandboxProvidersRequest)(nil),                  // 29: openshell.v1.ListSandboxProvidersRequest
	(*AttachSandboxProviderRequest)(nil),                 // 30: openshell.v1.AttachSandboxProviderRequest
	(*DetachSandboxProviderRequest)(nil),                 // 31: openshell.v1.DetachSandboxProviderRequest
	(*DeleteSandboxRequest)(nil),                         // 32: openshell.v1.DeleteSandboxRequest
	(*StopSandboxRequest)(nil),                           // 33: openshell.v1.StopSandboxRequest
	(*StartSandboxRequest)(nil),                          // 34: openshell.v1.StartSandboxRequest
	(*SandboxResponse)(nil),                              // 35: openshell.v1.SandboxResponse
	(*ListSandboxesResponse)(nil),                        // 36: openshell.v1.ListSandboxesResponse
	(*ListSandboxProvidersResponse)(nil),                 // 37: openshell.v1.ListSandboxProvidersResponse
	(*AttachSandboxProviderResponse)(nil),                // 38: openshell.v1.AttachSandboxProviderResponse
	(*DetachSandboxProviderResponse)(nil),                // 39: openshell.v1.DetachSandboxProviderResponse
	(*DeleteSandboxResponse)(nil),                        // 40: openshell.v1.DeleteSandboxResponse
	(*CreateSshSessionRequest)(nil),                      // 41: openshell.v1.CreateSshSessionRequest
	(*CreateSshSessionResponse)(nil),                     // 42: openshell.v1.CreateSshSessionResponse
	(*ExposeServiceRequest)(nil),                         // 43: openshell.v1.ExposeServiceRequest
	(*GetServiceRequest)(nil),                            // 44: openshell.v1.GetServiceRequest
	(*ListServicesRequest)(nil),                          // 45: openshell.v1.ListServicesRequest
	(*ListServicesResponse)(nil),                         // 46: openshell.v1.ListServicesResponse
	(*DeleteServiceRequest)(nil),                         // 47: openshell.v1.DeleteServiceRequest
	(*DeleteServiceResponse)(nil),                        // 48: openshell.v1.DeleteServiceResponse
	(*ServiceEndpoint)(nil),                              // 49: openshell.v1.ServiceEndpoint
	(*ServiceEndpointResponse)(nil),                      // 50: openshell.v1.ServiceEndpointResponse
	(*RevokeSshSessionRequest)(nil),                      // 51: openshell.v1.RevokeSshSessionRequest
	(*RevokeSshSessionResponse)(nil),                     // 52: openshell.v1.RevokeSshSessionResponse
	(*ExecSandboxRequest)(nil),                           // 53: openshell.v1.ExecSandboxRequest
	(*ExecSandboxStdout)(nil),                            // 54: openshell.v1.ExecSandboxStdout
	(*ExecSandboxStderr)(nil),                            // 55: openshell.v1.ExecSandboxStderr
	(*ExecSandboxExit)(nil),                              // 56: openshell.v1.ExecSandboxExit
	(*ExecSandboxEvent)(nil),                             // 57: openshell.v1.ExecSandboxEvent
	(*TcpForwardInit)(nil),                               // 58: openshell.v1.TcpForwardInit
	(*TcpForwardFrame)(nil),                              // 59: openshell.v1.TcpForwardFrame
	(*ExecSandboxInput)(nil),                             // 60: openshell.v1.ExecSandboxInput
	(*ExecSandboxWindowResize)(nil),                      // 61: openshell.v1.ExecSandboxWindowResize
	(*SshSession)(nil),                                   // 62: openshell.v1.SshSession
	(*WatchSandboxRequest)(nil),                          // 63: openshell.v1.WatchSandboxRequest
	(*SandboxStreamEvent)(nil),                           // 64: openshell.v1.SandboxStreamEvent
	(*SandboxLogLine)(nil),                               // 65: openshell.v1.SandboxLogLine
	(*SandboxStreamWarning)(nil),                         // 66: openshell.v1.SandboxStreamWarning
	(*CreateProviderRequest)(nil),                        // 67: openshell.v1.CreateProviderRequest
	(*GetProviderRequest)(nil),                           // 68: openshell.v1.GetProviderRequest
	(*ListProvidersRequest)(nil),                         // 69: openshell.v1.ListProvidersRequest
	(*UpdateProviderRequest)(nil),                        // 70: openshell.v1.UpdateProviderRequest
	(*DeleteProviderRequest)(nil),                        // 71: openshell.v1.DeleteProviderRequest
	(*ProviderResponse)(nil),                             // 72: openshell.v1.ProviderResponse
	(*ListProvidersResponse)(nil),                        // 73: openshell.v1.ListProvidersResponse
	(*ListProviderProfilesRequest)(nil),                  // 74: openshell.v1.ListProviderProfilesRequest
	(*GetProviderProfileRequest)(nil),                    // 75: openshell.v1.GetProviderProfileRequest
	(*ProviderProfileImportItem)(nil),                    // 76: openshell.v1.ProviderProfileImportItem
	(*ProviderProfileDiagnostic)(nil),                    // 77: openshell.v1.ProviderProfileDiagnostic
	(*ProviderCredentialTokenGrantAudienceOverride)(nil), // 78: openshell.v1.ProviderCredentialTokenGrantAudienceOverride
	(*ProviderCredentialTokenGrant)(nil),                 // 79: openshell.v1.ProviderCredentialTokenGrant
	(*ProviderProfileCredential)(nil),                    // 80: openshell.v1.ProviderProfileCredential
	(*ProviderCredentialRefreshMaterial)(nil),            // 81: openshell.v1.ProviderCredentialRefreshMaterial
	(*ProviderCredentialRefreshOutput)(nil),              // 82: openshell.v1.ProviderCredentialRefreshOutput
	(*ProviderCredentialRefresh)(nil),                    // 83: openshell.v1.ProviderCredentialRefresh
	(*ProviderCredentialRefreshStatus)(nil),              // 84: openshell.v1.ProviderCredentialRefreshStatus
	(*ProviderProfileDiscovery)(nil),                     // 85: openshell.v1.ProviderProfileDiscovery
	(*StoredProviderCredentialRefreshState)(nil),         // 86: openshell.v1.StoredProviderCredentialRefreshState
	(*StoredRefreshMaterialDeletion)(nil),                // 87: openshell.v1.StoredRefreshMaterialDeletion
	(*GetProviderRefreshStatusRequest)(nil),              // 88: openshell.v1.GetProviderRefreshStatusRequest
	(*GetProviderRefreshStatusResponse)(nil),             // 89: openshell.v1.GetProviderRefreshStatusResponse
	(*ConfigureProviderRefreshRequest)(nil),              // 90: openshell.v1.ConfigureProviderRefreshRequest
	(*ConfigureProviderRefreshResponse)(nil),             // 91: openshell.v1.ConfigureProviderRefreshResponse
	(*RotateProviderCredentialRequest)(nil),              // 92: openshell.v1.RotateProviderCredentialRequest
	(*RotateProviderCredentialResponse)(nil),             // 93: openshell.v1.RotateProviderCredentialResponse
	(*DeleteProviderRefreshRequest)(nil),                 // 94: openshell.v1.DeleteProviderRefreshRequest
	(*DeleteProviderRefreshResponse)(nil),                // 95: openshell.v1.DeleteProviderRefreshResponse
	(*ProviderProfile)(nil),                              // 96: openshell.v1.ProviderProfile
	(*StoredProviderProfile)(nil),                        // 97: openshell.v1.StoredProviderProfile
	(*ProviderProfileResponse)(nil),                      // 98: openshell.v1.ProviderProfileResponse
	(*ListProviderProfilesResponse)(nil),                 // 99: openshell.v1.ListProviderProfilesResponse
	(*ImportProviderProfilesRequest)(nil),                // 100: openshell.v1.ImportProviderProfilesRequest
	(*ImportProviderProfilesResponse)(nil),               // 101: openshell.v1.ImportProviderProfilesResponse
	(*UpdateProviderProfilesRequest)(nil),                // 102: openshell.v1.UpdateProviderProfilesRequest
	(*UpdateProviderProfilesResponse)(nil),               // 103: openshell.v1.UpdateProviderProfilesResponse
	(*LintProviderProfilesRequest)(nil),                  // 104: openshell.v1.LintProviderProfilesRequest
	(*LintProviderProfilesResponse)(nil),                 // 105: openshell.v1.LintProviderProfilesResponse
	(*DeleteProviderResponse)(nil),                       // 106: openshell.v1.DeleteProviderResponse
	(*DeleteProviderProfileRequest)(nil),                 // 107: openshell.v1.DeleteProviderProfileRequest
	(*DeleteProviderProfileResponse)(nil),                // 108: openshell.v1.DeleteProviderProfileResponse
	(*GetSandboxProviderEnvironmentRequest)(nil),         // 109: openshell.v1.GetSandboxProviderEnvironmentRequest
	(*StaticCredentialEndpointBinding)(nil),              // 110: openshell.v1.StaticCredentialEndpointBinding
	(*StaticCredentialBinding)(nil),                      // 111: openshell.v1.StaticCredentialBinding
	(*GetSandboxProviderEnvironmentResponse)(nil),        // 112: openshell.v1.GetSandboxProviderEnvironmentResponse
	(*UpdateConfigRequest)(nil),                          // 113: openshell.v1.UpdateConfigRequest
	(*PolicyMergeOperation)(nil),                         // 114: openshell.v1.PolicyMergeOperation
	(*AddNetworkRule)(nil),                               // 115: openshell.v1.AddNetworkRule
	(*RemoveNetworkEndpoint)(nil),                        // 116: openshell.v1.RemoveNetworkEndpoint
	(*RemoveNetworkRule)(nil),                            // 117: openshell.v1.RemoveNetworkRule
	(*AddDenyRules)(nil),                                 // 118: openshell.v1.AddDenyRules
	(*AddAllowRules)(nil),                                // 119: openshell.v1.AddAllowRules
	(*RemoveNetworkBinary)(nil),                          // 120: openshell.v1.RemoveNetworkBinary
	(*UpdateConfigResponse)(nil),                         // 121: openshell.v1.UpdateConfigResponse
	(*GetSandboxPolicyStatusRequest)(nil),                // 122: openshell.v1.GetSandboxPolicyStatusRequest
	(*GetSandboxPolicyStatusResponse)(nil),               // 123: openshell.v1.GetSandboxPolicyStatusResponse
	(*ListSandboxPoliciesRequest)(nil),                   // 124: openshell.v1.ListSandboxPoliciesRequest
	(*ListSandboxPoliciesResponse)(nil),                  // 125: openshell.v1.ListSandboxPoliciesResponse
	(*ReportPolicyStatusRequest)(nil),                    // 126: openshell.v1.ReportPolicyStatusRequest
	(*ReportPolicyStatusResponse)(nil),                   // 127: openshell.v1.ReportPolicyStatusResponse
	(*SandboxPolicyRevision)(nil),                        // 128: openshell.v1.SandboxPolicyRevision
	(*GetSandboxLogsRequest)(nil),                        // 129: openshell.v1.GetSandboxLogsRequest
	(*PushSandboxLogsRequest)(nil),                       // 130: openshell.v1.PushSandboxLogsRequest
	(*PushSandboxLogsResponse)(nil),                      // 131: openshell.v1.PushSandboxLogsResponse
	(*GetSandboxLogsResponse)(nil),                       // 132: openshell.v1.GetSandboxLogsResponse
	(*SupervisorMessage)(nil),                            // 133: openshell.v1.SupervisorMessage
	(*GatewayMessage)(nil),                               // 134: openshell.v1.GatewayMessage
	(*SupervisorHello)(nil),                              // 135: openshell.v1.SupervisorHello
	(*SessionAccepted)(nil),                              // 136: openshell.v1.SessionAccepted
	(*SessionRejected)(nil),                              // 137: openshell.v1.SessionRejected
	(*SupervisorHeartbeat)(nil),                          // 138: openshell.v1.SupervisorHeartbeat
	(*GatewayHeartbeat)(nil),                             // 139: openshell.v1.GatewayHeartbeat
	(*ReportMainProcessExitRequest)(nil),                 // 140: openshell.v1.ReportMainProcessExitRequest
	(*ReportMainProcessExitResponse)(nil),                // 141: openshell.v1.ReportMainProcessExitResponse
	(*RelayOpen)(nil),                                    // 142: openshell.v1.RelayOpen
	(*SshRelayTarget)(nil),                               // 143: openshell.v1.SshRelayTarget
	(*TcpRelayTarget)(nil),                               // 144: openshell.v1.TcpRelayTarget
	(*RelayInit)(nil),                                    // 145: openshell.v1.RelayInit
	(*RelayFrame)(nil),                                   // 146: openshell.v1.RelayFrame
	(*RelayOpenResult)(nil),                              // 147: openshell.v1.RelayOpenResult
	(*RelayClose)(nil),                                   // 148: openshell.v1.RelayClose
	(*L7RequestSample)(nil),                              // 149: openshell.v1.L7RequestSample
	(*DenialSummary)(nil),                                // 150: openshell.v1.DenialSummary
	(*DenialGroupCount)(nil),                             // 151: openshell.v1.DenialGroupCount
	(*NetworkActivitySummary)(nil),                       // 152: openshell.v1.NetworkActivitySummary
	(*PolicyChunk)(nil),                                  // 153: openshell.v1.PolicyChunk
	(*DraftPolicyUpdate)(nil),                            // 154: openshell.v1.DraftPolicyUpdate
	(*SubmitPolicyAnalysisRequest)(nil),                  // 155: openshell.v1.SubmitPolicyAnalysisRequest
	(*SubmitPolicyAnalysisResponse)(nil),                 // 156: openshell.v1.SubmitPolicyAnalysisResponse
	(*GetDraftPolicyRequest)(nil),                        // 157: openshell.v1.GetDraftPolicyRequest
	(*GetDraftPolicyResponse)(nil),                       // 158: openshell.v1.GetDraftPolicyResponse
	(*ApproveDraftChunkRequest)(nil),                     // 159: openshell.v1.ApproveDraftChunkRequest
	(*ApproveDraftChunkResponse)(nil),                    // 160: openshell.v1.ApproveDraftChunkResponse
	(*RejectDraftChunkRequest)(nil),                      // 161: openshell.v1.RejectDraftChunkRequest
	(*RejectDraftChunkResponse)(nil),                     // 162: openshell.v1.RejectDraftChunkResponse
	(*ApproveAllDraftChunksRequest)(nil),                 // 163: openshell.v1.ApproveAllDraftChunksRequest
	(*ApproveAllDraftChunksResponse)(nil),                // 164: openshell.v1.ApproveAllDraftChunksResponse
	(*EditDraftChunkRequest)(nil),                        // 165: openshell.v1.EditDraftChunkRequest
	(*EditDraftChunkResponse)(nil),                       // 166: openshell.v1.EditDraftChunkResponse
	(*UndoDraftChunkRequest)(nil),                        // 167: openshell.v1.UndoDraftChunkRequest
	(*UndoDraftChunkResponse)(nil),                       // 168: openshell.v1.UndoDraftChunkResponse
	(*ClearDraftChunksRequest)(nil),                      // 169: openshell.v1.ClearDraftChunksRequest
	(*ClearDraftChunksResponse)(nil),                     // 170: openshell.v1.ClearDraftChunksResponse
	(*GetDraftHistoryRequest)(nil),                       // 171: openshell.v1.GetDraftHistoryRequest
	(*DraftHistoryEntry)(nil),                            // 172: openshell.v1.DraftHistoryEntry
	(*GetDraftHistoryResponse)(nil),                      // 173: openshell.v1.GetDraftHistoryResponse
	(*PolicyRevisionPayload)(nil),                        // 174: openshell.v1.PolicyRevisionPayload
	(*DraftChunkPayload)(nil),                            // 175: openshell.v1.DraftChunkPayload
	(*StoredPolicyRevision)(nil),                         // 176: openshell.v1.StoredPolicyRevision
	(*StoredDraftChunk)(nil),                             // 177: openshell.v1.StoredDraftChunk
	(*CreateWorkspaceRequest)(nil),                       // 178: openshell.v1.CreateWorkspaceRequest
	(*CreateWorkspaceResponse)(nil),                      // 179: openshell.v1.CreateWorkspaceResponse
	(*GetWorkspaceRequest)(nil),                          // 180: openshell.v1.GetWorkspaceRequest
	(*GetWorkspaceResponse)(nil),                         // 181: openshell.v1.GetWorkspaceResponse
	(*ListWorkspacesRequest)(nil),                        // 182: openshell.v1.ListWorkspacesRequest
	(*ListWorkspacesResponse)(nil),                       // 183: openshell.v1.ListWorkspacesResponse
	(*DeleteWorkspaceRequest)(nil),                       // 184: openshell.v1.DeleteWorkspaceRequest
	(*DeleteWorkspaceResponse)(nil),                      // 185: openshell.v1.DeleteWorkspaceResponse
	(*WorkspaceMember)(nil),                              // 186: openshell.v1.WorkspaceMember
	(*AddWorkspaceMemberRequest)(nil),                    // 187: openshell.v1.AddWorkspaceMemberRequest
	(*AddWorkspaceMemberResponse)(nil),                   // 188: openshell.v1.AddWorkspaceMemberResponse
	(*RemoveWorkspaceMemberRequest)(nil),                 // 189: openshell.v1.RemoveWorkspaceMemberRequest
	(*RemoveWorkspaceMemberResponse)(nil),                // 190: openshell.v1.RemoveWorkspaceMemberResponse
	(*ListWorkspaceMembersRequest)(nil),                  // 191: openshell.v1.ListWorkspaceMembersRequest
	(*ListWorkspaceMembersResponse)(nil),                 // 192: openshell.v1.ListWorkspaceMembersResponse
	(*ExtensionServiceCredential)(nil),                   // 193: openshell.v1.ExtensionServiceCredential
	nil,                                                  // 194: openshell.v1.SandboxSpec.EnvironmentEntry
	nil,                                                  // 195: openshell.v1.SandboxTemplate.LabelsEntry
	nil,                                                  // 196: openshell.v1.SandboxTemplate.AnnotationsEntry
	nil,                                                  // 197: openshell.v1.SandboxTemplate.EnvironmentEntry
	nil,                                                  // 198: openshell.v1.PlatformEvent.MetadataEntry
	nil,                                                  // 199: openshell.v1.CreateSandboxRequest.LabelsEntry
	nil,                                                  // 200: openshell.v1.CreateSandboxRequest.AnnotationsEntry
	nil,                                                  // 201: openshell.v1.ExecSandboxRequest.EnvironmentEntry
	nil,                                                  // 202: openshell.v1.SandboxLogLine.FieldsEntry
	nil,                                                  // 203: openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntry
	nil,                                                  // 204: openshell.v1.StoredProviderCredentialRefreshState.MaterialEntry
	nil,                                                  // 205: openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntry
	nil,                                                  // 206: openshell.v1.StoredProviderCredentialRefreshState.SecretMaterialHandlesEntry
	nil,                                                  // 207: openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry
	nil,                                                  // 208: openshell.v1.ProviderProfile.AnnotationsEntry
	nil,                                                  // 209: openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry
	nil,                                                  // 210: openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntry
	nil,                                                  // 211: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry
	nil,                                                  // 212: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry
	nil,                                                  // 213: openshell.v1.UpdateConfigRequest.AnnotationsEntry
	nil,                                                  // 214: openshell.v1.UpdateConfigResponse.AnnotationsEntry
	nil,                                                  // 215: openshell.v1.SandboxPolicyRevision.ProvenanceEntry
	nil,                                                  // 216: openshell.v1.PolicyRevisionPayload.ProvenanceEntry
	nil,                                                  // 217: openshell.v1.StoredPolicyRevision.ProvenanceEntry
	nil,                                                  // 218: openshell.v1.CreateWorkspaceRequest.LabelsEntry
	(*datamodelv1.ObjectMeta)(nil),                       // 219: openshell.datamodel.v1.ObjectMeta
	(*sandboxv1.SandboxPolicy)(nil),                      // 220: openshell.sandbox.v1.SandboxPolicy
	(*structpb.Struct)(nil),                              // 221: google.protobuf.Struct
	(*datamodelv1.Provider)(nil),                         // 222: openshell.datamodel.v1.Provider
	(*datamodelv1.CredentialHandle)(nil),                 // 223: openshell.datamodel.v1.CredentialHandle
	(*sandboxv1.NetworkEndpoint)(nil),                    // 224: openshell.sandbox.v1.NetworkEndpoint
	(*sandboxv1.NetworkBinary)(nil),                      // 225: openshell.sandbox.v1.NetworkBinary
	(*sandboxv1.SettingValue)(nil),                       // 226: openshell.sandbox.v1.SettingValue
	(*sandboxv1.NetworkPolicyRule)(nil),                  // 227: openshell.sandbox.v1.NetworkPolicyRule
	(*sandboxv1.L7DenyRule)(nil),                         // 228: openshell.sandbox.v1.L7DenyRule
	(*sandboxv1.L7Rule)(nil),                             // 229: openshell.sandbox.v1.L7Rule
	(*datamodelv1.Workspace)(nil),                        // 230: openshell.datamodel.v1.Workspace
	(*sandboxv1.GetSandboxConfigRequest)(nil),            // 231: openshell.sandbox.v1.GetSandboxConfigRequest
	(*sandboxv1.GetGatewayConfigRequest)(nil),            // 232: openshell.sandbox.v1.GetGatewayConfigRequest
	(*sandboxv1.GetSandboxConfigResponse)(nil),           // 233: openshell.sandbox.v1.GetSandboxConfigResponse
	(*sandboxv1.GetGatewayConfigResponse)(nil),           // 234: openshell.sandbox.v1.GetGatewayConfigResponse
}
var file_openshell_proto_depIdxs = []int32{
	193, // 0: openshell.v1.RefreshSandboxTokenResponse.extension_credentials:type_name -> openshell.v1.ExtensionServiceCredential
	4,   // 1: openshell.v1.HealthResponse.status:type_name -> openshell.v1.ServiceStatus
	4,   // 2: openshell.v1.GetGatewayInfoResponse.status:type_name -> openshell.v1.ServiceStatus
	16,  // 3: openshell.v1.GetGatewayInfoResponse.compute_drivers:type_name -> openshell.v1.ComputeDriverInfo
	17,  // 4: openshell.v1.ComputeDriverInfo.capabilities:type_name -> openshell.v1.ComputeDriverCapabilities
	219, // 5: openshell.v1.Sandbox.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	19,  // 6: openshell.v1.Sandbox.spec:type_name -> openshell.v1.SandboxSpec
	23,  // 7: openshell.v1.Sandbox.status:type_name -> openshell.v1.SandboxStatus
	194, // 8: openshell.v1.SandboxSpec.environment:type_name -> openshell.v1.SandboxSpec.EnvironmentEntry
	22,  // 9: openshell.v1.SandboxSpec.template:type_name -> openshell.v1.SandboxTemplate
	220, // 10: openshell.v1.SandboxSpec.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	20,  // 11: openshell.v1.SandboxSpec.resource_requirements:type_name -> openshell.v1.ResourceRequirements
	21,  // 12: openshell.v1.ResourceRequirements.gpu:type_name -> openshell.v1.GpuResourceRequirements
	195, // 13: openshell.v1.SandboxTemplate.labels:type_name -> openshell.v1.SandboxTemplate.LabelsEntry
	196, // 14: openshell.v1.SandboxTemplate.annotations:type_name -> openshell.v1.SandboxTemplate.AnnotationsEntry
	197, // 15: openshell.v1.SandboxTemplate.environment:type_name -> openshell.v1.SandboxTemplate.EnvironmentEntry
	221, // 16: openshell.v1.SandboxTemplate.resources:type_name -> google.protobuf.Struct
	221, // 17: openshell.v1.SandboxTemplate.driver_config:type_name -> google.protobuf.Struct
	24,  // 18: openshell.v1.SandboxStatus.conditions:type_name -> openshell.v1.SandboxCondition
	0,   // 19: openshell.v1.SandboxStatus.phase:type_name -> openshell.v1.SandboxPhase
	198, // 20: openshell.v1.PlatformEvent.metadata:type_name -> openshell.v1.PlatformEvent.MetadataEntry
	19,  // 21: openshell.v1.CreateSandboxRequest.spec:type_name -> openshell.v1.SandboxSpec
	199, // 22: openshell.v1.CreateSandboxRequest.labels:type_name -> openshell.v1.CreateSandboxRequest.LabelsEntry
	200, // 23: openshell.v1.CreateSandboxRequest.annotations:type_name -> openshell.v1.CreateSandboxRequest.AnnotationsEntry
	18,  // 24: openshell.v1.SandboxResponse.sandbox:type_name -> openshell.v1.Sandbox
	18,  // 25: openshell.v1.ListSandboxesResponse.sandboxes:type_name -> openshell.v1.Sandbox
	222, // 26: openshell.v1.ListSandboxProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
	18,  // 27: openshell.v1.AttachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
	18,  // 28: openshell.v1.DetachSandboxProviderResponse.sandbox:type_name -> openshell.v1.Sandbox
	50,  // 29: openshell.v1.ListServicesResponse.services:type_name -> openshell.v1.ServiceEndpointResponse
	219, // 30: openshell.v1.ServiceEndpoint.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	49,  // 31: openshell.v1.ServiceEndpointResponse.endpoint:type_name -> openshell.v1.ServiceEndpoint
	201, // 32: openshell.v1.ExecSandboxRequest.environment:type_name -> openshell.v1.ExecSandboxRequest.EnvironmentEntry
	54,  // 33: openshell.v1.ExecSandboxEvent.stdout:type_name -> openshell.v1.ExecSandboxStdout
	55,  // 34: openshell.v1.ExecSandboxEvent.stderr:type_name -> openshell.v1.ExecSandboxStderr
	56,  // 35: openshell.v1.ExecSandboxEvent.exit:type_name -> openshell.v1.ExecSandboxExit
	143, // 36: openshell.v1.TcpForwardInit.ssh:type_name -> openshell.v1.SshRelayTarget
	144, // 37: openshell.v1.TcpForwardInit.tcp:type_name -> openshell.v1.TcpRelayTarget
	58,  // 38: openshell.v1.TcpForwardFrame.init:type_name -> openshell.v1.TcpForwardInit
	53,  // 39: openshell.v1.ExecSandboxInput.start:type_name -> openshell.v1.ExecSandboxRequest
	61,  // 40: openshell.v1.ExecSandboxInput.resize:type_name -> openshell.v1.ExecSandboxWindowResize
	219, // 41: openshell.v1.SshSession.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	18,  // 42: openshell.v1.SandboxStreamEvent.sandbox:type_name -> openshell.v1.Sandbox
	65,  // 43: openshell.v1.SandboxStreamEvent.log:type_name -> openshell.v1.SandboxLogLine
	25,  // 44: openshell.v1.SandboxStreamEvent.event:type_name -> openshell.v1.PlatformEvent
	66,  // 45: openshell.v1.SandboxStreamEvent.warning:type_name -> openshell.v1.SandboxStreamWarning
	154, // 46: openshell.v1.SandboxStreamEvent.draft_policy_update:type_name -> openshell.v1.DraftPolicyUpdate
	202, // 47: openshell.v1.SandboxLogLine.fields:type_name -> openshell.v1.SandboxLogLine.FieldsEntry
	222, // 48: openshell.v1.CreateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
	222, // 49: openshell.v1.UpdateProviderRequest.provider:type_name -> openshell.datamodel.v1.Provider
	203, // 50: openshell.v1.UpdateProviderRequest.credential_expires_at_ms:type_name -> openshell.v1.UpdateProviderRequest.CredentialExpiresAtMsEntry
	222, // 51: openshell.v1.ProviderResponse.provider:type_name -> openshell.datamodel.v1.Provider
	222, // 52: openshell.v1.ListProvidersResponse.providers:type_name -> openshell.datamodel.v1.Provider
	96,  // 53: openshell.v1.ProviderProfileImportItem.profile:type_name -> openshell.v1.ProviderProfile
	78,  // 54: openshell.v1.ProviderCredentialTokenGrant.audience_overrides:type_name -> openshell.v1.ProviderCredentialTokenGrantAudienceOverride
	83,  // 55: openshell.v1.ProviderProfileCredential.refresh:type_name -> openshell.v1.ProviderCredentialRefresh
	79,  // 56: openshell.v1.ProviderProfileCredential.token_grant:type_name -> openshell.v1.ProviderCredentialTokenGrant
	1,   // 57: openshell.v1.ProviderCredentialRefresh.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	81,  // 58: openshell.v1.ProviderCredentialRefresh.material:type_name -> openshell.v1.ProviderCredentialRefreshMaterial
	82,  // 59: openshell.v1.ProviderCredentialRefresh.additional_outputs:type_name -> openshell.v1.ProviderCredentialRefreshOutput
	1,   // 60: openshell.v1.ProviderCredentialRefreshStatus.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	219, // 61: openshell.v1.StoredProviderCredentialRefreshState.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	1,   // 62: openshell.v1.StoredProviderCredentialRefreshState.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	204, // 63: openshell.v1.StoredProviderCredentialRefreshState.material:type_name -> openshell.v1.StoredProviderCredentialRefreshState.MaterialEntry
	205, // 64: openshell.v1.StoredProviderCredentialRefreshState.additional_output_keys:type_name -> openshell.v1.StoredProviderCredentialRefreshState.AdditionalOutputKeysEntry
	206, // 65: openshell.v1.StoredProviderCredentialRefreshState.secret_material_handles:type_name -> openshell.v1.StoredProviderCredentialRefreshState.SecretMaterialHandlesEntry
	87,  // 66: openshell.v1.StoredProviderCredentialRefreshState.pending_secret_deletions:type_name -> openshell.v1.StoredRefreshMaterialDeletion
	223, // 67: openshell.v1.StoredRefreshMaterialDeletion.handle:type_name -> openshell.datamodel.v1.CredentialHandle
	84,  // 68: openshell.v1.GetProviderRefreshStatusResponse.credentials:type_name -> openshell.v1.ProviderCredentialRefreshStatus
	1,   // 69: openshell.v1.ConfigureProviderRefreshRequest.strategy:type_name -> openshell.v1.ProviderCredentialRefreshStrategy
	207, // 70: openshell.v1.ConfigureProviderRefreshRequest.material:type_name -> openshell.v1.ConfigureProviderRefreshRequest.MaterialEntry
	84,  // 71: openshell.v1.ConfigureProviderRefreshResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
	84,  // 72: openshell.v1.RotateProviderCredentialResponse.status:type_name -> openshell.v1.ProviderCredentialRefreshStatus
	2,   // 73: openshell.v1.ProviderProfile.category:type_name -> openshell.v1.ProviderProfileCategory
	80,  // 74: openshell.v1.ProviderProfile.credentials:type_name -> openshell.v1.ProviderProfileCredential
	224, // 75: openshell.v1.ProviderProfile.endpoints:type_name -> openshell.sandbox.v1.NetworkEndpoint
	225, // 76: openshell.v1.ProviderProfile.binaries:type_name -> openshell.sandbox.v1.NetworkBinary
	85,  // 77: openshell.v1.ProviderProfile.discovery:type_name -> openshell.v1.ProviderProfileDiscovery
	208, // 78: openshell.v1.ProviderProfile.annotations:type_name -> openshell.v1.ProviderProfile.AnnotationsEntry
	219, // 79: openshell.v1.StoredProviderProfile.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	96,  // 80: openshell.v1.StoredProviderProfile.profile:type_name -> openshell.v1.ProviderProfile
	96,  // 81: openshell.v1.ProviderProfileResponse.profile:type_name -> openshell.v1.ProviderProfile
	96,  // 82: openshell.v1.ListProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
	76,  // 83: openshell.v1.ImportProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
	77,  // 84: openshell.v1.ImportProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
	96,  // 85: openshell.v1.ImportProviderProfilesResponse.profiles:type_name -> openshell.v1.ProviderProfile
	76,  // 86: openshell.v1.UpdateProviderProfilesRequest.profile:type_name -> openshell.v1.ProviderProfileImportItem
	77,  // 87: openshell.v1.UpdateProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
	96,  // 88: openshell.v1.UpdateProviderProfilesResponse.profile:type_name -> openshell.v1.ProviderProfile
	76,  // 89: openshell.v1.LintProviderProfilesRequest.profiles:type_name -> openshell.v1.ProviderProfileImportItem
	77,  // 90: openshell.v1.LintProviderProfilesResponse.diagnostics:type_name -> openshell.v1.ProviderProfileDiagnostic
	110, // 91: openshell.v1.StaticCredentialBinding.endpoints:type_name -> openshell.v1.StaticCredentialEndpointBinding
	209, // 92: openshell.v1.GetSandboxProviderEnvironmentResponse.environment:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.EnvironmentEntry
	210, // 93: openshell.v1.GetSandboxProviderEnvironmentResponse.credential_expires_at_ms:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.CredentialExpiresAtMsEntry
	211, // 94: openshell.v1.GetSandboxProviderEnvironmentResponse.dynamic_credentials:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry
	212, // 95: openshell.v1.GetSandboxProviderEnvironmentResponse.static_credential_bindings:type_name -> openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry
	220, // 96: openshell.v1.UpdateConfigRequest.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	226, // 97: openshell.v1.UpdateConfigRequest.setting_value:type_name -> openshell.sandbox.v1.SettingValue
	114, // 98: openshell.v1.UpdateConfigRequest.merge_operations:type_name -> openshell.v1.PolicyMergeOperation
	213, // 99: openshell.v1.UpdateConfigRequest.annotations:type_name -> openshell.v1.UpdateConfigRequest.AnnotationsEntry
	115, // 100: openshell.v1.PolicyMergeOperation.add_rule:type_name -> openshell.v1.AddNetworkRule
	116, // 101: openshell.v1.PolicyMergeOperation.remove_endpoint:type_name -> openshell.v1.RemoveNetworkEndpoint
	117, // 102: openshell.v1.PolicyMergeOperation.remove_rule:type_name -> openshell.v1.RemoveNetworkRule
	118, // 103: openshell.v1.PolicyMergeOperation.add_deny_rules:type_name -> openshell.v1.AddDenyRules
	119, // 104: openshell.v1.PolicyMergeOperation.add_allow_rules:type_name -> openshell.v1.AddAllowRules
	120, // 105: openshell.v1.PolicyMergeOperation.remove_binary:type_name -> openshell.v1.RemoveNetworkBinary
	227, // 106: openshell.v1.AddNetworkRule.rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	228, // 107: openshell.v1.AddDenyRules.deny_rules:type_name -> openshell.sandbox.v1.L7DenyRule
	229, // 108: openshell.v1.AddAllowRules.rules:type_name -> openshell.sandbox.v1.L7Rule
	214, // 109: openshell.v1.UpdateConfigResponse.annotations:type_name -> openshell.v1.UpdateConfigResponse.AnnotationsEntry
	128, // 110: openshell.v1.GetSandboxPolicyStatusResponse.revision:type_name -> openshell.v1.SandboxPolicyRevision
	128, // 111: openshell.v1.ListSandboxPoliciesResponse.revisions:type_name -> openshell.v1.SandboxPolicyRevision
	3,   // 112: openshell.v1.ReportPolicyStatusRequest.status:type_name -> openshell.v1.PolicyStatus
	3,   // 113: openshell.v1.SandboxPolicyRevision.status:type_name -> openshell.v1.PolicyStatus
	220, // 114: openshell.v1.SandboxPolicyRevision.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	215, // 115: openshell.v1.SandboxPolicyRevision.provenance:type_name -> openshell.v1.SandboxPolicyRevision.ProvenanceEntry
	65,  // 116: openshell.v1.PushSandboxLogsRequest.logs:type_name -> openshell.v1.SandboxLogLine
	65,  // 117: openshell.v1.GetSandboxLogsResponse.logs:type_name -> openshell.v1.SandboxLogLine
	135, // 118: openshell.v1.SupervisorMessage.hello:type_name -> openshell.v1.SupervisorHello
	138, // 119: openshell.v1.SupervisorMessage.heartbeat:type_name -> openshell.v1.SupervisorHeartbeat
	147, // 120: openshell.v1.SupervisorMessage.relay_open_result:type_name -> openshell.v1.RelayOpenResult
	148, // 121: openshell.v1.SupervisorMessage.relay_close:type_name -> openshell.v1.RelayClose
	136, // 122: openshell.v1.GatewayMessage.session_accepted:type_name -> openshell.v1.SessionAccepted
	137, // 123: openshell.v1.GatewayMessage.session_rejected:type_name -> openshell.v1.SessionRejected
	139, // 124: openshell.v1.GatewayMessage.heartbeat:type_name -> openshell.v1.GatewayHeartbeat
	142, // 125: openshell.v1.GatewayMessage.relay_open:type_name -> openshell.v1.RelayOpen
	148, // 126: openshell.v1.GatewayMessage.relay_close:type_name -> openshell.v1.RelayClose
	143, // 127: openshell.v1.RelayOpen.ssh:type_name -> openshell.v1.SshRelayTarget
	144, // 128: openshell.v1.RelayOpen.tcp:type_name -> openshell.v1.TcpRelayTarget
	145, // 129: openshell.v1.RelayFrame.init:type_name -> openshell.v1.RelayInit
	149, // 130: openshell.v1.DenialSummary.l7_request_samples:type_name -> openshell.v1.L7RequestSample
	151, // 131: openshell.v1.NetworkActivitySummary.denials_by_group:type_name -> openshell.v1.DenialGroupCount
	227, // 132: openshell.v1.PolicyChunk.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	150, // 133: openshell.v1.SubmitPolicyAnalysisRequest.summaries:type_name -> openshell.v1.DenialSummary
	153, // 134: openshell.v1.SubmitPolicyAnalysisRequest.proposed_chunks:type_name -> openshell.v1.PolicyChunk
	152, // 135: openshell.v1.SubmitPolicyAnalysisRequest.network_activity_summaries:type_name -> openshell.v1.NetworkActivitySummary
	153, // 136: openshell.v1.GetDraftPolicyResponse.chunks:type_name -> openshell.v1.PolicyChunk
	227, // 137: openshell.v1.EditDraftChunkRequest.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	172, // 138: openshell.v1.GetDraftHistoryResponse.entries:type_name -> openshell.v1.DraftHistoryEntry
	220, // 139: openshell.v1.PolicyRevisionPayload.policy:type_name -> openshell.sandbox.v1.SandboxPolicy
	216, // 140: openshell.v1.PolicyRevisionPayload.provenance:type_name -> openshell.v1.PolicyRevisionPayload.ProvenanceEntry
	227, // 141: openshell.v1.DraftChunkPayload.proposed_rule:type_name -> openshell.sandbox.v1.NetworkPolicyRule
	217, // 142: openshell.v1.StoredPolicyRevision.provenance:type_name -> openshell.v1.StoredPolicyRevision.ProvenanceEntry
	218, // 143: openshell.v1.CreateWorkspaceRequest.labels:type_name -> openshell.v1.CreateWorkspaceRequest.LabelsEntry
	230, // 144: openshell.v1.CreateWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
	230, // 145: openshell.v1.GetWorkspaceResponse.workspace:type_name -> openshell.datamodel.v1.Workspace
	230, // 146: openshell.v1.ListWorkspacesResponse.workspaces:type_name -> openshell.datamodel.v1.Workspace
	219, // 147: openshell.v1.WorkspaceMember.metadata:type_name -> openshell.datamodel.v1.ObjectMeta
	5,   // 148: openshell.v1.WorkspaceMember.role:type_name -> openshell.v1.WorkspaceRole
	5,   // 149: openshell.v1.AddWorkspaceMemberRequest.role:type_name -> openshell.v1.WorkspaceRole
	186, // 150: openshell.v1.AddWorkspaceMemberResponse.member:type_name -> openshell.v1.WorkspaceMember
	186, // 151: openshell.v1.ListWorkspaceMembersResponse.members:type_name -> openshell.v1.WorkspaceMember
	223, // 152: openshell.v1.StoredProviderCredentialRefreshState.SecretMaterialHandlesEntry.value:type_name -> openshell.datamodel.v1.CredentialHandle
	80,  // 153: openshell.v1.GetSandboxProviderEnvironmentResponse.DynamicCredentialsEntry.value:type_name -> openshell.v1.ProviderProfileCredential
	111, // 154: openshell.v1.GetSandboxProviderEnvironmentResponse.StaticCredentialBindingsEntry.value:type_name -> openshell.v1.StaticCredentialBinding
	10,  // 155: openshell.v1.OpenShell.Health:input_type -> openshell.v1.HealthRequest
	12,  // 156: openshell.v1.OpenShell.GetCurrentUser:input_type -> openshell.v1.GetCurrentUserRequest
	14,  // 157: openshell.v1.OpenShell.GetGatewayInfo:input_type -> openshell.v1.GetGatewayInfoRequest
	26,  // 158: openshell.v1.OpenShell.CreateSandbox:input_type -> openshell.v1.CreateSandboxRequest
	27,  // 159: openshell.v1.OpenShell.GetSandbox:input_type -> openshell.v1.GetSandboxRequest
	28,  // 160: openshell.v1.OpenShell.ListSandboxes:input_type -> openshell.v1.ListSandboxesRequest
	29,  // 161: openshell.v1.OpenShell.ListSandboxProviders:input_type -> openshell.v1.ListSandboxProvidersRequest
	30,  // 162: openshell.v1.OpenShell.AttachSandboxProvider:input_type -> openshell.v1.AttachSandboxProviderRequest
	31,  // 163: openshell.v1.OpenShell.DetachSandboxProvider:input_type -> openshell.v1.DetachSandboxProviderRequest
	32,  // 164: openshell.v1.OpenShell.DeleteSandbox:input_type -> openshell.v1.DeleteSandboxRequest
	33,  // 165: openshell.v1.OpenShell.StopSandbox:input_type -> openshell.v1.StopSandboxRequest
	34,  // 166: openshell.v1.OpenShell.StartSandbox:input_type -> openshell.v1.StartSandboxRequest
	41,  // 167: openshell.v1.OpenShell.CreateSshSession:input_type -> openshell.v1.CreateSshSessionRequest
	43,  // 168: openshell.v1.OpenShell.ExposeService:input_type -> openshell.v1.ExposeServiceRequest
	44,  // 169: openshell.v1.OpenShell.GetService:input_type -> openshell.v1.GetServiceRequest
	45,  // 170: openshell.v1.OpenShell.ListServices:input_type -> openshell.v1.ListServicesRequest
	47,  // 171: openshell.v1.OpenShell.DeleteService:input_type -> openshell.v1.DeleteServiceRequest
	51,  // 172: openshell.v1.OpenShell.RevokeSshSession:input_type -> openshell.v1.RevokeSshSessionRequest
	53,  // 173: openshell.v1.OpenShell.ExecSandbox:input_type -> openshell.v1.ExecSandboxRequest
	59,  // 174: openshell.v1.OpenShell.ForwardTcp:input_type -> openshell.v1.TcpForwardFrame
	60,  // 175: openshell.v1.OpenShell.ExecSandboxInteractive:input_type -> openshell.v1.ExecSandboxInput
	67,  // 176: openshell.v1.OpenShell.CreateProvider:input_type -> openshell.v1.CreateProviderRequest
	68,  // 177: openshell.v1.OpenShell.GetProvider:input_type -> openshell.v1.GetProviderRequest
	69,  // 178: openshell.v1.OpenShell.ListProviders:input_type -> openshell.v1.ListProvidersRequest
	74,  // 179: openshell.v1.OpenShell.ListProviderProfiles:input_type -> openshell.v1.ListProviderProfilesRequest
	75,  // 180: openshell.v1.OpenShell.GetProviderProfile:input_type -> openshell.v1.GetProviderProfileRequest
	100, // 181: openshell.v1.OpenShell.ImportProviderProfiles:input_type -> openshell.v1.ImportProviderProfilesRequest
	102, // 182: openshell.v1.OpenShell.UpdateProviderProfiles:input_type -> openshell.v1.UpdateProviderProfilesRequest
	104, // 183: openshell.v1.OpenShell.LintProviderProfiles:input_type -> openshell.v1.LintProviderProfilesRequest
	70,  // 184: openshell.v1.OpenShell.UpdateProvider:input_type -> openshell.v1.UpdateProviderRequest
	88,  // 185: openshell.v1.OpenShell.GetProviderRefreshStatus:input_type -> openshell.v1.GetProviderRefreshStatusRequest
	90,  // 186: openshell.v1.OpenShell.ConfigureProviderRefresh:input_type -> openshell.v1.ConfigureProviderRefreshRequest
	92,  // 187: openshell.v1.OpenShell.RotateProviderCredential:input_type -> openshell.v1.RotateProviderCredentialRequest
	94,  // 188: openshell.v1.OpenShell.DeleteProviderRefresh:input_type -> openshell.v1.DeleteProviderRefreshRequest
	71,  // 189: openshell.v1.OpenShell.DeleteProvider:input_type -> openshell.v1.DeleteProviderRequest
	107, // 190: openshell.v1.OpenShell.DeleteProviderProfile:input_type -> openshell.v1.DeleteProviderProfileRequest
	231, // 191: openshell.v1.OpenShell.GetSandboxConfig:input_type -> openshell.sandbox.v1.GetSandboxConfigRequest
	232, // 192: openshell.v1.OpenShell.GetGatewayConfig:input_type -> openshell.sandbox.v1.GetGatewayConfigRequest
	113, // 193: openshell.v1.OpenShell.UpdateConfig:input_type -> openshell.v1.UpdateConfigRequest
	122, // 194: openshell.v1.OpenShell.GetSandboxPolicyStatus:input_type -> openshell.v1.GetSandboxPolicyStatusRequest
	124, // 195: openshell.v1.OpenShell.ListSandboxPolicies:input_type -> openshell.v1.ListSandboxPoliciesRequest
	126, // 196: openshell.v1.OpenShell.ReportPolicyStatus:input_type -> openshell.v1.ReportPolicyStatusRequest
	109, // 197: openshell.v1.OpenShell.GetSandboxProviderEnvironment:input_type -> openshell.v1.GetSandboxProviderEnvironmentRequest
	129, // 198: openshell.v1.OpenShell.GetSandboxLogs:input_type -> openshell.v1.GetSandboxLogsRequest
	130, // 199: openshell.v1.OpenShell.PushSandboxLogs:input_type -> openshell.v1.PushSandboxLogsRequest
	133, // 200: openshell.v1.OpenShell.ConnectSupervisor:input_type -> openshell.v1.SupervisorMessage
	140, // 201: openshell.v1.OpenShell.ReportMainProcessExit:input_type -> openshell.v1.ReportMainProcessExitRequest
	146, // 202: openshell.v1.OpenShell.RelayStream:input_type -> openshell.v1.RelayFrame
	63,  // 203: openshell.v1.OpenShell.WatchSandbox:input_type -> openshell.v1.WatchSandboxRequest
	155, // 204: openshell.v1.OpenShell.SubmitPolicyAnalysis:input_type -> openshell.v1.SubmitPolicyAnalysisRequest
	157, // 205: openshell.v1.OpenShell.GetDraftPolicy:input_type -> openshell.v1.GetDraftPolicyRequest
	159, // 206: openshell.v1.OpenShell.ApproveDraftChunk:input_type -> openshell.v1.ApproveDraftChunkRequest
	161, // 207: openshell.v1.OpenShell.RejectDraftChunk:input_type -> openshell.v1.RejectDraftChunkRequest
	163, // 208: openshell.v1.OpenShell.ApproveAllDraftChunks:input_type -> openshell.v1.ApproveAllDraftChunksRequest
	165, // 209: openshell.v1.OpenShell.EditDraftChunk:input_type -> openshell.v1.EditDraftChunkRequest
	167, // 210: openshell.v1.OpenShell.UndoDraftChunk:input_type -> openshell.v1.UndoDraftChunkRequest
	169, // 211: openshell.v1.OpenShell.ClearDraftChunks:input_type -> openshell.v1.ClearDraftChunksRequest
	171, // 212: openshell.v1.OpenShell.GetDraftHistory:input_type -> openshell.v1.GetDraftHistoryRequest
	6,   // 213: openshell.v1.OpenShell.IssueSandboxToken:input_type -> openshell.v1.IssueSandboxTokenRequest
	8,   // 214: openshell.v1.OpenShell.RefreshSandboxToken:input_type -> openshell.v1.RefreshSandboxTokenRequest
	178, // 215: openshell.v1.OpenShell.CreateWorkspace:input_type -> openshell.v1.CreateWorkspaceRequest
	180, // 216: openshell.v1.OpenShell.GetWorkspace:input_type -> openshell.v1.GetWorkspaceRequest
	182, // 217: openshell.v1.OpenShell.ListWorkspaces:input_type -> openshell.v1.ListWorkspacesRequest
	184, // 218: openshell.v1.OpenShell.DeleteWorkspace:input_type -> openshell.v1.DeleteWorkspaceRequest
	187, // 219: openshell.v1.OpenShell.AddWorkspaceMember:input_type -> openshell.v1.AddWorkspaceMemberRequest
	189, // 220: openshell.v1.OpenShell.RemoveWorkspaceMember:input_type -> openshell.v1.RemoveWorkspaceMemberRequest
	191, // 221: openshell.v1.OpenShell.ListWorkspaceMembers:input_type -> openshell.v1.ListWorkspaceMembersRequest
	11,  // 222: openshell.v1.OpenShell.Health:output_type -> openshell.v1.HealthResponse
	13,  // 223: openshell.v1.OpenShell.GetCurrentUser:output_type -> openshell.v1.GetCurrentUserResponse
	15,  // 224: openshell.v1.OpenShell.GetGatewayInfo:output_type -> openshell.v1.GetGatewayInfoResponse
	35,  // 225: openshell.v1.OpenShell.CreateSandbox:output_type -> openshell.v1.SandboxResponse
	35,  // 226: openshell.v1.OpenShell.GetSandbox:output_type -> openshell.v1.SandboxResponse
	36,  // 227: openshell.v1.OpenShell.ListSandboxes:output_type -> openshell.v1.ListSandboxesResponse
	37,  // 228: openshell.v1.OpenShell.ListSandboxProviders:output_type -> openshell.v1.ListSandboxProvidersResponse
	38,  // 229: openshell.v1.OpenShell.AttachSandboxProvider:output_type -> openshell.v1.AttachSandboxProviderResponse
	39,  // 230: openshell.v1.OpenShell.DetachSandboxProvider:output_type -> openshell.v1.DetachSandboxProviderResponse
	40,  // 231: openshell.v1.OpenShell.DeleteSandbox:output_type -> openshell.v1.DeleteSandboxResponse
	35,  // 232: openshell.v1.OpenShell.StopSandbox:output_type -> openshell.v1.SandboxResponse
	35,  // 233: openshell.v1.OpenShell.StartSandbox:output_type -> openshell.v1.SandboxResponse
	42,  // 234: openshell.v1.OpenShell.CreateSshSession:output_type -> openshell.v1.CreateSshSessionResponse
	50,  // 235: openshell.v1.OpenShell.ExposeService:output_type -> openshell.v1.ServiceEndpointResponse
	50,  // 236: openshell.v1.OpenShell.GetService:output_type -> openshell.v1.ServiceEndpointResponse
	46,  // 237: openshell.v1.OpenShell.ListServices:output_type -> openshell.v1.ListServicesResponse
	48,  // 238: openshell.v1.OpenShell.DeleteService:output_type -> openshell.v1.DeleteServiceResponse
	52,  // 239: openshell.v1.OpenShell.RevokeSshSession:output_type -> openshell.v1.RevokeSshSessionResponse
	57,  // 240: openshell.v1.OpenShell.ExecSandbox:output_type -> openshell.v1.ExecSandboxEvent
	59,  // 241: openshell.v1.OpenShell.ForwardTcp:output_type -> openshell.v1.TcpForwardFrame
	57,  // 242: openshell.v1.OpenShell.ExecSandboxInteractive:output_type -> openshell.v1.ExecSandboxEvent
	72,  // 243: openshell.v1.OpenShell.CreateProvider:output_type -> openshell.v1.ProviderResponse
	72,  // 244: openshell.v1.OpenShell.GetProvider:output_type -> openshell.v1.ProviderResponse
	73,  // 245: openshell.v1.OpenShell.ListProviders:output_type -> openshell.v1.ListProvidersResponse
	99,  // 246: openshell.v1.OpenShell.ListProviderProfiles:output_type -> openshell.v1.ListProviderProfilesResponse
	98,  // 247: openshell.v1.OpenShell.GetProviderProfile:output_type -> openshell.v1.ProviderProfileResponse
	101, // 248: openshell.v1.OpenShell.ImportProviderProfiles:output_type -> openshell.v1.ImportProviderProfilesResponse
	103, // 249: openshell.v1.OpenShell.UpdateProviderProfiles:output_type -> openshell.v1.UpdateProviderProfilesResponse
	105, // 250: openshell.v1.OpenShell.LintProviderProfiles:output_type -> openshell.v1.LintProviderProfilesResponse
	72,  // 251: openshell.v1.OpenShell.UpdateProvider:output_type -> openshell.v1.ProviderResponse
	89,  // 252: openshell.v1.OpenShell.GetProviderRefreshStatus:output_type -> openshell.v1.GetProviderRefreshStatusResponse
	91,  // 253: openshell.v1.OpenShell.ConfigureProviderRefresh:output_type -> openshell.v1.ConfigureProviderRefreshResponse
	93,  // 254: openshell.v1.OpenShell.RotateProviderCredential:output_type -> openshell.v1.RotateProviderCredentialResponse
	95,  // 255: openshell.v1.OpenShell.DeleteProviderRefresh:output_type -> openshell.v1.DeleteProviderRefreshResponse
	106, // 256: openshell.v1.OpenShell.DeleteProvider:output_type -> openshell.v1.DeleteProviderResponse
	108, // 257: openshell.v1.OpenShell.DeleteProviderProfile:output_type -> openshell.v1.DeleteProviderProfileResponse
	233, // 258: openshell.v1.OpenShell.GetSandboxConfig:output_type -> openshell.sandbox.v1.GetSandboxConfigResponse
	234, // 259: openshell.v1.OpenShell.GetGatewayConfig:output_type -> openshell.sandbox.v1.GetGatewayConfigResponse
	121, // 260: openshell.v1.OpenShell.UpdateConfig:output_type -> openshell.v1.UpdateConfigResponse
	123, // 261: openshell.v1.OpenShell.GetSandboxPolicyStatus:output_type -> openshell.v1.GetSandboxPolicyStatusResponse
	125, // 262: openshell.v1.OpenShell.ListSandboxPolicies:output_type -> openshell.v1.ListSandboxPoliciesResponse
	127, // 263: openshell.v1.OpenShell.ReportPolicyStatus:output_type -> openshell.v1.ReportPolicyStatusResponse
	112, // 264: openshell.v1.OpenShell.GetSandboxProviderEnvironment:output_type -> openshell.v1.GetSandboxProviderEnvironmentResponse
	132, // 265: openshell.v1.OpenShell.GetSandboxLogs:output_type -> openshell.v1.GetSandboxLogsResponse
	131, // 266: openshell.v1.OpenShell.PushSandboxLogs:output_type -> openshell.v1.PushSandboxLogsResponse
	134, // 267: openshell.v1.OpenShell.ConnectSupervisor:output_type -> openshell.v1.GatewayMessage
	141, // 268: openshell.v1.OpenShell.ReportMainProcessExit:output_type -> openshell.v1.ReportMainProcessExitResponse
	146, // 269: openshell.v1.OpenShell.RelayStream:output_type -> openshell.v1.RelayFrame
	64,  // 270: openshell.v1.OpenShell.WatchSandbox:output_type -> openshell.v1.SandboxStreamEvent
	156, // 271: openshell.v1.OpenShell.SubmitPolicyAnalysis:output_type -> openshell.v1.SubmitPolicyAnalysisResponse
	158, // 272: openshell.v1.OpenShell.GetDraftPolicy:output_type -> openshell.v1.GetDraftPolicyResponse
	160, // 273: openshell.v1.OpenShell.ApproveDraftChunk:output_type -> openshell.v1.ApproveDraftChunkResponse
	162, // 274: openshell.v1.OpenShell.RejectDraftChunk:output_type -> openshell.v1.RejectDraftChunkResponse
	164, // 275: openshell.v1.OpenShell.ApproveAllDraftChunks:output_type -> openshell.v1.ApproveAllDraftChunksResponse
	166, // 276: openshell.v1.OpenShell.EditDraftChunk:output_type -> openshell.v1.EditDraftChunkResponse
	168, // 277: openshell.v1.OpenShell.UndoDraftChunk:output_type -> openshell.v1.UndoDraftChunkResponse
	170, // 278: openshell.v1.OpenShell.ClearDraftChunks:output_type -> openshell.v1.ClearDraftChunksResponse
	173, // 279: openshell.v1.OpenShell.GetDraftHistory:output_type -> openshell.v1.GetDraftHistoryResponse
	7,   // 280: openshell.v1.OpenShell.IssueSandboxToken:output_type -> openshell.v1.IssueSandboxTokenResponse
	9,   // 281: openshell.v1.OpenShell.RefreshSandboxToken:output_type -> openshell.v1.RefreshSandboxTokenResponse
	179, // 282: openshell.v1.OpenShell.CreateWorkspace:output_type -> openshell.v1.CreateWorkspaceResponse
	181, // 283: openshell.v1.OpenShell.GetWorkspace:output_type -> openshell.v1.GetWorkspaceResponse
	183, // 284: openshell.v1.OpenShell.ListWorkspaces:output_type -> openshell.v1.ListWorkspacesResponse
	185, // 285: openshell.v1.OpenShell.DeleteWorkspace:output_type -> openshell.v1.DeleteWorkspaceResponse
	188, // 286: openshell.v1.OpenShell.AddWorkspaceMember:output_type -> openshell.v1.AddWorkspaceMemberResponse
	190, // 287: openshell.v1.OpenShell.RemoveWorkspaceMember:output_type -> openshell.v1.RemoveWorkspaceMemberResponse
	192, // 288: openshell.v1.OpenShell.ListWorkspaceMembers:output_type -> openshell.v1.ListWorkspaceMembersResponse
	222, // [222:289] is the sub-list for method output_type
	155, // [155:222] is the sub-list for method input_type
	155, // [155:155] is the sub-list for extension type_name
	155, // [155:155] is the sub-list for extension extendee
	0,   // [0:155] is the sub-list for field type_name
}

func init() { file_openshell_proto_init() }
func file_openshell_proto_init() {
	if File_openshell_proto != nil {
		return
	}
	file_openshell_proto_msgTypes[15].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[16].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[17].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[51].OneofWrappers = []any{
		(*ExecSandboxEvent_Stdout)(nil),
		(*ExecSandboxEvent_Stderr)(nil),
		(*ExecSandboxEvent_Exit)(nil),
	}
	file_openshell_proto_msgTypes[52].OneofWrappers = []any{
		(*TcpForwardInit_Ssh)(nil),
		(*TcpForwardInit_Tcp)(nil),
	}
	file_openshell_proto_msgTypes[53].OneofWrappers = []any{
		(*TcpForwardFrame_Init)(nil),
		(*TcpForwardFrame_Data)(nil),
	}
	file_openshell_proto_msgTypes[54].OneofWrappers = []any{
		(*ExecSandboxInput_Start)(nil),
		(*ExecSandboxInput_Stdin)(nil),
		(*ExecSandboxInput_Resize)(nil),
	}
	file_openshell_proto_msgTypes[58].OneofWrappers = []any{
		(*SandboxStreamEvent_Sandbox)(nil),
		(*SandboxStreamEvent_Log)(nil),
		(*SandboxStreamEvent_Event)(nil),
		(*SandboxStreamEvent_Warning)(nil),
		(*SandboxStreamEvent_DraftPolicyUpdate)(nil),
	}
	file_openshell_proto_msgTypes[84].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[108].OneofWrappers = []any{
		(*PolicyMergeOperation_AddRule)(nil),
		(*PolicyMergeOperation_RemoveEndpoint)(nil),
		(*PolicyMergeOperation_RemoveRule)(nil),
		(*PolicyMergeOperation_AddDenyRules)(nil),
		(*PolicyMergeOperation_AddAllowRules)(nil),
		(*PolicyMergeOperation_RemoveBinary)(nil),
	}
	file_openshell_proto_msgTypes[127].OneofWrappers = []any{
		(*SupervisorMessage_Hello)(nil),
		(*SupervisorMessage_Heartbeat)(nil),
		(*SupervisorMessage_RelayOpenResult)(nil),
		(*SupervisorMessage_RelayClose)(nil),
	}
	file_openshell_proto_msgTypes[128].OneofWrappers = []any{
		(*GatewayMessage_SessionAccepted)(nil),
		(*GatewayMessage_SessionRejected)(nil),
		(*GatewayMessage_Heartbeat)(nil),
		(*GatewayMessage_RelayOpen)(nil),
		(*GatewayMessage_RelayClose)(nil),
	}
	file_openshell_proto_msgTypes[136].OneofWrappers = []any{
		(*RelayOpen_Ssh)(nil),
		(*RelayOpen_Tcp)(nil),
	}
	file_openshell_proto_msgTypes[140].OneofWrappers = []any{
		(*RelayFrame_Init)(nil),
		(*RelayFrame_Data)(nil),
	}
	file_openshell_proto_msgTypes[170].OneofWrappers = []any{}
	file_openshell_proto_msgTypes[171].OneofWrappers = []any{}
	type x struct{}
	out := protoimpl.TypeBuilder{
		File: protoimpl.DescBuilder{
			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
			RawDescriptor: unsafe.Slice(unsafe.StringData(file_openshell_proto_rawDesc), len(file_openshell_proto_rawDesc)),
			NumEnums:      6,
			NumMessages:   213,
			NumExtensions: 0,
			NumServices:   1,
		},
		GoTypes:           file_openshell_proto_goTypes,
		DependencyIndexes: file_openshell_proto_depIdxs,
		EnumInfos:         file_openshell_proto_enumTypes,
		MessageInfos:      file_openshell_proto_msgTypes,
	}.Build()
	File_openshell_proto = out.File
	file_openshell_proto_goTypes = nil
	file_openshell_proto_depIdxs = nil
}